JSONSampleIncidentGenerator

Details

ID	`JSONSampleIncidentGenerator`
Provider	Open Source
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.14.12277297`
Supported Modules	Agentix Cloud Runtime Security XSIAM EDR Cortex Cloud

README

A utility for testing incident fetching with mock JSON data.

Configure JSON Sample Incident Generator in Cortex

Parameter	Required
Fetch incidents	False
Incident type	False
Incidents Fetch Interval	False
The raw JSON string to use as the sample data	True
The incident name to give to the created incident	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

json-sample-incident-generator-command

Read the provided JSON and return the results to the Context and Warroom. Can use key and value arg to change a JSON values if desired.

Base Command

json-sample-incident-generator-command

Input

Argument Name	Description	Required
key	The key to change. Must also set value arguement. Can be comma separated to change multiple values.	Optional
value	The new key value. Must also set key argument. Can be comma separated to support changing multiple values.	Optional

Context Output

There is no context output for this command.

Command Example

!json-sample-incident-generator-command key="somekey" value="somevalue"

Context Example

{
    "JSON": {
        "Sample": {
            "description": "something bad happened",
            "somekey": "somevalue",
            "type": "Malware"
        }
    }
}

Human Readable Output

Results

description somekey type

something bad happened somevalue Malware

description	somekey	type
something bad happened	somevalue	Malware

Configuration parameters

isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
JSON — The raw JSON string to use as the sample data (required)
name — The incident name to give to the created incident

Commands (1)

json-sample-incident-generator-command
Read the provided JSON and return the results to the Context and Warroom. Can use key and value arg to change a JSON values if desired.

Source

JSONSampleIncidentGenerator.py JSONSampleIncidentGenerator.yml JSONSampleIncidentGenerator_description.md command_examples.txt

Download History Raw

import json
from datetime import datetime

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def main() -> None:
    integrationInstance = demisto.integrationInstance()
    demisto.debug(f"Command being called is {demisto.command()}")
    try:
        if demisto.command() == "test-module":
            return_results("ok")

        elif demisto.command() == "fetch-incidents":
            data = json.loads(demisto.params().get("JSON"))
            incident_name = demisto.params().get("name")
            if not incident_name:
                incident_name = f"Sample Incident - {integrationInstance}"

            incidents = []

            if isinstance(data, list):
                for i in data:
                    incident = {
                        "name": incident_name,
                        "details": json.dumps(i),
                        "occurred": datetime.now().isoformat().split("Z", 1)[0] + "Z",
                        "rawJSON": json.dumps(i),
                    }
                    incidents.append(incident)
            else:
                incident = {
                    "name": incident_name,
                    "details": json.dumps(data),
                    "occurred": datetime.now().isoformat().split("Z", 1)[0] + "Z",
                    "rawJSON": json.dumps(data),
                }
                incidents.append(incident)

            demisto.incidents(incidents)

        elif demisto.command() == "json-sample-incident-generator-command":
            key = demisto.args().get("key", None)
            value = demisto.args().get("value", None)

            data = json.loads(demisto.params()["JSON"])

            if key and value:
                if "," in key:
                    keys = key.split(",")
                    values = value.split(",")
                    for index, tmp_key in enumerate(keys):
                        data[tmp_key] = values[index]
                else:
                    data[key] = value

            command_results = CommandResults(outputs_prefix="JSON.Sample", outputs=data)
            return_results(command_results)

    # Log exceptions and return errors
    except Exception as e:
        demisto.error(traceback.format_exc())  # print the traceback
        return_error(f"Failed to execute {demisto.command()} command.\nError:\n{e!s}")


""" ENTRY POINT """
if __name__ in ("__main__", "__builtin__", "builtins"):
    main()