topic Re: indicator extract data in Cortex XSOAR Discussions

indicator extract data

rune.man — Fri, 05 May 2023 07:06:04 GMT

im working on a project with xsoar indicators, we want to add a extra field to the layout that describes what the analist have to look for when certain indicators are present, now that problem that im running into is im trying to make a dynamic section script to call the extra data from our api but i need the tags we have given the indicator, but the tags are gathered using the custom field to be loaded in and as such i can't seem to gather the data i need in the script to dynamically get the right data from our api. is there anyway i could gather the data thats present in the indicator with my script using demisto-sdk?

Re: indicator extract data

MBeauchamp2 — Fri, 05 May 2023 15:00:03 GMT

If you're using an XSOAR automation that is tagged as a "dynamic-indicator-section", then the indicator including it's fields are passed into automatically as an argument called "indicator"

def main(): # magic # the indicator is passed automatically into an argument called "indicator" indicator = demisto.args().get('indicator') custom_fields = indicator.get("CustomFields",{}) return_results(CommandResults(readable_output=json.dumps(custom_fields,indent=2))) if __name__ in ('__main__', '__builtin__', 'builtins'): main()

Basically create your automation, tag it with dynamic-indicator-section, and add it to an Indicator Layout:

Re: indicator extract data

rune.man — Mon, 08 May 2023 06:30:06 GMT

thank you for helping me with this 🙂