Field Change Trigger - Python Development Quick Start Guide - 6.x - Cortex XSOAR - Cortex

You can create a script that is triggered when a field value changes.

This example automation creates a field called textfield that has a type Short text . Deleting all the characters triggers the field to display the text "ping" and typing characters in the field causes the field to display "pong".

Use the basic automation template to create the following code.

def main():
	try:
		fieldValue = demisto.args()['new']
		if fieldValue == "":
			fieldValue = "ping"
		else:
			fieldValue = "pong"
		demisto.executeCommand("setIncident", {
			'textfield': fieldValue
		})
	except Exception as ex:
		demisto.error(traceback.format_exc())
		return_error("Failed to setIncident: " +
			str(ex)
		)

if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

Use the Settings button to add the field-change-triggered tag.
This makes the automation available as a field change triggered automation. When a field change trigger script is invoked, the new and old values are passed as the new and old arguments to the script.
Create a new incident field textfield that has a field type Short text. In the Attributes tab, select the Script to run when field value changes and select the automation just created.
In the incident layout created previously (see Add a Table to the Incident Layout), add another section and add the textfield field just created.
Go to an incident and edit textfield. If you deleting all characters, the “ping” value displays. If you enter text, the “pong” value displays.

Field Change Trigger - Python Development Quick Start Guide - 6.x - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Python Development Quick Start Guide