CopyLinkedAnalystNotes

Copies the anaylst notes from the integrations and incidents grid. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Integrations & Incidents Health Check

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def create_grids(custom_fields, linked_incident):
    latest_related_incident_id = max(linked_incident)
    linked_list_data = demisto.executeCommand("getIncidents", {"id": latest_related_incident_id})
    linked_content = linked_list_data[0].get("Contents", {}).get("data")[0]
    linked_created_date = linked_content.get("created", {}).split("T")[0]
    linked_integrations_data = linked_content.get("CustomFields").get("integrationstestgrid", {})  # table of the linked incident

    integrations_data = {}
    for row in linked_integrations_data:
        instance_id = row.get("instance")
        integrations_data[instance_id] = row.get("analystnote", "")

    main_integration_grid = custom_fields.get("integrationstestgrid")  # Main incident table for integrations
    for main_row in main_integration_grid:
        if not main_row.get("analystnote"):
            last_analyst_note = integrations_data.get(main_row.get("instance"), "")
            if last_analyst_note:
                main_row["analystnote"] = (
                    f'({str(linked_created_date)}) {integrations_data.get(main_row.get("instance"), "")}'
                )

    incidents_data: dict[str, tuple] = {}
    linked_incidentsD_data = linked_content.get("CustomFields").get("playbooktaskserrors", {})  # table of the linked incident
    for row in linked_incidentsD_data:
        incidents_data[row.get("incidentid")] = (row.get("task_id"), row.get("analystnote", ""))

    main_incident_grid = custom_fields.get("playbooktaskserrors")  # Main incident table for incidents
    for main_row in main_incident_grid:
        if main_row.get("incidentid") not in incidents_data:
            # Does not appear in the last incident
            continue

        main_row["task_id"] = incidents_data[main_row.get("incidentid")][0]

        if not main_row.get("analystnote"):
            last_analyst_note = incidents_data[main_row.get("incidentid")][1]
            if last_analyst_note:
                main_row["analystnote"] = f'({str(linked_created_date)}) {incidents_data[main_row.get("incidentid")][1]}'

    return main_integration_grid, main_incident_grid


def main():
    incident = demisto.incidents()[0]
    custom_fields = incident.get("CustomFields")
    linked_incident = custom_fields.get("similarincident")

    if linked_incident:
        main_integration_grid, main_incident_grid = create_grids(custom_fields, linked_incident)
        main_incident_grid.sort(
            key=lambda incident_dict: incident_dict.get("creationdate", ""), reverse=True
        )  # sort incident grid by creation date

        demisto.executeCommand("setIncident", {"customFields": {"integrationstestgrid": main_integration_grid}})
        demisto.executeCommand("setIncident", {"customFields": {"playbooktaskserrors": main_incident_grid}})


if __name__ in ["__main__", "builtin", "builtins"]:
    main()

README

Copies the anaylst notes from the integrations and incidents grid.

Permissions

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name Description
Script Type python3
Tags failedIncidents, failedInstances
Cortex XSOAR Version 6.0.0

Used In

This script is used in the following playbooks and scripts.

  • JOB - Integrations and Playbooks Health Check

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.