indicator extract data

[rune.man]

im working on a project with xsoar indicators, we want to add a extra field to the layout that describes what the analist have to look for when certain indicators are present, now that problem that im running into is im trying to make a dynamic section script to call the extra data from our api but i need the tags we have given the indicator, but the tags are gathered using the custom field to be loaded in and as such i can't seem to gather the data i need in the script to dynamically get the right data from our api. is there anyway i could gather the data thats present in the indicator with my script using demisto-sdk?

[MBeauchamp2 · Accepted solution]

If you're using an XSOAR automation that is tagged as a "dynamic-indicator-section", then the indicator including it's fields are passed into automatically as an argument called "indicator"

def main():
    # magic
    # the indicator is passed automatically into an argument called "indicator"
    indicator = demisto.args().get('indicator')
    custom_fields = indicator.get("CustomFields",{})
    return_results(CommandResults(readable_output=json.dumps(custom_fields,indent=2)))


if __name__ in ('__main__', '__builtin__', 'builtins'):
    main()

Basically create your automation, tag it with dynamic-indicator-section, and add it to an Indicator Layout:

[rune.man]

thank you for helping me with this 🙂