AddEvidence

Adds provided entries to the incident Evidence Board. In playbook, can be positioned after a task to add the previous task's entries to Evidence Board automatically (with no need to provide arguments)

javascript · Common Scripts

Source

if (!args.entryIDs) {
    throw 'Missing argument values for command AddEvidenceJS are : entryIDs';
}
var entryIDs = args.entryIDs;
var entryTags = args.tags;
var desc = (args.description) ? args.description : args.desc ? args.desc : 'Evidence added by DBot';
entryIDs = (Array.isArray(entryIDs)) ? entryIDs : [entryIDs];
entryTags = (Array.isArray(entryTags)) ? entryTags.join(',') : entryTags;

for (var i=0;i<entryIDs.length;i++) {
    var entryID = entryIDs[i];
    entries = executeCommand('getEntry', {'id': entryID});
    if (isValidRes(entries)) {
        for (var j=0;j<entries.length;j++){
            var ent=entries[j];
            var obj = { 'id': entryID, 'description': desc};
            if (args.occurred) {
              obj.when = args.occurred;
            }
            if (entryTags) {
              obj.tags = entryTags;
            }
            var res = executeCommand('markAsEvidence', obj);
            if (!isValidRes(res)) {
                return res;
            }
        }
    } else {
        return entries;
    }

}

return "Entry ID " + entryIDs + " added to evidence";

README

Adds the provided entries to the incident Evidence Board. The playbook, can be positioned after a task to add the previous task’s entries to the Evidence Board automatically (with no need to provide arguments).

Script Data

Name	Description
Script Type	javascript
Tags	Utility
Cortex XSOAR Version	2.5.0+

Inputs

Argument Name	Description
entryIDs	The entry IDs to add its output to the Evidence Board.
desc	The description to add to the Evidence Board.
description	The description to add to the Evidence Board.
occurred	The time the evidence occurred (in time format: 2008-01-02T15:04:05).
tags	The evidence tags.

Outputs

There are no outputs for this script.