ExtractAttackPattern

Source

import demistomock as demisto
import urllib3
from CommonServerPython import *

# Disable insecure warnings
urllib3.disable_warnings()


def get_mitre_results(items):
    return execute_command("mitre-get-indicator-name", {"attack_ids": items})


def is_valid_attack_pattern(items) -> list:
    try:
        results = get_mitre_results(items)
        values = [content.get("value") for content in results]
        return values if values else []

    except ValueError as e:
        if "verify you have proper integration enabled to support it" in str(e):
            demisto.info(
                "Unsupported Command : mitre-get-indicator-name, "
                "verify you have proper integration (MITRE ATTACK v2) enabled to support it. "
                "This Is needed in order to auto extract MITRE IDs and translate them to Attack Pattern IOCs"
            )
        else:
            demisto.info(f"MITRE Attack formatting script, {e!s}")
        return []
    except Exception as e:
        demisto.info(f"MITRE Attack formatting script, {e!s}")
        return []


def main():
    the_input = demisto.args().get("input")

    entries_list = is_valid_attack_pattern(the_input)

    if entries_list:
        return_results(entries_list)
    else:
        return_results("")


if __name__ in ("__builtin__", "builtins"):
    main()

README