ExpanseEnrichAttribution

Deprecated. No available replacement. > This script can be used to enrich context generated by ExpanseAggregateAttribution* scripts with additional details

Type

python

Pack

ExpanseV2

Source

import demistomock as demisto
from CommonServerPython import *  # noqa # pylint: disable=unused-wildcard-import
from CommonServerUserPython import *  # noqa

from typing import Dict, Any, List, Optional


''' COMMAND FUNCTION '''


def enrich(current_list: List[Dict[str, Any]], enrich_list: List[Dict[str, Any]], enrich_key: str,
           enrich_fields: List[str], key_field: str, outputs_prefix: str) -> CommandResults:
    for enrich_entry in enrich_list:
        key = enrich_entry.get(enrich_key, None)
        if key is None:
            continue

        for current_entry in current_list:
            current_key = current_entry[key_field].lower()
            if isinstance(key, list):
                if next((k for k in key if k.lower() == current_key), None) is None:
                    continue
            else:
                if current_key != key.lower():
                    continue

            for enrich_field in enrich_fields:
                new_enrich_field = enrich_field
                if '=' in enrich_field:
                    enrich_field, new_enrich_field = enrich_field.split('=', 1)

                if enrich_field not in enrich_entry:
                    continue

                enrich_value = enrich_entry[enrich_field]
                if isinstance(enrich_value, list) and len(enrich_value) == 1:
                    enrich_value = enrich_value[0]

                current_entry[new_enrich_field] = enrich_value

    return CommandResults(
        outputs_prefix=outputs_prefix,
        outputs_key_field=key_field,
        outputs=current_list if len(current_list) > 0 else None,
        readable_output=""
    )


def enrich_command(args: Dict[str, Any]) -> CommandResults:
    type_: Optional[str]
    if (type_ := args.get("type")) is not None:
        type_ = type_.lower()

    current_list = argToList(args.get('current', []))
    enrich_list = argToList(args.get('enrich', []))
    enrich_key = args.get('enrich_key', "")
    enrich_fields = argToList(args.get('enrich_fields', []))

    if type_ == "ip":
        return enrich(
            current_list,
            enrich_list,
            enrich_key,
            enrich_fields,
            key_field="ip",
            outputs_prefix="Expanse.AttributionIP")
    elif type_ == "device":
        return enrich(
            current_list,
            enrich_list,
            enrich_key,
            enrich_fields,
            key_field="serial",
            outputs_prefix="Expanse.AttributionDevice")
    elif type_ == "user":
        return enrich(
            current_list,
            enrich_list,
            enrich_key,
            enrich_fields,
            key_field="username",
            outputs_prefix="Expanse.AttributionUser")

    raise ValueError("Invalid value for type argument")


''' MAIN FUNCTION '''


def main():
    try:
        enrich_result = enrich_command(demisto.args())
        return_results(enrich_result)
    except Exception as ex:
        return_error(f'Failed to execute ExpanseEnrichAttribution. Error: {str(ex)}')


''' ENTRY POINT '''


if __name__ in ('__main__', '__builtin__', 'builtins'):
    main()

README