CustomContentBundleWizardry

This automation accepts an XSOAR custom content bundle, and either returns a list of file names, or the files you want to the war room.

python · XSOAR - Simple Dev to Prod

Source

import io
import tarfile

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

# arguments
action = demisto.args().get("action")
entry_id = demisto.args().get("entry_id")
file_names = demisto.args().get("file_names")

# handle single file export by ensuring it's still a list
if not isinstance(file_names, list):
    file_names = [file_names]

# check if the content bundle exists
res = demisto.getFilePath(entry_id)
if not res:
    return_error(f"Entry {entry_id} not found")

file_path = res.get("path")

# Return a list of custom content in the content bundle
if action == "listfiles":
    files = []
    with open(file_path, "rb") as f:
        data = f.read()
        tar = tarfile.open(fileobj=io.BytesIO(data))
        files = tar.getnames()

    files = [file[1:] for file in files]
    readable = f"Got {len(files)} file names from custom content bundle"
    results = CommandResults(readable_output=readable, outputs_prefix="CustomContent", outputs=files)

    return_results(results)

# Return the selected files to the war room
if action == "exportfiles":
    files = [f"/{file}" for file in file_names]
    exported_files = []
    with open(file_path, "rb") as f:
        data = f.read()
        tar = tarfile.open(fileobj=io.BytesIO(data))

        for member in tar.getmembers():
            path = member.name
            if path in files:
                data = tar.extractfile(member)  # type:ignore
                f = data.read()  # type:ignore
                exported_files.append(member.name[1:])
                demisto.results(fileResult(member.name[1:], f))

    demisto.results(f"Added the following files to Context: {exported_files}")

README

This automation accepts an XSOAR custom content bundle, and either returns a list of file names, or the files you want to the war room.

Script Data


Name Description
Script Type python3
Tags Utility
Cortex XSOAR Version 6.0.0

Inputs


Argument Name Description
entry_id The EntryID of the custom content bundle from the war room.
action Whether to list the files in the bundle, or return the selected files to the war room.
file_names Array of file names to export, generated from the listfiles action.

Outputs


Path Description Type
CustomContent List of files in the custom content bundle Unknown