AssociateIndicatorsToIncident

Details

ID	`AssociateIndicatorsToIncident`
Language	python
From Version	6.6.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	DomainTools

README

Associate Indicators to an Incident

Script Data

Name	Description
Script Type	python3
Tags	DomainTools
Cortex XSOAR Version	6.6.0

Used In

This script is used in the following playbooks and scripts.

DomainTools_Associate_Indicator_to_Incident

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

AssociateIndicatorsToIncident.py AssociateIndicatorsToIncident_test.py AssociateIndicatorsToIncident.yml

Download History Raw

from AssociateIndicatorsToIncident import main
from CommonServerPython import *


def test_associate_existing_indicators_to_incident_already_associated(mocker):
    mocker.patch.object(demisto, "context", return_value={"associatedIndicators": True})
    mocker.patch.object(demisto, "results")

    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0]
    assert len(results) == 1
    assert results[0]["HumanReadable"] == "Related indicators are already associated."


def test_associate_existing_indicators_to_incident(mocker):
    mocker.patch.object(demisto, "context", return_value={"associatedIndicators": False})
    mocker.patch.object(demisto, "incident", return_value={"id": 1, "CustomFields": {"additionalindicators": "2"}})
    mocker.patch.object(demisto, "results")

    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0]
    assert len(results) == 1
    assert results[0]["HumanReadable"] == "Associated 1 Indicators to Incident 1"