CaseMgmtIncidentTypesByRole
Restricts the Incident Types a user can create manually, based on their assigned XSOAR Role(s). Requirements - Create an XSOAR List called IncidentTypeRBAC with the following structure, the names must match exactly to the names in the Incident Types under Settings! Example List: { "Default":["Case","Job","Unclassified"], "Analyst":["Phishing","Malware"], "ThreatHunters":["Hunt"] }
python · CaseManagement-Generic
Source
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 # check if this is a new Incident or not incident = demisto.incident().get("id") # if new Incident, the ID will be empty: if not incident: # get the XSOAR IncidentTypesRBAC XSOAR List types_list = demisto.executeCommand("getList", {"listName": "IncidentTypesRBAC"})[0]["Contents"] # check if the list exists, if not, display the default options. if "Item not found" in types_list: # do nothing, return the original values from the field pass else: # make sure the list is valid json, if it's invalid or another error, return the original values from the field try: role_list = json.loads(types_list) # get the users roles roles = demisto.executeCommand("getUsers", {"current": "true"})[0].get("Contents")[0].get("allRoles") # set default Incident types for all roles allowedTypes = role_list["Default"] # for each role the user has, add their types if the role exists in the list for role in roles: if role in role_list: allowedTypes.extend(role_list[role]) # remove duplicates allowedTypes = list(set(allowedTypes)) demisto.results({"hidden": False, "options": allowedTypes}) except ValueError: pass except Exception: pass else: # if it's an existing Incident, prevent changing the type from the UI. # get the current Incident Type, and only return that type. incident_type = demisto.incident().get("type") return_results({"hidden": False, "options": [incident_type]})
README
Restricts the Incident Types a user can create manually, based on their assigned XSOAR Role(s).
Requirements - Create an XSOAR List called IncidentTypeRBAC with the following structure, the names must match exactly to the names in the Incident Types under Settings!
Example List:
{
“Default”:[“Case”,”Job”,”Unclassified”],
“Analyst”:[“Phishing”,”Malware”],
“ThreatHunters”:[“Hunt”]
}
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | field-display |
| Cortex XSOAR Version | 6.5.0 |
Inputs
There are no inputs for this script.
Outputs
There are no outputs for this script.