Returning output from scripts that run on indicators to the war room

[EnesOzdemir]

Hi,

I am playing around with buttons on indicator layouts. The output from the script comes as a notification on the bottom of the screen. The output gets truncated if long. To overcome the problem I used the following lines of code.

```

command_result = CommandResults(readable_output=text)
result = command_result.to_context()

return_results(demisto.executeCommand('addEntries', {'id': '2528', 'entries': [result]}))

```

However, the script isn't aware of the incident on which it has run so the id of the incident must be given manually. demisto.investigation() gave me the output below

```{ "cacheVersn": 0, "category": "", "closed": "0001-01-01T00:00:00Z", "created": "2022-12-23T11:56:03.467855667Z", "details": "", "entryUsers": null, "highPriority": false, "id": "d6b5abd0-f5dd-4715-85a0-fc5536d859e8", "isDebug": false, "lastOpen": "0001-01-01T00:00:00Z", "mirrorAutoClose": null, "mirrorTypes": null, "modified": "0001-01-01T00:00:00Z", "name": "Do Not Use Me", "rawCategory": "", "reason": null, "runStatus": "", "slackMirrorAutoClose": false, "slackMirrorType": "", "status": 0, "systems": null, "tags": null, "type": 0, "users": null, "version": 0 }```

It clearly doesn't want me to use it.

Is there a way to return results to the current war room without having to specify the incident id manually?

[jfernandes1 · Accepted solution]

Hi @EnesOzdemir, the buttons inside the indicator layout do not run on the incident hence you cannot see the ID. I would suggest using enhancement script. It would still use a button approach but you can reference the incident that it was called from. Refer -https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Enhanc...

Screenshot of it working.