ChangeContext

Enables changing context in two ways. The first is to capitalize the first letter of each key in following level of the context key entered. The second is to change context keys to new values.

python · Common Scripts

Source

import json

from CommonServerPython import *


def replace_context(args: dict) -> tuple:
    context = args.get("input", "")
    output_key = args.get("output_key", "")
    inplace = args.get("inplace", "True") == "True"
    capitalize = args.get("capitalize") == "True"
    replace_dict = json.loads(args.get("replace_dict", "{}"))

    if not context:
        return "The context key you've entered is empty. Nothing has happened.", {}, {}

    if not isinstance(context, list | dict):
        return "The context key you've entered is at the lowest level and cannot be changed.", {}, {}

    def replace_func(key):
        if key in replace_dict:
            return replace_dict.get(key)
        else:
            if capitalize:
                return key.title()
            return key

    new_context = createContext(context, keyTransform=replace_func)

    if inplace:
        demisto.executeCommand("Set", {"key": output_key, "value": new_context})
        return f"Changed {output_key} successfully", {}, {}
    else:
        return f"Appended {output_key} successfully", {output_key: new_context}, {}


def main():
    hr, ec, raw = replace_context(demisto.args())
    return_outputs(hr, ec, raw)


if __name__ in ["__main__", "builtin", "builtins"]:
    main()

README

Enables changing context in two ways. The first is to capitalize the first letter of each key in following level of the context key entered. The second is to change context keys to new values.

Script Data

Name	Description
Script Type	python3
Tags	Utility
Cortex XSOAR Version	5.0.0

Used In

This script is used in the following playbooks and scripts.

QRadar - Get Offense Logs
QRadar - Get offense correlations v2
QRadarCorrelationLog
SafeBreach - Compare and Validate Insight Indicators

Inputs

Argument Name	Description
input	The context to change (i.e., ${Context.Key}).
inplace	If “True” replaces the existing key. The default is “True”.
replace_dict	A list of key-values to replace key for value in the following format: {“old_key1”:”new_key1”, “old_key2”:”new_key2”}
capitalize	If “True” capitalizes the first letter of the context key.
output_key	The context path in which to output the results. Should be in the format of Context.Key.

Outputs

There are no outputs for this script.