If you're using an XSOAR automation that is tagged as a "dynamic-indicator-section", then the indicator including it's fields are passed into automatically as an argument called "indicator"
def main():
# magic
# the indicator is passed automatically into an argument called "indicator"
indicator = demisto.args().get('indicator')
custom_fields = indicator.get("CustomFields",{})
return_results(CommandResults(readable_output=json.dumps(custom_fields,indent=2)))
if __name__ in ('__main__', '__builtin__', 'builtins'):
main()
Basically create your automation, tag it with dynamic-indicator-section, and add it to an Indicator Layout:
... View more
