ExpanseEnrichAttribution Deprecated
Deprecated. No available replacement. > This script can be used to enrich context generated by ExpanseAggregateAttribution* scripts with additional details
Details
| ID | ExpanseEnrichAttribution |
|---|---|
| Language | python |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.10.13.87159 |
README
This script can be used to enrich context generated by ExpanseAggregateAttribution* scripts with additional details
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | |
| Cortex XSOAR Version | 6.0.0 |
Used In
This script is used in the following playbooks and scripts.
- Expanse Attribution Subplaybook
Inputs
| Argument Name | Description |
|---|---|
| enrich | List of entries to extract additional data from. |
| enrich_key | Primary key in the enrichment entries to match against primary key in the attribution data structure. |
| current | Current attribution data structure. |
| type | What attribution structure to enrich. |
| enrich_fields | comma separated list of fields to take enrichment details from. |
Outputs
| Path | Description | Type |
|---|---|---|
| Expanse.AttributionIP.ip | IP address | string |
| Expanse.AttributionIP.private | Is the IP private? | boolean |
| Expanse.AttributionIP.sightings | Number of sessions seen on this device | number |
| Expanse.AttributionDevice.serial | Serial Number of the device | string |
| Expanse.AttributionDevice.vsys | VSYS of the device | string |
| Expanse.AttributionDevice.device-group | Device Group inside Panorama | string |
| Expanse.AttributionDevice.exposing_service | Is the device exposing the asset? | boolean |
| Expanse.AttributionDevice.sightings | Number of sessions seen on this device | number |
| Expanse.AttributionUser.username | Username of the user | string |
| Expanse.AttributionUser.domain | Domain of the user | string |
| Expanse.AttributionUser.groups | List of groups the user is member of | Unknown |
| Expanse.AttributionUser.display-name | Display Name | string |
| Expanse.AttributionUser.description | Description of the user | string |
| Expanse.AttributionUser.sightings | Number of sessions seen on this device | number |
args: - description: List of entries to extract additional data from. isArray: true name: enrich - description: > Primary key in the enrichment entries to match against primary key in the attribution data structure. name: enrich_key required: true - description: Current attribution data structure. isArray: true name: current - name: type description: What attribution structure to enrich. required: true predefined: - IP - Device - User - name: enrich_fields description: comma separated list of fields to take enrichment details from required: true comment: Deprecated. No available replacement. > This script can be used to enrich context generated by ExpanseAggregateAttribution* scripts with additional details deprecated: true commonfields: id: ExpanseEnrichAttribution version: -1 name: ExpanseEnrichAttribution outputs: - contextPath: Expanse.AttributionIP.ip description: IP address type: string - contextPath: Expanse.AttributionIP.private description: Is the IP private? type: boolean - contextPath: Expanse.AttributionIP.sightings description: Number of sessions seen on this device type: number - contextPath: Expanse.AttributionDevice.serial description: Serial Number of the device type: string - contextPath: Expanse.AttributionDevice.vsys description: VSYS of the device type: string - contextPath: Expanse.AttributionDevice.device-group description: Device Group inside Panorama type: string - contextPath: Expanse.AttributionDevice.exposing_service description: Is the device exposing the asset? type: boolean - contextPath: Expanse.AttributionDevice.sightings description: Number of sessions seen on this device type: number - contextPath: Expanse.AttributionUser.username description: Username of the user type: string - contextPath: Expanse.AttributionUser.domain description: Domain of the user type: string - contextPath: Expanse.AttributionUser.groups description: List of groups the user is member of - contextPath: Expanse.AttributionUser.display-name description: Display Name type: string - contextPath: Expanse.AttributionUser.description description: Description of the user type: string - contextPath: Expanse.AttributionUser.sightings description: Number of sessions seen on this device type: number script: '-' tags: [] timeout: '0' type: python subtype: python3 dockerimage: demisto/python3:3.10.13.87159 fromversion: 6.0.0 tests: - No tests (auto formatted)