GIBIncidentUpdate

This script prevents duplication of existing incidents. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

Type

python

Pack

GroupIB_ThreatIntelligenceAttribution

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def prevent_duplication(current_incident):
    """
    This script checks if there is an existing incident with the same GIB ID as the incoming incident.
    If so, the script updates the already existing incident with the fields of the incoming incident, and returns False.
    If not, the script returns True.
    """
    result = True
    custom_fields = current_incident.get("CustomFields", {})
    if "CustomFields" in current_incident:
        del current_incident["CustomFields"]
    if "labels" in current_incident:
        del current_incident["labels"]
    if "occurred" in current_incident:
        del current_incident["occurred"]
    if "sla" in current_incident:
        del current_incident["sla"]
    current_incident.update(custom_fields)
    gibid = custom_fields.get("gibid")
    search_incident = demisto.executeCommand("getIncidents", {"query": f"gibid: {gibid} and -status:Closed"})
    if search_incident:
        total = int(search_incident[0].get("Contents", {}).get("total", 0))
        if total > 0:
            result = False
            incident_id = search_incident[0].get("Contents", {}).get("data", {})[total - 1].get("id")
            for key, value in current_incident.items():
                demisto.executeCommand("setIncident", {"id": incident_id, key: value})

    return result


def main():
    try:
        return_results(prevent_duplication(demisto.incident()))
    except Exception as e:
        return_error(f"Error: {e!s}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README