Action results are viewable from an action context details, or case wall by clicking on the action block/entry and observing its results.

URL Links

Add a clickable link to the action result under a specific title (Usually the entity’s identifier).
Here’s an example of a link added to the action result:

A common usage for this function is to display a link to a sandbox report or to an external service, where the analyst can watch a full report (Like VirusTotal or Cuckoo). However, you can also use this function to trigger a get request on one of your services, forcing the analyst to use specific parameters.

Related Methods: ScriptResult.add_link

Data Tables

You can add a table display to the action result. This table, in turn, can be exported into a CSV that is downloaded to the local machine of the user.
Here’s how it looks in Siemplify:

To expand the result, simply click on the square with the arrow on the top right corner of table view. This pop-up will appear:

You can export this table to a CSV from this pop-up

Related Methods: ScriptResult.add_data_table

JSON Results

You can add a JSON result, and view it in the system A common use for this function is displaying return values from API calls. Most third party integrations (and Siemplify’s API) return a JSON object when called.

Here’s an example for a JSON viewer in Siemplify (As an action result)

To expand the result, simply click on the square with the arrow on the top right corner of table view. This pop-up will appear:

Related Methods: ScriptResult.add_json

Attachments

You can add an attachment to the Action Result. The attachment will be displayed like an attached link or a table. Below is an image with example:

Here we have two HTML reports, one for each IP address. Clicking the link will download the HTML report to the local system of the user.


Related Methods: ScriptResult.add_attachment