SplunkConvertConsolidatedFindingsToMD

Renders the Splunk Investigation `consolidated_findings` JSON payload as a Markdown summary (key/value table for scalar fields plus a transposed table for parallel array columns such as `search_name`, `_time`, `dest`, `risk_score`, `severity`, and `src`). Designed for use as a dynamic-section in the Splunk Investigation layout.

Type

python

Pack

SplunkPy

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def _coerce_to_dict(raw_value):
    """Return the consolidated_findings payload as a dict.

    The classifier stores the value as a JSON string (Stringify transformer),
    but defensively also handle the case where it already arrived as a dict
    (e.g. older mappings or manual incident edits).
    """
    if not raw_value:
        return {}
    if isinstance(raw_value, dict):
        return raw_value
    if isinstance(raw_value, str):
        try:
            parsed = json.loads(raw_value)
        except (ValueError, TypeError):
            return {}
        return parsed if isinstance(parsed, dict) else {}
    return {}


def main():
    incident = demisto.incident()
    if not incident:
        raise ValueError("Error - demisto.incident() expected to return current incident from context but returned None")

    raw_value = demisto.get(incident, "CustomFields.splunkconsolidatedfindings", "")
    payload = _coerce_to_dict(raw_value)
    md_output = tableToMarkdown("Splunk Consolidated Findings", payload, headerTransform=string_to_table_header)
    return CommandResults(readable_output=md_output)


if __name__ in ("__main__", "__builtin__", "builtins"):
    try:
        return_results(main())
    except Exception as e:
        return_error(f"Got an error while rendering Splunk consolidated findings: {e}")

README