Returning output from scripts that run on indicators to the war room

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Returning output from scripts that run on indicators to the war room

L2 Linker

Hi,

 

I am playing around with buttons on indicator layouts. The output from the script comes as a notification on the bottom of the screen. The output gets truncated if long. To overcome the problem I used the following lines of code.

 

```

command_result = CommandResults(readable_output=text)
result = command_result.to_context()

return_results(demisto.executeCommand('addEntries', {'id': '2528', 'entries': [result]}))

```

 

However, the script isn't aware of the incident on which it has run so the id of the incident must be given manually. demisto.investigation() gave me the output below

 

 

```{ "cacheVersn": 0, "category": "", "closed": "0001-01-01T00:00:00Z", "created": "2022-12-23T11:56:03.467855667Z", "details": "", "entryUsers": null, "highPriority": false, "id": "d6b5abd0-f5dd-4715-85a0-fc5536d859e8", "isDebug": false, "lastOpen": "0001-01-01T00:00:00Z", "mirrorAutoClose": null, "mirrorTypes": null, "modified": "0001-01-01T00:00:00Z", "name": "Do Not Use Me", "rawCategory": "", "reason": null, "runStatus": "", "slackMirrorAutoClose": false, "slackMirrorType": "", "status": 0, "systems": null, "tags": null, "type": 0, "users": null, "version": 0 }```

 

It clearly doesn't want me to use it.

 

Is there a way to return results to the current war room without having to specify the incident id manually?

 

1 ACCEPTED SOLUTION

Accepted Solutions

L4 Transporter

Hi @EnesOzdemir, the buttons inside the indicator layout do not run on the incident hence you cannot see the ID. I would suggest using enhancement script. It would still use a button approach but you can reference the incident that it was called from. Refer -https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Enhanc...

 

Screenshot of it working. 

Screen Shot 2022-12-28 at 2.55.05 pm.png

View solution in original post

1 REPLY 1

L4 Transporter

Hi @EnesOzdemir, the buttons inside the indicator layout do not run on the incident hence you cannot see the ID. I would suggest using enhancement script. It would still use a button approach but you can reference the incident that it was called from. Refer -https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Enhanc...

 

Screenshot of it working. 

Screen Shot 2022-12-28 at 2.55.05 pm.png

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!