CheckContextValue

This script checks that a context key exists (and contains data), and optionally checks the value of the context key for a match against an input value. If a regex is not supplied, the script checks that the key is not empty. This script can be used with the "GenericPolling" playbook to poll for field population or that a field contains a specific value. This scripts does not support a context key which holds a list of values.

python · Common Scripts

Details

IDCheckContextValue
Languagepython
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10404775
Tagsevaluation polling

README

This script checks that a context value exists (and contains data), and optionally checks the value of the key for a match against an input value. This script can be used with the “GenericPolling” playbook to poll for field population or that a field contains a specific value.

Script Data

Name Description
Script Type python3
Tags evaluation, polling
Cortex XSOAR Version 5.0.0

Inputs

Argument Name Description
key The key to check (can contain. ex: key1.key2.key3)
regex The regex pattern to check the field for. (optional).
ignore_case Whether character matching will be case-insensitive. Default is “False”.

Outputs

Path Description Type
CheckContextKey.name Key Name string
CheckContextKey.exists.exists Whether the Key Exists. Unknown

Source

CheckContextValue.py CheckContextValue_test.py CheckContextValue.yml
Download History Raw 
from CheckContextValue import poll_field
from CommonServerPython import *

context = {
    "id": 1,
    "name": "This is incident1",
    "type": "Phishing",
    "severity": 0,
    "status": 1,
    "created": "2019-01-02",
    "closed": "0001-01-01T00:00:00Z",
    "foo": "bar",
}

missing_context = {
    "id": 2,
    "name": "This is incident2",
    "type": "Phishing",
    "severity": 0,
    "status": 1,
    "created": "2019-01-02",
    "closed": "0001-01-01T00:00:00Z",
}


def test_poll_context_field_from_root(mocker):
    """Unit test
    Given
        - An incident with the context field named 'foo' with value 'bar' in the root
        - The regex sent is matching the field value
    When
        - mock the server response to demisto.context().
    Then
        Validate the script finds the field
    """
    mocker.patch.object(demisto, "context", return_value=context)
    args = {
        "key": "foo",
    }

    result = poll_field(args)

    assert result.readable_output in "The key exists."
    assert result.outputs["exists"] is True


def test_poll_context_field_from_root_with_regex_failure(mocker):
    """Unit test
    Given
        - An incident with the context field named 'foo' with value 'bar' in the root
        - The regex sent does not match the context field value
    When
        - mock the server response to demisto.context().
    Then
        Validate the script returns a false value
    """
    mocker.patch.object(demisto, "context", return_value=context)
    args = {
        "key": "foo",
        "regex": "^a",
    }

    result = poll_field(args)

    assert result.readable_output in "The key does not exist."
    assert result.outputs["exists"] is False


def test_poll_field_from_root_with_regex_success(mocker):
    """Unit test
    Given
        - An incident with the context field named 'foo' with value 'bar' in root
        - No regex argument sent to the command
    When
        - mock the server response to demisto.context().
    Then
        Validate the script finds the context field
    """
    mocker.patch.object(demisto, "context", return_value=context)
    args = {
        "key": "foo",
        "regex": "^b",
    }

    result = poll_field(args)

    assert result.readable_output in "The key exists."
    assert result.outputs["exists"] is True


def test_poll_missing_context_field_in_root(mocker):
    """Unit test
    Given
        - An incident without the context field named 'foo' in the root
    When
        - mock the server response to demisto.context().
    Then
        Validate the script returns a false value
    """
    mocker.patch.object(demisto, "context", return_value=missing_context)
    args = {
        "key": "foo",
    }

    result = poll_field(args)

    assert result.readable_output in "The key does not exist."
    assert result.outputs["exists"] is False