Integrations and Automation Scripts in Cortex XSOAR are stored in YAML files that include all the required information (metadata, code, images, etc.). This is what we call the Unified YAML file.
To better handle them in the Content repository, Python/Powershell Automation Scripts and Integrations are stored with a Directory Structure, where the YAML files only contains the metadata, while code and artifacts live in separate files.
This is requirement, among others, for running linting and unit testing of the code.
When an Integration or Automation Script is exported from Cortex XSOAR using
demisto-sdk download, the Unified YAML is automatically split in its components.
When an Integration or Automation Script is imported into Cortex XSOAR using
demisto-sdk upload, the Integration/Automation directory files are automatically assembled in the Unified YAML file that gets uploaded.
As a content developer, most of the times you don't need to worry about the Unified file, and just work with the Directory Structure.
Directory Structure is as follows:
For example, the integration Palo Alto Networks Cortex XDR is stored under Integrations directory in a sub-directory named
PaloAltoNetworks_XDR and contain the following files:
Split a YML file to Directory Structure
If you need to split a Unified YAML file (exported via the Cortex XSOAR UI) into the Directory Structure you can use the following options:
demisto-sdk split-yml: This command will also format the code (using autopep8) and setup the proper Pipenv files. See full command documentation here.
- Cortex XSOAR IntelliJ Plugin
Generate a YML file from Directory Structure
If you need to manually create the Unified YAML file (for example to manually import it in Cortex XSOAR via the UI), you can either use: