‎Introduction to Utility Commands‎

1. Data Manipulations: Handles simple data processing on the following data types:
   ARRAY
   EXAMPLE
   - Add Text to Empty Array
   BOOLEAN
   EXAMPLE
   - Is False
   DATETIME
   EXAMPLE
   - Get Current UTC Time
   HTML
   EXAMPLE
   - Strip Tags
   JSON OBJECT
   EXAMPLE
   - Convert JSON Array to HTML Table
   NUMBER
   EXAMPLE
   - Get Maximum Number
   TEXT
   EXAMPLE
   - Ends with

2. Agent: Manages agent-related operations.
   EXAMPLE
   - Get Agent Details

3. AI: Executes artificial intelligence-related operations.

   EXAMPLE
   - Set Al Investigation Detail

4. Artifact: Handles artifact-related operations.

   EXAMPLE
   - Get Related Incidents by Artifact

5. Automation Rule: Performs automation rule-related operations.

   EXAMPLE
   - Sync Event Automation Rule

6. Case: Supports case management.

   EXAMPLE
   - Remove Case Attachment

7. Communication: Facilitates interaction with external systems or services.

   EXAMPLE
   - Send Email

8. Connection: Manages connections.

   EXAMPLE
   - Sync Connection

9. Data Ingestion: Handles data ingestion-related operations.

   EXAMPLE
   - Create Incident With Conditions

10. Domain: Performs domain-related operations.

    EXAMPLE
    - Get from URLs

11. Dynamic Form: Performs dynamic form-related operations.

    EXAMPLE
    - Set Incident Dynamic Field Values

12. Email: Manages email-based operations.

    EXAMPLE
    - Extract Basic Information from Email File

13. Event: Performs event-related operations.

    EXAMPLE
    - Get Events

14. File: Handles file-related operations.

    EXAMPLE
    - Encrypt File with Password Protection

15. Global List: Performs global list-related operations.

    EXAMPLE
    - Check Value Exists in Global List

16. Hash: Performs hash-related operations.

    EXAMPLE
    - Extract Hashes from Array of JSON Objects

17. Hostname: Performs hostname-related operations.

    EXAMPLE
    - Get Hostname for IP Addresses

18. IOC: Performs operations related to indicators of compromise.

    EXAMPLE
    - Extract IOCs

19. IP: Performs IP-related operations.

    EXAMPLE
    - Get IP Addresses Reputation

20. Local Shared Data: Performs operations involving locally shared data.

    EXAMPLE
    - Add Root Key for Local Shared Data

21. Logging: Performs logging-related operations.

    EXAMPLE
    - Get D3 Log

22. Metrics: Performs metrics-related operations.

    EXAMPLE
    - Get D3 Application Metrics

23. MITRE: Performs operations related to MITRE frameworks to analyze and map threats or tactics.

    EXAMPLE
    - Update Mitre Tactics and Techniques

24. Multitenancy: Performs operations related to multi-tenancy.

    EXAMPLE
    - Sync Global List

25. Playbook: Performs playbook-related operations.

    EXAMPLE
    - Delay

26. Reporting: Performs reporting-related operations.

    EXAMPLE
    - Generate Incident Summary Report

27. Site: Performs site-related operations.

    EXAMPLE
    - Create Site

28. SLA: Performs service level agreement-related operations.

    EXAMPLE
    - Pause SLA

29. System Counter: Performs system counter-related operations.

    EXAMPLE
    - Set System Counter

30. Tactics & Techniques: Performs tactics and techniques-related operations.

    EXAMPLE
    - Add Tactics & Techniques to Incident

31. Trigger Output Data: Performs trigger output data-related operations.

    EXAMPLE
    - Add Fields in Trigger Output Data

32. Uncategorized Folder: Performs miscellaneous operations.

33. URL: Performs URL-related operations.

    EXAMPLE
    - Get URLs Reputation

34. User: Performs user-related operations.

    EXAMPLE
    - Get All Users with Specific Role

35. Widget: Performs widget-related operations.

    EXAMPLE
    - Get Reporting Widget

Search Panel (Left)

• Search Utility Commands: Users can enter keywords into the search bar, or select from the categories, to locate specific commands.

• Add New Command: The + button allows users to create or configure new utility commands.

• Custom Categories: Users can add, edit and delete custom utility command categories.
  Adding

  

  

  

  Editing

  

  

  Deleting

  

  

  

Results Panel (Right)

• Utility Command Cards: Displays a grid of commands based on the current search or filter selection. Each card contains the utility command’s name, description, and its implementation type.

• Sort Commands: Users can sort the displayed commands based on:

  • Type (Built-In or Custom)

  • Tags

  • Featured

  • Most Used

  • Last Modified Time (Latest or Oldest first)

  • Alphabetical name order (A-Z or Z-A)

• Pagination: Navigates through multiple pages of results.

Command Details Panel (Left)

• Command Name and Description: Basic command information.

• Implementation Type: System, Python or Codeless Playbook.

• Command Category: See Categories and Examples of Utility Commands.

• Tags: Labels that give a general sense of the topics or areas to which commands are related, and that enable filtering in the results panel.

• Role Access: Whether to restrict this command for the exclusive use of privileged users.

• Command Application Scope: Where this command will be available for use.

Command Editor Panel (Right)

• Command Code Editor: The place to write or modify the command logic using Python.

• Save and Undo Buttons:

  • Save: Saves the code changes for this draft.

  • Undo Changes: Reverts the command editor to its state before the previous action.

By default, commands are not enabled for any scope. They must be explicitly assigned to one or more of the following application contexts:

Command Task (Preprocessing and Investigation Playbooks)

Conditional Task (Preprocessing and Investigation Playbooks)

Transform Command: This feature was designed for earlier versions of the D3 vSOC platform, and has been deprecated since version 14. Data transformations are now primarily handled by the Data Formatter task. The Transform Command UI components are subject to removal in future releases.

Ad-hoc Command (Incident Workspace)

Alert Reformatter (Schedule and Webhook Data Ingestion)