ZTAPParseFields

Parses ZTAP event fields to display as key/value pairs in a dynamic table.

Type

python

Pack

ZeroTrustAnalyticsPlatform

Source

from CommonServerPython import *

from typing import Any
import traceback
from collections import defaultdict

""" STANDALONE FUNCTION """


def parse_fields(events, full, max_fields, max_value_length) -> str:
    """Parses events from the raw trigger events field
    and returns a section of the events in key/value tables
    in the input (events).
    """

    if not events:
        return "No trigger events found"

    headers = ["Key", "Value", "Order"]

    product_indexes: defaultdict = defaultdict(int)
    output = ""
    for event in events:
        trigger = "(*)" if event["ata_trigger"] else ""
        product = event["product"]
        index = product_indexes[product]
        datetime_created = event["datetime_created"]
        table_name = f"## {trigger} {product} {index} ({datetime_created})\n"

        fields = []
        for index, field in enumerate(event["fields"]):
            if not full and index >= max_fields:
                break

            label = field["label"]
            key = field["key"]
            value = field["value"]
            if not full and len(str(value)) > max_value_length:
                value = str(value)[:max_value_length] + "..."

            fields.append(
                {
                    "Key": f"{label} ({key})",
                    "Value": value,
                    "Order": field["order"],
                }
            )
        output += tableToMarkdown(table_name, fields, headers=headers)

        product_indexes[product] += 1

    return output


""" COMMAND FUNCTION """


def parse_fields_command(args: dict[str, Any]) -> CommandResults:
    incident = demisto.incident()
    custom_fields = incident.get("CustomFields")
    events = custom_fields.get("ztaptriggers")

    max_fields = args.get("max_fields", 50)
    max_value_length = args.get("max_value_length", 512)
    full = args.get("full", False)

    # Call the standalone function and get the raw response
    result = parse_fields(events, full, max_fields, max_value_length)

    return CommandResults(
        outputs_prefix="ZTAPParseFields",
        outputs_key_field="",
        outputs=[result],
        readable_output=result,
    )


""" MAIN FUNCTION """


def main():
    try:
        return_results(parse_fields_command(demisto.args()))
    except Exception as ex:
        demisto.error(traceback.format_exc())  # print the traceback
        return_error(f"Failed to execute BaseScript. Error: {str(ex)}")


""" ENTRY POINT """


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README