Skip to main content
Skip table of contents

Introduction to Utility Commands

LAST UPDATED: JULY 22, 2025

Utility Commands are used to manipulate system data. D3 offers hundreds of built-in utility commands to automate data manipulation, enrichment, and various system actions. These built-in utility commands are immediately available for use and cannot be modified. While only a portion is currently documented, documentation is actively being expanded.

UtilityCommands 1.png

Conversely, users have the ability to create and customize their own utility commands, allowing for greater control data processing and utility functions. The Utility Commands module features an editor interface that facilitates the creation of custom commands using either Codeless Playbook or Python implementations. Refer to Custom Command Overview for details.

Utility commands fall into three categories:

  1. Basic Utility: Handles simple data processing on the following data types: Text, Number, Boolean, DateTime, Text Array, Number Array, Boolean Array, DateTime Array, JSON Array, JSON Object, File, and File Array.

    Group 2 (5).png

    Examples of basic utility commands include:

    • Check if Text Exists in Text Array

    • Convert String to HTML Table

    • Extract Key/Value Pairs from JSON Object

    • Get Current UTC Time

    • Remove Special Characters from JSON Object Keys

  2. Cyber Utility: Focuses on cyber-specific data processing for enriching or extracting information from artifacts such as Email, Event, File, HostName, Port, and Process.

    Group 3 (4).png

    Examples of cyber utility commands include:

    • Check IP Subnet

    • Extract Artifacts From Excel File

    • Extract IOCs

    • Get Agent Details

    • Set Artifact Is Key Asset Field

  3. System Utility: Performs actions on system objects such as Incident, Context Data, Users, Global List, and SLA.

    Group 4 (7).png

    Examples of system utility commands include:

    • Add or Update Artifact Reputation

    • Dismiss

    • Get Excel File Content

    • Export Incident Report

    • Update Identical Event

The D3 platform also supports exporting and importing custom utility commands between different D3 SOAR environments. Refer to Exporting and Importing Utility Commands for details.

READER NOTE

For detailed information, refer to Utility Commands.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.