End-of-Life (EoL)

Extend Context

There are situations where the data returned by an integration or command is not exactly what you need. For example, when you run the command
!ad-get-user name="sampleName"
, you receive information about the user's dn, email, and more. However, you might only want the name of the user's manager. And you might want to store that information in a specific field.
Cortex XSOAR enables you to do that using the Extend Context feature. Extend Context can be used as in the situation above, or when you want to run a command multiple times and save the output to a different key each time. Using our
command from above, run the command once to retrieve the user, and once to retrieve the user's manager. Also, there are situations where an integration is configured to display only some of the information that you retrieved. The information is shown in context-data, but there is more available. For example, when you run a command to retrieve offenses from a SIEM, only some of the information is displayed, per the configuration of the instance. You can use Extend Context to retrieve the additional information and place it in a new field.
By default, when you run a command, either from the command line or as part of a script or playbook, a subset of JSON fields are returned. To display the full JSON response, run the command using the

Recommended For You