CyphoApproveIssue

Type
python
Pack
CyphoThreatIntelligence

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

try:
    incident = demisto.incident()
    custom_fields = incident.get("CustomFields", {})
    ticket_id, owner, Category, users_response, Incident_Type, Cypho_Status = (
        custom_fields.get("cyphoticketid"),
        incident.get("owner"),
        custom_fields.get("cyphocategoryname"),
        demisto.executeCommand("getUsers", {}),
        incident.get("type"),
        custom_fields.get("cyphostatus"),
    )
    args_update_incident = {"cyphostatus": "Open", "type": f"Cypho {Category}"}

    if not owner:
        raise DemistoException("Incident is not assigned. Please assign an owner before approve a issue.")

    if Incident_Type == "Cypho Under Review Issues" and Cypho_Status == "Candidate":
        if is_error(users_response[0]):
            raise DemistoException("Failed to retrieve user list.")

        users = users_response[0].get("Contents", [])
        user_info = next((u for u in users if u.get("username") == owner), None)

        if not user_info or not user_info.get("email"):
            raise DemistoException(f"Could not find email for incident owner '{owner}'.")

        email = user_info.get("email")
        args_approve_issue = {"approve": "True", "ticket_id": ticket_id, "user_email": email}
        demisto.executeCommand("cypho-approve-dismiss-issue", args_approve_issue)
        demisto.executeCommand("setIncident", args_update_incident)
    else:
        raise DemistoException(
            "Either the incident type is not 'Cypho Under Review Issues' or the issue status is not set to 'Candidate'."
        )

except Exception as e:
    demisto.error(f"[CyphoApproveIssueButton] Error: {str(e)}")
    return_results(CommandResults(readable_output=f"Failed to process approval for Cypho ticket. Error: {str(e)}"))

README

Cypho Approve Issue

This automation allows analysts to approve a Cypho issue directly from Cortex XSOAR.

The script synchronizes the approval action with Cypho, ensuring that the issue status in Cypho accurately reflects the decision made by the analyst in XSOAR. This eliminates the need for manual approval actions in external systems and maintains consistency across platforms.

The automation enforces ownership validation before execution, ensuring that the incident is assigned to an analyst. This guarantees proper accountability, accurate activity tracking, and reliable SOC metrics such as MTTR and analyst attribution.

Script Data

Name Description
Script Type python3
Tags incident-action

Inputs

There are no manual inputs for this script.
The automation automatically uses:

Outputs

There are no direct outputs for this script.
The script performs a background approval action in Cypho and updates the external issue state accordingly.

✔ Notes