Special automation tags enable you to use the automation in a specific area of Cortex XSOAR. For example, an automation can be tagged for use in post-processing, indicator formatting, field display, indicator enhancement, etc.
Tag Value | Description |
|---|---|
Condition | Conditional automation in a playbook task NoteAll custom scripts are available for conditional tasks, including scripts without the condition tag. System scripts are only available for use in conditional tasks if they have the condition tag. |
dynamic-indicator-section | General purpose dynamic section script for indicator layout |
dynamic-section | General purpose dynamic section script for incident layout |
enhancement | Indicator enhancement script |
field-change-triggered | Script to run on incident field change |
field-display | Field display script |
filter | Script used as filter or conditional operator in a playbook task |
general-dynamic-section | General purpose dynamic section script for object layouts (excluding incidents and indicator layouts) |
incident-action-button | Incident layout action button script |
indicator-action-button | Indicator layout action button script |
indicator-format | Indicator formatting script |
post-processing | Incident post process script |
preProcessing | Pre-process rule script |
reputation | Indicator reputation script |
sla | SLA breach script |
threatIntelReport-action-button | Threat Intel Report layout action button script |
transformer | Script used as transformer in a playbook task |
widget | Script that can be used to generate a dashboard/report widget |