Cyren-Show-Threat-Indicators

Displays threat indicators in readable format This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Cyren Inbox Security

Details

ID	`Cyren-Show-Threat-Indicators`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Tags	incidents dynamic-section transformer

README

Displays threat indicators in readable format

Permissions

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name	Description
Script Type	python3
Tags	incidents, dynamic-section, transformer
Cortex XSOAR Version	6.0.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Script Example


## Context Example

```json
{}

Human Readable Output

Number of indicators: 0

Source

CyrenShowThreatIndicators.py CyrenShowThreatIndicators.yml

Download History Raw

import json

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def stringify_indicators(threat_indicators):
    #

    indicator_type = threat_indicators.get("type")

    # url indicators
    if indicator_type == "url":
        return tableToMarkdown("", threat_indicators, ["type", "subType", "value"], pretty_title) + "\n\n"

    # attachment indicators
    if indicator_type == "attachment":
        attachment = threat_indicators.get("attachment", [])
        attachment["type"] = "attachment"
        return (
            tableToMarkdown("", attachment, ["type", "file_name", "file_size", "file_category", "file_hash"], pretty_title)
            + "\n\n"
        )

    # other indicators
    if threat_indicators.get("type") is not None:
        return tableToMarkdown("", threat_indicators, ["type", "value"], pretty_title) + "\n\n"
    return None


def pretty_title(s):
    s = s.replace("_", " ")
    return pascalToSpace(s)


def no_indicators():
    return {
        "ContentsFormat": formats["markdown"],
        "Type": entryTypes["note"],
        "Contents": "No indicators identified by system. _Refer to user feedback._\n",
    }


def main():
    try:
        threat_indicators = demisto.get(demisto.incidents()[0], "CustomFields.cyrenthreatindicators")
        if not threat_indicators:
            threat_indicators = "[]"

        threat_indicators = json.loads(threat_indicators)
        markdown_result = ""

        # show threat indicators
        if isinstance(threat_indicators, list):
            markdown_result += f"**Number of indicators:**&nbsp;&nbsp;&nbsp;&nbsp; {len(threat_indicators)}\n\n"
            for x in threat_indicators:
                markdown_result += stringify_indicators(x)
        else:
            markdown_result += stringify_indicators(threat_indicators)

        if markdown_result == "":
            return no_indicators()

        return {"ContentsFormat": formats["markdown"], "Type": entryTypes["note"], "Contents": markdown_result}

    except Exception as e:
        return_error(f"Failed to execute CyrenShowThreatIndicators. Error: {e!s}")


if __name__ in ["__main__", "__builtin__", "builtins"]:
    entry = main()
    return_results(entry)