AssignAnalystToIncident

Assign analyst to incident. By default, the analyst is picked randomly from the available users, according to the provided roles (if no roles provided, will fetch all users). Otherwise, the analyst will be picked according to the 'assignBy' arguments. machine-learning: DBot will calculated and decide who is the best analyst for the job. top-user: The user that is most commonly owns this type of incident less-busy-user: The less busy analyst will be picked to be the incident owner. online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles provided, will fetch all users). current: The user that executed the command.

javascript · Common Scripts

Source

// returns true if the current platform is XSIAM.
isXsiam = function () {
    res = getDemistoVersion();
    platform = res.platform;
    if  (platform === "x2") {
        return true
    }
    return false
}

if (isXsiam()){
    incidentObject = JSON.parse(incObj);
    if (incidentObject.length > 0 && incidentObject[0].id.startsWith("INCIDENT")) {
        throw "AssignAnalystToIncident script can only be used within an alert and not from an incident."
    }
}


if (args.email && args.username) {
    throw 'Please provide either username or email';
}

var emailToAssign = args.email;
var userToAssign = args.username;

if (emailToAssign) {
    userToAssign = '';
    var res = executeCommand('getUsers',{});
    if (res && res[0] && res[0].Contents) {
        res[0].Contents.forEach(function(user) {
            if (user.email.toLowerCase() === args.email.toLowerCase()) {
                userToAssign = user.id;
            }
        });
    }
    if (!userToAssign) {
        throw 'Cannot find user with email ' + args.email;
    }
}

assignBy = args.assignBy || 'random';
var onCallArg = true ? args.onCall === 'true' : false;

function pickRandomUser(usersRes) {
    var usersList = usersRes[0].Contents.map(function (u) { return u.username });
    userToAssign = usersList[Math.floor(Math.random() * usersList.length)];
}
function pickRandomAvailableUser(usersRes) {
    var usersList = usersRes[0].Contents.filter(u => !u.isAway).map(function (u) { return u.username });
    userToAssign = usersList[Math.floor(Math.random() * usersList.length)];
}
if (!userToAssign) {
    switch(assignBy) {
        case 'online':
            var usersRes = executeCommand('getUsers', { roles: args.roles, online: true, onCall: onCallArg });
            if (isError(usersRes[0])) {
                return usersRes[0];
            }
            pickRandomAvailableUser(usersRes);
            break;
        case 'current':
            var usersRes = executeCommand('getUsers', { current: true, onCall: onCallArg });
            if (isError(usersRes[0])) {
                return usersRes[0];
            }
            pickRandomUser(usersRes);
            break;
        case 'random':
            var usersRes = executeCommand('getUsers', { roles: args.roles, onCall: onCallArg });
            if (isError(usersRes[0])) {
                return usersRes[0];
            }
            pickRandomAvailableUser(usersRes);
            break;
        default:
            res = executeCommand("getOwnerSuggestion", { roles: args.roles, shiftOnly: onCallArg })[0].Contents;

            switch (assignBy) {
                case 'machine-learning':
                    userToAssign = res.ownerByMl;
                    break;
                case 'top-user':
                    userToAssign = res.topOwner;
                    break;
                case 'less-busy-user':
                    userToAssign = res.userLeastLoad;
                    break;
            }

            if (!userToAssign) {
                var usersRes = executeCommand('getUsers', { roles: args.roles, onCall: onCallArg });
                if (isError(usersRes[0])) {
                    return usersRes[0];
                }
                pickRandomAvailableUser(usersRes);
            }
    }
}

if (userToAssign) {
    var res = executeCommand("setOwner", { owner: userToAssign });
    if (!isError(res[0])) {
        return 'User \'' + userToAssign + '\' assigned to be the incident owner.';
    } else {
        return {
          ContentsFormat: formats.text,
          Type: entryTypes.error,
          Contents: 'Failed to assign user: \'' + userToAssign + '\', error: ' + res[0].Contents
        };
    }
} else {
    return {
      ContentsFormat: formats.text,
      Type: entryTypes.error,
      Contents: 'No user found.'
    };
}

README

Assigns an analyst to an incident.
By default, the analyst is picked randomly from the available users, according to the provided roles. However, if no roles are provided, this will fetch all users.
The analyst will be picked according to the assignBy arguments.

Machine-Learning: DBot will calculate and decide who is the best analyst for the job.

top-user: The user that is most commonly owns this type of incident.
less-busy-user: The less busy analyst will be picked to be the incident owner.
online: The analyst is picked randomly from all online analysts, according to the provided roles (if no roles are provided, this will fetch all users).
current: The user that executed the command.

When the chosen assignBy argument is either: machine-learning, top-user or less-busy-user,
the selection of the analyst will not take into consideration the given role.

Script Data

Name	Description
Script Type	javascript
Tags	Utility

Inputs

Argument Name	Description
roles	The optional list of roles to assign users from. Can accept arrays or comma-separated list. Leave this empty to fetch all users.
assignBy	The owner to assign. Can be, “random”, “online”, “current”, “machine-learning”, “top-user”, or “less-busy-user”. The default is random.
username	The provided user who will be assigned as the incident owner (optional).
email	The user of the provided email who is assigned as the incident owner (optional).
onCall	Set to true to assign only a user that is currently on shift (optional, default: false). Requires Cortex XSOAR v5.5 or later.

Outputs

There are no outputs for this script.