Build Your First SIERRA Invoker

SIERRA Invokers / Beginner Tutorial

Build your first Invoker

This tutorial is for people who do not want to learn the full Invoker schema first. You will copy two small files, load them into SIERRA, and run a working local tool from a graph node.

Start the tutorial Full reference guide

What an Invoker does

An Invoker is a bridge between the SIERRA graph and an outside tool. SIERRA sends text from a selected node to your script. Your script sends back structured results. SIERRA turns those results into new graph nodes.

Selected node

example.com

Python script

Builds first follow-up checks for that domain

Result nodes

WHOIS, DNS, subdomains, and example pivots

Step 1

Create one folder in Documents.

Step 2

Save one YAML file and one Python file.

Step 3

Point SIERRA at the YAML file.

Step 4

Select a graph node and run your new Invoker.

Create a folder for this Invoker

In your Documents folder, create a folder named sierra-first-invoker.

Keep this exact folder name for the first run. The YAML below uses that location so you do not have to copy a long file path.

Add the Python file

In the folder, create a file named first_domain_expander.py and paste this code into it.

python

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
import json
import re
import sys

domain = " ".join(sys.argv[1:]).strip()
domain = re.sub(r"^https?://", "", domain).split("/")[0].lower()

if not domain:
    print(json.dumps({
        "type": "Error",
        "message": "No domain was sent to the invoker."
    }))
    raise SystemExit(0)

print(json.dumps({
    "type": "Tree",
    "results": [
        f"# First Domain Result\n{domain}",
        f"WHOIS record for {domain}",
        f"DNS records for {domain}",
        f"Subdomains of {domain}",
        f"# Example pivots\nwww.{domain}\nmail.{domain}"
    ]
}))

Add the YAML file SIERRA will load

In the same folder, create a file named invoker.yaml and paste this configuration into it.

yaml

1
2
3
4
5
6
7
8
9
10
SCRIPTS:
  - Name: First Domain Expander
    Description: Expands a domain into simple follow-up investigation nodes.
    Params:
      - Name: Domain
        Description: Domain or hostname from the selected SIERRA node
        Type: STRING
        Options:
          - MANDATORY
    Command: cd "$HOME/Documents/sierra-first-invoker" && python3 first_domain_expander.py "{Domain}"

The command first moves into $HOME/Documents/sierra-first-invoker, then runs the Python file. If you put the folder somewhere else, change only that path.

Optional: test it before opening SIERRA

If you are comfortable opening Terminal, run these two lines. This confirms Python can run the script before SIERRA uses it.

bash

1
2
cd "$HOME/Documents/sierra-first-invoker"
python3 first_domain_expander.py "example.com"

You should see JSON that looks like this.

json

1
2
3
4
5
6
7
8
9
10
{
  "type": "Tree",
  "results": [
    "# First Domain Result\nexample.com",
    "WHOIS record for example.com",
    "DNS records for example.com",
    "Subdomains of example.com",
    "# Example pivots\nwww.example.com\nmail.example.com"
  ]
}

Load the YAML file in SIERRA

Open SIERRA, switch to the Invoker panel, click Select Invoker Config, and choose the invoker.yaml file you just created.

After loading it, SIERRA should show an Invoker named First Domain Expander.

SIERRA Invoker panel showing the Select Invoker Config button

Open the Invoker panel and choose Select Invoker Config.

SIERRA Invoker panel with First Domain Expander loaded

After loading invoker.yaml, First Domain Expander appears in the library.

Run it from a graph node

Create a graph node that says example.com. Right-click that node, open Suggested Invokers, and choose Run via First Domain Expander.

The suggestion appears because the node contains a domain and the Invoker parameter is named Domain.

SIERRA context menu showing Run via First Domain Expander

Right-click the domain node and run the suggested Invoker.

SIERRA graph after First Domain Expander creates result nodes

SIERRA creates new graph nodes from the JSON returned by Python.

Success Check

A successful Invoker creates graph output

The exact layout depends on your graph, but the important sign is that SIERRA receives a structured result and turns it into nodes instead of leaving the output as plain text.

Invoker results shown inside the SIERRA graph after a real First Domain Expander run

Captured from a real SIERRA run of this tutorial.

Common problems

SIERRA says it cannot find the Python file.

Keep the folder name exactly sierra-first-invoker inside Documents. If you put it somewhere else, edit the cd path in the YAML command.

The command works in Terminal but not in SIERRA.

Use python instead of python3, or use the full path to Python on your machine.

Suggested Invokers does not show this Invoker.

Make sure the SIERRA node says example.com, the parameter is named Domain, and the loaded Invoker is named First Domain Expander.

SIERRA shows a JSON or parsing error.

Do not add extra print lines to the script. For this first version, the script should print only the final JSON result.

After this works, use the full guide

This page intentionally avoids advanced topics. The full guide covers image inputs, streaming output, network-shaped results, approval prompts, and the LLM authoring prompt.

Read full guide Download SIERRA

Phantom Helix

In silence, patterns emerge.

OSINT tools for modern investigators and security professionals.

Product

SIERRA Helix Download Cloud Invoker Pricing Cloud Invoker Catalog Invoker Tutorial Documentation

Resources

Community Resources Live Invoker Catalog About the Founder Beginner Invoker Tutorial Invoker Guide Community Support

Legal

Made with ❤️ for the OSINT community