ExportIndicatorsToCSV

This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.

python · Common Scripts

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def main():
    indicator_query = demisto.args().get("query")
    seen_days = arg_to_number(demisto.args().get("seenDays", "7"))
    columns_arg = demisto.args().get("columns")
    if columns_arg:
        indicator_columns = [x.strip() for x in columns_arg.split(",")]
    else:
        indicator_columns = [
            "id",
            "indicator_type",
            "value",
            "score",
            "timestamp",
            "relatedIncCount",
            "sourceBrands",
            "expirationStatus",
            "expiration",
            "modified",
        ]

    # body for the indicator request
    indicator_body = {
        "all": True,
        "filter": {
            "query": indicator_query,
            "sort": [{"field": "calculatedTime", "asc": False}],
            "period": {"by": "day", "fromValue": seen_days},
        },
        "columns": indicator_columns,
    }

    # generate the file
    res = demisto.executeCommand("core-api-post", {"uri": "/indicators/batch/exportToCsv", "body": indicator_body})[0][
        "Contents"
    ]["response"]

    # download the file and return to the war room
    file = demisto.executeCommand("core-api-get", {"uri": f"/indicators/csv/{res}"})[0]["Contents"]["response"]
    demisto.results(fileResult(res, file))


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README

This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.

Script Data

Name	Description
Script Type	python3
Tags	Utility

Dependencies

This script uses the following commands and scripts.

core-api-get
core-api-post

Inputs

Argument Name	Description
query	The query for the Indicators that you want to export. (e.g. type:IP and reputation:Bad and expirationStatus:active). You can and should generate the query from the Indicators search screen.
seenDays	Indicator last seen days (default is 7). Needs to be a number.
columns	Comma separated list of columns (fields) for the CSV. (Default is: id,indicator_type,value,source,score,relatedIncCount,setBy,sourceBrands,modified)

Outputs

There are no outputs for this script.