Skip to main content

Cortex XDR - Run script

This Playbook is part of the Cortex XDR by Palo Alto Networks Pack.#

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

Initiates a new endpoint script execution action using a provided script unique id from Cortex XDR script library.


This playbook uses the following sub-playbooks, integrations, and scripts.


  • Cortex XDR - Check Action Status


  • CortexXDRIR


This playbook does not use any scripts.


  • xdr-run-script
  • xdr-get-script-execution-results

Playbook Inputs#

NameDescriptionDefault ValueRequired
endpoint_idsA comma-separated list of endpoint IDs.Optional
script_uidUnique identifier of the script. Can be retrieved by running the xdr-get-scripts command.Optional
parametersDictionary contains the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}. The required parameters for each script can be retrieved by running xdr-get-script-metadata with the script uid.Optional
script_timeoutThe timeout in seconds for this execution.
(Default is: '600')
polling_timeoutAmount of time to poll action status before declaring a timeout and resuming the playbook (in minutes).10Optional

Playbook Outputs#

PaloAltoNetworksXDR.ScriptResult.results._return_valueValue returned by the script in case the type is not a dictionary.unknown

Playbook Image#

Cortex XDR - Run script