Add context data to a case - Use a script, command, or playbook to add context data to a case to be used in playbooks or other automations. - Administrator Guide

Add context data to a case - Use a script, command, or playbook to add context data to a case to be used in playbooks or other automations. - Administrator Guide - Cortex CLOUD

Cortex Cloud Posture Management Documentation

Product

Cortex Cloud Application Security > Cortex CLOUD

License

Cloud Posture Management

Creation date

2025-01-22

Last date published

2026-06-10

Use the CLI

Run the !setParentIncidentContext command in the issue War Room or the Case War Room.

Note

If you run the command in the issue War Room, the data is added to the following places:

The case context data.
The issue context data under the case tab.

If you run the command in the Case War Room, the data is added to the case context data only.

Run the command in the issue War Room

Open an issue and select the War Room tab.
Run the !setParentIncidentContext command.
Example 43. Example
The following example adds the key and value hello:world to the case and issue context data.
```
!setParentIncidentContext key="hello" value="world"
```

Run the command in the case War Room

Open a case and switch to the Detailed view.
Select the Case War Room tab.
Run the !setParentIncidentContext command.
Example 44. Example
The following example adds the key and value hello:world to the case context data.
```
!setParentIncidentContext key="hello" value="world"
```

Use a script

In any script that runs in an issue, the data is written to the issue context data. If you want to add the data to the case context from your script, run the setParentIncidentContext using the demisto.executeCommand key, as follows:

demisto.executeCommand("setParentIncidentContext", {"key":"<key>", "value":"<value>"})

Example 45. Example

The following example creates a new key name AuditID with a 90210 value to your script.

demisto.executeCommand("setParentIncidentContext", {"key":"AuditID", "value":"90210"})

Use a playbook

When a playbook runs, the playbook data is written to the issue context data. To write the data to the parent case context data, use the setParentIncidentContext script in a standard task.

Example 46.

The following example adds the TicketID to the case context. To see a full use case that includes this standard task, see Use context data in a playbook.