Repository: demisto/content
Pull request #39737: xdr retrieve data script
Author: login: rshunim
Labels: name: docs-approved
name: ready-for-pipeline-running
description: Whether the pr is ready for running the whole pipeline, including testing on SAAS machines
Created: 2025-04-27T13:24:03Z | Merged: 2025-05-13T13:29:45Z


## Status
- [x] In Progress
- [ ] Ready
- [ ] In Hold - (Reason for hold)

## Related Issues
fixes: link to the issue

## Description
A few sentences describing the overall goals of the pull request's commits.

## Must have
- [ ] Tests
- [ ] Documentation 



Diff:
diff --git a/Packs/Core/ReleaseNotes/3_3_0.md b/Packs/Core/ReleaseNotes/3_3_0.md
new file mode 100644
index 000000000000..78407ff49fc6
--- /dev/null
+++ b/Packs/Core/ReleaseNotes/3_3_0.md
@@ -0,0 +1,8 @@
+
+#### Scripts
+
+##### New: SearchIndicatorInEvents
+
+- New: Added a new script- SearchIndicatorInEvents that Gets an indicator data set and timeframe, and searches for the indicator.
+<~XSIAM> (Available from Cortex XSIAM 2.5).</~XSIAM>
+
diff --git a/Packs/Core/Scripts/SearchIndicatorInEvents/README.md b/Packs/Core/Scripts/SearchIndicatorInEvents/README.md
new file mode 100644
index 000000000000..11e3e8ee0972
--- /dev/null
+++ b/Packs/Core/Scripts/SearchIndicatorInEvents/README.md
@@ -0,0 +1,32 @@
+Searches for a specific indicator in the tenant's event and log data, and extracts the logs the indicator appears in.
+
+## Script Data
+
+---
+
+| **Name** | **Description** |
+| --- | --- |
+| Script Type | python3 |
+| Tags | Utilities |
+| Cortex XSOAR Version | 6.1.0 |
+
+## Inputs
+
+---
+
+| **Argument Name** | **Description** |
+| --- | --- |
+| indicator | The indicator value \(e.g., IP address, domain, hash\) to search for in the selected dataset logs. |
+| time_frame | The search timeframe in days \(e.g., "7 days" means searching the past 7 days of data\). |
+| data_set | The dataset for the search. By default, this is "xdr_data". |
+| query_name | The name to use for the query results. Find the query results under this name in the War Room context. |
+| interval_in_seconds | The interval in seconds for checking query completion. |
+| timeout_in_seconds | The maximum time to wait for the query to finish \(in seconds\). The command fails if the query takes longer. |
+
+## Outputs
+
+---
+
+| **Path** | **Description** | **Type** |
+| --- | --- | --- |
+| PaloAltoNetworksXQL | A list of event records \(constructed as dictionaries\) where the specified indicator was found. | List |
diff --git a/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.py b/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.py
new file mode 100644
index 000000000000..80890e402dc2
--- /dev/null
+++ b/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.py
@@ -0,0 +1,111 @@
+import demistomock as demisto  # noqa: F401
+from CommonServerPython import *  # noqa: F401
+import urllib3
+from CoreXQLApiModule import *
+
+urllib3.disable_warnings()
+DEFAULT_TIMEOUT = 600
+DEFAULT_INTERVAL = 30
+
+
+def shorten_text(text: str) -> str:
+    parts = text.split()
+    if len(parts) == 2:
+        return f"{parts[0]}{parts[1][0].lower()}"
+    return text  # Return original if not exactly two words
+
+
+def check_status(args: dict) -> PollResult:
+    """
+    This function executes the xdr-xql-get-query-results command and PollResult object accordingly.
+    """
+    demisto.debug("starting check_status function")
+
+    query_id = args["query_id"]
+    entry_result = demisto.executeCommand(command="xdr-xql-get-query-results", args={"query_id": query_id})
+    demisto.debug(f"This is the entry result from executing xdr-xql-get-query-results command:\n{entry_result} ")
+
+    continue_to_poll = entry_result[0]["Contents"]["status"] == "PENDING"
+
+    if continue_to_poll:
+        demisto.debug("continue_to_poll is True")
+        return PollResult(
+            response={},
+            continue_to_poll=continue_to_poll,
+            args_for_next_run=args,
+            partial_result=CommandResults(readable_output=f'Waiting for job ID {args["query_id"]} to finish...'),
+        )
+
+    demisto.debug("continue_to_poll is False")
+    return PollResult(
+        response=CommandResults(
+            readable_output=f'job ID {args["query_id"]} is finished!',
+            outputs=entry_result[0]["Contents"]["results"],
+            outputs_prefix="PaloAltoNetworksXQL",
+        ),
+        continue_to_poll=continue_to_poll,
+        args_for_next_run=args,
+    )
+
+
+def execute_query(args: dict) -> dict:
+    """
+    This function executes the xdr-xql-generic-query command and returns the args for the next run since it's a polling command.
+    """
+    demisto.debug("starting execute_query")
+    time_frame: str = args.get("time_frame", "7 days")
+    data_set: str = args.get("data_set", "xdr_data")
+    indicator: str = args["indicator"]
+    query_name: str = args["query_name"]
+
+    time_frame_for_query: str = shorten_text(time_frame)
+    query: str = f'config timeframe = {time_frame_for_query} | search "{indicator}" dataset = {data_set}'
+
+    entry_result = demisto.executeCommand(command="xdr-xql-generic-query", args={"query": query, "query_name": query_name})
+    demisto.debug(f"This is the entry result from executing xdr-xql-generic-query command:\n{entry_result} ")
+    polling_args = entry_result[0]["Metadata"]["pollingArgs"]
+    args_for_next_run = {
+        "query_id": polling_args["query_id"],
+        "query_name": polling_args["query_name"],
+        "time_frame": time_frame_for_query,
+        "data_set": data_set,
+        "indicator": indicator,
+    }
+
+    return args_for_next_run
+
+
+@polling_function(
+    name="SearchIndicatorInEvents",
+    interval=arg_to_number(demisto.args().get("interval_in_seconds", DEFAULT_INTERVAL)),
+    timeout=arg_to_number(demisto.args().get("timeout_in_seconds", DEFAULT_TIMEOUT)),
+    requires_polling_arg=False,
+)
+def retrieve_data_from_xdr(args: dict) -> PollResult:
+    """
+    This is the main function, which manages the polling.
+    If the 'query_id' argument exists, we're after executing the query and checking for the results.
+    Otherwise, we're just starting the process and should execute the query.
+    """
+    if "query_id" not in args:  # first time executing query
+        demisto.debug("starting polling_command function")
+        args_for_next_run = execute_query(args=args)
+        return PollResult(
+            response={},
+            continue_to_poll=True,
+            args_for_next_run=args_for_next_run | {"polling": True},
+            partial_result=CommandResults(readable_output=f'Waiting for job ID {args_for_next_run["query_id"]} to finish...'),
+        )
+    else:  # check query's status
+        return check_status(args=args)
+
+
+def main():  # pragma: no cover
+    try:
+        return_results(retrieve_data_from_xdr(args=demisto.args()))
+    except Exception as e:
+        return_error("Error occurred while retrieving data from XDR. Exception info:\n" + str(e))
+
+
+if __name__ in ("__main__", "__builtin__", "builtins"):
+    main()
diff --git a/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.yml b/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.yml
new file mode 100644
index 000000000000..92b7a84001ac
--- /dev/null
+++ b/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.yml
@@ -0,0 +1,48 @@
+commonfields:
+  id: SearchIndicatorInEvents
+  version: -1
+name: SearchIndicatorInEvents
+script: ''
+type: python
+tags:
+  - Utilities
+comment: Searches for a specific indicator in the tenant's event and log data, and extracts the logs the indicator appears in.
+enabled: true
+args:
+  - name: indicator
+    required: true
+    description: The indicator value (e.g., IP address, domain, hash) to search for in the selected dataset logs.
+  - name: time_frame
+    required: true
+    defaultValue: 7 days
+    description: The search timeframe in days (e.g., "7 days" means searching the past 7 days of data).
+  - name: data_set
+    defaultValue: xdr_data
+    description: The dataset for the search. By default, this is "xdr_data".
+  - name: query_name
+    required: true
+    description: The name to use for the query results. Find the query results under this name in the War Room context.
+  - name: query_id
+    hidden: true
+    description: The internal ID for the query. It cannot be set manually.
+  - name: interval_in_seconds
+    defaultValue: '30'
+    description: The interval in seconds for checking query completion.
+  - name: timeout_in_seconds
+    defaultValue: '600'
+    description: The maximum time to wait for the query to finish (in seconds). The command fails if the query takes longer.
+outputs:
+  - contextPath: PaloAltoNetworksXQL
+    description: A list of event records (constructed as dictionaries) where the specified indicator was found.
+    type: List
+scripttarget: 0
+subtype: python3
+dockerimage: demisto/python3:3.12.8.3296088
+fromversion: 6.1.0
+tests:
+  - No tests (auto formatted)
+polling: true
+marketplaces:
+  - xsoar
+  - marketplacev2
+  - platform
\ No newline at end of file
diff --git a/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents_test.py b/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents_test.py
new file mode 100644
index 000000000000..7269b42f6298
--- /dev/null
+++ b/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents_test.py
@@ -0,0 +1,74 @@
+def test_retrieve_data_from_xdr_sanity_check(mocker):
+    """
+    Given:
+    - All the required args
+
+    When:
+    - Executing retrieve_data_from_xdr function (first case of executing query)
+
+    Then:
+    - Ensure executeCommand was called once
+    - Ensure the correct args were sent in executeCommand call
+    - Ensure shorten_text function generated a correct output (a part of the query's check)
+    """
+
+    # Mock input arguments
+    args = {"time_frame": "7 days", "indicator": "1.2.3.4", "query_name": "Test Query", "data_set": "xdr_data"}
+
+    # Mock return values
+    initial_response = [
+        {"Contents": {"status": "PENDING"}, "Metadata": {"pollingArgs": {"query_id": "abc123", "query_name": "TEST"}}}
+    ]
+    completed_response = [{"Contents": {"status": "COMPLETED"}, "HumanReadable": "Query results here"}]
+
+    # Patching dependencies
+    mock_execute = mocker.patch(
+        "SearchIndicatorInEvents.demisto.executeCommand", side_effect=[initial_response, completed_response]
+    )
+
+    from SearchIndicatorInEvents import retrieve_data_from_xdr
+
+    poll_result = retrieve_data_from_xdr(args)
+
+    assert mock_execute.call_count == 1
+    assert mock_execute.mock_calls[0][2]["args"]["query"] == 'config timeframe = 7d | search "1.2.3.4" dataset = xdr_data'
+    assert poll_result.scheduled_command._args["query_id"] == "abc123"
+
+
+def test_check_status(mocker):
+    """
+    Given:
+    - All the required args
+
+    When:
+    - Executing retrieve_data_from_xdr function (second case of checking status)
+
+    Then:
+    - Ensure executeCommand was called once
+    - Ensure the correct args were sent in executeCommand call, query_id and the right command
+    - Ensure the readable_output is correct
+    """
+
+    # Mock input arguments
+    args = {
+        "time_frame": "7 days",
+        "indicator": "1.2.3.4",
+        "query_name": "Test Query",
+        "data_set": "xdr_data",
+        "query_id": "abc123",
+    }
+
+    # Mock return values
+    completed_response = [{"Contents": {"status": "COMPLETED", "results": []}}]
+
+    # Patching dependencies
+    mock_execute = mocker.patch("SearchIndicatorInEvents.demisto.executeCommand", side_effect=[completed_response])
+
+    from SearchIndicatorInEvents import retrieve_data_from_xdr
+
+    poll_result = retrieve_data_from_xdr(args)
+
+    assert mock_execute.call_count == 1
+    assert mock_execute.mock_calls[0][2]["args"] == {"query_id": "abc123"}
+    assert mock_execute.mock_calls[0][2]["command"] == "xdr-xql-get-query-results"
+    assert poll_result.readable_output == "job ID abc123 is finished!"
diff --git a/Packs/Core/pack_metadata.json b/Packs/Core/pack_metadata.json
index 90cd3a9ac190..41bd74766ae6 100644
--- a/Packs/Core/pack_metadata.json
+++ b/Packs/Core/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Core - Investigation and Response",
     "description": "Automates incident response",
     "support": "xsoar",
-    "currentVersion": "3.2.40",
+    "currentVersion": "3.3.0",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",


Reviews:
user: login: jbabazadeh
body: great work! please see my comments
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-11T07:52:04Z
user: login: rshunim
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-11T09:45:44Z
user: login: jbabazadeh
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-12T18:39:48Z
user: login: julieschwartz18
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-13T06:31:31Z

Review comments:
diff_hunk: @@ -0,0 +1,113 @@
+import demistomock as demisto  # noqa: F401
+from CommonServerPython import *  # noqa: F401
+import urllib3
+from CoreXQLApiModule import *
+
+urllib3.disable_warnings()
+DEFAULT_TIMEOUT = 600
+DEFAULT_INTERVAL = 30
+
+
+def shorten_text(text: str) -> str:
+    parts = text.split()
+    if len(parts) == 2:
+        return f"{parts[0]}{parts[1][0].lower()}"
+    return text  # Return original if not exactly two words
+
+
+def check_status(args: dict) -> PollResult:
+    """
+    This function executes the xdr-xql-get-query-results command and PollResult object accordingly.
+    """
+    demisto.debug("starting check_status function")
+
+    query_id = args["query_id"]
+    entry_result = demisto.executeCommand(command="xdr-xql-get-query-results", args={"query_id": query_id})
+    demisto.debug(f"This is the entry result from executing xdr-xql-get-query-results command:\n{entry_result} ")
+
+    continue_to_poll = (entry_result[0]["Contents"]['status'] == 'PENDING')
+
+    if continue_to_poll:
+        demisto.debug("continue_to_poll is True")
+        return PollResult(
+            response={},
+            continue_to_poll=continue_to_poll,
+            args_for_next_run=args,
+            partial_result=CommandResults(
+                readable_output=f'Waiting for job ID {args["query_id"]} to finish...'
+            ),
+        )
+
+    demisto.debug("continue_to_poll is False")
+    return PollResult(
+        response=CommandResults(readable_output=f'job ID {args["query_id"]} is finished!',
+                                outputs=entry_result[0]["Contents"]["results"],
+                                outputs_prefix="PaloAltoNetworksXQL"),
+        continue_to_poll=continue_to_poll,
+        args_for_next_run=args,
+    )
+
+
+def execute_query(args: dict) -> dict:
+    """
+    This function executes the xdr-xql-generic-query command and returns the args for the next run since it's a polling command.
+    """
+    demisto.debug("starting execute_query")
+    time_frame: str = args.get("time_frame", "7 days")
+    data_set: str = args.get("data_set", "xdr_data")
+    indicator: str = args["indicator"]
+    query_name: str = args["query_name"]
+
+    time_frame_for_query: str = shorten_text(time_frame)
+    query: str = f'config timeframe = {time_frame_for_query} | search "{indicator}" dataset = {data_set}'
+
+    entry_result = demisto.executeCommand(command="xdr-xql-generic-query", args={"query": query, "query_name": query_name})
+    demisto.debug(f"This is the entry result from executing xdr-xql-generic-query command:\n{entry_result} ")
+    polling_args = entry_result[0]["Metadata"]["pollingArgs"]
+    args_for_next_run = {"query_id": polling_args["query_id"],
+                         "query_name": polling_args["query_name"],
+                         'time_frame': time_frame_for_query,
+                         'data_set': data_set,
+                         "indicator": indicator,
+                         }
+
+    return args_for_next_run
+
+
+@polling_function(
+    name='AgentixRetrieveData',
+    interval=arg_to_number(demisto.args().get("interval_in_seconds", DEFAULT_INTERVAL)),
+    timeout=arg_to_number(demisto.args().get("timeout_in_seconds", DEFAULT_TIMEOUT)),
+    requires_polling_arg=False
+)
+def retrieve_data_from_xdr(args: dict) -> PollResult:
+    """
+    This is the main function, which manages the polling.
+    If the 'query_id' argument exists, we're after executing the query and checking for the results.
+    Otherwise, we're just starting the process and should execute the query.
+    """
+    if "query_id" not in args:  # first time executing query
+        demisto.debug("starting polling_command function")
+        args_for_next_run = execute_query(args=args)
+        demisto.debug("After - execute_query function")
path: Packs/Core/Scripts/AgentixRetrieveData/AgentixRetrieveData.py
user: login: jbabazadeh
body: Please remove unnecessary debug logs
created_at: 2025-05-08T16:22:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,8 @@
+
+#### Scripts
+
+##### New: AgentixRetrieveData
+
+- New: Added a new script- AgentixRetrieveData that Gets an indicator data set and timeframe, and searches for the indicator.
path: Packs/Core/ReleaseNotes/3_3_0.md
user: login: jbabazadeh
body: i think the name of the script shouldn't contain Agentix.. lets think on different name.
created_at: 2025-05-11T07:50:50Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,48 @@
+commonfields:
+  id: AgentixRetrieveData
+  version: -1
+name: AgentixRetrieveData
+script: ''
+type: python
+tags:
+  - Utilities
+comment: Gets an indicator data set and timeframe, and searches for the indicator.
path: Packs/Core/Scripts/AgentixRetrieveData/AgentixRetrieveData.yml
user: login: jbabazadeh
body: is this the updated descriptions? 
created_at: 2025-05-11T07:51:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,48 @@
+commonfields:
+  id: AgentixRetrieveData
+  version: -1
+name: AgentixRetrieveData
+script: ''
+type: python
+tags:
+  - Utilities
+comment: Gets an indicator data set and timeframe, and searches for the indicator.
path: Packs/Core/Scripts/AgentixRetrieveData/AgentixRetrieveData.yml
user: login: rshunim
body: Updated it now
created_at: 2025-05-11T09:45:44Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,8 @@
+
+#### Scripts
+
+##### New: SearchIndicatorInEvents
+
+- New: Added a new script- SearchIndicatorInEvents that Gets an indicator data set and timeframe, and searches for the indicator.
path: Packs/Core/ReleaseNotes/3_3_0.md
user: login: julieschwartz18
body: Recommended:
Added the ***SearchIndicatorInEvents*** script that gets an indicator data set and timeframe and searches for the indicator.
created_at: 2025-05-13T05:48:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,32 @@
+Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
path: Packs/Core/Scripts/SearchIndicatorInEvents/README.md
user: login: julieschwartz18
body: Recommended:
Searches for a specific indicator in the tenant's event and log data, and extracts the logs the indicator appears in.
created_at: 2025-05-13T06:05:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,32 @@
+Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+
+## Script Data
+
+---
+
+| **Name** | **Description** |
+| --- | --- |
+| Script Type | python3 |
+| Tags | Utilities |
+| Cortex XSOAR Version | 6.1.0 |
+
+## Inputs
+
+---
+
+| **Argument Name** | **Description** |
+| --- | --- |
+| indicator | The indicator value \(e.g., IP address, domain, hash\) to search for in the selected dataset logs. |
+| time_frame | The time range to search within, specified in days \(e.g., "7 days" means searching the past 7 days of data\). |
path: Packs/Core/Scripts/SearchIndicatorInEvents/README.md
user: login: julieschwartz18
body: The search timeframe in days \(e.g., "7 days" means searching the past 7 days of data\).
created_at: 2025-05-13T06:06:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,32 @@
+Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+
+## Script Data
+
+---
+
+| **Name** | **Description** |
+| --- | --- |
+| Script Type | python3 |
+| Tags | Utilities |
+| Cortex XSOAR Version | 6.1.0 |
+
+## Inputs
+
+---
+
+| **Argument Name** | **Description** |
+| --- | --- |
+| indicator | The indicator value \(e.g., IP address, domain, hash\) to search for in the selected dataset logs. |
+| time_frame | The time range to search within, specified in days \(e.g., "7 days" means searching the past 7 days of data\). |
+| data_set | The name of the dataset to search in. If not specified, the search defaults to the "xdr_data" dataset. |
path: Packs/Core/Scripts/SearchIndicatorInEvents/README.md
user: login: julieschwartz18
body: The dataset for the search. By default, this is "xdr_data".
created_at: 2025-05-13T06:11:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,32 @@
+Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+
+## Script Data
+
+---
+
+| **Name** | **Description** |
+| --- | --- |
+| Script Type | python3 |
+| Tags | Utilities |
+| Cortex XSOAR Version | 6.1.0 |
+
+## Inputs
+
+---
+
+| **Argument Name** | **Description** |
+| --- | --- |
+| indicator | The indicator value \(e.g., IP address, domain, hash\) to search for in the selected dataset logs. |
+| time_frame | The time range to search within, specified in days \(e.g., "7 days" means searching the past 7 days of data\). |
+| data_set | The name of the dataset to search in. If not specified, the search defaults to the "xdr_data" dataset. |
+| query_name | A user-defined name. The query results will appear under the query_name in the context data of the current war room. |
path: Packs/Core/Scripts/SearchIndicatorInEvents/README.md
user: login: julieschwartz18
body: The name to use for the query results. Find the query results under this name in the War Room context.
created_at: 2025-05-13T06:15:35Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,32 @@
+Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+
+## Script Data
+
+---
+
+| **Name** | **Description** |
+| --- | --- |
+| Script Type | python3 |
+| Tags | Utilities |
+| Cortex XSOAR Version | 6.1.0 |
+
+## Inputs
+
+---
+
+| **Argument Name** | **Description** |
+| --- | --- |
+| indicator | The indicator value \(e.g., IP address, domain, hash\) to search for in the selected dataset logs. |
+| time_frame | The time range to search within, specified in days \(e.g., "7 days" means searching the past 7 days of data\). |
+| data_set | The name of the dataset to search in. If not specified, the search defaults to the "xdr_data" dataset. |
+| query_name | A user-defined name. The query results will appear under the query_name in the context data of the current war room. |
+| interval_in_seconds | The interval, in seconds, between checking the status of the query while waiting for the query to complete. |
path: Packs/Core/Scripts/SearchIndicatorInEvents/README.md
user: login: julieschwartz18
body: The interval in seconds for checking query completion.
created_at: 2025-05-13T06:17:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,32 @@
+Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+
+## Script Data
+
+---
+
+| **Name** | **Description** |
+| --- | --- |
+| Script Type | python3 |
+| Tags | Utilities |
+| Cortex XSOAR Version | 6.1.0 |
+
+## Inputs
+
+---
+
+| **Argument Name** | **Description** |
+| --- | --- |
+| indicator | The indicator value \(e.g., IP address, domain, hash\) to search for in the selected dataset logs. |
+| time_frame | The time range to search within, specified in days \(e.g., "7 days" means searching the past 7 days of data\). |
+| data_set | The name of the dataset to search in. If not specified, the search defaults to the "xdr_data" dataset. |
+| query_name | A user-defined name. The query results will appear under the query_name in the context data of the current war room. |
+| interval_in_seconds | The interval, in seconds, between checking the status of the query while waiting for the query to complete. |
+| timeout_in_seconds | The maximum time, in seconds, to wait for the query to finish before the command is forced to fail. |
path: Packs/Core/Scripts/SearchIndicatorInEvents/README.md
user: login: julieschwartz18
body: The maximum time to wait for the query to finish (in seconds). The command fails if the query takes longer.
created_at: 2025-05-13T06:20:19Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,32 @@
+Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+
+## Script Data
+
+---
+
+| **Name** | **Description** |
+| --- | --- |
+| Script Type | python3 |
+| Tags | Utilities |
+| Cortex XSOAR Version | 6.1.0 |
+
+## Inputs
+
+---
+
+| **Argument Name** | **Description** |
+| --- | --- |
+| indicator | The indicator value \(e.g., IP address, domain, hash\) to search for in the selected dataset logs. |
+| time_frame | The time range to search within, specified in days \(e.g., "7 days" means searching the past 7 days of data\). |
+| data_set | The name of the dataset to search in. If not specified, the search defaults to the "xdr_data" dataset. |
+| query_name | A user-defined name. The query results will appear under the query_name in the context data of the current war room. |
+| interval_in_seconds | The interval, in seconds, between checking the status of the query while waiting for the query to complete. |
+| timeout_in_seconds | The maximum time, in seconds, to wait for the query to finish before the command is forced to fail. |
+
+## Outputs
+
+---
+
+| **Path** | **Description** | **Type** |
+| --- | --- | --- |
+| PaloAltoNetworksXQL | A list of event records \(constructed as dictionaries\) where the specified indicator was found during the search. | List |
path: Packs/Core/Scripts/SearchIndicatorInEvents/README.md
user: login: julieschwartz18
body: A list of event records \(constructed as dictionaries\) where the specified indicator was found.
created_at: 2025-05-13T06:25:40Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,48 @@
+commonfields:
+  id: SearchIndicatorInEvents
+  version: -1
+name: SearchIndicatorInEvents
+script: ''
+type: python
+tags:
+  - Utilities
+comment: Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+enabled: true
+args:
+  - name: indicator
+    required: true
+    description: The indicator value (e.g., IP address, domain, hash) to search for in the selected dataset logs.
+  - name: time_frame
+    required: true
+    defaultValue: 7 days
+    description: The time range to search within, specified in days (e.g., "7 days" means searching the past 7 days of data).
path: Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.yml
user: login: julieschwartz18
body: The search timeframe in days (e.g., "7 days" means searching the past 7 days of data).
created_at: 2025-05-13T06:26:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,48 @@
+commonfields:
+  id: SearchIndicatorInEvents
+  version: -1
+name: SearchIndicatorInEvents
+script: ''
+type: python
+tags:
+  - Utilities
+comment: Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+enabled: true
+args:
+  - name: indicator
+    required: true
+    description: The indicator value (e.g., IP address, domain, hash) to search for in the selected dataset logs.
+  - name: time_frame
+    required: true
+    defaultValue: 7 days
+    description: The time range to search within, specified in days (e.g., "7 days" means searching the past 7 days of data).
+  - name: data_set
+    defaultValue: xdr_data
+    description: The name of the dataset to search in. If not specified, the search defaults to the "xdr_data" dataset.
path: Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.yml
user: login: julieschwartz18
body: The dataset for the search. By default, this is "xdr_data".
created_at: 2025-05-13T06:27:00Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,48 @@
+commonfields:
+  id: SearchIndicatorInEvents
+  version: -1
+name: SearchIndicatorInEvents
+script: ''
+type: python
+tags:
+  - Utilities
+comment: Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+enabled: true
+args:
+  - name: indicator
+    required: true
+    description: The indicator value (e.g., IP address, domain, hash) to search for in the selected dataset logs.
+  - name: time_frame
+    required: true
+    defaultValue: 7 days
+    description: The time range to search within, specified in days (e.g., "7 days" means searching the past 7 days of data).
+  - name: data_set
+    defaultValue: xdr_data
+    description: The name of the dataset to search in. If not specified, the search defaults to the "xdr_data" dataset.
+  - name: query_name
+    required: true
+    description: A user-defined name. The query results will appear under the query_name in the context data of the current war room.
path: Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.yml
user: login: julieschwartz18
body: The name to use for the query results. Find the query results under this name in the War Room context.
created_at: 2025-05-13T06:27:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,48 @@
+commonfields:
+  id: SearchIndicatorInEvents
+  version: -1
+name: SearchIndicatorInEvents
+script: ''
+type: python
+tags:
+  - Utilities
+comment: Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+enabled: true
+args:
+  - name: indicator
+    required: true
+    description: The indicator value (e.g., IP address, domain, hash) to search for in the selected dataset logs.
+  - name: time_frame
+    required: true
+    defaultValue: 7 days
+    description: The time range to search within, specified in days (e.g., "7 days" means searching the past 7 days of data).
+  - name: data_set
+    defaultValue: xdr_data
+    description: The name of the dataset to search in. If not specified, the search defaults to the "xdr_data" dataset.
+  - name: query_name
+    required: true
+    description: A user-defined name. The query results will appear under the query_name in the context data of the current war room.
+  - name: query_id
+    hidden: true
+    description: Internal Id of the query, hidden from inserting manually.
path: Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.yml
user: login: julieschwartz18
body: The internal ID for the query. It cannot be set manually.
created_at: 2025-05-13T06:29:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,48 @@
+commonfields:
+  id: SearchIndicatorInEvents
+  version: -1
+name: SearchIndicatorInEvents
+script: ''
+type: python
+tags:
+  - Utilities
+comment: Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+enabled: true
+args:
+  - name: indicator
+    required: true
+    description: The indicator value (e.g., IP address, domain, hash) to search for in the selected dataset logs.
+  - name: time_frame
+    required: true
+    defaultValue: 7 days
+    description: The time range to search within, specified in days (e.g., "7 days" means searching the past 7 days of data).
+  - name: data_set
+    defaultValue: xdr_data
+    description: The name of the dataset to search in. If not specified, the search defaults to the "xdr_data" dataset.
+  - name: query_name
+    required: true
+    description: A user-defined name. The query results will appear under the query_name in the context data of the current war room.
+  - name: query_id
+    hidden: true
+    description: Internal Id of the query, hidden from inserting manually.
+  - name: interval_in_seconds
+    defaultValue: '30'
+    description: The interval, in seconds, between checking the status of the query while waiting for the query to complete.
path: Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.yml
user: login: julieschwartz18
body: The interval in seconds for checking query completion.
created_at: 2025-05-13T06:30:17Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,48 @@
+commonfields:
+  id: SearchIndicatorInEvents
+  version: -1
+name: SearchIndicatorInEvents
+script: ''
+type: python
+tags:
+  - Utilities
+comment: Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+enabled: true
+args:
+  - name: indicator
+    required: true
+    description: The indicator value (e.g., IP address, domain, hash) to search for in the selected dataset logs.
+  - name: time_frame
+    required: true
+    defaultValue: 7 days
+    description: The time range to search within, specified in days (e.g., "7 days" means searching the past 7 days of data).
+  - name: data_set
+    defaultValue: xdr_data
+    description: The name of the dataset to search in. If not specified, the search defaults to the "xdr_data" dataset.
+  - name: query_name
+    required: true
+    description: A user-defined name. The query results will appear under the query_name in the context data of the current war room.
+  - name: query_id
+    hidden: true
+    description: Internal Id of the query, hidden from inserting manually.
+  - name: interval_in_seconds
+    defaultValue: '30'
+    description: The interval, in seconds, between checking the status of the query while waiting for the query to complete.
+  - name: timeout_in_seconds
+    defaultValue: '600'
+    description: The maximum time, in seconds, to wait for the query to finish before the command is forced to fail.
path: Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.yml
user: login: julieschwartz18
body: The maximum time to wait for the query to finish (in seconds). The command fails if the query takes longer.
created_at: 2025-05-13T06:30:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,48 @@
+commonfields:
+  id: SearchIndicatorInEvents
+  version: -1
+name: SearchIndicatorInEvents
+script: ''
+type: python
+tags:
+  - Utilities
+comment: Searches for a specific indicator in the tenant's events and logs data and extract the logs which the indicator appears in.
+enabled: true
+args:
+  - name: indicator
+    required: true
+    description: The indicator value (e.g., IP address, domain, hash) to search for in the selected dataset logs.
+  - name: time_frame
+    required: true
+    defaultValue: 7 days
+    description: The time range to search within, specified in days (e.g., "7 days" means searching the past 7 days of data).
+  - name: data_set
+    defaultValue: xdr_data
+    description: The name of the dataset to search in. If not specified, the search defaults to the "xdr_data" dataset.
+  - name: query_name
+    required: true
+    description: A user-defined name. The query results will appear under the query_name in the context data of the current war room.
+  - name: query_id
+    hidden: true
+    description: Internal Id of the query, hidden from inserting manually.
+  - name: interval_in_seconds
+    defaultValue: '30'
+    description: The interval, in seconds, between checking the status of the query while waiting for the query to complete.
+  - name: timeout_in_seconds
+    defaultValue: '600'
+    description: The maximum time, in seconds, to wait for the query to finish before the command is forced to fail.
+outputs:
+  - contextPath: PaloAltoNetworksXQL
+    description: A list of event records (constructed as dictionaries) where the specified indicator was found during the search.
path: Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.yml
user: login: julieschwartz18
body: A list of event records (constructed as dictionaries) where the specified indicator was found.
created_at: 2025-05-13T06:31:24Z
author_association: CONTRIBUTOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-04-29T14:21:24Z
body: <!-- Pytest Coverage Comment: pre-commit -->
<a href="https://github.com/demisto/content/blob/a5dedac1ebecdf66844268855b79a5db63d69fc7/README.md"><img alt="Coverage" src="https://img.shields.io/badge/Coverage-93%25-brightgreen.svg" /></a><details><summary>Coverage Report </summary><table><tr><th>File</th><th>Stmts</th><th>Miss</th><th>Cover</th><th>Missing</th></tr><tbody><tr><td colspan="5"><b>Packs/Core/Scripts/SearchIndicatorInEvents</b></td></tr><tr><td>&nbsp; &nbsp;<a href="https://github.com/demisto/content/blob/a5dedac1ebecdf66844268855b79a5db63d69fc7/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.py">SearchIndicatorInEvents.py</a></td><td>43</td><td>3</td><td>93%</td><td><a href="https://github.com/demisto/content/blob/a5dedac1ebecdf66844268855b79a5db63d69fc7/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.py#L15">15</a>, <a href="https://github.com/demisto/content/blob/a5dedac1ebecdf66844268855b79a5db63d69fc7/Packs/Core/Scripts/SearchIndicatorInEvents/SearchIndicatorInEvents.py#L31-L32">31&ndash;32</a></td></tr><tr><td><b>TOTAL</b></td><td><b>43</b></td><td><b>3</b></td><td><b>93%</b></td><td>&nbsp;</td></tr></tbody></table></details>

| Tests | Skipped | Failures | Errors | Time |
| ----- | ------- | -------- | -------- | ------------------ |
| 2 | 0 :zzz: | 0 :x: | 0 :fire: | 3.493s :stopwatch: |

author_association: NONE
user: login: content-bot
created_at: 2025-05-06T07:55:07Z
body: ### This PR was automatically updated by a [GitHub Action](https://github.com/demisto/content/actions/runs/14854412222)
- **Core** pack version was bumped to **3.3.0**.

To stop automatic version bumps, add the `ignore-auto-bump-version` label to the github PR.

author_association: CONTRIBUTOR
user: login: julieschwartz18
created_at: 2025-05-13T06:32:00Z
body: Doc review complete. Please review the recommended edits.
author_association: CONTRIBUTOR
user: login: julieschwartz18
created_at: 2025-05-13T06:32:32Z
body: In the meantime, I added the label docs-approved.
author_association: CONTRIBUTOR
user: login: content-bot
created_at: 2025-05-13T08:50:57Z
body: Validate summary

Verdict: PR can be force merged from validate perspective? ✅
author_association: CONTRIBUTOR