Markdown in Cortex XSOAR - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide
Product
Cortex XSOAR
Version
8
Creation date
2024-02-14
Last date published
2024-04-15
Category
Administrator Guide
Solution
Cloud
Abstract

Use markdown to add basic formatting to text in multiple contexts within Cortex XSOAR.

You can use Markdown in many places within Cortex XSOAR. Some of the more common places are:

  • Threat intel reports

  • Command line interface (CLI)

  • Scripts

  • Playbook tasks

  • Widgets

  • Incident fields

  • Lists

In most contexts where Markdown is supported, a GUI Markdown editor is available to help you easily apply styles and then view a preview of how those styles will look.

Markdown Syntax

Most Markdown syntax elements within Cortex XSOAR are identical to those used in basic and extended Markdown syntax. Refer to the following site for a description of markdown syntax: https://www.markdownguide.org/.

The following Markdown elements used in Cortex XSOAR and exposed in the Markdown editor follow the same syntax as basic/extended Markdown:

  • Bold

  • Italics

  • Strike-through

  • Headings

  • Lists (unordered/ordered)

  • Links

  • Code

    Note

    Using the Insert code button in the Markdown editor adds three backtick quotes, which allows inclusion of a literal backtick character within the code snippet.

  • Tables

    Note

    You can use the Insert table button in the Markdown editor to easily create a table with up to five rows/columns.

  • Images

  • Blockquote

Additional elements not exposed in the Markdown editor can also be applied, such as: letter-spacing, text-shadow, font-weight, font-size.

Cortex XSOAR Flavored Markdown

Cortex XSOAR supports additional elements not found in basic/extended Markdown that provide useful functionality when working with Cortex XSOAR. For example:

Markdown Element

Syntax/Description

Underline

+This text will be underlined+

Text alignment

<:-->Left Aligned Text<-:->Center Aligned Text<--:>Right Aligned Text

Highlight text

==This text will be highlighted==

Text color

{{color:#fd0800}}(This text will be in red) OR {{color:red}}(This text will be in red)

Note

You can use the name of the color, or the color code (hex triplet format)

Text background color

{{background:#fd0800}}(This text will have red background) OR {{background:red}}(This text will have red background)

Note

You can use either the name of the color, or the color code (hex triplet format). You can use text color and text background color in parallel. For example (using the editor buttons): {{background:red}}({{color:blue}}(This text will be in blue with red background)). Or, alternatively, if you are manually applying attributes, you can include both types in a single bracket: {{background:red;color:blue}}(This text will be in blue with red background)). For both text color and text background color, you can select Show custom options in the Markdown editor to select or enter a specific color code (hex triplet format).

Keyboard input style

[[kbd]]

Note

Denotes textual user input from a keyboard.

Linking to other Cortex XSOAR incidents

#Incident ID Number

Upload a local image

You can upload a local image that is not available on the internet to the Markdown editor. Copy/paste or drag a local image into the Markdown editor, which automatically applies the standard image syntax and adds a relative path to the image.

Note

Within the War Room, when the Markdown editor is open, you will only be able to drag images into the Markdown editor. To drag images into the War Room, first close the Markdown editor.

Button

%%%{"message": "This is a Button", "action":"Command Name", "params": { "param1": "val1", "param2": "val2"}}%%%

Note

  • Buttons are available only in entries of incidents.

  • If data between the two sets of %%% is not parsed as JSON, all of the data is taken as a command to render. For example, %%%!Print value='test'%%% causes the button to run !Print.

Some extended Markdown syntax may not be supported. For example, checkboxes and footnotes.