Utility Custom Command

Last Updated: October 26, 2026

Overview

A utility custom command is a utility command you build yourself, for data processing that no built-in utility command covers. You can implement it in Python or as a Codeless Playbook. This article shows how to create each kind and how to clone an existing command, and then builds a small Python command step by step. For the parts of a command's page, testing and submitting, see Utility Commands. For the difference between the command types and statuses, see Custom Command Overview.

Creating a Utility Custom Command

You can generate the command with AI, or build it yourself.

Generating with AI

Morpheus, D3's AI assistant, can write the command for you, in Python or as a codeless playbook, from a description and a sample input.

1. Go to Configuration > Utility Commands and select the + button beside Search Utility Commands.

2. Enter a Command Display Name. The Command Internal Name is generated from it. Choose a Command Category, or leave it Uncategorized.

3. Keep Implementation set to Python.

4. Under What should this command do?, say what the command should compute and what a later task should be able to use from its result. Start from (Reshape, Extract or Score) fills in an example description to start from.

5. Under Sample input, paste one example input, or select Attach a file. Its top-level keys become the command's parameters.

6. Select Generate with AI. Morpheus shows its progress; this takes a few minutes, and Stop generating stops it.

7. Check the command schema Morpheus proposes: the brief, the description, the INPUTS, the OUTPUTS and any Assumptions. Then select Add as command.

The generated command

For a Codeless Playbook command, set Implementation to Codeless Playbook before you describe it. Start from then offers Enrich, Contain and Notify, and the window also asks for the Site (required), Global lists and Connected integrations. The command opens in the playbook editor with the generated tasks.

The generated codeless playbook

Building It Manually

To build the command yourself instead:

1. Go to Configuration > Utility Commands.

2. Select the + button beside Search Utility Commands.

3. In the Add Command window, open the Implementation list. It offers two options: Python and Codeless Playbook.

The implementation options

The implementation cannot be changed after the command is created.

Python

1. Enter a Command Display Name. The Command Internal Name is generated from it and becomes the name of the command's Python function.

2. Choose a Command Category, or leave it Uncategorized.

3. Keep Implementation set to Python.

4. Select Add Command.

The Add Command window for a Python command

A new Python command

Codeless Playbook

1. Enter a Command Display Name and choose a Command Category.

2. Set Implementation to Codeless Playbook. The window then also asks for a Site (required), and optionally Global lists and Connected integrations. These set what the AI assistant may use when it drafts the command from your description; they do not limit where the command runs.

3. Select Add Command.

Adding a codeless playbook command

The codeless playbook editor

Cloning a Utility Custom Command

Clone a command to start a new one from a copy of it.

1. Open the command to clone.

2. Select the More button (⋯) in the header.

3. Select Clone Command.

Clone Command in the More menu

A cloned command

Step by Step: Building a Python Command

This example builds a small Python command. The command takes a JSON array of objects and replaces the spaces in each object's top-level keys with underscores, so that "Host Name" becomes "Host_Name". Along the way it shows how to write the code, add an input parameter and test the command.

The screenshots use a command named CT22522 B5 Demo Replace Spaces in JSON Keys. Use any name you like, for example Replace Spaces in JSON Keys.

Step 1: Add the Command

Create a Python command as described in Python above, with your chosen Command Display Name.

Step 2: Write the Code

1. Replace the contents of the code editor with the code below. Keep the function name from your own editor (the name after def); it must match the command's internal name.

2. Select Save above the code editor.

def ReplaceSpacesInJSONKeys(*args):
    """Replaces spaces with underscores in the top-level keys of the JSON objects in a JSON array."""
    modified_array = []
    json_array = args[0]
    resultData = "Successful"
    returnData = ""
    error = ""
    try:
        for item in json_array:
            modified_item = {}
            for key, value in item.items():
                modified_item[key.replace(" ", "_")] = value
            modified_array.append(modified_item)
        returnData = modified_array
    except Exception as e:
        error = str(e)
        resultData = "Failed"
    return pb.returnOutputModel(resultData, returnData, "", "", "", error)

The function reads the first input parameter (args[0]), builds a new array with the renamed keys, and returns it as the command's return data with pb.returnOutputModel.

The code in the editor

Step 3: Add the Input Parameter

1. On the Overview tab, open Inputs.

2. Select New Input Parameter.

3. Fill in the New Parameter window:

   • Parameter Name: inputJsonArray

   • Display Name: Input JSON Array

   • Parameter Type: JSON Array

   • Is Required?: Yes

   • Description: A JSON array of objects. Spaces in the top-level keys are replaced with underscores.

   • Sample Data: the JSON array below

4. Select Add.

[
    {"Host Name": "web-01", "Risk Score": 72, "Last Seen": "2026-10-20"},
    {"Host Name": "db-02", "Risk Score": 35, "Last Seen": "2026-10-21"}
]

The New Parameter window

The new input parameter

Step 4: Test the Command

1. Select the Test tab.

2. Choose the SITE to test on.

3. Under COMMAND INPUT, paste the sample JSON array into Input JSON Array.

4. Select Test Command.

The Test tab

The Return Data tab

Next Steps

The command is still a Draft. To make it available to playbooks, submit it, and switch on where it can be used under FEATURES on its Settings tab. See Utility Commands.