GetIncidentTasks
Get all tasks for a specific incident by the given state, name and/or tag.
- Type
- javascript
- Pack
- DemistoRESTAPI
Source
TASK_STATES = {
"new": "",
"inprogress": "inprogress",
"completed": "Completed",
"waiting": "Waiting",
"error": "Error",
"looperror": "LoopError",
"skipped": "WillNotBeExecuted",
"willnotbeexecuted": "WillNotBeExecuted",
"blocked": "Blocked",
undefined: undefined
}
function getPlaybookTasks(tasks){
var readyTasks = [];
for (var i = 0; i < tasks.length; i++) {
var task = tasks[i];
if (task.type === "playbook" && task.subPlaybook) {
var subPlaybookTasks = [];
if (task.subPlaybook.tasks) {
for (var key in task.subPlaybook.tasks) {
if (task.subPlaybook.tasks.hasOwnProperty(key)) {
subPlaybookTasks.push(task.subPlaybook.tasks[key]);
}
}
}
var nestedTasks = getPlaybookTasks(subPlaybookTasks);
readyTasks = readyTasks.concat(nestedTasks);
}
readyTasks.push(task);
}
return readyTasks;
}
function isTaskMatch(task, name, tag, states) {
var taskTask = task.task || {};
var nameMatch = name === null || name === undefined ||
(taskTask.name && taskTask.name.toLowerCase() === name.toLowerCase());
var tagMatch = tag === null || tag === undefined ||
(taskTask.tags && taskTask.tags.indexOf(tag) !== -1);
var stateMatch = !states || states.length === 0 ||
(states.indexOf(task.state) !== -1);
return nameMatch && tagMatch && stateMatch;
}
function getStates(states) {
// If "error" is in the input list, add "loopError"
if (states.indexOf("error") !== -1) {
states.push("loopError");
}
var readyStates = [];
for (var i = 0; i < states.length; i++) {
var state = states[i];
var systemState = TASK_STATES[state.toLowerCase()];
if (systemState && readyStates.indexOf(systemState) === -1) {
readyStates.push(systemState);
}
}
// If no matches were found, return all values from TASK_STATES
if (readyStates.length === 0) {
for (var key in TASK_STATES) {
if (TASK_STATES.hasOwnProperty(key)) {
var value = TASK_STATES[key];
if (readyStates.indexOf(value) === -1) {
readyStates.push(value);
}
}
}
}
return readyStates;
}
var name = args.name
var tag = args.tag
var inc_id = args.inc_id
var using = args.using
var states = getStates(argToList(args.states))
var executeArgs = {
uri: `/investigation/${inc_id}/workplan`
};
if (using) {
executeArgs.using = using;
}
var res = executeCommand('core-api-get', executeArgs);
if (!isValidRes(res))
{
if(res[0].Contents){
return {
ContentsFormat: formats.markdown,
Type: entryTypes.error,
Contents: res[0].Contents
};
}
}
var tasks = undefined;
if (
res &&
res[0] &&
res[0].Contents &&
res[0].Contents.response &&
res[0].Contents.response.invPlaybook &&
res[0].Contents.response.invPlaybook.tasks
)
{
tasks = res[0].Contents.response.invPlaybook.tasks;
if (tasks == undefined){
return{
Type: entryTypes.note,
ReadableContentsFormat: formats.text,
Contents: `Workplan for incident ${inc_id} has no tasks.`,
};
}
allTasks = getPlaybookTasks(Object.values(tasks));
var res = [];
for (var i = 0; i < allTasks.length; i++) {
var task = allTasks[i];
if (isTaskMatch(task, name, tag, states)) {
res.push({
id: task.id,
name: (task.task && task.task.name) || "",
type: task.type,
owner: task.assignee,
state: task.state,
scriptId: task.task && task.task.scriptId,
startDate: task.startDate,
dueDate: task.dueDate,
completedDate: task.completedDate,
parentPlaybookID: task.parentPlaybookID,
completedBy: task.completedBy
});
}
}
var ec = {'Tasks(val.id && val.id == obj.id)': res};
return {
Type: entryTypes.note,
ReadableContentsFormat: formats.markdown,
Contents: res,
ContentsFormat: formats.json,
HumanReadable: tableToMarkdown(`Incident #${inc_id} Playbook Tasks`, res, ["id", "name", "state", "owner", "scriptId"],removeNull=true),
EntryContext: ec
};
}
if (tasks == undefined){
return{
Type: entryTypes.note,
ReadableContentsFormat: formats.text,
Contents: `Workplan for incident ${inc_id} has no tasks.`,
};
}
README
Get all tasks for a specific incident by the given state, name and/or tag.
Script Data
| Name | Description |
|---|---|
| Script Type | javascript |
| Tags | Utility |
| Cortex XSOAR Version | 6.10.0 |
Dependencies
This script uses the following commands and scripts.
- Core REST API
- core-api-get
Inputs
| Argument Name | Description |
|---|---|
| inc_id | Incident ID to get tasks from. |
| states | Comma-separated list of states. Possible values: New, InProgress, Completed, Waiting, Error, LoopError, Skipped, Blocked. (Leave empty to get all tasks). |
| name | The name of the task to search. |
| tag | The tag to search. |
| using | The Cortex REST API integration instance to use for the API request. If not provided, the default instance is used. |
Outputs
| Path | Description | Type |
|---|---|---|
| Tasks | The entire task object. | Unknown |
| Tasks.id | Task ID. | string |
| Tasks.name | Task name. | string |
| Tasks.type | The type of the task (regular, condition, title, playbook, start). | string |
| Tasks.owner | Task owner. | string |
| Tasks.state | Task state (inprogress, Completed, WillNotBeExecuted, Error, LoopError, Waiting, Blocked, and empty string for not started). | string |
| Tasks.scriptId | Task related script (empty if manual). | string |
| Tasks.startDate | Task start date. | unknown |
| Tasks.completedDate | Task completed date. | unknown |
| Tasks.dueDate | Task due date (SLA). | unknown |
| Tasks.parentPlaybookID | Task parent playbook ID (in case the task is part of a sub-playbook). | unknown |
| Tasks.completedBy | Task completed by (username). | string |
Script Examples
Example command
!GetIncidentTasks inc_id=10 name="Email Campaign Search"
Context Example
{
"Tasks": {
"completedBy": "DBot",
"completedDate": "2024-01-09T12:26:33.75641877Z",
"dueDate": "0001-01-01T00:00:00Z",
"id": "101",
"name": "Email Campaign Search",
"owner": "Dummy",
"parentPlaybookID": null,
"scriptId": null,
"startDate": "0001-01-01T00:00:00Z",
"state": "Completed",
"type": "title"
}
}
Human Readable Output
Incident #10 Playbook Tasks
id name state owner scriptId 101 Email Campaign Search Completed Dummy