Skip to main content


This Script is part of the Common Scripts Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.5.0 and later.

The script takes one or more domain names and checks whether they're in the Cortex XSOAR list defined in the InternalDomainsListName argument. By default, the InternalDomainsListName argument will use the Cortex XSOAR list called "InternalDomains". The list can be customized by the user. It should contain the organization's internal domain names, separated by new lines. Subdomains are also supported in the list. The results of the script are tagged with the "Internal_Domain_Check_Results" tag, so they can be displayed in the War Room entry sections in incident layouts.

Script Data#

Script Typepython3
Cortex XSOAR Version6.5.0


Argument NameDescription
InternalDomainsListNameThe name of the Cortex XSOAR list that holds the internal domains in the organization. If no list is specified, the script will use the InternalDomains list by default.
DomainsA domain name or a list of domain names to check for being internal or external, against the specified list of internal domains.


Domain.NameThe domain name that was checked for being internal/external.string
Domain.InternalWhether the domain name is internal or external, according to the domain names defined in the Cortex XSOAR list, which is provided in the InternalDomains argument.boolean