XSOAR Storage

Details

ID	`XSOAR Storage`
Provider	Palo Alto Networks
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Facilitates the storage and retrieval of key/value pairs within XSOAR.

Configure XSOAR Storage in Cortex

Parameter	Required
Max Size of Store in bytes (Maximum of 1024000)	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

xsoar-store-list

List the keys available.

Base Command

xsoar-store-list

Input

Argument Name	Description	Required
namespace	The namespace to retrieve keys from.	Optional

Context Output

Path	Type	Description
XSOAR.Store	unknown	The namespace and keys.

Command Example


#### Human Readable Output

### xsoar-store-put

***
Places data in the store under the provided key.

#### Base Command

`xsoar-store-put`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| key | The key to store data under. | Required |
| data | The data to store. | Required |
| namespace | The namespace to store data in. | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

Human Readable Output

xsoar-store-get

Retrieve data stored in the provided key.

Base Command

xsoar-store-get

Input

Argument Name	Description	Required
key	The Key value.	Required
namespace	The namespace to retrieve data from.	Optional

Context Output

Path	Type	Description
XSOAR.Store	unknown

Command Example

``````

Human Readable Output

Configuration parameters

maxsize — Max Size of Store in bytes (Maximum of 1024000) (required)

Commands (3)

xsoar-store-get
Retrieve data stored in the provided key.
xsoar-store-list
List the keys available.
xsoar-store-put
Places data in the store under the provided key.

Source

XSOARStorage.py XSOARStorage.yml XSOARStorage_description.md

Download History Raw

import traceback
from typing import Any

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

SIZE_LIMIT = 1024000

MAX_SIZE = int(demisto.params().get("maxsize", SIZE_LIMIT))
MAX_SIZE = min(MAX_SIZE, SIZE_LIMIT)


def xsoar_store_list_command(args: dict[str, Any]) -> CommandResults:
    namespace = args.get("namespace", "default")

    data = demisto.getIntegrationContext().get(namespace)

    if not data:
        if namespace == "default":
            return_error("Namespace: <default> empty!")
        else:
            return_error(f"Namespace: <{namespace}> not found!")

    data = list(demisto.getIntegrationContext().get(namespace, []))

    number_of_keys = len(data)

    r_data = "\n".join(data)

    return CommandResults(
        readable_output=f"{number_of_keys} key(s) found: \n {r_data}",
        outputs_prefix=f"XSOAR.Store.{namespace}",
        outputs={"keys": data},
        raw_response=data,
    )


def xsoar_store_put_command(args: dict[str, Any]) -> CommandResults:
    namespace = args.get("namespace", "default")

    key = args.get("key")
    input_data = args.get("data")

    current_data = demisto.getIntegrationContext()

    if (sys.getsizeof(current_data) + sys.getsizeof(input_data)) > MAX_SIZE:
        return_error(f"Store cannot be larger than {MAX_SIZE} bytes")

    if namespace in current_data:
        current_data[namespace][key] = input_data
    else:
        current_data[namespace] = {key: input_data}

    demisto.setIntegrationContext(current_data)

    return CommandResults(readable_output=f"put: <{input_data}> in key: <{key}> for namespace: <{namespace}>")


def xsoar_store_get_command(args: dict[str, Any]) -> CommandResults:
    namespace = args.get("namespace", "default")

    key = args.get("key")

    data = demisto.getIntegrationContext().get(namespace)

    data = data.get(key)

    return CommandResults(
        readable_output=f"retrieved: <{data}> from key: <{key}> for namespace: <{namespace}>",
        outputs_prefix=f"XSOAR.Store.{namespace}.{key}",
        outputs=data,
    )


""" MAIN FUNCTION """


def main() -> None:
    """main function, parses params and runs command functions

    :return:
    :rtype:
    """

    demisto.debug(f"Command being called is {demisto.command()}")
    try:
        if demisto.command() == "test-module":
            # This is the call made when pressing the integration Test button.

            return_results("ok")

        elif demisto.command() == "xsoar-store-list":
            return_results(xsoar_store_list_command(demisto.args()))

        elif demisto.command() == "xsoar-store-put":
            return_results(xsoar_store_put_command(demisto.args()))

        elif demisto.command() == "xsoar-store-get":
            return_results(xsoar_store_get_command(demisto.args()))

            # Log exceptions and return errors
    except Exception as e:
        demisto.error(traceback.format_exc())  # print the traceback
        return_error(f"Failed to execute {demisto.command()} command.\nError:\n{e!s}")


"""


Entry Point
-----------

This is the integration code entry point. It checks whether the ``__name__``
variable is ``__main__`` , ``__builtin__`` (for Python 2) or ``builtins`` (for
Python 3) and then calls the ``main()`` function. Just keep this convention.

"""


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()