Penfield

The penfield-get-assignee command takes in necessary context data, and returns the analyst that Penfield believes the incident should be assigned to based on Penfield's models of skill and process. The test command verfies that the endpoint is reachable.

Case Management · PenfieldAI

Details

ID	`Penfield`
Provider	PenfieldAI
Category	Case Management
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

The penfield-get-assignee command takes in necessary context data, and returns the analyst that Penfield believes the incident should be assigned to based on Penfield’s models of skill and process. The test command verfies that the endpoint is reachable.
This integration was integrated and tested with version 0.1.4 of Penfield

Configure Penfield in Cortex

Parameter	Description	Required
Your server URL		True
API Key	The API Key to use for connection	True
Trust any certificate (not secure)	Trust any certificate (not secure).	False
Use system proxy settings	Use system proxy settings.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

penfield-get-assignee

Calls the Penfield API and returns the analyst Penfield recommends assigning the incident to. This information is saved in the output, but the incident will not be automatically assigned.

Base Command

penfield-get-assignee

Input

Argument Name	Description	Required
analyst_ids	An array of XSOAR analyst IDs for Penfield to choose from when determining who to assign to.	Required
category	The category of the incident to assign. Can be taken from incident Context Data.	Required
created	The creation_date of the incident to assign. Can be taken from incident Context Data.	Required
id	The id of the incident to assign. Can be taken from incident Context Data.	Required
name	The name of the incident to assign. Can be taken from incident Context Data.	Required
severity	The severity of the incident to assign. Can be taken from incident Context Data.	Required

Context Output

Parameter	Description
Penfield.Recommended	The analyst Penfield recommends assigning this incident too.

Command Example

!penfield-get-assignee analyst_ids=['analystid1', 'analystid2'] category='my cat' created='2021-09-13T01:58:22.621033322Z' id=34 name='big rootkit attack' severity='High'

Human Readable Output

peter

Configuration parameters

url — Your server URL (required)
apikey — API Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

penfield-get-assignee
Calls the Penfield API and returns the analyst Penfield recommends assigning the incident to. This information is saved in the output, but the incident will not be automatically assigned.

Source

Penfield.py Penfield_test.py Penfield.yml Penfield_description.md command_examples.txt

Download History Raw

import traceback

import demistomock as demisto  # noqa: F401
import urllib3
from CommonServerPython import *  # noqa: F401

from CommonServerUserPython import *  # noqa

# Disable insecure warnings
urllib3.disable_warnings()

""" CLIENT CLASS """


class Client(BaseClient):
    def live_assign_get(self, analyst_ids, category, created, arg_id, name, severity) -> str:
        params = assign_params(
            analyst_ids=analyst_ids, category=category, created=created, id=arg_id, name=name, severity=severity
        )
        response = self._http_request(method="POST", url_suffix="/api/v1/xsoar_live_assign/", params=params)
        return response["analyst"]

    def test(self) -> str:
        response = self._http_request(method="GET", url_suffix="/api/v1/xsoar_live_assign/")
        return response


""" HELPER FUNCTIONS """


def get_assignee(client: Client, args) -> CommandResults:
    analyst_ids = argToList(args.get("analyst_ids"))
    category = args.get("category")
    created = args.get("created")
    arg_id = args.get("id")
    name = args.get("name")
    severity = args.get("severity")
    analyst = client.live_assign_get(analyst_ids, category, created, arg_id, name, severity)
    human_readable = tableToMarkdown(
        "Analyst Penfield Recommends", analyst, headers=["Recommendation"], headerTransform=pascalToSpace, removeNull=True
    )
    return CommandResults(
        readable_output=human_readable, outputs_prefix="Penfield.Recommended", outputs_key_field="Analyst", outputs=analyst
    )


def test_api(client: Client):
    return client.test()


""" MAIN FUNCTION """


def main() -> None:
    api_key = demisto.params().get("apikey")
    base_url = urljoin(demisto.params()["url"], "")
    verify_certificate = not demisto.params().get("insecure", False)
    proxy = demisto.params().get("proxy", False)

    demisto.debug(f"Command being called is {demisto.command()}")
    try:
        headers = {"Authorization": f"Bearer {api_key}"}
        client = Client(base_url=base_url, verify=verify_certificate, headers=headers, proxy=proxy)

        if demisto.command() == "test-module":
            result = test_api(client)
            if int(result) == 0:
                return_results("ok")
            else:
                raise RuntimeError("Penfield API cannot be reached")

        elif demisto.command() == "penfield-get-assignee":
            result = get_assignee(client, demisto.args())
            return_results(result)

    # Log exceptions and return errors
    except Exception as e:
        demisto.error(traceback.format_exc())  # print the traceback
        return_error(f"Failed to execute {demisto.command()} command.\nError:\n{e!s}")


""" ENTRY POINT """

if __name__ in ("__main__", "__builtin__", "builtins"):
    main()