CybereasonPreProcessingExample

Preprocessing script to run when fetching Cybereason malops. Will check if malop was already fetched, and will then update the existing incident, otherwise will create a new incident.

python · Cybereason

Details

ID	`CybereasonPreProcessingExample`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	preProcessing Cybereason example

README

Checks if the malop was already fetched, and will update the existing incident accordingly. Otherwise, it will create a new incident. Run the pre-processing script when fetching Cybereason malops.

Script Data

Name	Description
Script Type	python
Tags	preProcessing, Cybereason, example

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

CybereasonPreProcessingExample.py CybereasonPreProcessingExample_test.py CybereasonPreProcessingExample.yml

Download History Raw

from CommonServerPython import *  # noqa: F401


def test_main(mocker):
    """
    Given:
        - The CyberReasonPreProcessingExample.
    When:
        - Running the script function.
    Then:
        - Validating the incidents outputs as expected.
    """
    from CybereasonPreProcessingExample import get_guid_from_system_incident

    test_data = {
        "labels": [
            {"type": "x", "value": "not found"},
            {"type": "guidString", "value": "12345678"},
            {"type": "x", "value": "nothing"},
            {"type": "GUID", "value": "12345678"},
            {"type": "y", "value": "nanana"},
        ]
    }

    malopGuid = get_guid_from_system_incident(test_data)

    assert malopGuid == "12345678"