CustomContentBundleWizardry
This automation accepts an XSOAR custom content bundle, and either returns a list of file names, or the files you want to the war room.
python · XSOAR - Simple Dev to Prod
Source
import io import tarfile import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 # arguments action = demisto.args().get("action") entry_id = demisto.args().get("entry_id") file_names = demisto.args().get("file_names") # handle single file export by ensuring it's still a list if not isinstance(file_names, list): file_names = [file_names] # check if the content bundle exists res = demisto.getFilePath(entry_id) if not res: return_error(f"Entry {entry_id} not found") file_path = res.get("path") # Return a list of custom content in the content bundle if action == "listfiles": files = [] with open(file_path, "rb") as f: data = f.read() tar = tarfile.open(fileobj=io.BytesIO(data)) files = tar.getnames() files = [file[1:] for file in files] readable = f"Got {len(files)} file names from custom content bundle" results = CommandResults(readable_output=readable, outputs_prefix="CustomContent", outputs=files) return_results(results) # Return the selected files to the war room if action == "exportfiles": files = [f"/{file}" for file in file_names] exported_files = [] with open(file_path, "rb") as f: data = f.read() tar = tarfile.open(fileobj=io.BytesIO(data)) for member in tar.getmembers(): path = member.name if path in files: data = tar.extractfile(member) # type:ignore f = data.read() # type:ignore exported_files.append(member.name[1:]) demisto.results(fileResult(member.name[1:], f)) demisto.results(f"Added the following files to Context: {exported_files}")
README
This automation accepts an XSOAR custom content bundle, and either returns a list of file names, or the files you want to the war room.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | Utility |
| Cortex XSOAR Version | 6.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| entry_id | The EntryID of the custom content bundle from the war room. |
| action | Whether to list the files in the bundle, or return the selected files to the war room. |
| file_names | Array of file names to export, generated from the listfiles action. |
Outputs
| Path | Description | Type |
|---|---|---|
| CustomContent | List of files in the custom content bundle | Unknown |