PreProcessAsimilyDedup

Asimily Preprocessing Rule for Deduplication of incoming incident. The script will be used for creating Pre-Process Rules for Incidents to avoid creating duplicate incidents. Comparison is based on incident type and dbotMirrorId.

python · Asimily Insight

Details

ID	`PreProcessAsimilyDedup`
Language	python
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	preProcessing

README

The script will be used for creating Pre-Process Rules for Incidents to avoid creating duplicate incidents. Comparison is based on incident type and dbotMirrorId.

Permissions

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations.
For Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script.
For Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name	Description
Script Type	python
Tags	preProcessing

Inputs

There are no inputs for this script.

Outputs

Returns False if incident already exists to Drop incoming incident. Otherwise return True.

Source

AsimilyPreProcessDedup.py AsimilyPreProcessDedup_test.py AsimilyPreProcessDedup.yml

Download History Raw

import demistomock as demisto  # noqa: F401
import pytest


@pytest.fixture(autouse=True)
def patch_missing_modules(mocker):
    mocker.patch.dict("sys.modules", {"DemistoClassApiModule": mocker.MagicMock()})


@pytest.mark.parametrize(
    "incident, existing_incidents, expected",
    [
        (
            # Case 1: missing type
            {"dbotMirrorId": "abc123"},
            [],
            True,
        ),
        (
            # Case 2: missing mirror id
            {"type": "Asimily Anomaly"},
            [],
            True,
        ),
        (
            # Case 3: unrelated incident type
            {"type": "Other Type", "dbotMirrorId": "abc123"},
            [],
            True,
        ),
        (
            # Case 4: valid type, no duplicates
            {"type": "Asimily Anomaly", "dbotMirrorId": "abc123"},
            [],
            True,
        ),
        (
            # Case 5: valid type, duplicate exists
            {"type": "Asimily Anomaly", "dbotMirrorId": "abc123"},
            [{"id": "123"}],
            False,
        ),
    ],
)
def test_main(mocker, incident, existing_incidents, expected):
    mocker.patch("demistomock.incidents", return_value=[incident])
    mocker.patch("demistomock.executeCommand", return_value=[{"Contents": {"data": existing_incidents}}])
    mock_results = mocker.patch("AsimilyPreProcessDedup.return_results")

    from AsimilyPreProcessDedup import main

    main()

    mock_results.assert_called_once_with(expected)