Cortex XSOAR Script Development Process - Python Development Quick Start Guide - 6.x - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Python Development Quick Start Guide
Product
Cortex XSOAR
Version
6.x
Creation date
2023-03-22
Last date published
2023-08-31
Category
Python Development Quick Start Guide

The script development process varies according to whether it is for playbook automations, content packs and integrations, remote applications, or webhook applications.

Playbook Automation Scripts

Scripts for automating playbook tasks are the most common script type created in Cortex XSOAR and can be developed within the Cortex XSOAR console IDE. The high-level steps are:

  1. Review the Demisto class functions.

  2. Review the Common Server Python functions.

  3. Review the Common Scripts.

  4. Author automations in the Cortex XSOAR console IDE.

  5. Execute automations in the Cortex XSOAR playground to test.

  6. Configure automations as playbook tasks and test with playbook debugger.

  7. Fully test the playbook with real incident data, since not all functions execute identically in the playground or debugger.

  8. For additional customization, implement these automations as needed:

    1. Configure automations as field display scripts.

    2. Configure automations as field change triggered scripts.

    3. Configure dynamic section scripts.

    4. Configure widget-based scripts.

    5. Configure post-processing scripts.

    6. Configure filters.

    7. Configure transformers.

  9. If an automation needs to use the Cortex XSOAR REST API, in the Cortex XSOAR console:

    1. Create an API key.

    2. Enable the REST integration instance.

Content Packs and Integrations

You can develop integrations for internal use within the Cortex XSOAR console IDE.  If you want to publish content packs with integrations to the Marketplace, you can configure a Cortex XSOAR development environment with Visual Studio Code.

  1. Review the Cortex XSOAR development site Welcome for guidance on developing integrations.

  2. In the Cortex XSOAR console:

    1. Create an API key.

    2. Enable the REST integration instance.

  3. Review the Demisto Class functions.

  4. Review the Common Server Python functions.

  5. If not publishing content packs to the Marketplace or for a simple development environment using the Cortex XSOAR console IDE:

    1. In the Cortex XSOAR console under Settings+Integrations, click the +BYOI button and create the integration code.

      It uses a copy of the HelloWorld integration as a starting point.

    2. To debug non-Cortex XSOAR python code if needed:

      1. Copy the integration code to a preferred Python IDE.

      2. Stub or mock demisto() calls for test and debug.

      3. Copy the code back to the Cortex XSOAR console IDE.

  6. To publish to Marketplace, perform extensive integration development, or if you prefer a full development environment:

    1. Create a Cortex XSOAR content repository in GitHub.

    2. Install Visual Studio Code.

      An example process in the Visual Studio Code XSOAR Extension illustrates configuring Visual Studio Code with the Cortex XSOAR extension and the Demisto SDK.

    3. Create and test the integration. Stub or mock demisto() calls for testing and debugging within Visual Studio Code.

  7. From Cortex XSOAR 6.5 and later, there is a CI/CD process based on the Demisto SDK for heavy development.

Remote Applications

You can create scripts for remote automations not running under Cortex XSOAR that use the Demisto Python Client and HTTPS requests to the Cortex XSOAR REST API.

  1. In the Cortex XSOAR console, create an API key.

  2. In the development system:

    1. Install Python.

    2. Install the preferred Python development environment

    3. Install the Demisto Python client.

    4. Create and test the application.

Webhook Applications

Webhook applications remotely create incidents by posting HTTPS requests to a webhook configured on the Cortex XSOAR server.

  1. In the Cortex XSOAR console:

    1. In the Marketplace, install the Generic Webhooks content pack.

    2. Configure the webhook integration instance.

  2. In the development system:

    1. Install Python.

    2. Install the preferred development environment.

    3. Create and test the webhook application.