About jfernandes1

Hi @EnesOzdemir, I was able to locate the ticket and I think I understand the issue better now.   Yes, this is limitation of the platform. To prevent a know issue with DB version synchronisation since 2 different versions of the incident are sent to DB at the same time. The limitation was document here - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/incidents/incident-management/incident-fields/field-trigger-scripts.   You will need to de-select the "Run triggered script after incident is modified" option. ... View more

Hi @Antanas, could you try this. Save the text as yml file and upload it to the automations page. Its more flexible. you can issue the command like below.   !joinListWithLookup list1=${data.data.Emails} list2=${data.data.Hostnames} matchingKey=IP   commonfields: id: cfc605f7-6d30-4ea0-8330-dacb34e60397 version: 7 vcShouldKeepItemLegacyProdMachine: false name: joinListWithLookup script: |- # Accept the input as arguments list1 = demisto.args()['list1'] list2 = demisto.args()['list2'] # Key that should be tested for matches. Since the order is unknown keyMatch = demisto.args()['matchingKey'] # Validate the input error = 1 if isinstance(list1, list): if isinstance(list2, list): if isinstance(keyMatch, str): error = 0 if error == 1: return_error("Invalid inputs") newList = [] # Loop primary list for item in list1: # Loop secondary list for x in list2: # Check if there is a matching key between the lists if x[keyMatch] == item[keyMatch]: # Add new keys from secondary list to primary for key in x.keys(): # Only add if they key does not exist, prevent existing data from being overwritten if key not in item.keys(): item[key] = x[key] # Join data to new list newList.append(item) # In the last example I included a simple output. # The below example add data to the context and the warroom (A nice table) demisto.results({ 'Type' : entryTypes['note'], 'Contents': newList, 'ContentsFormat' : formats['json'], 'HumanReadable': tableToMarkdown('New Table', newList), 'ReadableContentsFormat' : formats['markdown'], 'EntryContext' : {'newList' : newList } }) type: python tags: [] enabled: true args: - name: list1 required: true isArray: true - name: list2 required: true isArray: true - name: matchingKey required: true scripttarget: 0 subtype: python3 pswd: "" runonce: false dockerimage: demisto/python3:3.10.4.29342 runas: DBotWeakRole engineinfo: {} mainengineinfo: {}    ... View more

Hi @MKececioglu    Not sure if you can do it for a table output. But below is how you get it for chart. ... View more

Hi @MKececioglu,  Method 1: Create a markdown field. Use the ToTables function to populate the data in the field.  (Easiest + table looks nicer)  Method 2: Create a GridField and use the setGridField automation to populate the data in the field. (Can be resized and sortable(I think)) Method 3: If you want a graph. You can use the dynamic section with a script to populate the data. https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/widgets/create-a-custom-widget-using-an-automation-script#idc003596e-0361-4cd5-b9eb-d21f57ffe258   Warnings: It is not recommended to put large amount of information into a field. This will directly affect your incident load times and index sizes.    Recommended Method - Use the ToTables function to send the output to the warroom. Mark the output as evidence. Ask your analyst to view this information on the evidence board.  ... View more

Hi @kbratt,   Could you try something like this riskLevel eq 'medium' or riskLevel eq 'high'   ... View more

Hi Antanas,   You will need to create a custom automation for this. The automation will have to loop the array and dict to remove the columns. I'm attaching some code I had written that does something similar. I had to process a CSV file and save specific columns.  ## Script to strip excess columns and only keep columns identified in the columnsToKeep field # columnsToKeep - If no columns are matched a blank file will be created # Arguments to the script fileID = demisto.args()['fileEntryID'] fileName = demisto.args()['FileName'] columnsToKeep = demisto.args()['columnsToKeep'] # Output array newData = [] # Convert file input into array of dict data = demisto.executeCommand('ParseCSV', { 'entryID' : fileID })[0]['Contents'] # Loop through items and copy matched columns for item in data: temp = {} for key in item: if key in columnsToKeep: temp[key] = item[key] newData.append(temp) # Output data to csv file demisto.results(demisto.executeCommand('ExportToCSV', { 'fileName' : 'stripped_' + str(fileName) + '.csv', 'csvArray' : newData }))   ... View more