CyphoAddCommentButton

python · Cypho Threat Intelligence

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

try:
    incident = demisto.incident() or {}
    custom_fields = incident.get("CustomFields", {}) or {}

    comment = custom_fields.get("cyphocomments")
    ticket_id = custom_fields.get("cyphoticketid")
    owner = incident.get("owner")

    if not owner:
        raise DemistoException("Incident is not assigned. Please assign an owner before adding a comment.")

    if not ticket_id or not comment:
        raise DemistoException("Missing required fields: Cypho Ticket ID or Cypho Comment.")

    users_response = demisto.executeCommand("getUsers", {})
    if isError(users_response[0]):
        raise DemistoException("Failed to retrieve user list.")

    users = users_response[0].get("Contents", [])
    user_info = next((u for u in users if u.get("username") == owner), None)

    if not user_info or not user_info.get("email"):
        raise DemistoException(f"Could not find email for incident owner '{owner}'.")

    email = user_info.get("email")
    args = {"ticket_id": ticket_id, "user_email": email, "status_reason": comment}

    response = demisto.executeCommand("cypho-add-comment", args)
    if isError(response[0]):
        raise DemistoException(f"Failed to add comment: {response[0].get('Contents')}")

    return_results(CommandResults(readable_output=f"Comment successfully added to Cypho ticket {ticket_id} by {owner}."))

except Exception as e:
    demisto.error(f"[CyphoAddCommentButton] Error: {str(e)}")
    return_results(CommandResults(readable_output=f"Failed to add comment: {str(e)}"))

README

Cypho Add Comment Button

This automation allows analysts to add a comment to a Cypho issue directly from Cortex XSOAR.

The script is designed to be used as a button automation on Cypho-related incidents. When executed, it synchronizes the analyst’s comment from XSOAR to the corresponding issue in Cypho, ensuring that investigation notes, explanations, and analyst feedback remain consistent across both platforms.

The automation validates that the incident is properly assigned to an owner before executing the action. This ensures accountability, accurate analyst activity tracking, and alignment with Cypho’s incident management workflow.

Script Data


Name Description
Script Type python3
Tags incident-action, button

Inputs


There are no manual inputs for this script.
The automation automatically uses:

  • The current incident owner
  • The analyst comment provided in XSOAR
  • The associated Cypho ticket ID

Outputs


There are no outputs for this script.
The script performs a background synchronization and adds the comment to the corresponding Cypho issue.

✔ Notes

  • This script is intended to be executed via a button on the incident layout.
  • The incident must be assigned before a comment can be added.
  • Designed to reduce manual context switching between Cypho and Cortex XSOAR.
  • Ensures consistent documentation and investigation notes across platforms.