Action Results
Action results are viewable from an action context details, or case wall by clicking on the action block/entry and observing its results.
URL Links
Add a clickable link to the action result
under a specific title (Usually the entity’s identifier).
Here’s
an example of a link added to the action result:
A common usage for this function is to display a link to a sandbox report or to an external service, where the analyst can watch a full report (Like VirusTotal or Cuckoo). However, you can also use this function to trigger a get request on one of your services, forcing the analyst to use specific parameters.
Related Methods: ScriptResult.add_link
Data Tables
You can add a table display to the action result. This table, in turn, can be
exported into a CSV that is downloaded to the local machine of the
user.
Here’s how it looks in Siemplify:
To expand the result, simply click on the square with the arrow on the top right corner of table view. This pop-up will appear:
You can export this table to a CSV from this pop-up
Related Methods: ScriptResult.add_data_table
JSON Results
You can add a JSON result, and view it in the system A common use for this function is displaying return values from API calls. Most third party integrations (and Siemplify’s API) return a JSON object when called.
Here’s an example for a JSON viewer in Siemplify (As an action result)
To expand the result, simply click on the square with the arrow on the top right corner of table view. This pop-up will appear:
Related Methods: ScriptResult.add_json
Attachments
You can add an attachment to the Action Result. The attachment will be
displayed like an attached link or a table. Below is an image with example:
Here we have two HTML reports, one for each IP address. Clicking the link will download the HTML report to the local system of the user.
Related Methods: ScriptResult.add_attachment