DBotShowClusteringModelInfo

Show clustering model information - model summary and incidents in specific cluster.

Type

python

Pack

Base

Source

from CommonServerPython import *

# CONSTS
BASE_INCIDENT_COLUMNS = ["id", "created", "name", "Group name", "Group id"]


def show_model_info(model_name):
    success = False
    start = datetime.now()
    model = None

    while not success and datetime.now() - start < timedelta(minutes=10):
        res = demisto.executeCommand("getMLModel", {"modelName": model_name})
        if is_error(res):
            time.sleep(5)
        else:
            success = True
            model = res[0]["Contents"]

    if model:
        md = model["model"]["extra"]["modelSummaryMarkdown"]
        return_outputs(md)
    else:
        return_outputs("Cannot find model " + model_name)


def wrapped_list(obj):
    if not isinstance(obj, list):
        return [obj]
    return obj


def show_incidents_in_cluster(model_name, query, display_fields):
    res = demisto.executeCommand("DBotTrainClustering", {"modelName": model_name})
    data = res[0]["Contents"]["data"]
    id_to_cluster = {}
    id_to_cluster_name = {}
    incidents = []  # type: ignore
    for row in data:
        if row["pivot"] in query.split(" "):
            incidents_in_cluster = json.loads(row["incidents"])
            incidents += incidents_in_cluster
            for inc in incidents_in_cluster:
                id_to_cluster[inc["id"]] = re.sub(r"\D", "", row["pivot"])
                id_to_cluster_name[inc["id"]] = row.get("name")

    incidents_to_show = []
    for inc in incidents:
        incident_to_show = {}
        for field in display_fields:
            if field in inc:
                value = inc[field]
            else:
                value = wrapped_list(demisto.dt(inc, field))
                value = " ".join(set(filter(lambda x: x not in ["None", None, "N/A"], value)))  # type: ignore
            incident_to_show[field] = value
        incident_to_show["Id"] = "[{0}](#/Details/{0})".format(inc["id"])
        incident_to_show["Name"] = incident_to_show["name"].replace("#", "")
        incident_to_show["Created"] = incident_to_show["created"][: incident_to_show["created"].find(".")]
        incident_to_show["Group id"] = id_to_cluster.get(inc["id"])
        incident_to_show["Group name"] = id_to_cluster_name.get(inc["id"])
        incidents_to_show.append(incident_to_show)

    headers = [x.capitalize() for x in BASE_INCIDENT_COLUMNS] + [x for x in display_fields if x not in BASE_INCIDENT_COLUMNS]
    title = "Incidents In Clusters " + ", ".join(set(id_to_cluster.values()))
    return_outputs(tableToMarkdown(title, incidents_to_show, headers))


def main():
    query = demisto.args().get("searchQuery")
    model_name = demisto.args()["modelName"]
    return_type = demisto.args()["returnType"]
    if return_type == "incidents":
        if not query:
            return_outputs("## Please select a specific cluster to show incidents")
        else:
            display_fields = demisto.args().get("fieldsToDisplay", "").split(",")
            display_fields = [x.strip() for x in display_fields if x]
            display_fields = list(set(BASE_INCIDENT_COLUMNS + display_fields))
            display_fields = list(dict.fromkeys(display_fields))
            show_incidents_in_cluster(model_name, query, display_fields)
    else:
        show_model_info(model_name)


if __name__ in ["__main__", "__builtin__", "builtins"]:
    main()

README