Breadcrumbs

Command Tasks

Last Updated: October 26, 2026

Command tasks refer to integration or utility commands, which can be D3-built or user-built (custom). Built-in and custom commands may be implemented through Python scripts or codeless playbooks.

Group 39.png

Integration Commands

These commands execute actions related to external systems or services, such as retrieving threat intelligence, managing cloud resources, or automating tasks in areas like analytics, SIEM/XDR operations, and identity management.

Choosing an Integration Command

In a Playbook

Tip: you can also generate this playbook with AI. See Generating with AI.

  1. Add a command task (point to the node it should follow, select +, then New Command Task), or select an existing command task to open its settings. See Playbook Tasks.

  2. Open the Command list. Commands are grouped by category, and integration commands show their integration in the name, for example Create List - Microsoft Lists (From v1.0).

    01-command-list.png

  3. Type in the search box to find the command by name. The Only connected integrations box is under the search box.

    The Command list filtered by the search Extract Domains from Text

  4. Select the command. Its description appears under it, with View Sample Data, and its input parameters are listed below. Type a fixed value, or switch on Dynamic to take the value from data that earlier tasks produced (see Dynamically Selecting Data).

    03-command-inputs.png

  5. Select the check mark at the top of the settings to save the task.

Integrations Page

To explore an integration's commands and run one outside a playbook:

  1. Select Configuration > Integrations, then search for and open the integration (see Integrations).

  2. Select a command.

  3. On its Test tab, choose a connection under CONNECTION, enter the input parameters, then select Test Command.

READER NOTE

On the incident-level, commands can be executed on-the-fly using the Execute Command button in the general information header panel.

Utility commands

These commands primarily support internal operations, including data manipulation, updating incident details, and generating reports, with occasional exceptions like facilitating email communications.

Choosing a Utility Command

In a Playbook

  1. Add a command task (point to the node it should follow, select +, then New Command Task), or select an existing command task to open its settings. See Playbook Tasks.

  2. Open the Command list. Commands are grouped by category, and utility commands are listed under their categories.

  3. Type in the search box to find the command by name. The Only connected integrations box is under the search box.

  4. Select the command. Its description appears under it, with View Sample Data, and its input parameters are listed below. Type a fixed value, or switch on Dynamic to take the value from data that earlier tasks produced (see Dynamically Selecting Data).

  5. Select the check mark at the top of the settings to save the task.

Utility Commands Page

To explore all utility commands and run one outside a playbook:

  1. Select Configuration > Utility Commands (see Utility Commands).

  2. Search for and select a command.

  3. On its Test tab, select a site, enter the input parameters, then select Test Command.

READER NOTE

On the incident-level, commands can be executed on-the-fly using the Execute Command button in the general information header panel.

Integration Command Examples

Checking the Reputation of a URL

check url.gif

Objective Set up and run a command task that checks the reputation of a URL.

  1. Add a command task to the On Playbook Start trigger. In its Command list, select Check URL Reputation from VirusTotal v3.

    check url rep.gif

  2. Name the task in Task Name.

    Group 9 (3).png

  3. Configure the task details, then save the task.

    Group 10 (1).png

    1. Enter a URL in text array format.
      For the demo, the data is hardcoded, but it should almost always be dynamically retrieved from a data source (e.g., an event or incident) using the Format Builder function.

    2. Select an existing connection to use or create a new one.

    3. Select the Auto Run checkbox.

    4. Select the check mark at the top of the settings to save the task.

  4. Select Test Playbook, then select Run Test in the Test Trigger window.

    Group 2 (1).png

RESULT

The Check URL Reputation command provides reputation data for a URL, enabling analysts to assess its safety and determine if blocking is necessary.

image 39 (4)-20250127-220208.png

check url.gif
Interacting with Slack Interactivity Elements

Frame 111 (3)-20250127-195833.png

See Send Interactivity examples.

Utility Command Examples

Sending an Email with Attachments

Group 21 (1).png

Objective Send an email from the vSOC platform, including any files attached to the incident as email attachments.

  1. Add a command task to the On Playbook Start trigger, and select the Send Email utility command in its Command list.

    drag_send_email.gif

  2. Name the task in Task Name.

    Group 15 (1).png

  3. Configure the task details, then save the task.

    Group 38.png

    1. Enter the recipient's email address.

    2. Enter the email subject.

    3. Enter the email body.

    4. Enter the CC recipient.

    5. Choose Incident Attachment File as the file source.

    6. Select the Dynamic toggle.

    7. Dynamically retrieve the value for the File ID. Refer to Dynamically Selecting Data for more information.

      {{ $.PlaybookData.DataSource.incident.File[*].FileId }}

    8. Select the Auto Run checkbox.
      For information about the Reply Mode and Reply Due Time parameters, refer to this documentation.

    9. Select the check mark at the top of the settings to save the task.

  4. Test the playbook.

    Group 13.png

    1. Select Test Playbook.

    2. Select a site.

    3. Select an incident.
      Testing the playbook on an incident will impact the incident. To avoid unintended effects, perform all testing involving the Test Playbook functionality in a demo instance of vSOC.

    4. Click on the Run Test button.

RESULT

The Send Email command task sends an email based on the specified task configurations, delivering it to the primary recipient and any CC or BCC recipients defined. Any files uploaded to the incident workspace are included as an attachment.

Group 21 (1).png
Retrieving Global List Metadata

Frame 183 (1)-20250127-201347.png

Objective Extract the description of a global list titled Demo Global List.

  1. Ensure Demo Global List is available for use in select sites.

    Frame 188 (1)-20250127-205228.png

  2. Connect a command task to the On Playbook Start trigger.

    Frame 184 (1)-20250127-201909.png

  3. Name the command task in Task Name.

    Frame 185 (4)-20250127-202132.png

  4. Select the Auto Run checkbox, then open the Command list.

    Frame 186 (1)-20250127-202409.png

  5. Select the Get Global List MetaData utility command.

    Frame 187 (1)-20250127-203126.png

  6. Specify the search type and global list name, then save the task.

    Frame 189 (1)-20250127-205712.png

  7. Select Test Playbook, then select Run Test in the Test Trigger window.

    Group 2 (1).png

  8. Select the status icon on the command task to open Playbook Task Details.

    Frame 191 (1)-20250127-210203.png

  9. Click on the Return Data tab to view the extracted description.

    Frame 192-20250127-210643.png

Mixed Command Use Example

Mixed Command Use Example - Generating a CSV File Using Domain IP Reputation Results

Group 30.png

Objective Create a CSV file that includes information about the IP reputation linked to domain names.

  1. Add a command task to the On Playbook Start trigger, and select the Get Ips by Domain Names utility command in its Command list.

    add IP.gif

  2. Name the task in Task Name.

    Group 22 (1).png

  3. Configure the task details, then save the task.

    Group 23.png

    1. Enter the domain names whose IPs will be retrieved, such as this compromised domain listed by NetAPI:

      [shopsabz.com]

      For the demo, the data is hardcoded, but it should almost always be dynamically retrieved from a data source (e.g., an event or incident) using the Format Builder function.

    2. Select the Auto Run checkbox.

    3. Select the check mark at the top of the settings to save the task.

  4. Repeat steps 1 and 2 to add the Get IP Reputation command task from the VirusTotal V3 integration to the previous task.

    Group 24 (1).png

  5. Configure the task details, then save the task.

    Group 25 (1).png

    1. Dynamically retrieve the value for the IPs, the output data of the previous task.

      {{PlaybookData | jsonpath('$.["Get IP by Domain"].outputData.IPAddresses')}}

    2. Select an existing connection to use or create a new one.

    3. Select the Auto Run checkbox.

    4. Select the check mark at the top of the settings to save the task.

  6. Repeat steps 1 and 2 to add the Convert HTML to JSON utility command task to the previous task.

    Group 26 (1).png

  7. Configure the task details, then save the task.

    Group 27 (1).png

    1. Click on the Dynamic toggle.

    2. Dynamically retrieve the value for the HTML Text, the result of the previous task.

      {{ $.PlaybookData.["Get IP Reputation"].result }}

    3. Select the True option.

    4. Select the Auto Run checkbox.

    5. Select the check mark at the top of the settings to save the task.

  8. Repeat steps 1 and 2 to add the Convert JSON Array to CSV utility command task to the previous task.

    Group 28.png

  9. Configure the task details, then save the task.

    Group 29.png

    1. Dynamically retrieve the value for the JSON Array to Convert the return data of the previous task.

      {{ $.PlaybookData.["Convert HTML Table to JSON"].returnData }}

    2. (Optional) Rename the file.

    3. Select the Auto Run checkbox.

    4. Select the check mark at the top of the settings to save the task.

  10. Select Test Playbook, then select Run Test in the Test Trigger window.

    Group 2 (1).png

RESULT

Users will be able to download the "result" CSV file by navigating to the playbook task details > Result tab, then clicking on the result.csv file.

mixedcommand.gif