topic trying to return raw output vs formatted in Cortex XSOAR Discussions

trying to return raw output vs formatted

JoshBoyd — Wed, 23 Feb 2022 17:48:38 GMT

!py script=`return_results(demisto.executeCommand("azure-sentinel-list-incident-entities", {"incident_id":"xxxxxxx-xxxxxx-xxxxx"}))`

The above works and turns in human readable format; however i want to return the raw json.

This works:
!azure-sentinel-list-incident-entities incident_id=xxxx-xxxx-xxxx raw-response=true

However this does not:

!py script=`return_results(demisto.executeCommand("azure-sentinel-list-incident-entities", {"incident_id":"xxxx-xxxx-xxxx"}, {"raw-response":"true"}))`

I get the following error:

TypeError: executeCommand() takes exactly 3 arguments (4 given)

I need it in python, but I can't figure out the format to return the raw json.

Any help is appreciated,

Boyd

Re: trying to return raw output vs formatted

jgomes — Wed, 23 Feb 2022 18:25:55 GMT

Just pass it as another argument. This should work: return_results(demisto.executeCommand("azure-sentinel-list-incident-entities", {"incident_id":"xxxxxxx-xxxxxx-xxxxx", "raw-response":"true"}))

Re: trying to return raw output vs formatted

JoshBoyd — Wed, 23 Feb 2022 18:49:52 GMT

Thanks, I see what I did wrong there...
Though, oddly this returns the same thing twice:

entities = demisto.executeCommand("azure-sentinel-list-incident-entities", {"incident_id":external_id})
entitiesRaw = demisto.executeCommand("azure-sentinel-list-incident-entities", {"incident_id":external_id,"raw-response":"true"})
return_results(entities)
return_results(entitiesRaw)

I was expecting the raw json output similar to the following command, but return_results seems to be formatting it in human readable format; does that seem right?

This gives me what I need, but I need to put it in python code:

!azure-sentinel-list-incident-entities incident_id=xxxx-xxxx-xxxx raw-response=true

Re: trying to return raw output vs formatted

tyler_bailey — Wed, 23 Feb 2022 18:53:32 GMT

Try this and see if it does what you are looking for.

entitiesRaw = demisto.executeCommand("azure-sentinel-list-incident-entities", {"incident_id":external_id})[0]["Contents"]