Enhancement scripts - Administrator Guide - Threat Intel Management Guide - Cortex XSIAM - Cortex - Security Operations

The enhancement script requires the indicator value as the input argument.

In the following example, the DomainReputation script uses domain as the input.

The enhancement script output depends on its input because the script is run manually. If you want the output to be added to indicator enrichment or the Threat Intelligence screen, it should follow the DBotScore convention in the content output as described in https://xsoar.pan.dev/docs/integrations/dbot.

output =
   {
       'Type': entryTypes['note'],
       'ContentsFormat': formats['json'],
       'Contents': ‘this is the enrichment data’,
       'EntryContext': {
           'Email': ‘xsoar@test.com’, 
           ‘DBotScore’: {}},
   }

return_results(output)

You can run out-of-the-box or custom enhancement scripts in the CLI to enrich specific indicator values.

The following are examples of the syntax for running the out-of-the-box IPReputation and URLReputation enhancement scripts in the CLI.