DarkmonFilterUnseen

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def main():
    args = demisto.args()
    items = argToList(args.get("items")) or []
    id_field = args.get("id_field", "id")
    seen_list_name = args.get("seen_list")
    domain_filter_list = args.get("domain_filter_list")
    domain_match_field = args.get("domain_match_field", "username")
    allowlist_name = args.get("allowlist")
    allowlist_match_field = args.get("allowlist_match_field", "username")

    def _get_list(name):
        if not name:
            return set()
        try:
            res = demisto.executeCommand("getList", {"listName": name})
            content = res[0].get("Contents", "") if res else ""
            return {line.strip() for line in (content or "").replace(",", "\n").splitlines() if line.strip()}
        except Exception:
            return set()

    seen = _get_list(seen_list_name)
    customer_domains = _get_list(domain_filter_list) if domain_filter_list else None
    allowlist = _get_list(allowlist_name) if allowlist_name else set()

    new_items = []
    new_ids = []
    for it in items:
        iid = str(it.get(id_field, "")).strip()
        if not iid or iid in seen:
            continue
        match_val = str(it.get(allowlist_match_field, "")).lower()
        if any(a.lower() in match_val for a in allowlist):
            continue
        if customer_domains is not None:
            uval = str(it.get(domain_match_field, "")).lower()
            if not any(d.lower() in uval for d in customer_domains):
                continue
        new_items.append(it)
        new_ids.append(iid)

    if new_ids and seen_list_name:
        merged = "\n".join(sorted(seen | set(new_ids)))
        demisto.executeCommand("setList", {"listName": seen_list_name, "listData": merged})

    return_results({"NewAccounts": new_items})


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README