ExtendQueryBasedOnPhishingLabels

Source

from CommonServerPython import *

ALL_LABELS = "*"


def get_phishing_map_labels(comma_values):
    if comma_values == ALL_LABELS:
        return comma_values
    values = [x.strip() for x in comma_values.split(",")]
    labels_dict = {}
    for v in values:
        v = v.strip()
        if ":" in v:
            splited = v.rsplit(":", maxsplit=1)
            labels_dict[splited[0].strip()] = splited[1].strip()
        else:
            labels_dict[v] = v
    return dict(labels_dict.items())


def build_query_in_reepect_to_phishing_labels(args):
    mapping = args.get("phishingLabels", ALL_LABELS)
    tag_field = args["tagField"]
    query = args.get("query", "")
    if mapping == ALL_LABELS:
        mapping_query = f"{tag_field}:*"
    else:
        mapping_dict = get_phishing_map_labels(mapping)
        tags_union = " ".join([f'"{label}"' for label in mapping_dict])
        mapping_query = f"{tag_field}:({tags_union})"
    if query == "":
        modified_query = mapping_query
    else:
        modified_query = f"({query}) and ({mapping_query})"
    return modified_query


def main():
    try:
        result = {"extendedQuery": build_query_in_reepect_to_phishing_labels(demisto.args())}

        res = CommandResults(
            outputs_prefix="ExtendQueryBasedOnPhishingLabels",
            outputs_key_field="",
            outputs=result,
        )
        return_results(res)
    except Exception as ex:
        demisto.error(traceback.format_exc())  # print the traceback
        return_error(f"Failed to execute ExtendQueryBasedOnPhishingLabels. Error: {ex!s}")


""" ENTRY POINT """


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README