Returning output from scripts that run on indicators to the war room

EnesOzdemir — Fri, 23 Dec 2022 12:28:50 GMT

Hi,

I am playing around with buttons on indicator layouts. The output from the script comes as a notification on the bottom of the screen. The output gets truncated if long. To overcome the problem I used the following lines of code.

```

command_result = CommandResults(readable_output=text)
result = command_result.to_context()

return_results(demisto.executeCommand('addEntries', {'id': '2528', 'entries': [result]}))

```

However, the script isn't aware of the incident on which it has run so the id of the incident must be given manually. demisto.investigation() gave me the output below

```{ "cacheVersn": 0, "category": "", "closed": "0001-01-01T00:00:00Z", "created": "2022-12-23T11:56:03.467855667Z", "details": "", "entryUsers": null, "highPriority": false, "id": "d6b5abd0-f5dd-4715-85a0-fc5536d859e8", "isDebug": false, "lastOpen": "0001-01-01T00:00:00Z", "mirrorAutoClose": null, "mirrorTypes": null, "modified": "0001-01-01T00:00:00Z", "name": "Do Not Use Me", "rawCategory": "", "reason": null, "runStatus": "", "slackMirrorAutoClose": false, "slackMirrorType": "", "status": 0, "systems": null, "tags": null, "type": 0, "users": null, "version": 0 }```

It clearly doesn't want me to use it.

Is there a way to return results to the current war room without having to specify the incident id manually?

Re: Returning output from scripts that run on indicators to the war room

jfernandes1 — Wed, 28 Dec 2022 03:56:33 GMT

Hi @EnesOzdemir, the buttons inside the indicator layout do not run on the incident hence you cannot see the ID. I would suggest using enhancement script. It would still use a button approach but you can reference the incident that it was called from. Refer -https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Enhancement-Scripts

Screenshot of it working.

topic Returning output from scripts that run on indicators to the war room in Cortex XSOAR Discussions

Returning output from scripts that run on indicators to the war room

Re: Returning output from scripts that run on indicators to the war room