CyphoAddCommentButton
python · Cypho Threat Intelligence
Source
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 try: incident = demisto.incident() or {} custom_fields = incident.get("CustomFields", {}) or {} comment = custom_fields.get("cyphocomments") ticket_id = custom_fields.get("cyphoticketid") owner = incident.get("owner") if not owner: raise DemistoException("Incident is not assigned. Please assign an owner before adding a comment.") if not ticket_id or not comment: raise DemistoException("Missing required fields: Cypho Ticket ID or Cypho Comment.") users_response = demisto.executeCommand("getUsers", {}) if isError(users_response[0]): raise DemistoException("Failed to retrieve user list.") users = users_response[0].get("Contents", []) user_info = next((u for u in users if u.get("username") == owner), None) if not user_info or not user_info.get("email"): raise DemistoException(f"Could not find email for incident owner '{owner}'.") email = user_info.get("email") args = {"ticket_id": ticket_id, "user_email": email, "status_reason": comment} response = demisto.executeCommand("cypho-add-comment", args) if isError(response[0]): raise DemistoException(f"Failed to add comment: {response[0].get('Contents')}") return_results(CommandResults(readable_output=f"Comment successfully added to Cypho ticket {ticket_id} by {owner}.")) except Exception as e: demisto.error(f"[CyphoAddCommentButton] Error: {str(e)}") return_results(CommandResults(readable_output=f"Failed to add comment: {str(e)}"))
README
Cypho Add Comment Button
This automation allows analysts to add a comment to a Cypho issue directly from Cortex XSOAR.
The script is designed to be used as a button automation on Cypho-related incidents. When executed, it synchronizes the analyst’s comment from XSOAR to the corresponding issue in Cypho, ensuring that investigation notes, explanations, and analyst feedback remain consistent across both platforms.
The automation validates that the incident is properly assigned to an owner before executing the action. This ensures accountability, accurate analyst activity tracking, and alignment with Cypho’s incident management workflow.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | incident-action, button |
Inputs
There are no manual inputs for this script.
The automation automatically uses:
- The current incident owner
- The analyst comment provided in XSOAR
- The associated Cypho ticket ID
Outputs
There are no outputs for this script.
The script performs a background synchronization and adds the comment to the corresponding Cypho issue.
✔ Notes
- This script is intended to be executed via a button on the incident layout.
- The incident must be assigned before a comment can be added.
- Designed to reduce manual context switching between Cypho and Cortex XSOAR.
- Ensures consistent documentation and investigation notes across platforms.