Multi-select Field Display - Python Development Quick Start Guide - 6.x - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Python Development Quick Start Guide

Product
Cortex XSOAR
Version
6.x
Creation date
2023-03-22
Last date published
2023-08-31
Category
Python Development Quick Start Guide

You can create a script for a display field with custom multi-select options.

This example automation creates a field called multiselectfield that has a type Multi select . You then define in the Cortex XSOAR console the list of options that can be selected.

  1. Use the basic automation template to create the following code.

    The field displayed is passed in the field argument and selectValues contains the list of options that can be selected.

    The Python function sorted() is used to sort the values and update the field options.

    def main():
    	try:
    		vals = demisto.args()['field']['selectValues']
    		return_results({'hidden': False, 'options': sorted(vals)})
    	except Exception as ex:
    		demisto.error(traceback.format_exc())
    		return_error("Failed to sort display field values +
    			str(ex)
    		)
    
    if __name__ in ("__main__", "__builtin__", "builtins"):
        main()
  2. Use the Settings button to add the field-display tag.

    This makes the automation available as a field display automation.

  3. Create a new incident field multiselectfield that has a field type Multi select and enter the list of values that can be selected.

    cortex-xsoar-automation-multi-select.png
  4. In the Attributes tab, select the Field display script and select the automation just created.

    cortex-xsoar-automation-select-field-display-script.png
  5. In the incident layout created previously (see Add a Table to the Incident Layout), add another section and add the multiselectfield field just created.

  6. In an incident, click the multiselectfield and observe the sorted list of options.

    cortex-xsoar-automation-drop-down.png