Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Function to get the date when "Common Scripts" were updated

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Function to get the date when "Common Scripts" were updated

L2 Linker

Hello,

We'd like to to get the date when "Common Scripts" were updated. Is there any function to get it?

4 REPLIES 4

L0 Member

Hiya,

Let me make sure I understand the ask. You'd like to be notified when Common Scripts has been updated in your xsoar environment?

Synthanee H Humbert  | Manager, Customer Success Engineer
Palo Alto Networks  |  3000 Tannery Way  |  Santa Clara, CA 95054  | USA
Office: 972.424.6307  | www.paloaltonetworks.com

L5 Sessionator

Hi @SanDev,

 

You should be able to see the last updated date in the below places.

 

On the Automation page:

In Automations.png

 

On the Marketplace page:

In Marketplace.png

 

L1 Bithead

L2 Linker

You can pull the information for installs if you're looking for when something was installed by going to Settings > User and Roles > Audit Trail.   Here's a sample query to get you started object:ContentPack and type:install and action.ID:CommonScripts modified:>2023-04-01T00:00:00


Here's the reference in the admin guide  https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR-Administrator-Guide/Audit-T...

Here's a command that pulls no more than 200 entries for common script installs from the past 3 months.   You can see more syntax under getAudit in the api guide https://<yourdomain name>/api#_getaudits
!demisto-api-post uri=/settings/audits body="{\"page\":0,\"size\":200,\"query\":\"object:ContentPack and type:install and action.ID:CommonScripts\", \"period\": {\"by\": \"\",\"byfrom\": \"months\", \"toValue\": null, \"fromValue\": 3, \"field\": \"\" }}"

cpayne26_2-1684770123788.png

 

cpayne26_0-1684769678399.pngcpayne26_1-1684769770808.png

 



  • 1412 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!