Last Updated: October 23, 2026
Overview
Utility commands are commands that work on data inside D3. They convert and check text, numbers, dates and JSON, enrich artifacts, and act on events, incidents, sites, users and other system objects. Playbooks run them as tasks.
Every utility command is either Built-in (it ships with D3) or Custom (built by your team). A command is implemented in Python, as a Codeless Playbook, or, for some built-in commands, as a System command.
Utility commands are found under Configuration > Utility Commands. This article explains how the commands are organised. For creating, testing and submitting a command, see Utility Commands and My First Custom Utility Command.
The Utility Commands Page
The page lists the commands as cards. Each card shows the command's name, its description and its implementation, for example Python.
-
Search Utility Commands finds a command by name.
-
The + button beside the search box creates a custom command.
-
The category list on the left narrows the cards: All Utility Commands, Built-in Categories, Custom Categories and Uncategorized. Each category shows how many commands it holds.
-
Type shows only Built-in or only Custom commands, and Tags filters by tag.
-
Export schema file is at the top right of the cards.
-
The page lists 50 commands at a time. Use the arrows at the bottom right to page through them.
The Utility Commands page
Sorting the Commands
The sort control (Featured by default) orders the cards by Featured, Most Used, Last modified time or Alphabetical.
The sort options
Categories
Built-in Categories groups the commands that ship with D3. Data Manipulation holds the commands that work on one kind of data (such as text, numbers, dates, arrays and JSON objects). The other built-in categories are grouped by area:
-
AI
-
Artifact & Threat Intelligence
-
Communication & Notifications
-
Data Ingestion
-
Event
-
Global Lists & Shared Data
-
Incident & Case Management
-
Monitoring & Reporting
-
Multitenancy
-
Playbook & Automation Framework
-
Site
-
User & Access Management
Uncategorized holds custom commands that have no category.
The built-in categories
Custom Categories
Custom categories group your team's own commands.
-
Select the + button beside Custom Categories.
-
Select New Category. (New Folder is also offered.)
-
Type the category name in the box that appears in the list, and press Enter.
Adding a custom category
The category is added under Custom Categories and opens, showing "No utility commands in this category" until a command is added to it.
To delete a custom category, point to it, select the ⋮ button on its row, select Delete Category, and then select Delete in the confirmation window.
Deleting a custom category
Where a Command Can Be Used
A command's Settings tab has a FEATURES section that sets where the command can be used. Each switch turns one use on or off:
-
Command Task: as a command task in a playbook. See Command Tasks.
-
Conditional Task: as a conditional task in a playbook. See Conditional Tasks.
-
Ad-hoc Command.
-
Event Formatter.
The same tab has ROLE ACCESS: switch on Privileged Command to limit who can set and use the command to roles with privileged-command settings. Below FEATURES, SCHEDULES lists the command's schedules. See Scheduling Commands.
The FEATURES section of a command
Learning More
-
Utility Commands: the command page, inputs and outputs, testing, submitting and exporting.
-
My First Custom Utility Command: build a custom command step by step.
-
Scheduling Commands: run a command on a schedule.