1. Home
    2. Security Operations
    3. Cortex XSOAR
    4. Cortex XSOAR Administrator’s Guide
    5. Widgets
    6. Create a Custom Widget Using an Automation Script
    7. Script Based Widgets Using Automation Scripts Examples
    End-of-Life (EoL)

    Script Based Widgets Using Automation Scripts Examples

    Create script based widgets based on automation scripts for reports and dashboards in Cortex XSOAR.
    The following examples are script based widgets using automation scripts. After creating the script, you do not need to create a JSON file as you can create a widget in the
    Widgets Library
    . For more information about creating widgets in the
    Widgets Library
     see Create a Widget in the Widgets Library.

    Text

    In this example, create a script that queries and returns current on-line users, and displays the data in a Markdown table. If using a JSON file, you must set widgetType to text.
    In the automation script, type one of the following return values:
    JavaScript
    
				
    return executeCommand("getUsers", {online: true})[0].HumanReadable;
    Python
    demisto.results(demisto.executeCommand("getUsers", { "online": True })[0]["HumanReadable"])
    (
    Optional
    ) If creating a JSON file, type the following:
    
				
    {
  "id": "1a2b3c4d",
  "name": "GetOnlineUsers",
  "dataType": "scripts",
  "widgetType": "text",
  "query": "GetOnlineUsers"
}
    When creating or editing the widget in the Cortex XSOAR, to add a page break, type
    /pagebreak
     in the text box. When you generate a report, the widgets that follow the page break are on a separate page.
    In the dashboard, the following widget displays the on-line users:
    (
    Multi-tenant
    ) Script-based text widgets are not supported in the Main Account.

    Number

    This example shows how to create a single item widget with the percentage of incidents that DBot closed.
    In the automation script, type one of the following:
    JavaScript
    
				
    
					var res = executeCommand("getIncidents", {
  'query': 'status:closed and investigation.users:""',
  'fromdate': args.from,
  'todate': args.to,
  'size': 0
});
var closedByDbot = res[0].Contents.total;

res = executeCommand("getIncidents", {
  'status': 'closed',
  'fromdate': args.from,
  'todate': args.to,
  'size': 0
});
var overallClosed = res[0].Contents.total;

var result = Math.round(closedByDbot * 100 / overallClosed);
return isNaN(result) ? 0 : result;
    Python
    res = demisto.executeCommand("getIncidents", {
    "query": "status:closed and investigation.users:\"\"",
    "fromdate": demisto.args()["from"],
    "todate": demisto.args()["to"],
    "size": 0
})
closedByDbot = res[0]["Contents"]["total"]

res = demisto.executeCommand("getIncidents", {
    "status": "closed",
    "fromdate": demisto.args()["from"],
    "todate": demisto.args()["to"],
    "size": 0
});
overallClosed = res[0]["Contents"]["total"]
if overallClosed == 0:
    demisto.results(0)
else:
    result = round(closedByDbot * 100 / overallClosed)
    demisto.results(result);
    (
    Optional
    ) If creating a JSON file, type the following:
    
				
    
					{
  "id": "closed-by-dbot-incidents-percentage",
  "name": "Closed By Dbot",
  "dataType": "scripts",
  "widgetType": "number",
  "query": "DBotClosedIncidentsPercentage"
}

    Duration

    In this example, create a script that queries and returns a time duration (specified in seconds), and displays the data as a countdown clock. If using a JSON file, you must set widgetType to duration.
    In the automation script, type one of the following return values:
    JavaScript
    
					
    return JSON.stringify([{ name: "", data: [120] }]);
    Python
    demisto.results('[{"name": "", "data": [120]}]')
    The return type should be a string (any name) and an integer. The time is displayed in seconds.
    (
    Optional
    ) If using a JSON file, type the following:
    
					
    
						{
  "id": "1a2b3c4d687",
  "name": "slaRemaining",
  "dataType": "scripts",
  "widgetType": "duration",
  "query": "RemainingSLAScript"
}
    After you have uploaded the script and created the widget, you can add the widget to the dashboard or report. The following widget displays the time duration:

    Trend

    In this example, create a script that queries and returns the trend between two sums. If creating a JSON file, set widgetType to trend.
    In the automation script, type one of the following return values:
    JavaScript
    
						
    return JSON.stringify({currSum: 48, prevSum: 32});
    Python
    demisto.results({ "currSum": 48, "prevSum": 32 })
    The return displays an object which compares the current sum with the previous sum.
    (
    Optional
    ) If creating a JSON file, type the following:
    
						
    
							{
  "id": "1a2b3c4d55",
  "name": "DailyTotalTrend",
  "dataType": "scripts",
  "widgetType": "trend",
  "query": "DailyTotalTrendScript"
}

    Chart

    A valid result for a chart widget is a list of groups. Each group points to a single entity, for example, in bar charts each group is a bar. A group consists of the following:
    • Name
       - A string.
    • Data
       - An array of integers.
    • Color
       - A string representing a color that will be used as a default color for that group. It can be the name of the color, a hexadecimal representation of the color, or an rgb color value (optional).
      A widget legend color will override a group color if it exists.
    • Groups
       - A nested list of groups (optional).
    In this example, we show how to create a script that will query and return the trend between two sums in a pie chart. If creating a JSON file, set the widgetType to one of the following chart types.
    • Pie
    • Line
    • Bar
    • Column
    Simple pie/chart
    In the automation script, type the following return value:
    JavaScript
    									var data = [
    {name: "2018-04-12", data: [10], color: "blue"},
    {name: "2018-04-10", data: [3], color: "#029be5"},
    {name: "2018-04-17", data: [1], color: "rgb(174, 20, 87)"},
    {name: "2018-04-16", data: [34], color: "grey"},
    {name: "2018-04-15", data: [17], color: "purple"}
];
return JSON.stringify(data);
    Python
    data = [
    {"name": "2018-04-12", "data": [10], "color": "blue"},
    {"name": "2018-04-10", "data": [3], "color": "#029be5"},
    {"name": "2018-04-17", "data": [1], "color": "rgb(174, 20, 87)"},
    {"name": "2018-04-16", "data": [34], "color": "grey"},
    {"name": "2018-04-15", "data": [17], "color": "purple"}
];
demisto.results(json.dumps(data));
    (
    Optional
    ) If creating a JSON file, type the following:
    
				
    
					{
  "id": "1a2b3c4dee",
  "name": "DailyTotalSales",
  "dataType": "scripts",
  "widgetType": "pie",
  "query": "DailyTotalSalesScript"
}
    After you have uploaded the script and created the widget you can add the widget to a dashboard or report. The following widget displays the trend in a pie chart:
    Two group chart
    JavaScript
    var data = [
    {name: "2018-04-12", data: [10], groups: [{name: "Unclassified", data: [10] }]},
    {name: "2018-04-10", data: [3], groups: [{name: "Unclassified", data: [2] }, {name: "Access", data: [1] }]},
    {name: "2018-04-17", data: [1], groups: [{name: "Unclassified", data: [1] }]},
    {name: "2018-04-16", data: [34], groups: [{name: "Unclassified", data: [18] }, {name: "Phishing", data: [14] }]},
    {name: "2018-04-15", data: [17], groups: [{name: "Access", data: [17] }]}
];
return JSON.stringify(data);
    Python
    data = [
    {"name": "2018-04-12", "data": [10], "groups": [{"name": "Unclassified", "data": [10] }]},
    {"name": "2018-04-10", "data": [3], "groups": [{"name": "Unclassified", "data": [2] }, {"name": "Access", "data": [1] }]},
    {"name": "2018-04-17", "data": [1], "groups": [{"name": "Unclassified", "data": [1] }]},
    {"name": "2018-04-16", "data": [34], "groups": [{"name": "Unclassified", "data": [18] }, {"name": "Phishing", "data": [14] }]},
    {"name": "2018-04-15", "data": [17], "groups": [{"name": "Access", "data": [17] }]}
];
demisto.results(json.dumps(data));

    Table or List

    In this example, you need to create a script that queries and returns employee information in a table. For Table or List, if creating a JSON file, set the widgetType to table or list. When using lists, a maximum of two columns displays, the rest are ignored (do not display).
    In the automation script, type one of the following return values:
    JavaScript
    
				
    
					return JSON.stringify({total: 3, data:[
    {Employee: 'David D', Phone: '+14081234567', Email: 'David@org.com'},
    {Employee: 'James J', Phone: '+14087654321', Email: 'James@org.com'},
    {Employee: 'Alex A', Phone: '+14087777777', Email: 'Alex@org.com'}
]});
    Python
    demisto.results({ "total": 3, "data": [{"Employee": "David D", "Phone": "+14081234567", "Email": "David@org.com"},  {"Employee": "James J", "Phone": "+14087654321", "Email": "James@org.com"}, {"Employee": "Alex A", "Phone": "+14087777777", "Email": "Alex@org.com"}]})
    (
    Optional
    ) If creating a JSON file, type the following:
    
				
    
					{
  "id": "1a2b3c4de345",
  "name": "EmployeeInfo",
  "dataType": "scripts",
  "widgetType": "table",
  "query": "EmployeeInfoScript"
}
    After you have uploaded the script and created a widget you can add the widget to a dashboard or report. The following widget displays the employee information:

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2022 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo