AppendindicatorFieldWrapper

A wrapper script to the 'AppendindicatorField' script that enables adding tags to certain indicators. Note: You can use this script in an incident Layout button to allow tags to be added to indicators through the incident.

python · Common Scripts

Details

IDAppendindicatorFieldWrapper
Languagepython
From Version6.2.0
Docker Imagedemisto/python3:3.12.13.10404775
Tagsincident-action-button

README

A wrapper script to the AppendindicatorField script that enables adding tags to certain indicators.
Note: You can use this script in an incident Layout button to allow tags to be added to indicators through the incident.

Script Data


Name Description
Script Type python3
Tags basescript
Cortex XSOAR Version 6.2.0

Inputs


Argument Name Description
indicators_values A comma-separated list of indicators values. For example, for IP indicators, “1.1.1.1,2.2.2.2”.
tags A comma-separated list of tags to add to the indicators. For example, “tag1,tag2,tag3”.

Outputs


There are no outputs for this script.

import demistomock as demisto
import pytest


def test_run_append_indicator_field_script(mocker):
    """
    Given:
        - A list of Indicators values.
        - A list of tags to append to the given indicators.
    When:
        Running the 'run_append_indicator_field_script' function.
    Then:
        Verify that the readable output is as expected.

    """
    import AppendindicatorFieldWrapper

    indicators_values = ["test_indicator1", "test_indicator2"]
    tags = ["test_tag1", "test_tag2"]

    mocker.patch.object(AppendindicatorFieldWrapper, "execute_command")
    response = AppendindicatorFieldWrapper.run_append_indicator_field_script(indicators_values, tags)

    assert (
        response.readable_output == "### The following tags were added successfully:\n|Indicator|Tags|\n"
        "|---|---|\n| test_indicator1 | test_tag1,<br>test_tag2 |\n| test_indicator2 |"
        " test_tag1,<br>test_tag2 |\n"
    )


@pytest.mark.parametrize(
    "args, expected_err_message",
    [
        ({"indicators_values": "", "tags": "test_tag1,test_tag2"}, "Indicators values were not specified."),
        ({"indicators_values": "test_indicator1,test_indicator2", "tags": ""}, "Tags were not specified."),
    ],
)
def test_missing_arguments(mocker, args, expected_err_message):
    """
    Given:
        1. Demisto args object containing an empty string as the Indicator values argument, and a
           comma-separated list of tags to append to the indicators.
           An error message about missing indicators.

        2. Demisto args object containing an empty string as the Tags argument, and a
           comma-separated list of indicators values.
           An error message about missing tags.
    When:
        Running the 'main' function.

    Then:
        Verify that the expected error message is returned as an error.
    """

    import AppendindicatorFieldWrapper

    mocker.patch.object(demisto, "args", return_value=args)
    return_error_mock = mocker.patch.object(AppendindicatorFieldWrapper, "return_error")

    AppendindicatorFieldWrapper.main()

    assert return_error_mock.call_count == 1
    assert return_error_mock.call_args[0][0] == (f"Failed to execute AppendindicatorFieldWrapper. Error: {expected_err_message}")