SearchCases

Retrieves cases based on the provided filters.

Type

python

Pack

CommonScripts

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def extract_ids(case_extra_data: dict) -> list:
    """
    Extract a list of IDs from a command result.

    Args:
        command_res: The result of a command. It can be either a dictionary or a list.
        field_name: The name of the field that contains the ID.

    Returns:
        A list of the IDs extracted from the command result.
    """
    if not case_extra_data:
        return []

    field_name = "issue_id"
    issues = case_extra_data.get("issues", {})
    issues_data = issues.get("data", {}) if issues else {}
    issue_ids = [c.get(field_name) for c in issues_data if isinstance(c, dict) and field_name in c]
    demisto.debug(f"Extracted issue ids: {issue_ids}")
    return issue_ids


def get_case_extra_data(args):
    """
    Calls the core-get-case-extra-data command and parses the output to a standard structure.

    Args:
        args: The arguments to pass to the core-get-case-extra-data command.

    Returns:
        A dictionary containing the case data with the following keys:
            issue_ids: A list of IDs of issues in the case.
            network_artifacts: A list of network artifacts in the case.
            file_artifacts: A list of file artifacts in the case.
    """
    demisto.debug(f"Calling core-get-case-extra-data, {args=}")
    case_extra_data = execute_command("core-get-case-extra-data", args)
    demisto.debug(f"After calling core-get-case-extra-data, {case_extra_data=}")
    issue_ids = extract_ids(case_extra_data)
    network_artifacts = case_extra_data.get("network_artifacts")
    file_artifacts = case_extra_data.get("file_artifacts")
    extra_data = {"issue_ids": issue_ids, "network_artifacts": network_artifacts, "file_artifacts": file_artifacts}
    return extra_data


def add_cases_extra_data(case_data):
    # for each case id in the entry context, get the case extra data
    for case in case_data:
        case_id = case.get("case_id")
        extra_data = get_case_extra_data({"case_id": case_id, "limit": 1000})
        case.update({"CaseExtraData": extra_data})

    return case_data


def prepare_start_end_time(args: dict):
    """
    Prepare and validate start and end time parameters from args dictionary.

    Parses start_time and end_time from string format to ISO format and validates
    that when end_time is provided, start_time must also be provided. If only start_time
    is provided, sets end_time to current time. Sets time_frame to 'custom' when both
    times are specified.

    Args:
        args (dict): Dictionary containing start_time and end_time parameters

    Raises:
        DemistoException: If end_time is provided without start_time

    Side Effects:
        Modifies the args dictionary in place by:
        - Converting start_time and end_time to ISO format
        - Setting time_frame to 'custom' when both times are present
        - Setting end_time to current time if only start_time is provided

    """
    start_time = args.get("start_time", "")
    end_time = args.get("end_time", "")

    if end_time and not start_time:
        raise DemistoException("When end time is provided start_time must be provided as well.")

    if start_time := dateparser.parse(start_time):
        start_time = start_time.strftime("%Y-%m-%dT%H:%M:%S")

    if end_time := dateparser.parse(end_time):
        end_time = end_time.strftime("%Y-%m-%dT%H:%M:%S")

    if start_time and not end_time:
        # Set end_time to default now.
        end_time = datetime.now().strftime("%Y-%m-%dT%H:%M:%S")

    if start_time and end_time:
        args["gte_creation_time"] = start_time
        args["lte_creation_time"] = end_time


def main():  # pragma: nocover
    """
    Gets cases using the core-get-cases command with the given arguments.
    """
    args: dict = demisto.args()
    prepare_start_end_time(args)
    args["limit"] = args.pop("page_size", 100)
    try:
        demisto.debug(f"Calling core-get-cases with arguments: {args}")
        results: dict = demisto.executeCommand("core-get-cases", args)[0]  # type: ignore
        demisto.debug(f"core-get-cases command results {results}")

        if is_error(results):
            error = get_error(results)
            demisto.debug("error: " + error)
            raise DemistoException(f"Failed to execute the core-get-cases command {error}")

        # In case enriched case data was requested
        if argToBoolean(args.get("get_enriched_case_data", "false")):
            raw_response_search_cases = results.get("Contents", {})
            if isinstance(raw_response_search_cases, dict):
                raw_response_search_cases = [raw_response_search_cases]

            case_extra_data = add_cases_extra_data(raw_response_search_cases)

            return_results(
                CommandResults(
                    readable_output=tableToMarkdown("Cases", case_extra_data, headerTransform=string_to_table_header),
                    outputs_prefix="Core.Case",
                    outputs_key_field="case_id",
                    outputs=case_extra_data,
                    raw_response=case_extra_data,
                )
            )

        return_results(results)

    except DemistoException as error:
        return_error(f"Failed to execute SearchCases. Error:\n{error}", error)


if __name__ in ("__main__", "__builtin__", "builtins"):  # pragma: no cover
    main()