ExportIncidentsToCSV

This automation uses the Core REST API Integration to batch export Incidents to CSV and return the resulting CSV file to the war room.

python · Common Scripts

Details

IDExportIncidentsToCSV
Languagepython
From Version6.5.0
Docker Imagedemisto/python3:3.12.13.10404775
TagsUtility

README

This automation uses the Core REST API Integration to batch export Incidents to CSV and return the resulting CSV file to the war room.

Script Data


Name Description
Script Type python3
Tags Utility

Dependencies


This script uses the following commands and scripts.

  • core-api-get
  • core-api-post

Inputs


Argument Name Description
query The query for the Incidents that you want to export. (e.g. status:closed -category:job). You can and should generate the query from the Incidents search screen.
fetchdays The number of days back to fetch incidents. This argument acts as the primary time filter and is always applied, even when using the query argument. The command first filters for all incidents created in the last fetchdays and then applies the query argument to that subset of incidents. Warning: If the query argument contains a created: time range (for example, created:>=now-90d), you must set fetchdays to a value equal to or larger than that range. If fetchdays is smaller that the window in the query, the results will be truncated. (default is 7). Must be a number.
columns Comma separated list of columns (fields) for the CSV. (Default is: id,name,type,severity,status,owner,roles,playbookId,occurred,created,modified,closed)

Outputs


There are no outputs for this script.

import demistomock as demisto
import pytest
from ExportIncidentsToCSV import main


def test_main(mocker):
    side_effect = iter([[{"Contents": {"response": {"test": "test"}}}], [{"Contents": {"response": b"123"}}]])
    mocker.patch.object(demisto, "args", return_value={"query": "html", "fetchdays": "6", "columns": "id,name"})
    mocker.patch.object(demisto, "results", return_value={})
    mocker.patch("ExportIncidentsToCSV.is_error", return_value=False)
    execute_command_mock = mocker.patch.object(demisto, "executeCommand", side_effect=side_effect)
    main()
    assert execute_command_mock.call_args_list[0][0][1]["body"]["columns"] == ["id", "name"]


def test_main_error(mocker):
    side_effect = iter([[{"Contents": {"response": {"test": "test"}}}], Exception("error")])
    mocker.patch.object(demisto, "args", return_value={"query": "html", "fetchdays": "6"})
    mocker.patch.object(demisto, "results", return_value={})
    mocker.patch("ExportIncidentsToCSV.is_error", return_value=True)
    mocker.patch("ExportIncidentsToCSV.get_error", return_value="error")
    mocker.patch.object(demisto, "error")
    mocker.patch.object(demisto, "debug")
    mocker.patch.object(demisto, "executeCommand", side_effect=side_effect)
    with pytest.raises(Exception):
        main()


def test_no_incidents_found(mocker):
    """
    Given: NO_INCIDENTS_FOUND global string
    When: The main() function is called and no incidents are found
    Then: The NO_INCIDENTS_FOUND message is expected to be called as a result within the results object,
     and the call count for results is expected to be 1.
    """

    from ExportIncidentsToCSV import main, NO_INCIDENTS_FOUND

    export_to_csv_result = [
        {
            "Contents": " - Script failed to run: Core REST APIs - "
            '"Status":"400 Bad Request "title": "Incidents search returned no results" '
        }
    ]
    mocker.patch.object(demisto, "args", return_value={"query": "html", "fetchdays": "6"})
    mocker.patch.object(demisto, "executeCommand", return_value=export_to_csv_result)
    mocker.patch("ExportIncidentsToCSV.is_error", return_value=True)
    mocker.patch.object(demisto, "results")
    main()
    demisto.results.assert_called_once_with(NO_INCIDENTS_FOUND)
    assert demisto.results.call_count == 1


def test_incidents_amount_limit_exceeded(mocker):
    """
    Given: LIMIT_EXCEEDED global string
    When: The main() function is called and the incidents amount exceeded the limit
    Then: The LIMIT_EXCEEDED message is expected to be called as a result within the results object,
     and the call count for results is expected to be 1.
    """

    from ExportIncidentsToCSV import main, LIMIT_EXCEEDED

    export_to_csv_result = [
        {"Contents": " - Script failed to run: Core REST APIs - " '"StatusCode":413, title":"Limit Exceeded" '}
    ]
    mocker.patch.object(demisto, "args", return_value={"query": "html", "fetchdays": "6"})
    mocker.patch.object(demisto, "executeCommand", return_value=export_to_csv_result)
    mocker.patch("ExportIncidentsToCSV.is_error", return_value=True)
    return_error_mock = mocker.patch("ExportIncidentsToCSV.return_error")
    main()
    expected_error_message = f"{LIMIT_EXCEEDED} (10,000 incidents). Try to run the same query with lower fetchdays value"
    return_error_mock.assert_called_once_with(expected_error_message)
    assert return_error_mock.call_count == 1


def test_general_error_occurred(mocker):
    """
    Given: None
    When: The main() function is called and general error returned as response from executeCommand
    Then: ValueError is expected to be raised
    """

    from ExportIncidentsToCSV import main

    export_to_csv_result = [{"Contents": " - Script failed to run: Core REST APIs - "}]
    mocker.patch.object(demisto, "args", return_value={"query": "html", "fetchdays": "6"})
    mocker.patch.object(demisto, "executeCommand", return_value=export_to_csv_result)
    mocker.patch("ExportIncidentsToCSV.is_error", return_value=True)
    with pytest.raises(ValueError) as ve:
        main()
        assert "Couldn't export incidents to CSV." in str(ve)


def test_execute_command_empty_response(mocker):
    """
    Given: None
    When: The main() function is called and general error occurred when executing executeCommand
    Then: ValueError is expected to be raised
    """

    from ExportIncidentsToCSV import main

    mocker.patch.object(demisto, "args", return_value={"query": "html", "fetchdays": "6"})
    mocker.patch.object(demisto, "executeCommand", return_value=[])
    with pytest.raises(ValueError) as ve:
        main()
        assert "when trying to export incident(s) with query" in str(ve)