topic Re: Running Script or Playbook in one tenant from another tenant. in Cortex XSOAR Discussions

Running Script or Playbook in one tenant from another tenant.

YilmazDincer — Wed, 24 May 2023 14:11:51 GMT

Hi all,

I have a multi-tenant deployment. I want to run a script or playbook from one tenant to another tenant. How can I do this?

#XSOAR

Re: Running Script or Playbook in one tenant from another tenant.

gyldz — Wed, 24 May 2023 14:57:01 GMT

Hi, what kind of script do you want to run? You can make use of API calls for this purpose.

Re: Running Script or Playbook in one tenant from another tenant.

YilmazDincer — Thu, 25 May 2023 13:01:04 GMT

Yes, actually I want to run an automation script in XSOAR via API.

Re: Running Script or Playbook in one tenant from another tenant.

gyldz — Fri, 26 May 2023 07:16:16 GMT

You can use different API endpints. Please see the below example, which will retrieve the incidents under the tenant customer1. You can change the query according to your needs.

query="account:customer1" body = { "filter":{ "page":0,"size":200,"query":query, "period":{"byFrom":"days","fromValue":7,"byTo":"days"} } } incidents = demisto.executeCommand("demisto-api-post", {'uri': f"/incidents/search/", 'body': body})[0]["Contents"]["response"]["data"] demisto.results(incidents)

Re: Running Script or Playbook in one tenant from another tenant.

YilmazDincer — Tue, 30 May 2023 09:23:40 GMT

Hi Gyldz,

Thank for your reply.
I didn't want to run script on an existing incident. My bad, I didn't specify that. For this, I first created an incident and assigned a default playbook to the incident. This way I can run the script I want.
demisto-api-post uri = /tenant_name/incident and
body;
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR-API/Create-single-incident