DBotGroupXDRIncidents

Train clustering model on Cortex XDR incident type.

python · Cortex XDR by Palo Alto Networks

Details

ID	`DBotGroupXDRIncidents`
Language	python
From Version	6.2.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	widget

README

Train clustering model on Cortex XDR incident type.

Script Data

Name	Description
Script Type	python3
Tags	widget
Cortex XSOAR Version	6.2.0

Inputs

Argument Name	Description
returnWidgetType	The type of the widget to return.
fromDate	The start date by which to filter incidents. Date format will be the same as in the incidents query page, for example: “3 days ago”, ““2019-01-01T00:00:00 +0200”).
limit	The maximum number of incidents to fetch
incidentType	The Cortex XDR incident type
searchQuery	Input search query from the dashboard
modelExpiration	Period of time (in hours) before retraining the model. Default is “24”.
forceRetrain	Determines whether to force the model to re-train. Default is “False”.
fieldsToDisplay	Comma-separated list of additional incident fields to display, but which will not be taken into account when computing similarity.

Outputs

There are no outputs for this script.

Source

DBotGroupXDRIncidents.py DBotGroupXDRIncidents_test.py DBotGroupXDRIncidents.yml

Download History Raw

import json

import DBotGroupXDRIncidents
from CommonServerPython import *


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_DBotGroupXDRIncidents_scatter(mocker):
    """
    Given:
        - returnWidgetType - scatter and the rest of the arguments.
    When:
     - calling DBotGroupXDRIncidents
    Then:
     - Verify that in case 0 incidents fetched, the returned data object was set correctly to [].
    """
    mocker.patch.object(demisto, "args", return_value={"returnWidgetType": "scatter"})
    args = {
        "returnWidgetType": "scatter",
        "incidentType": "XDR incident",
        "limit": "500",
        "fromDate": "1 months ago",
        "searchQuery": "searchQuery",
        "forceRetrain": "False",
    }
    response = [
        {
            "ModuleName": "CustomScripts",
            "Brand": "Scripts",
            "Category": "automation",
            "ID": "",
            "Version": 0,
            "Type": 1,
            "Contents": "- 0 incidents fetched with these exact match for the given dates. \n \n",
            "HumanReadable": None,
            "ImportantEntryContext": None,
            "EntryContext": None,
            "IgnoreAutoExtract": False,
            "ReadableContentsFormat": "",
            "ContentsFormat": "text",
            "File": "",
            "FileID": "",
            "FileMetadata": None,
            "System": "",
            "Note": False,
            "Evidence": False,
            "EvidenceID": "",
            "Tags": None,
            "Metadata": {},
            "IndicatorTimeline": None,
            "NextRun": "",
            "Timeout": "",
            "PollingCommand": "",
            "PollingArgs": None,
            "PollingItemsRemaining": 0,
            "Relationships": None,
            "APIExecutionMetrics": None,
        }
    ]
    mocker.patch.object(demisto, "executeCommand", return_value=response)
    result = DBotGroupXDRIncidents.get_group_incidents(args)
    assert result.get("Contents", {}) == {"data": []}
    assert not result.get("EntryContext")


def test_DBotGroupXDRIncidents_incidents(mocker):
    """
    Given:
        - returnWidgetType - incidents and the rest of the arguments.
    When:
     - calling DBotGroupXDRIncidents
    Then:
     - Verify that Contents and EntryContext aren't empty and of type dict.
    """
    mocker.patch.object(demisto, "args", return_value={"returnWidgetType": "scatter"})
    args = {
        "returnWidgetType": "incidents",
        "incidentType": "XDR incident",
        "limit": "500",
        "fromDate": "1 months ago",
        "searchQuery": "searchQuery",
        "forceRetrain": "False",
    }
    response = [
        {
            "ModuleName": "CustomScripts",
            "Brand": "Scripts",
            "Category": "automation",
            "ID": "",
            "Version": 0,
            "Type": 1,
            "Contents": {
                "data": [
                    {"color": "0048BA", "data": [7], "dataType": "incident", "incidents": '[{"incident1data", "incident2data"}]'}
                ]
            },
            "EntryContext": {"DBotTrainClustering": "{info}"},
        }
    ]
    mocker.patch.object(demisto, "executeCommand", return_value=response)
    result = DBotGroupXDRIncidents.get_group_incidents(args)
    assert isinstance(result[0]["Contents"], dict)
    assert isinstance(result[0]["EntryContext"], dict)