Utility Commands

Last Updated: October 26, 2026

Overview

Utility commands are commands that work on data inside D3: they transform text, numbers, dates and JSON, enrich artifacts, and act on events, incidents, sites, users and other system objects. Playbooks use them as tasks. D3 ships several hundred of them, and you can build your own in Python or as a codeless playbook.

Every utility command is either Built-in (it ships with D3) or Custom (built by your team). A command is implemented in Python, as a Codeless Playbook, or, for some built-in commands, as a System command.

Utility commands are found under Configuration > Utility Commands.

The Utility Commands Page

The page lists every utility command as a card with its name, description and implementation (for example Python or Codeless Playbook).

• Search Utility Commands finds a command by name.

• The + button beside the search box creates a command. See Creating a Utility Command below.

• The category list on the left narrows the cards to one category: All Utility Commands, Built-in Categories, Custom Categories or Uncategorized. Each category shows how many commands it holds.

• Type shows only Built-in or only Custom commands, and Tags filters by tag.

• Export schema file is at the top right of the cards.

• The page lists 50 commands at a time. Use the arrows at the bottom right to page through them.

The Utility Commands page

Sorting the Commands

The sort control (Featured by default) orders the cards by Featured, Most Used, Last modified time or Alphabetical.

The sort options

Categories

Built-in Categories groups the commands that ship with D3:

• Data Manipulation, by data type: Array, Boolean, Date/Time, HTML, JSON Object, Number, Text and Unknown.

• Categories by area: AI, Artifact & Threat Intelligence, Communication & Notifications, Data Ingestion, Event, Global Lists & Shared Data, Incident & Case Management, Monitoring & Reporting, Multitenancy, Playbook & Automation Framework, Site and User & Access Management.

Custom Categories holds the categories your team creates, and Uncategorized holds custom commands without a category.

The built-in categories

Custom Categories

Custom categories group your team's own commands.

1. Select the + button beside Custom Categories.

2. Select New Category. (New Folder is also offered.)

3. Type the category name in the box that appears in the list, and press Enter.

Adding a custom category

To delete a custom category, point to it, select the ⋮ button on its row, select Delete Category, and then select Delete in the confirmation window.

Deleting a custom category

Creating a Utility Command

You can generate a utility command with AI, or create it and write it yourself.

Generating with AI

Morpheus, D3's AI assistant, can write a utility command for you from a description and a sample input. It drafts the command's parameters, its return data and its code (or, for a codeless playbook command, its tasks).

1. Enter a Command Display Name. The Command Internal Name is generated from it. Choose a Command Category, or leave it Uncategorized.

2. Keep Implementation set to Python.

3. Under What should this command do?, say what the command should compute and what a later task should be able to use from its result. Start from (Reshape, Extract or Score) fills in an example description to start from.

4. Under Sample input, paste one example input, or select Attach a file. Its top-level keys become the command's parameters.

5. Select Generate with AI. Morpheus shows its progress; this takes a few minutes, and Stop generating stops it.

   Describing a utility command

   

6. Check the command schema Morpheus proposes: the brief, the description, the INPUTS, the OUTPUTS and any Assumptions. Then select Add as command.

   The generated command schema

   

For a Codeless Playbook command, the window also asks for a Site; see Utility Custom Command.

Building It Manually

To create the command yourself instead:

1. Select the + button beside Search Utility Commands.

2. Enter a Command Display Name. The Command Internal Name is generated from it and is used as the Python function name.

3. Choose a Command Category, or leave it Uncategorized.

4. Choose the Implementation: Python or Codeless Playbook.

5. Optionally, describe under What should this command do? what the command should compute, and paste or attach a Sample input. Its top-level keys become the command's parameters. You can also leave this empty and add the parameters by hand.

6. Select Add Command.

The Add Command window

For each implementation, and for a step-by-step example, see Utility Custom Command.

The Command Page

A command's page has the settings on the left and the code (Python) or the playbook editor (Codeless Playbook) on the right. The header shows the command's status, Draft or Live, and its actions.

A new command

The left side has two tabs, Overview and Test. Overview has four sub-tabs:

• Settings:

  • COMMAND NAME and COMMAND DESCRIPTION. Draft with AI writes a description for you.

  • WEBHOOK AUTHENTICATION (on live commands): switch on API Key & JWT to allow the command to be run from outside D3. See Running a Command Remotely below.

  • IMPLEMENTATION, which cannot be changed.

  • COMMAND CATEGORY and TAGS.

  • ROLE ACCESS: Privileged Command limits who can set and use the command to roles with privileged-command settings.

  • FEATURES: where the command can be used. See Where a Command Can Be Used below.

  • SCHEDULES: the command's schedules. See Schedules.

• Libraries.

• Inputs: the command's input parameters.

• Outputs: what the command returns.

The More menu (⋯) in the header has Clone Command, Delete Command and Command References.

The More menu

Where a Command Can Be Used

The FEATURES section of the Settings sub-tab sets where the command can be used. Each switch turns one use on or off:

• Command Task: as a command task in a playbook. See Command Tasks.

• Conditional Task: as a conditional task in a playbook. See Conditional Tasks.

• Ad-hoc Command.

• Event Formatter.

The FEATURES section of a command

Inputs

1. On the Inputs tab, select New Input Parameter.

2. Enter the Parameter Name used in the command and a Display Name.

3. Choose the Parameter Type, for example Text, Number or JSON Object, or an array type such as Text Array.

4. Set Is Required?, and the Parameter Index (its position among the inputs).

5. Choose the Input Type: Custom Input, Text Template, HTML Template, Drop Down Option or Multi Select Option.

6. Optionally, enter a Default Value, a Description and Sample Data.

7. Select Add.

The New Parameter window

Outputs

The Outputs tab has four tabs: Key Fields, Return Data, Context Data and Raw Data. On Key Fields, select Add Key Field to add a field.

The Outputs tab

Testing a Command

1. Open the command's Test tab.

2. Choose the Site to test on.

3. Select Test Command.

The Test tab

Submitting a Command

A new or edited command is a Draft until you submit it. Save Draft keeps your changes without submitting them.

1. Select Submit.

2. In the Submit Command window, add a Comment (optional).

3. Select Submit.

The Submit Command window

A live command

Running a Command Remotely

A live utility command can be run from another system through D3's webhook. On the command's Settings sub-tab, under WEBHOOK AUTHENTICATION, switch on API Key & JWT, then set up an API Key or a JSON Web Token (JWT). For the authentication steps and the request format, see the Webhook Configuration Guide.

Exporting a Command

Each submitted version of a command is kept in its version history.

1. On a live command, select the Version History button (the clock icon) in the header.

2. Find the version and select Export.

The Version History window

Each version in the window also has View and Restore.