demisto-sdk

What it is and what it does

Demisto SDK is a Python library and CLI tool for developing and managing integrations and content packs within the Cortex XSOAR and Cortex XSIAM security orchestration platforms. It provides commands to initialize, validate, format, and upload content; generate documentation and test playbooks; and interact with XSOAR/XSIAM servers via API. The tool is designed to work with content repositories structured like the official Cortex content repository and includes code generators for OpenAPI and Postman specifications.

The SDK supports a large surface of development workflows: entity validation, secret scanning, pre-commit hooks, content preparation, splitting and formatting YAML files, running playbooks and commands on remote servers, downloading existing content, and generating integration code from API specifications. It requires environment variables to connect to an XSOAR or XSIAM instance and runs best from within a git repository or when the content path is explicitly configured.

Use it for:

• Validate integration and playbook YAML files before uploading to Cortex XSOAR or XSIAM.
• Generate integration code from OpenAPI or Postman API specifications to accelerate integration development.
• Upload and download integrations, playbooks, and other content entities between your development environment and a live XSOAR/XSIAM instance.
• Run pre-commit hooks and secret scanning to catch issues early in the development workflow.
• Generate test playbooks and documentation automatically from integration definitions.
• Set up and manage environment configuration for multi-instance XSOAR/XSIAM deployments.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A command-line SDK and Python library for developing, validating, and deploying integrations and content packs to Cortex XSOAR and Cortex XSIAM platforms.

Yes, if you are developing integrations or content packs for Cortex XSOAR or Cortex XSIAM. The SDK is actively maintained, has no known vulnerabilities, uses a permissive MIT license, and provides a comprehensive CLI and Python API for the full development lifecycle. Install only on Unix-like systems (Linux, macOS, or WSL2); Windows is not supported. The large dependency tree (67 runtime packages) is typical for a mature development tool and should not be a blocker.

Install

demisto-sdk on PyPI

pip install demisto-sdk

uv add demisto-sdk

poetry add demisto-sdk

Installing demisto-sdk

Before you install

Low friction installation as a pure Python wheel. Active maintenance with a recent release. Requires Python 3.10–3.14, git, and a Unix-like environment (Linux, macOS, or WSL2); Windows is not supported directly.

License in practice

MIT license permits commercial and private use with minimal restrictions, making it suitable for both open-source and proprietary development workflows.

Quickstart

pip3 install demisto-sdk
demisto-sdk -h
# Set environment variables for XSOAR/XSIAM connection:
export DEMISTO_BASE_URL=<server-url>
export DEMISTO_API_KEY=<api-key>
demisto-sdk validate

Requires Python 3.10–3.14, git, and a Unix-like environment (Linux, macOS, or WSL2); Windows is not supported. Some commands require Node.js and npm for markdown validation.

Verify before relying

• Whether the 67 runtime dependencies introduce significant supply-chain risk or maintenance burden for end users.
• Performance characteristics when validating large content packs or running integration tests.
• Availability and quality of documentation for each of the 21 supported commands.

Package facts

Evidence: demisto_sdk-1.39.6-py3-none-any.whl

Tags

More Build Tools packages