ExportIndicatorsToCSV

This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.

python · Common Scripts

Details

ID	`ExportIndicatorsToCSV`
Language	python
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	Utility

README

This automation uses the Core REST API Integration to batch export Indicators to CSV and return the resulting CSV file to the war room.

Script Data

Name	Description
Script Type	python3
Tags	Utility

Dependencies

This script uses the following commands and scripts.

core-api-get
core-api-post

Inputs

Argument Name	Description
query	The query for the Indicators that you want to export. (e.g. type:IP and reputation:Bad and expirationStatus:active). You can and should generate the query from the Indicators search screen.
seenDays	Indicator last seen days (default is 7). Needs to be a number.
columns	Comma separated list of columns (fields) for the CSV. (Default is: id,indicator_type,value,source,score,relatedIncCount,setBy,sourceBrands,modified)

Outputs

There are no outputs for this script.

Source

ExportIndicatorsToCSV.py ExportIndicatorsToCSV_test.py ExportIndicatorsToCSV.yml

Download History Raw

import demistomock as demisto
from ExportIndicatorsToCSV import main

side_effect = iter([[{"Contents": {"response": {"test": "test"}}}], [{"Contents": {"response": b"123"}}]])


def test_main(mocker):
    mocker.patch.object(demisto, "args", return_value={"query": "html", "seenDays": "6", "columns": "id,name"})
    mocker.patch.object(demisto, "results", return_value={})
    execute_command_mock = mocker.patch.object(demisto, "executeCommand", side_effect=side_effect)
    main()
    assert execute_command_mock.call_args_list[0][0][1]["body"]["columns"] == ["id", "name"]