ContextSetup

This script simplifies how you add data to Cortex XSOAR's context. Use it to set static values or to map different values to existing context paths. Instead of a value you can enter TIMESTAMP to get the current timestamp in ISO format. For example: `!ContextSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" context_key="key"`.

python · Cortex Exposure Management

Details

IDContextSetup
Languagepython
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
TagsUtility

README

This script simplifies how you add data to Cortex XSOAR’s context. Use it to set static values or to map different values to existing context paths. Instead of a value you can enter TIMESTAMP to get the current timestamp in ISO format. For example:
!ContextSetup keys=ip,src,timestamp val1=${AWS.EC2.Instances.NetworkInterfaces.PrivateIpAddress} val2="AWS" val3="TIMESTAMP" context_key="key".

Script Data


Name Description
Script Type python3
Tags Utility
Cortex XSOAR Version 6.10.0

Dependencies


This script uses the following commands and scripts.

  • Set

Used In


This script is used in the following playbooks and scripts.

  • Cortex EM - Exposure Issue
  • Cortex EM - ServiceNow CMDB

Inputs


Argument Name Description
keys A comma-separated list of columns for the context key.
val1 A value for the 1st key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val2 A value for the 2nd key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val3 A value for the 3rd key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val4 A value for the 4th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val5 A value for the 5th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val6 A value for the 6th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val7 A value for the 7th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val8 A value for the 8th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val9 A value for the 9th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val10 A value for the 10th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val11 A value for the 11th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val12 A value for the 12th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val13 A value for the 13th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val14 A value for the 14th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val15 A value for the 15th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val16 A value for the 16th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val17 A value for the 17th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val18 A value for the 18th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val19 A value for the 19th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
val20 A value for the 20th key. (Can be a string or context path or `TIMESTAMP` to get the current timestamp in ISO format.)
context_key Context key to populate.
overwrite Whether to overwrite (true) or append (false) what is in the context key (default is false).

Outputs


There are no outputs for this script.

from ContextSetup import *
import pytest

incident_contains_field_in_root = {
    "field_name": "Test",
    "id": 2,
    "name": "This is incident2",
    "CustomFields": {"urlsslverification": [{"entryid": "abcd", "link": "1234"}, {"entryid": "abcd", "link": "1234"}]},
}


def test_append(mocker):
    """
    Tests context_setup_command with append functionality.
    Given: An incident with existing urlsslverification custom field data and valid arguments with multiple keys and values
    When: Running the 'context_setup_command' with append arguments
    Then: Checks the function executes successfully and appends new values to existing context data
    """
    args = {
        "keys": "Link,EntryID,TimeStamp",
        "val1": "www.google.com",
        "val2": "AWS",
        "val3": "TIMESTAMP",
        "context_key": "urlsslverification",
    }
    mocker.patch.object(demisto, "incidents", return_value=[incident_contains_field_in_root])
    mocker.patch.object(demisto, "executeCommand", return_value="Done")
    entry = context_setup_command(args)
    assert entry == "Done"


def test_overwrite(mocker):
    """
    Tests context_setup_command with overwrite functionality.
    Given: An incident with existing urlsslverification custom field data and overwrite flag set to true
    When: Running the 'context_setup_command' with overwrite enabled
    Then: Checks the function executes successfully and replaces existing context data with new values
    """
    args = {
        "keys": "Link,EntryID",
        "val1": "www.google.com",
        "val2": "AWS",
        "context_key": "urlsslverification",
        "overwrite": "true",
    }
    mocker.patch.object(demisto, "incidents", return_value=[incident_contains_field_in_root])
    mocker.patch.object(demisto, "executeCommand", return_value="Done")
    entry = context_setup_command(args)
    assert entry == "Done"


def test_error(mocker):
    """
    Tests context_setup_command error handling.
    Given: An incident with existing data and mismatched keys and values causing validation errors
    When: Running the 'context_setup_command' with invalid key-value mapping
    Then: Checks the function raises ValueError due to key-value count mismatch and fails validation
    """
    args = {"keys": "Link", "val1": "www.google.com", "val2": "AWS", "context_key": "urlsslverification", "overwrite": "true"}
    mocker.patch.object(demisto, "incidents", return_value=[incident_contains_field_in_root])
    mocker.patch.object(demisto, "executeCommand", return_value="Done")
    with pytest.raises(ValueError):
        context_setup_command(args)