Prerequisit : have the Utility Functions integration installed and configured Link to App Exchange Purpose : Enhance the standard shell access using a multi-select choice fo shell action ot the analyst Changes : New Rule Shell Commands actually limited to atifact type IP and DNS. It use a Shell Command activity fields (below) that allow the analyst to select the action they want to run at once. New Workflow CVE Lookup as duplicate of the Example: CVE Search with changes in post process scripts Rule: Workflow: Actually, the following commands are available : traceroute nslookup dig whois nmap It needs the app.config to be adapted like: # local shell_command default commands (unix) nslookup=nslookup "{{shell_param1}}" dig=dig "{{shell_param1}}" traceroute=traceroute -m 15 "{{shell_param1}}" whois=whois "{{shell_param1}}" nmap=nmap "{{shell_param1}}" and the requested packages to be installed on the integration server that will launch the shell. Here is my personal list, but check and verify it before using it! # Install for Shell action traceroute, whois, bind, nmap, nslookup wget http://mirror.centos.org/centos/7/os/x86_64/Packages/traceroute-2.0.22-2.el7.x86_64.rpm sudo rpm -Uvh traceroute-2.0.22-2.el7.x86_64.rpm wget http://mirror.centos.org/centos/7/os/x86_64/Packages/whois-5.1.1-2.el7.x86_64.rpm sudo rpm -Uvh whois-5.1.1-2.el7.x86_64.rpm sudo yum install bind-utils wget http://mirror.centos.org/centos/7/os/x86_64/Packages/libpcap-1.5.3-11.el7.x86_64.rpm sudo rpm -Uvh libpcap-1.5.3-11.el7.x86_64.rpm http://mirror.ghettoforge.org/distributions/gf/el/7/plus/x86_64/nmap-ncat-7.10-1.gf.el7.x86_64.rpm http://mirror.ghettoforge.org/distributions/gf/el/7/plus/x86_64//nmap-7.10-1.gf.el7.x86_64.rpm sudo rpm -Uvh nmap-ncat-7.10-1.gf.el7.x86_64.rpm sudo rpm -Uvh nmap-7.10-1.gf.el7.x86_64.rpm Note that I recommend a dedicated integration server in a DMZ for integrations facing internet like Shell, VirusTotal, Pipl etc... Results are visible in notes, and result status in artifact description: Attached is the res file to import this configuration. Feel free to use, change, adapt this code to your usage. Building the res file: resilient-circuits extract --workflow "shell" --rule "Shell Commands" -o config_SHELL.res --zip