ExpanseAggregateAttributionIP Deprecated

Deprecated. No available replacement. > Aggregate entries from multiple sources into AttributionIP.

python · Cortex Xpanse by Palo Alto Networks (Deprecated)

Details

ID	`ExpanseAggregateAttributionIP`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.10.13.83255`

README

Aggregate entries from multiple sources into AttributionIP

Script Data

Name	Description
Script Type	python3
Tags
Cortex XSOAR Version	6.0.0

Used In

This script is used in the following playbooks and scripts.

Expanse Attribution Subplaybook

Inputs

Argument Name	Description
input	Input list.
current	Current aggregation state.
source_ip_fields	Comma separated list of fields to treat as source IPs.
internal_ip_networks	Comma separated list of IPv4 Networks to be considered internal (default to RFC private networks).
sightings_fields	Comma separated list of field names to be considered sighting counts.

Outputs

Path	Description	Type
Expanse.AttributionIP.ip	IP address	string
Expanse.AttributionIP.private	Is the IP private?	boolean
Expanse.AttributionIP.sightings	Number of sessions seen on this device	number

Source

ExpanseAggregateAttributionIP.py ExpanseAggregateAttributionIP_test.py ExpanseAggregateAttributionIP.yml

Download History Raw

name: ExpanseAggregateAttributionIP
comment: Deprecated. No available replacement. >
  Aggregate entries from multiple sources into AttributionIP.
deprecated: true
commonfields:
  id: ExpanseAggregateAttributionIP
  version: -1
args:
- name: input
  description: Input list.
  isArray: true
- name: current
  description: Current aggregation state.
  isArray: true
- name: source_ip_fields
  description: Comma separated list of fields to treat as source IPs.
  defaultValue: src,src_ip
  isArray: true
- name: internal_ip_networks
  description: Comma separated list of IPv4 Networks to be considered internal (default to RFC private networks).
  defaultValue: ''
  isArray: true
- name: sightings_fields
  description: Comma separated list of field names to be considered sighting counts.
  defaultValue: count
  isArray: true
outputs:
- contextPath: Expanse.AttributionIP.ip
  description: IP address.
  type: string
- contextPath: Expanse.AttributionIP.private
  description: Is the IP private?
  type: boolean
- contextPath: Expanse.AttributionIP.sightings
  description: Number of sessions seen on this device.
  type: number
script: '-'
tags: []
timeout: '0'
type: python
subtype: python3
dockerimage: demisto/python3:3.10.13.83255
fromversion: 6.0.0
tests:
- No tests (auto formatted)