ReadProcessesFileXDR

Return a process list from the XDRIR integration.

Type

python

Pack

MalwareInvestigationAndResponse

Source

import re

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

CONTEXT_PATH_TO_READ_PROCESS_FILE_NAME_FROM_XDR_DATA = "PaloAltoNetworksXDR.ScriptResult"


def read_xdr_context():  # pragma: no cover
    script_results = demisto.get(demisto.context(), CONTEXT_PATH_TO_READ_PROCESS_FILE_NAME_FROM_XDR_DATA)
    return script_results


def entries_to_markdown(entry_list: List[str]):
    """
    Args:
         entry_list (List[str]): the _return_value array from demisto context

     Returns:
         str: a markdown table to be displayed on the layout.
    """
    if not entry_list:
        return ""

    process_list = []
    regex = r"Name: (?P<name>.*), CPU: (?P<cpu>.*), Memory: (?P<memory>.*)\b"

    for entry in entry_list:
        result = re.search(regex, entry)
        if not result:
            continue
        process_list.append({"Name": result.group("name"), "CPU": result.group("cpu"), "Memory": result.group("memory")})
    md = tableToMarkdown("", process_list, ["Name", "CPU", "Memory"])
    return md


def detect_process_field(entry: str):
    lst = ["Name", "Memory", "CPU"]
    return all(word in entry for word in lst)


def find_last_process_list_script(script_results: list | dict):
    """
    Iterates over the 'script_results' to find the last script result
    activate that matches the 'detected_process_field' filter.

    Args:
        script_results (List | dict): script results after running XDRIR script

    Returns:
        list | None: if a proper result was found return the _return_value (list) else None

    Actions:
    """
    if not script_results:
        return None

    if not isinstance(script_results, list):
        script_results = [script_results]

    for script_result in reversed(script_results):
        if not (results := script_result.get("results", [])):
            continue

        if not isinstance(results, list):
            results = [results]

        for result in reversed(results):
            if not (_return_value := result.get("_return_value", [])):
                continue

            # check the first element in _return_value list to verify it matches the
            # format of the process list script, and not some other script under context entry.
            if detect_process_field(_return_value[0]):
                return _return_value

    return None


def main():  # pragma: no cover
    script_results = read_xdr_context()
    _return_value = find_last_process_list_script(script_results)
    markdown = entries_to_markdown(_return_value)
    if markdown:
        return_results(CommandResults(readable_output=markdown))
    else:
        return_results(CommandResults(readable_output="No data to present"))


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README

### Context Example

```json
{}