topic Re: Automation Output In Indicator or Incident Layout in Cortex XSOAR Discussions

Automation Output In Indicator or Incident Layout

UmutAK — Tue, 06 Sep 2022 11:14:02 GMT

Dear all,

We have an issue about visulazating the outputs of indicator enrichment via using virus total ( vt-passive-dns-data).

To be more specific I am going to share our indicator layout and what we are expecting. As its given in the first screenshot we are using nearly default indicator layout.

However to provide more precise information to analyst team we want to illustratre passive dns records ( which is under Virus Total's relations tab) via command :

!vt-passive-dns-data ip=8.8.8.8

Command execution in CLI provides a table output as its given in the screen shot.

Main question is that, is it possible to add automation's result/output to the indicator layout for which data taken from an incident

Re: Automation Output In Indicator or Incident Layout

UmutAK — Tue, 06 Sep 2022 12:01:40 GMT

Output's screen shot from the task is given below. I want to see that table on the layout.

Re: Automation Output In Indicator or Incident Layout

AbelSantamarina — Tue, 20 Sep 2022 16:23:04 GMT

@UmutAK ,

You can achieve this by creating a custom indicator field (https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-9/cortex-xsoar-admin/manage-indicators/understand-indicators/indicator-fields/create-a-custom-indicator-field) and adding that field to your IP indicator layout (https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-9/cortex-xsoar-admin/incidents/customize-incident-view-layouts/customize-incident-layouts). Since the data will be displayed in a tabular format, you can use a field of either of these two types: grid field or markdown. For this example we will be using a markdown as it is easier to work with.

Once you have the field in your indicator layout, it can be populated in few different ways, i.e. using an enhancement scripts, using a button in the layout, using reputation scripts. For this example and for simplicity, we will use a button in the indicator layout that will trigger our script. On how to add a button to the layout -> (https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-9/cortex-xsoar-admin/manage-indicators/understand-indicators/customize-indicator-view-layouts/customize-an-indicator-type-layout).

The script will basically get the data from the integration command (vt-passive-dns-data), format it in a table (using tableToMarkdown built-in function) and populate the field using setIndicator built in command.

Find below a sample script to do this, as well as a screenshot of the layout.