Add a Script to the Incident Layout - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
8
Creation date
2023-11-02
Last date published
2024-04-11
Category
Administrator Guide
Solution
Cloud
Abstract

Add automation script-based content to the incident layout in Cortex XSOAR.

You can add automation script-based content to the incident layout by adding the General Purpose Dynamic Section in the incident layout builder.

The General Purpose Dynamic Section enables you to configure a section in the incident layout from an automation script. The automation can return a simple text, markdown, or an HTML, the results of which appear in General Purpose Dynamic Section. All possible values for EntryFormat are specified in CommonServerPython.

You can add any required information from a script. For example, you can assign a script that calculates the total number of entries that exist for an incident, and it dynamically updates when new entries are added to the incident. You can also Add a Custom Widget to the Incident Page and Add Note Information Using an Automation Script.

The following are examples of values that can be returned from the General Purpose Dynamic Section script:

Text Example

return_results(<TEXT>)

Markdown Example

return_results({
    'ContentsFormat': EntryFormat.MARKDOWN,
    'Type': EntryType.NOTE,
    'Contents': <MARKDOWN_DATA>
})

HTML Example

return_results({
    'ContentsFormat': EntryFormat.HTML,
    'Type': EntryType.NOTE,
    'Contents': <HTML_DATA>
})

Before you begin, you need to create a script.

  1. Select the layout you want to add to the General Purpose Dynamic Section by completing steps 1 to 3 in Customize Incident Layouts.

  2. Drag and drop the General Purpose Dynamic Section into the layout area you want to appear.

  3. Select the General Purpose Dynamic Section, click indicator-option-pointer.png and then click Edit section settings.

  4. In the Name and Description fields, add a meaningful name and a description for the dynamic section that explains what the script displays.

  5. In the Automation script field, from the dropdown list, select the script that returns data for the dynamic section.

    Note

    Only scripts to which you have added the dynamic-section tag appear in the dropdown list.

  6. Click OK.