topic How can I get the scores of the indicators I extract with commands? in Cortex XSOAR Discussions

How can I get the scores of the indicators I extract with commands?

YilmazDincer — Sun, 25 Feb 2024 22:22:18 GMT

Greetings to everyone,

With the help of an automation, I extract indicators from incoming incidents. I do this by running commands that createNewIndicator and then enrichIndicator. But these are not written to the context. I need to write them to the context, find out if it is Malicious or Suspicious and send it as an email. When I search with the searchIndicator command, most of the time, it searches without the indicator and the result is misleading.

How can I do this in the simplest way?

In short, how can I find out whether the indicators I extract are Malicious or not in the simplest way? (I do all of this in automation. But I will create a separate task in the playbook for the "Send mail if malicious" part).

Re: How can I get the scores of the indicators I extract with commands?

YilmazDincer — Sun, 25 Feb 2024 22:50:19 GMT

What I really want is to write the DBotScore key in the content. But I don't know how to write it.

If I can write it to the context, I can send the scores one by one from there.

Re: How can I get the scores of the indicators I extract with commands?

jqamruddin — Mon, 26 Feb 2024 19:56:03 GMT

Hi,

When you run !createNewIndicator, the indicator will be written to context along with the score under the context key CreatedIndicator in your context data. Are you not seeing that behavior?

Thank you!

Re: How can I get the scores of the indicators I extract with commands?

YilmazDincer — Tue, 27 Feb 2024 08:48:35 GMT

Yes, it doesn't show results. I do this in a custom automation with the command "demisto.executeCommand('createNewIndicator', pseudo, pseudo)".

Re: How can I get the scores of the indicators I extract with commands?

jqamruddin — Tue, 27 Feb 2024 16:20:05 GMT

Hi,

You will need to use CommandResults class to return the outputs to context in a custom automation.
Here is some documentation on that:
https://xsoar.pan.dev/docs/integrations/code-conventions#commandresults

Hope that helps!