Skip to main content


This Script is part of the Cortex XDR by Palo Alto Networks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.2.0 and later.

Train clustering model on Cortex XDR incident type.

Script Data#

Script Typepython3
Cortex XSOAR Version6.2.0


Argument NameDescription
returnWidgetTypeThe type of the widget to return.
fromDateThe start date by which to filter incidents. Date format will be the same as in the incidents query page, for example: "3 days ago", ""2019-01-01T00:00:00 +0200").
limitThe maximum number of incidents to fetch
incidentTypeThe Cortex XDR incident type
searchQueryInput search query from the dashboard
modelExpirationPeriod of time (in hours) before retraining the model. Default is "24".
forceRetrainDetermines whether to force the model to re-train. Default is "False".
fieldsToDisplayComma-separated list of additional incident fields to display, but which will not be taken into account when computing similarity.


There are no outputs for this script.