Add context data to an issue - Use a script, command, or playbook to add context data to an issue to be used in playbooks or other automations. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 5.x Documentation

Product
Cortex XDR
License
XDR + Cloud
Creation date
2025-07-13
Last date published
2026-06-11
Category
Administrator Guide
Abstract

Use a script, command, or playbook to add context data to an issue to be used in playbooks or other automations.

You can add keys and values to an issue's context data to be used in playbooks or other automations.

To add context data to an issue, run the Set command in CLI, in a script, or in a playbook task. The Set command enables you to set a value under a specific key. For more information about the Set command, see Set.

Run the !Set command in the issue War Room.

  1. Open an issue and select the War Room tab.

  2. Run the !Set command.

    Example 118. Example

    The following example adds the key and value hello:world to the issue context data.

    !set key="hello" value="world"

In the JSON file, add Set to the demisto.executeCommand key.

Example 119. Example

The following example adds the key and value hello:world to the issue context data.

demisto.executeCommand("Set", {"key":"hello", "value":"world"})

Use the Set script in a standard task.

Example 120. Example

An issue's context data contains the following values:

{  
   "Account":
    {
      "firstName": "Bob",
      "lastName": "Jones",
    }
}

For an automation, you need to use the full name value. You can use the Set script to add an new fullName value to the JSON:

addcontextdata.png

Result:

{  
   "Account":
    {
      "firstName": "Bob",
      "fullName": "Bob Jones"
      "lastName": "Jones",
    }
}