Cortex XSOAR 6 Security Orchestration and Automation Course

Search Query Examples

# Search for active incidents with Information severity

status:Active and severity:Informational

# Search for active incidents or Informational incidents

status:Active or severity:Informational

# Search for all incidents that are not closed and are not in the job category.

-status:closed -category:job

# Search playbooks whose name starts by Block

name:Block*

# Search for automations whose code contains "import json"

script:*import json*

# Search for incidents that were created on or after July 1, 2024

created:>="2024-07-01T00:00:00 +0200"

# Search for indicator values that contain "www" and end with ".com" using regex

value:"/w{3}..*.com/"

# Search for incident id 523

/search incident.id:523

# Search indicators that ends with ".com"

/search indicator.value:*.com

!GetErrorsFromEntry entry_id=${lastCompletedTaskEntries}

!getInvPlaybookMetaData incidentId=<incident ID> minSize=<size of the data you want to return in KB. Default is 10>

Get sample data for testing/debugging

# Export root data

!js script="return ${.}"

# Export context data

!py script="return_results(demisto.context())"

!PrintContext outputformat=json

# Export incident data

!py script="return_results(demisto.incident())"

!Print value=${.incident}

Commands

/docker_images

/docker_image_update all=<bool> | image=<image_name>

/docker_image_create name="<name>" base="<docker_image_base>" dependencies="<dependency1>, <dependency2>" packages="<package1>, <package2>"

/docker_image_create name=”demisto/py3-bs4” base=”demisto/python3-deb:3.8.2.6981” dependencies=beautifulsoup4

Fix Permission Denied Error

sudo mkdir -p /home/demisto

sudo chown demisto:demisto /home/demisto

curl 'https://<host>:443/incidents/search' -H 'content-type: application/json' -H 'accept: application/json' -H 'Authorization: <your api key>' --data-binary '{"filter":{"query":"-status:closed -category:job","period":{"by":"day","fromValue":30}}}' --compressed -k

!core-api-get uri="/health/containers”

{"alertName": "Phishing Attack", "type": "phishing", "email": "test@outlook.com"}

/var/log/demisto/integration-instance.log

!command debug-mode=true