ContextSetup
This script simplifies how you add data to Cortex XSOAR's context. Use it to set static values or to map different values to existing context paths. Instead of a value you can enter TIMESTAMP to get the current timestamp in ISO format. For example: `!ContextSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" context_key="key"`.
python · Cortex Exposure Management
Details
| ID | ContextSetup |
|---|---|
| Language | python |
| From Version | 6.10.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Tags | Utility |
README
This script simplifies how you add data to Cortex XSOAR’s context. Use it to set static values or to map different values to existing context paths. Instead of a value you can enter TIMESTAMP to get the current timestamp in ISO format. For example:
!ContextSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" context_key="key".
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | Utility |
| Cortex XSOAR Version | 6.10.0 |
Dependencies
This script uses the following commands and scripts.
- Set
Used In
This script is used in the following playbooks and scripts.
- Cortex EM - Exposure Issue
- Cortex EM - ServiceNow CMDB
Inputs
| Argument Name | Description |
|---|---|
| keys | A comma-separated list of columns for the context key. |
| val1 | A value for the 1st key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val2 | A value for the 2nd key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val3 | A value for the 3rd key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val4 | A value for the 4th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val5 | A value for the 5th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val6 | A value for the 6th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val7 | A value for the 7th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val8 | A value for the 8th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val9 | A value for the 9th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val10 | A value for the 10th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val11 | A value for the 11th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val12 | A value for the 12th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val13 | A value for the 13th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val14 | A value for the 14th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val15 | A value for the 15th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val16 | A value for the 16th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val17 | A value for the 17th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val18 | A value for the 18th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val19 | A value for the 19th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| val20 | A value for the 20th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.) |
| context_key | Context key to populate. |
| overwrite | Whether to overwrite (true) or append (false) what is in the context key (default is false). |
Outputs
There are no outputs for this script.
from ContextSetup import * import pytest incident_contains_field_in_root = { "field_name": "Test", "id": 2, "name": "This is incident2", "CustomFields": {"urlsslverification": [{"entryid": "abcd", "link": "1234"}, {"entryid": "abcd", "link": "1234"}]}, } def test_append(mocker): """ Tests context_setup_command with append functionality. Given: An incident with existing urlsslverification custom field data and valid arguments with multiple keys and values When: Running the 'context_setup_command' with append arguments Then: Checks the function executes successfully and appends new values to existing context data """ args = { "keys": "Link,EntryID,TimeStamp", "val1": "www.google.com", "val2": "AWS", "val3": "TIMESTAMP", "context_key": "urlsslverification", } mocker.patch.object(demisto, "incidents", return_value=[incident_contains_field_in_root]) mocker.patch.object(demisto, "executeCommand", return_value="Done") entry = context_setup_command(args) assert entry == "Done" def test_overwrite(mocker): """ Tests context_setup_command with overwrite functionality. Given: An incident with existing urlsslverification custom field data and overwrite flag set to true When: Running the 'context_setup_command' with overwrite enabled Then: Checks the function executes successfully and replaces existing context data with new values """ args = { "keys": "Link,EntryID", "val1": "www.google.com", "val2": "AWS", "context_key": "urlsslverification", "overwrite": "true", } mocker.patch.object(demisto, "incidents", return_value=[incident_contains_field_in_root]) mocker.patch.object(demisto, "executeCommand", return_value="Done") entry = context_setup_command(args) assert entry == "Done" def test_error(mocker): """ Tests context_setup_command error handling. Given: An incident with existing data and mismatched keys and values causing validation errors When: Running the 'context_setup_command' with invalid key-value mapping Then: Checks the function raises ValueError due to key-value count mismatch and fails validation """ args = {"keys": "Link", "val1": "www.google.com", "val2": "AWS", "context_key": "urlsslverification", "overwrite": "true"} mocker.patch.object(demisto, "incidents", return_value=[incident_contains_field_in_root]) mocker.patch.object(demisto, "executeCommand", return_value="Done") with pytest.raises(ValueError): context_setup_command(args)