DamSensorDown

Pre processing script for Emails from Mcafee DAM, about sensor disconnected. Will ignore second notification, but will process first notification into incidents.

Type

python

Pack

mcafeeDam

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def main():
    res = demisto.incidents()[0]
    subject = ""
    body = ""
    for t in demisto.incidents()[0]["labels"]:
        if t["type"] == "Email/subject":
            subject = t["value"]
        if t["type"] == "Email/text":
            body = t["value"]

    if "Sensor" not in subject:
        res = False
    if "was disconnected at" not in subject:
        res = False
    if "this is a second notification" in subject:
        res = False
    labels = []
    s = body.find("with sensor: ")
    if s > 0:
        endNamePos = min(body.index(" ", s + 13), body.index("<", s + 13))
        sensorName = body[s + 13 : endNamePos]
        labels.append({"sensorName": sensorName})

        hostLoc = body[endNamePos:].find("host: ")
        body_rest = body[endNamePos:]
        if hostLoc > 0:
            endNamePos = min(body_rest.index(" ", hostLoc + 6), body_rest.index("<", hostLoc + 6))
            host = body_rest[hostLoc + 6 : endNamePos]
            labels.append({"host": host})

            body_rest = body_rest[endNamePos:]
            ipLoc = body_rest.find("ip: ")
            if ipLoc > 0:
                endNamePos = min(body_rest.index(" ", ipLoc + 4), body_rest.index(",", ipLoc + 4))
                ip = body_rest[ipLoc + 4 : endNamePos]
                labels.append({"ip": ip})
    demisto.executeCommand("setIncident", {"addLabels": json.dumps(labels)})
    demisto.results(res)


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README