Xsoar_Utils

This is a wrapper on top of XSOAR API. Can be used to implement commands that call the XSOAR API in the background. This is mostly to avoid constructing raw json strings while calling the demisto rest api integration. The first implemented command can be used to create an entry on any investigation; playground by default. An example use-case could be debugging a pre-process script. (Call demisto.execute_command("xsoar-create-entry",{arguments}) The idea is to use the same code to test from a local machine. python3 Xsoar_Utils.py xsoar-create-entry '{"data":"# testapi4","inv_id":"122c7bff-feae-4177-867e-37e2096cd7d9"}' Read the code to understand more.

Utilities · Xsoar_Utils

Details

ID	`Xsoar_Utils`
Provider	Palo Alto Networks
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

The first implemented command can be used to create an entry on any investigation; playground by default. An example use-case could be debugging a pre-process script. (Call .execute_command(“xsoar-create-entry”,{arguments})

The idea is to use the same code to test from a local machine.
python3 Xsoar_Utils.py xsoar-create-entry ‘{“data”:”# testapi4”,”inv_id”:”122c7bff-feae-4177-867e-37e2096cd7d9”}’

Read the code to understand more.

Configure Xsoar_Utils in Cortex

Parameter	Description	Required
XSOAR Server URL		True
XSOAR Server API_Key		True
XSOAR Server playground-id		True
Allow Insecure connections to the server	Check this to ignore certificate signature	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

xsoar-create-entry

Creates an entry into an investigation warroom or by default on the playground.

Base Command

xsoar-create-entry

Input

Argument Name	Description	Required
data	Entry value to be created.	Optional
inv_id	The investigation id on which the entry is created. Defaults to playbook-id.	Optional

Context Output

There is no context output for this command.

Command Example

``````

Human Readable Output

Configuration parameters

url — XSOAR SERVER URL (required)
apikey — XSOAR SERVER API KEY (required)
playground-id — XSOAR Server PLAYGROUND ID (required)
insecure — Trust any certificate (not secure)

Commands (1)

xsoar-create-entry
Creates an entry into an investigation warroom or by default on the playground.

Source

XsoarUtils.py XsoarUtils.yml XsoarUtils_description.md

Download History Raw

import json
from collections.abc import Callable

import demistomock as demisto  # noqa: F401
import requests
from CommonServerPython import *  # noqa: F401

# change the below to your default playground id while testing from your local machine
default_playground_id = "122c7bff-feae-4177-867e-37e2096cd7d9"


class Main_Object:
    def __init__(self) -> None:
        self.endpoint = demisto.params()["url"]
        self.api_key = demisto.params().get("apikey")
        self.playground = demisto.params().get("playground-id")
        self.ssl_verify = not bool(demisto.params().get("insecure", False))
        self.log_response = log_response_demisto


def log_response_demisto(res: requests.Response):
    if res.status_code == 200:
        return_results(f"Command seemed to have worked status-code:{res.status_code}")
    else:
        return_results(f"Command seemed to have failed status-code:{res.status_code}")
        return_results(res.text)


def send_request(obj: Main_Object, path: str, method="get", data="", test=False):
    endpoint = f"{obj.endpoint}{path}"
    headers = {"Authorization": obj.api_key, "content-type": "application/json"}
    if method == "get":
        res = requests.get(endpoint, headers=headers, verify=obj.ssl_verify)
    else:
        res = requests.post(endpoint, data=data, headers=headers, verify=obj.ssl_verify)

    if not test:
        obj.log_response(res)
    else:
        if res.status_code == 200:
            demisto.results("ok")
        else:
            return_error(f"please validate your credentials.{res.text}")


def create_entry(obj: Main_Object, data: str, inv_id: str):
    req_args = {"id": "", "version": 0, "investigationId": inv_id, "data": data, "markdown": True}
    send_request(obj, path="/entry", method="Post", data=json.dumps(req_args))


def main():
    obj = Main_Object()
    commands_list: Dict[str, Callable] = {"xsoar-create-entry": create_entry}
    demisto.info("Executing Xsoar_Utils, detected demisto as environment")
    command = demisto.command()
    command_args = demisto.args()
    if "inv_id" not in command_args:
        command_args["inv_id"] = obj.playground
    if command == "test-module":
        send_request(obj, path="/engines", method="get", test=True)
    else:
        commands_list[command](obj, **command_args)


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()