BuildEWSQuery

Source

import re

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def build_ews_query(demisto_args):
    # Regex for removing forward/replay prefixes
    p = re.compile(r"([\[\(] *)?(RE|FWD?) *([-:;)\]][ :;\])-]*|$)|\]+ *$", re.IGNORECASE)

    args = {}

    if demisto_args.get("from"):
        args["From"] = demisto_args.get("from")
    if demisto_args.get("subject"):
        args["Subject"] = demisto_args.get("subject")
    if demisto_args.get("attachmentName"):
        args["Attachment"] = demisto_args.get("attachmentName")
    if demisto_args.get("body"):
        args["Body"] = demisto_args.get("body")

    stripSubject = demisto_args.get("stripSubject").lower() == "true"
    escapeColons = demisto_args.get("escapeColons").lower() == "true"
    if stripSubject and args.get("Subject"):
        # Recursively remove the regex matches only from the beginning of the string
        match_string = args["Subject"]
        location_match = p.match(match_string)
        location = location_match.start() if location_match else -1

        while location == 0 and match_string:
            match_string = p.sub("", match_string, 1)
            location_match = p.match(match_string)
            location = location_match.start() if location_match else -1

        args["Subject"] = match_string

    if escapeColons:
        query = " AND ".join(rf'{key}\\:"{value}"' for (key, value) in args.items())

    else:
        query = " AND ".join(f'{key}:"{value}"' for (key, value) in args.items())

    search_last_week = demisto_args.get("searchThisWeek").lower() == "true"
    if search_last_week:
        query = query + ' AND Received:"this week"'

    return CommandResults(
        content_format=formats["json"],
        raw_response={"EWS": {"Query": query or " "}},
        entry_type=entryTypes["note"],
        readable_output=query or " ",
        outputs={"EWS": {"Query": query or " "}},
    )


def main():  # pragma: no cover
    args = demisto.args()
    try:
        return_results(build_ews_query(args))
    except Exception as e:
        err_msg = f"Encountered an error while running the script: [{e}]"
        return_error(err_msg, error=e)


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README