ContextSetup
This script simplifies how you add data to Cortex XSOAR's context. Use it to set static values or to map different values to existing context paths. Instead of a value you can enter TIMESTAMP to get the current timestamp in ISO format. For example: `!ContextSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" context_key="key"`.
python · Cortex Exposure Management
Source
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 def context_setup(keys: list[str], vals: dict) -> list[dict[str, str]]: """Prepares key/value mapping to prepare input into XSOAR context :type keys: list[str] :type vals: ``dict`` :param keys: comma separated values used for keys (columns) :param vals: dictionary of the value assigned to keys :return: list of dictionaries """ res_list = [] temp = {} for i, key in enumerate(keys, start=1): if vals[f"val{i}"] == "TIMESTAMP": timestamp = datetime.now().strftime("%Y-%m-%dT%H:%M:%S.%fZ") temp[key] = timestamp demisto.debug(f"Generated timestamp for key '{key}': {timestamp}") else: temp[key] = vals[f"val{i}"] demisto.debug(f"Set key '{key}' to value: {vals[f'val{i}']}") res_list.append(temp) demisto.debug(f"Context setup completed. Result: {res_list}") return res_list """ COMMAND FUNCTION """ def context_setup_command(args: dict[str, str]) -> CommandResults: """ Main command that takes key/value pairs and formats them in a way that allows input into XSOAR context. Args: args (Dict[str, Any]): Demisto.args() object Returns: CommandResults: human readable message of results of !Set command. """ keys = argToList(args.get("keys", [])) overwrite = argToBoolean(args.get("overwrite", False)) context_key = args.get("context_key", None) demisto.debug(f"Parsed keys: {keys}, Overwrite mode: {overwrite} Context key: {context_key}") # dictionary or all vals vals = {k: v for k, v in args.items() if k.startswith("val")} demisto.debug(f"Extracted values: {vals}") # error is keys and value numbers don't align if len(keys) != len(vals): error_msg = f"Number of keys ({len(keys)}) and values ({len(vals)}) needs to be the same" demisto.debug(f"Validation error: {error_msg}") raise ValueError(error_msg) # Call the standalone function and get the raw response result = context_setup(keys, vals) if overwrite: demisto.debug(f"Setting context key '{context_key}' with overwrite=True") results = demisto.executeCommand("Set", {"key": context_key, "value": result}) else: demisto.debug(f"Setting context key '{context_key}' with append=true") results = demisto.executeCommand("Set", {"key": context_key, "value": result, "append": "true"}) return results """ MAIN FUNCTION """ def main(): try: return_results(context_setup_command(demisto.args())) except Exception as ex: demisto.error(traceback.format_exc()) # print the traceback demisto.error(str(ex)) return_error(f"Failed to execute ContextSetup. Error: {str(ex)}") """ ENTRY POINT """ if __name__ in ("__main__", "__builtin__", "builtins"): main()
README
This script simplifies how you add data to Cortex XSOAR’s context. Use it to set static values or to map different values to existing context paths. Instead of a value you can enter TIMESTAMP to get the current timestamp in ISO format. For example:
!ContextSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" context_key="key".
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | Utility |
| Cortex XSOAR Version | 6.10.0 |
Dependencies
This script uses the following commands and scripts.
- Set
Used In
This script is used in the following playbooks and scripts.
- Cortex EM - Exposure Issue
- Cortex EM - ServiceNow CMDB
Inputs
| Argument Name | Description |
|---|---|
| keys | A comma-separated list of columns for the context key. |
| val1 | A value for the 1st key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val2 | A value for the 2nd key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val3 | A value for the 3rd key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val4 | A value for the 4th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val5 | A value for the 5th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val6 | A value for the 6th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val7 | A value for the 7th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val8 | A value for the 8th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val9 | A value for the 9th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val10 | A value for the 10th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val11 | A value for the 11th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val12 | A value for the 12th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val13 | A value for the 13th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val14 | A value for the 14th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val15 | A value for the 15th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val16 | A value for the 16th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val17 | A value for the 17th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val18 | A value for the 18th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val19 | A value for the 19th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val20 | A value for the 20th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| context_key | Context key to populate. |
| overwrite | Whether to overwrite (true) or append (false) what is in the context key (default is false). |
Outputs
There are no outputs for this script.