SetThreatVaultIncidentMarkdownRepresentation

This automation takes several Incident fields from the Threat Vault incident context and displays them as markdown in the layout.

Type

python

Pack

PaloAltoNetworks_Threat_Vault

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

KEYS_INCIDENT_FIELDS = {
    "threatvaultbypaloaltonetworksspyware": "Spyware",
    "threatvaultbypaloaltonetworksvulnerability": "Vulnerability",
    "threatvaultbypaloaltonetworksfiletype": "File type",
    "threatvaultbypaloaltonetworksdatacorrelation": "Data correlation",
    "threatvaultbypaloaltonetworksdecoders": "Decoders",
    "threatvaultbypaloaltonetworksapplications": "Applications",
}


def read_context_from_threat_vault_incident():
    incident = demisto.incident().get("CustomFields", {})

    data: dict = {}
    for key in KEYS_INCIDENT_FIELDS:
        if field_content := incident.get(key):
            data.update({KEYS_INCIDENT_FIELDS[key]: field_content})

    return data


def json_to_md(incident_fields: dict) -> str:
    md = ""

    for incident_field in incident_fields:
        md += tableToMarkdown(name=incident_field, t=incident_fields[incident_field])
        md += "\n\n\n"

    return md


def main():
    incident_fields = read_context_from_threat_vault_incident()
    md = json_to_md(incident_fields)

    return_results(CommandResults(readable_output=md or "No data to present"))


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README

### Context Example

```json
{"Spyware": 
    [
        {
            "severity": "medium",
            "pan_id": 22144,
            "attack_name": "WebCompanion Adware Traffic Detection",
            "category": "spyware",
            "action": "alert",
            "change_data": "new coverage",
            "min_version": "8.1.0",
            "max_version": ""
        },
        {
            "severity": "medium",
            "pan_id": 22145,
            "attack_name": "AdLoad Adware Traffic Detection",
            "category": "spyware",
            "action": "alert",
            "change_data": "new coverage",
            "min_version": "8.1.0",
            "max_version": ""
        }
    ]
}