ArcannaFeedbackPostProcessing Deprecated

Deprecated. No available replacement.

python · ArcannaAI

Details

IDArcannaFeedbackPostProcessing
Languagepython
From Version5.5.0
Docker Imagedemisto/python3:3.10.14.98471
Tagspost-processing

README

This Script is a post-processing-script that can be used as a starter to send Arcanna.ai feedback when an analyst performs investigation.

Script can also be used with Arcanna-Generic-Investigation-V2 playbook

Script Data


Name Description
Script Type python3
Tags basescript
Cortex XSOAR Version 6.0.0

Inputs


Argument Name Description
closing_user username used to trigger script
closing_reason closing reasong used to trigger script
closing_notes closing notes used to trigger script

All Inputs are Optional just to be able to trigger the script if needed

Outputs


No Outputs

import demistomock as demisto
from CommonServerPython import *
from CommonServerUserPython import *

ARCANNA_AUTO_CLOSED_TICKET_PLAYBOOK_PLACEHOLDER = "Arcanna decision:"


def get_value_from_context(key):
    return demisto.get(demisto.context(), key)


def send_arcanna_feedback(close_notes, close_reason, closing_user, event_id, job_id):
    ret = demisto.executeCommand("arcanna-send-event-feedback", {
        "job_id": job_id,
        "event_id": event_id,
        "label": close_reason,
        "username": closing_user,
        "closing_notes": close_notes
    })
    return ret


def extract_feedback_information():
    feedback_field = get_value_from_context(key="Arcanna.FeedbackField")
    if type(feedback_field) == list and len(feedback_field) > 0:
        feedback_field = feedback_field[0]

    if not feedback_field:
        raise Exception("Failed to get value for Arcanna closing field")

    # Get Values from incident
    feedback_field_value = demisto.incident().get(feedback_field, None)
    if not feedback_field_value:
        # if closing field value is Empty try to get it from Args as a fallback
        feedback_field_value = demisto.args().get(feedback_field, None)

    return feedback_field, feedback_field_value


def add_closing_user_information(closing_user, owner, survey_user):
    if not closing_user:
        if survey_user:
            closing_user = survey_user
        elif owner:
            closing_user = owner
        else:
            closing_user = "dbot"
    return closing_user


def run_arcanna_send_feedback():
    try:
        event_id = get_value_from_context(key="Arcanna.Event.event_id")
        job_id = get_value_from_context(key="Arcanna.Event.job_id")
        incident = demisto.incident()
        run_status = incident.get("runStatus")

        if run_status == "waiting":
            return_error("Trying to close and incident without completing task")

        incident_id = incident.get('id')
        if not event_id:
            demisto.debug("Trying to send feedback for an event which was not sent to Arcanna first.Skipping")
            return_results(f'Skipping event feedback with id={incident_id}')
            return

        args_closing_reason = demisto.args().get("closing_reason", None)
        if args_closing_reason:
            user = demisto.args().get("closing_user", None)
            notes = demisto.args().get("closing_notes", None)
            ret = send_arcanna_feedback(notes, args_closing_reason, user, event_id, job_id)
            return_results(ret)
        else:
            demisto.executeCommand("arcanna-get-feedback-field", {})

            feedback_field, feedback_field_value = extract_feedback_information()

            close_reason = incident.get('closeReason', None)
            close_notes = incident.get('closeNotes')
            owner = incident.get('owner', None)
            closing_user = incident.get('closingUserId', None)
            demisto.debug(f"Values supplied to command are{feedback_field} "
                          f"close_reason={close_reason} owner={owner} closing_user={closing_user} "
                          f"close_notes={close_notes}")

            # if feedback_field_value is not empty get that value, else use the default closeReason value
            if feedback_field_value:
                close_reason = feedback_field_value

            survey_user = get_value_from_context(key="Closure_Reason_Survey.Answers.name")
            # Arcanna-Generic-Playbook usage.Prevent sending Arcanna Feedback if no analyst reviewed the incident
            if str(close_notes).startswith(ARCANNA_AUTO_CLOSED_TICKET_PLAYBOOK_PLACEHOLDER):
                return_results(
                    f'Skipping Sending Arcanna event feedback for incident_id={incident_id}.No Analyst Reviewed')
                return

            if not closing_user and not close_notes and not close_reason:
                return_results(
                    f'Skipping Sending Arcanna event feedback for incident_id={incident_id}.No Analyst Reviewed')
                return

            if not close_reason:
                raise Exception(
                    "Trying to use Arcanna post-processing script without providing value for the closing field")

            closing_user = add_closing_user_information(closing_user, owner, survey_user)

            ret = send_arcanna_feedback(close_notes, close_reason, closing_user, event_id, job_id)
            return_results(ret)
    except Exception as ex:
        demisto.error(traceback.format_exc())  # print the traceback
        return_error(f'Failed to execute ArcannaFeedbackPostProcessingScript. Error: {str(ex)}')


''' ENTRY POINT '''

if __name__ in ('__main__', '__builtin__', 'builtins'):
    run_arcanna_send_feedback()