Skip to main content

Cortex XDR - Run script

This Playbook is part of the Palo Alto Networks Cortex XDR - Investigation and Response Pack.#

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

Initiates a new endpoint script execution action using a provided script unique id from Cortex XDR script library.

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

  • Cortex XDR - Check Action Status

Integrations#

  • CortexXDRIR

Scripts#

This playbook does not use any scripts.

Commands#

  • xdr-run-script
  • xdr-get-script-execution-results

Playbook Inputs#


NameDescriptionDefault ValueRequired
endpoint_idsA comma-separated list of endpoint IDs.Optional
script_uidUnique identifier of the script. Can be retrieved by running the xdr-get-scripts command.Optional
parametersDictionary contains the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}. The required parameters for each script can be retrieved by running xdr-get-script-metadata with the script uid.Optional
script_timeoutThe timeout in seconds for this execution.
(Default is: '600')
Optional
polling_timeoutAmount of time to poll action status before declaring a timeout and resuming the playbook (in minutes).10Optional

Playbook Outputs#


PathDescriptionType
PaloAltoNetworksXDR.ScriptResult.results._return_valueValue returned by the script in case the type is not a dictionary.unknown

Playbook Image#


Cortex XDR - Run script