Add manual input to a query on a button?

EspenAbildgaard — Mon, 20 Mar 2023 10:51:56 GMT

Greetings all.
I have this situation I am trying to resolve, but can't find a solution.

I have a dynamic section in a layout, in which I want to add a button. When clicked, this button should run a query, but it should first ask for a user input, which needs to be a part of the query.

Example:
I want a button to run a Azure Log Analytics query.
I make the button, the azure-log-analytics-execute-query button script.
Say the query should be:
CommonSecurityLog
| where SourceIP == "USERINPUT"

So, the execution would need to be:
1: User clicks button
2: Button asks the user for the IP to use.
3: User provides the input (IP), and the input replaces the "USERINPUT" field in the query.

Does anyone have any smart solutions to this?
Only reasonable alternative I have come up with, is to have another button which uses the setIncident script, sets the user input as a context field, and then the query uses that context field as the input.
A python script could do this too, but the end result would be the same (?), as the script would also use a context field for input.

Re: Add manual input to a query on a button?

MBeauchamp2 — Mon, 20 Mar 2023 14:28:19 GMT

In this case you can just wrap the command in an automation script, and have that script present the arguments/input to the user. Anything marked mandatory will be prompted for, anything option you have the option to ask the User when you add the button to the layout.

Would look something like this:

Basically what is covered in video 11 of the training series: https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success-engineering-training-video/ta-p/484604

topic Add manual input to a query on a button? in Cortex XSOAR Discussions

Add manual input to a query on a button?

Re: Add manual input to a query on a button?