CopyContextToField

Copy a context key to an incident field of multiple incidents, based on an incident query. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Common Scripts

Source

from CommonServerPython import *


def get_context(incident_id):
    res = demisto.executeCommand("getContext", {"id": incident_id})
    try:
        return res[0]["Contents"].get("context") or {}
    except Exception:
        return {}


res = demisto.executeCommand("getIncidents", {"query": demisto.args()["incidentsQuery"], "limit": int(demisto.args()["limit"])})
incidents = res[0]["Contents"]["data"]
src_context_key = demisto.args()["sourceContextKey"]
target_incident_field = demisto.args()["targetIncidentField"]
list_separator = demisto.args()["listSeparator"]
success_count = 0
failed_count = 0
skipped_count = 0
for i in incidents:
    incident_id = i["id"]
    context = get_context(incident_id)
    value = demisto.dt(context, src_context_key)
    if isinstance(value, list) and len(value) > 0:
        if len(value) == 1:
            value = value[0]
        elif isinstance(value[0], STRING_TYPES):
            value = list_separator.join(value)
    if value and not isinstance(value, list) and not isinstance(value, dict):
        res = demisto.executeCommand("setIncident", {target_incident_field: value, "id": i["id"]})
        if isError(res[0]):
            failed_count += 1
        else:
            success_count += 1
    else:
        skipped_count += 1

if success_count > 0:
    return_results(f"Update incidents: {success_count} success")
if skipped_count > 0:
    return_results(f"Skipped {skipped_count} incidents due to missing value")
if failed_count > 0:
    return_results(f"Failed to update {failed_count} incidents with setIncident error")

README

Copy a context key to an incident field of multiple incidents, based on an incident query.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name	Description
Script Type	python2
Tags	Utility
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
sourceContextKey	The context key from which to get the value.
targetIncidentField	The incident field to set with the value.
incidentsQuery	The incidents query on which to apply the copy process. For example, to apply this to all incidents of type “Phishing”, use the query: “type:Phishing”.
limit	The maximum number of incidents to edit. Default is 1,000.
listSeparator	Concatenates list values.

Outputs

There are no outputs for this script.