How can I get the scores of the indicators I extract with commands?

[YilmazDincer]

Greetings to everyone,

With the help of an automation, I extract indicators from incoming incidents. I do this by running commands that createNewIndicator and then enrichIndicator. But these are not written to the context. I need to write them to the context, find out if it is Malicious or Suspicious and send it as an email. When I search with the searchIndicator command, most of the time, it searches without the indicator and the result is misleading.

How can I do this in the simplest way?

In short, how can I find out whether the indicators I extract are Malicious or not in the simplest way? (I do all of this in automation. But I will create a separate task in the playbook for the "Send mail if malicious" part).

[YilmazDincer]

What I really want is to write the DBotScore key in the content. But I don't know how to write it.

If I can write it to the context, I can send the scores one by one from there. 

[jqamruddin]

Hi, 

When you run !createNewIndicator, the indicator will be written to context along with the score under the context key CreatedIndicator in your context data. Are you not seeing that behavior?

Thank you! 

[YilmazDincer]

Yes, it doesn't show results. I do this in a custom automation with the command "demisto.executeCommand('createNewIndicator', pseudo, pseudo)".

[jqamruddin]

Hi, 

You will need to use CommandResults class to return the outputs to context in a custom automation.
Here is some documentation on that: 
https://xsoar.pan.dev/docs/integrations/code-conventions#commandresults 

Hope that helps!