Custom scripts and the Marketplace

Custom Scripts let your org write and share detection logic, API connectors, WMI queries, and webhook filters.

Script types:
• Detection Rule — YAML-based rule that evaluates incoming events and fires an alert
• API Connector — JSON config for polling an external API as an event source
• WMI Query — WQL query deployed to the WMI Agent on Windows hosts
• Webhook Filter — JavaScript expression to filter or transform inbound webhook payloads

Creating a script:
1. Security → Integrations → Custom Scripts → + New Script
2. Choose a type, name it, paste or write the script body
3. Click Save — the script runs privately for your org only

Each type has a starter template pre-filled in the editor. Your scripts are listed in the Custom Scripts section with their type, status, and creation date.

Publishing to the community Marketplace:
1. From Custom Scripts, click Publish next to a draft script
2. The script status changes to Pending Review
3. Turtini reviews the submission — approved scripts appear in the Marketplace tab for all orgs

Installing from the Marketplace:
1. Security → Integrations → Marketplace
2. Browse approved community scripts — sorted by install count
3. Click Install to copy the script into your org
4. Each install increments the community download counter

Published scripts show their install count. Once approved, a script is permanently public and discoverable by any Turtini org.