JSONSampleIncidentGenerator

Details

ID	`JSONSampleIncidentGenerator`
Provider	Open Source
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.14.12277297`
Supported Modules	Agentix Cloud Runtime Security XSIAM EDR Cortex Cloud

README

A utility for testing incident fetching with mock JSON data.

Configure JSON Sample Incident Generator in Cortex

Parameter	Required
Fetch incidents	False
Incident type	False
Incidents Fetch Interval	False
The raw JSON string to use as the sample data	True
The incident name to give to the created incident	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

json-sample-incident-generator-command

Read the provided JSON and return the results to the Context and Warroom. Can use key and value arg to change a JSON values if desired.

Base Command

json-sample-incident-generator-command

Input

Argument Name	Description	Required
key	The key to change. Must also set value arguement. Can be comma separated to change multiple values.	Optional
value	The new key value. Must also set key argument. Can be comma separated to support changing multiple values.	Optional

Context Output

There is no context output for this command.

Command Example

!json-sample-incident-generator-command key="somekey" value="somevalue"

Context Example

{
    "JSON": {
        "Sample": {
            "description": "something bad happened",
            "somekey": "somevalue",
            "type": "Malware"
        }
    }
}

Human Readable Output

Results

description somekey type

something bad happened somevalue Malware

description	somekey	type
something bad happened	somevalue	Malware

Configuration parameters

isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
JSON — The raw JSON string to use as the sample data (required)
name — The incident name to give to the created incident

Commands (1)

json-sample-incident-generator-command
Read the provided JSON and return the results to the Context and Warroom. Can use key and value arg to change a JSON values if desired.

Source

JSONSampleIncidentGenerator.py JSONSampleIncidentGenerator.yml JSONSampleIncidentGenerator_description.md command_examples.txt

Download History Raw

category: Utilities
provider: Open Source
commonfields:
  id: JSONSampleIncidentGenerator
  version: -1
sectionorder:
- Collect
configuration:
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: "1"
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: The raw JSON string to use as the sample data
  name: JSON
  required: true
  type: 12
  section: Collect
- display: The incident name to give to the created incident
  name: name
  type: 0
  required: false
  section: Collect
description: |-
  A utility for testing incident fetching with mock JSON data.
display: JSON Sample Incident Generator
name: JSONSampleIncidentGenerator
script:
  commands:
  - arguments:
    - description: The key to change.  Must also set value arguement.  Can be comma separated to change multiple values.
      name: key
    - description: The new key value. Must also set key argument. Can be comma separated to support changing multiple values.
      name: value
    description: Read the provided JSON and return the results to the Context and Warroom.  Can use key and value arg to change a JSON values if desired.
    name: json-sample-incident-generator-command
  dockerimage: demisto/python3:3.12.14.12277297
  isfetch: true
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)