MicrosoftSentinelConvertCommentsToTable

This script is used to convert comments to a table.

Type

python

Pack

AzureSentinel

Source

import demistomock as demisto
from CommonServerPython import *
from dateutil import parser


def format_comment(comment: dict) -> dict:
    """
    Converts a comment to a dictionary with the relevant fields.
    """
    comment_time = comment.get("properties", {}).get("createdTimeUtc")
    try:
        createdTime = datetime.strftime(parser.parse(comment_time), "%d/%m/%Y, %H:%M")
    except Exception:
        createdTime = comment_time
    return {
        "message": comment.get("properties", {}).get("message"),
        "createdTime": createdTime,
        "name": comment.get("properties", {}).get("author", {}).get("name"),
    }


def convert_to_table(context_results: str) -> CommandResults:
    """
    Args:
        context_results (str): String representing a list of dicts

    Returns:
        CommandResults: CommandResults object containing only readable_output
    """
    context_results = json.loads(context_results)

    context_formatted = [
        format_comment(comment)
        for comment in context_results  # type: ignore
    ]

    md = tableToMarkdown(
        "",
        context_formatted,
        headers=["message", "createdTime", "name"],
        removeNull=True,
        sort_headers=False,
        headerTransform=pascalToSpace,
    )

    return CommandResults(readable_output=md)


def main():  # pragma: no cover
    context = dict_safe_get(demisto.callingContext, ["context", "Incidents", 0, "CustomFields", "microsoftsentinelcomments"], {})

    if not context:
        return_error("No data to present")

    return_results(convert_to_table(str(context)))


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README