ExpanseAggregateAttributionDevice Deprecated
Deprecated. No available replacement. > Aggregate entries from multiple sources into AttributionDevice.
Details
| ID | ExpanseAggregateAttributionDevice |
|---|---|
| Language | python |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.10.13.83255 |
README
Aggregate entries from multiple sources into AttributionDevice
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | |
| Cortex XSOAR Version | 6.0.0 |
Used In
This script is used in the following playbooks and scripts.
- Expanse Attribution Subplaybook
Inputs
| Argument Name | Description |
|---|---|
| input | Input list. |
| current | Current aggregation state. |
| serial_fields | Comma separated list of fields to treat as serial number. |
| vsys_fields | Comma separate list of field names to be used as vsys. |
| sightings_fields | Comma separated list of field names to be considered sighting counts. |
| source_ip_fields | Comma separated list of field names to be considered as source IPs. |
| internal_ip_networks | Comma separated list of IPv4 Networks to be considered internal (default to RFC private networks). |
Outputs
| Path | Description | Type |
|---|---|---|
| Expanse.AttributionDevice.serial | Serial Number of the device | string |
| Expanse.AttributionDevice.vsys | VSYS of the device | string |
| Expanse.AttributionDevice.device-group | Device Group inside Panorama | string |
| Expanse.AttributionDevice.xsoar-instance | XSOAR Panorama instance for this device | string |
| Expanse.AttributionDevice.exposing_service | Is the device exposing the asset? | boolean |
| Expanse.AttributionDevice.sightings | Number of sessions seen on this device | number |
name: ExpanseAggregateAttributionDevice comment: Deprecated. No available replacement. > Aggregate entries from multiple sources into AttributionDevice. deprecated: true commonfields: id: ExpanseAggregateAttributionDevice version: -1 args: - name: input description: Input list. isArray: true - name: current description: Current aggregation state. isArray: true - name: serial_fields description: Comma separated list of fields to treat as serial number. defaultValue: serial_number,serial,log_source_id isArray: true - name: vsys_fields description: Comma separate list of field names to be used as vsys. defaultValue: vsys isArray: true - name: sightings_fields description: Comma separated list of field names to be considered sighting counts. defaultValue: count isArray: true - name: source_ip_fields description: Comma separated list of field names to be considered as source IPs. defaultValue: src,src_ip isArray: true - name: internal_ip_networks description: Comma separated list of IPv4 Networks to be considered internal (default to RFC private networks). defaultValue: '' isArray: true outputs: - contextPath: Expanse.AttributionDevice.serial description: Serial Number of the device. type: string - contextPath: Expanse.AttributionDevice.vsys description: VSYS of the device. type: string - contextPath: Expanse.AttributionDevice.device-group description: Device Group inside Panorama. type: string - contextPath: Expanse.AttributionDevice.xsoar-instance description: XSOAR Panorama instance for this device. type: string - contextPath: Expanse.AttributionDevice.exposing_service description: Is the device exposing the asset? type: boolean - contextPath: Expanse.AttributionDevice.sightings description: Number of sessions seen on this device. type: number script: '-' tags: [] timeout: '0' type: python subtype: python3 dockerimage: demisto/python3:3.10.13.83255 fromversion: 6.0.0 tests: - No tests (auto formatted)