Running Script or Playbook in one tenant from another tenant.

[YilmazDincer]

Hi all,

I have a multi-tenant deployment. I want to run a script or playbook from one tenant to another tenant. How can I do this?

#XSOAR

[gyldz]

Hi, what kind of script do you want to run? You can make use of API calls for this purpose.

[YilmazDincer]

Yes, actually I want to run an automation script in XSOAR via API.

[gyldz · Accepted solution]

You can use different API endpints. Please see the below example, which will retrieve the incidents under the tenant customer1. You can change the query according to your needs.

query="account:customer1"
body = {
    "filter":{
        "page":0,"size":200,"query":query,
        "period":{"byFrom":"days","fromValue":7,"byTo":"days"}
    }
    }

incidents = demisto.executeCommand("demisto-api-post", {'uri': f"/incidents/search/", 'body': body})[0]["Contents"]["response"]["data"]
demisto.results(incidents)

[YilmazDincer · Accepted solution]

Hi Gyldz,

Thank for your reply.
I didn't want to run script on an existing incident. My bad, I didn't specify that. For this, I first created an incident and assigned a default playbook to the incident. This way I can run the script I want.
demisto-api-post uri = /tenant_name/incident and
body;
https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR-API/Create-single-incident