Markdown is a lightweight markup language that you can use to add basic formatting to text in multiple contexts within Cortex XSOAR. For example, you can highlight key terms in bold, mark text as a header, add links, or add tables. This provides a better end-user experience, which is more aesthetically pleasing and easier to use.
You can use Markdown in many places within Cortex XSOAR. Some of the more common places are:
Threat intel reports
Command line interface (CLI)
In most contexts where Markdown is supported, a GUI Markdown editor is available to help you easily apply styles and then view a preview of how those styles will look.
Most Markdown syntax elements within Cortex XSOAR are identical to those used in basic and extended Markdown syntax. For a description of markdown syntax, see https://www.markdownguide.org/.
The following Markdown elements used in Cortex XSOAR and exposed in the Markdown editor follow the same syntax as basic/extended Markdown:
Using the Insert code button in the Markdown editor adds three backtick quotes, which allows inclusion of a literal backtick character within the code snippet.
You can use the Insert table button in the Markdown editor to easily create a table with up to five rows/columns.
Additional elements not exposed in the Markdown editor can also be applied, such as:
Cortex XSOAR Flavored Markdown
Cortex XSOAR supports additional elements not found in basic/extended Markdown that provide useful functionality when working with Cortex XSOAR. For example:
Cortex XSOAR Markdown Element
You can use the name of the color, or the color code (hex triplet format)
Text background color
You can use either the name of the color, or the color code (hex triplet format). You can use text color and text background color in parallel. For example (using the editor buttons):
Keyboard input style
Denotes textual user input from a keyboard.
Linking to other Cortex XSOAR incidents
#Incident ID Number
Upload a local image
You can upload a local image that is not available on the internet to the Markdown editor. Copy/paste or drag a local image into the Markdown editor, which automatically applies the standard image syntax and adds a relative path to the image.
Within the War Room, when the Markdown editor is open, you will only be able to drag images into the Markdown editor. To drag images into the War Room, first close the Markdown editor.
Buttons are available only in entries of incidents.
If data between the two sets of %%% is not parsed as a JSON, all of the data is taken as a command to render. For example,
Some extended Markdown syntax may not be supported in Cortex XSOAR. For example, checkboxes and footnotes.