demisto/content

Health v2 · maintenance only

Adoption not part of the score

1304 stars · 1985 forks observed · 2026-09-03

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

The official content repository for Cortex XSOAR (formerly Demisto), a security orchestration, automation and response (SOAR) platform. It contains a large collection of community- and vendor-contributed playbooks, integrations, automation scripts, incident layouts, and report templates packaged as Content Packs.

Use cases

• automate incident response playbooks in a SOC
• integrate security products into a SOAR workflow
• find prebuilt playbooks for phishing or threat intel triage
• contribute a new integration pack for a security product
• enrich indicators from threat intelligence feeds
• push incidents from Splunk into XSOAR
• automate user provisioning with identity lifecycle management

When to choose

• you run Cortex XSOAR and want ready-made playbooks and integrations
• you are a security vendor building a certified pack for the XSOAR Marketplace
• you want community-maintained SOAR automation content to customize
• you need reference examples for writing XSOAR integrations and scripts

When to avoid

• you need a standalone SOAR engine - this repo is content, not the platform itself
• you use a different SOAR product like Splunk SOAR without porting effort
• you want a general-purpose workflow automation tool outside security operations

Facets

plugin · maturity active

security workflow-automation developer-tools security developer-tools python self-hosted cloud soar xsoar demisto playbooks content-packs incident-response security-orchestration integrations soc automation docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="demisto/content")