Penfield

The penfield-get-assignee command takes in necessary context data, and returns the analyst that Penfield believes the incident should be assigned to based on Penfield's models of skill and process. The test command verfies that the endpoint is reachable.

Case Management · PenfieldAI

Details

ID	`Penfield`
Provider	PenfieldAI
Category	Case Management
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

The penfield-get-assignee command takes in necessary context data, and returns the analyst that Penfield believes the incident should be assigned to based on Penfield’s models of skill and process. The test command verfies that the endpoint is reachable.
This integration was integrated and tested with version 0.1.4 of Penfield

Configure Penfield in Cortex

Parameter	Description	Required
Your server URL		True
API Key	The API Key to use for connection	True
Trust any certificate (not secure)	Trust any certificate (not secure).	False
Use system proxy settings	Use system proxy settings.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

penfield-get-assignee

Calls the Penfield API and returns the analyst Penfield recommends assigning the incident to. This information is saved in the output, but the incident will not be automatically assigned.

Base Command

penfield-get-assignee

Input

Argument Name	Description	Required
analyst_ids	An array of XSOAR analyst IDs for Penfield to choose from when determining who to assign to.	Required
category	The category of the incident to assign. Can be taken from incident Context Data.	Required
created	The creation_date of the incident to assign. Can be taken from incident Context Data.	Required
id	The id of the incident to assign. Can be taken from incident Context Data.	Required
name	The name of the incident to assign. Can be taken from incident Context Data.	Required
severity	The severity of the incident to assign. Can be taken from incident Context Data.	Required

Context Output

Parameter	Description
Penfield.Recommended	The analyst Penfield recommends assigning this incident too.

Command Example

!penfield-get-assignee analyst_ids=['analystid1', 'analystid2'] category='my cat' created='2021-09-13T01:58:22.621033322Z' id=34 name='big rootkit attack' severity='High'

Human Readable Output

peter

Configuration parameters

url — Your server URL (required)
apikey — API Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

penfield-get-assignee
Calls the Penfield API and returns the analyst Penfield recommends assigning the incident to. This information is saved in the output, but the incident will not be automatically assigned.

Source

Penfield.py Penfield_test.py Penfield.yml Penfield_description.md command_examples.txt

Download History Raw

category: Case Management
provider: PenfieldAI
commonfields:
  id: Penfield
  version: -1
configuration:
- defaultvalue: https://example.com/
  display: Your server URL
  name: url
  required: true
  type: 0
- display: API Key
  additionalinfo: The API Key to use for connection
  name: apikey
  required: true
  type: 4
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: "The penfield-get-assignee command takes in necessary context data, and returns the analyst that Penfield believes the incident should be assigned to based on Penfield's models of skill and process. The test command verfies that the endpoint is reachable."
display: 'Penfield'
name: Penfield
script:
  commands:
  - name: penfield-get-assignee
    description: 'Calls the Penfield API and returns the analyst Penfield recommends assigning the incident to. This information is saved in the output, but the incident will not be automatically assigned.'
    outputs:
    - contextPath: Penfield.Recommended.Analyst
      description: The XSOAR analyst Penfield recommends assigning the incident to.
      type: String
    arguments:
    - name: analyst_ids
      description: 'An array of XSOAR analyst IDs for Penfield to choose from when determining who to assign to.'
      required: true
      isArray: true
    - name: category
      required: true
      description: 'The category of the incident to assign. Can be taken from incident Context Data.'
    - name: created
      required: true
      description: 'The creation_date of the incident to assign. Can be taken from incident Context Data.'
    - name: id
      required: true
      description: 'The id of the incident to assign. Can be taken from incident Context Data.'
    - name: name
      required: true
      description: 'The name of the incident to assign. Can be taken from incident Context Data.'
    - name: severity
      required: true
      description: 'The severity of the incident to assign. Can be taken from incident Context Data.'
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.0.0
tests:
- No tests (auto formatted)