topic Re: Display flags in long XSOAR automation in Cortex XSOAR Discussions

Display flags in long XSOAR automation

SanDev — Thu, 12 Jan 2023 20:34:10 GMT

Hello,

A long automation with no time limit is created. However, when we execute it, there's no way to know if it's executing properly.

We've tried: "demisto.results" and putting information in the context but it only appears when it's completely executed.

How can we display flags to know the progress of an automation?

Re: Display flags in long XSOAR automation

amontminy — Tue, 17 Jan 2023 22:03:15 GMT

Hi SanDev, all output is queued to display after the automation finishes which is why demisto.results doesn't work. The only way around this would be to use the Demisto API to call the Print command to print to the war room. Here is what I did to test this functionality:

import time i = 1 id = demisto.incident().get("id") while i < 3: body = { "investigationId": id, "data": f"!Print value=`I have looped {i} times.`" } demisto.executeCommand("demisto-api-post", {"uri":"/entry", "body": body}) time.sleep(1) i += 1 return_results("All Done")

Hope this helps!

Re: Display flags in long XSOAR automation

SanDev — Tue, 17 Jan 2023 22:17:31 GMT

Thanks for your reply.

I'll try to use "demisto-api-post". I'll tell you if it works.

Re: Display flags in long XSOAR automation

SanDev — Thu, 19 Jan 2023 13:58:37 GMT

It worked perfectly. However, I don't know where to find the posible values of "URI". "/entry" I supose that it's in the War Room.

Re: Display flags in long XSOAR automation

amontminy — Thu, 19 Jan 2023 16:18:20 GMT

You can see all the different API endpoints in Settings > Integrations > API Keys > View Cortex XSOAR API. /entry is the endpoint that creates a war room entry and the body of that API request just requires the investigation ID and whatever you want to post to the war room.

Re: Display flags in long XSOAR automation

SanDev — Thu, 19 Jan 2023 20:47:47 GMT

Let me understand, I just discovered this feature. This is like using XSOAR as an API and with the command, in this case "\entry", you can choose where to execute the command you want.

The documentation is not easy to understand😅

Re: Display flags in long XSOAR automation

amontminy — Thu, 19 Jan 2023 21:43:30 GMT

That's exactly right.

demisto.executeCommand("demisto-api-post", {"uri":"/entry", "body": body})

In this line we are telling XSOAR to execute the command demisto-api-post. That command uses the API to post to the endpoint /entry with a body of text. The /entry endpoint posts an entry to a war room exactly like you would manually from the war room itself.

Re: Display flags in long XSOAR automation

SanDev — Thu, 19 Jan 2023 21:58:46 GMT

I will take another look at the others, because I didn't understand how to use them. The one you told me is crystal clear. Many thanks. ❤️