Extend context to retrieve additional data from integrations
or commands and map to fields. Extend context in a Cortex XSOAR
You can extend context either in a playbook
task, or directly from the command line. Whichever method you use,
Cortex XSOAR recommends that you first run your command with the
This will help you identify the information that you want to add
to your extended data.
tab of the relevant playbook
the name of the field in which you want the information to appear
and the value you want to return. For example, using the ad-get-user
command, you could enter user=attributes.displayname to place the
user's name in the user key.
The following image shows the result of the !IPReuptation ip=126.96.36.199
To include more than one field, separate the fields with
a double colon. For example: