Source
from functools import reduce import demistomock as demisto from CommonServerPython import * from CommonServerUserPython import * def get_by_incident_id(incident_id, get_key, set_key=""): set_key = set_key if set_key else get_key keys = get_key.split(".") try: context = demisto.executeCommand("getContext", {"id": incident_id})[0]["Contents"]["context"] res = reduce(lambda x, y: x[y], keys, context) except KeyError: error_msg = f"Cannot find {get_key} in incident #{incident_id}" return_error(message=error_msg, error="GetByIncidentId: " + error_msg, outputs={set_key: error_msg}) entry_context = {set_key: res} return_outputs( readable_output=f"Key '{get_key}' successfully retrieved and set into current incident at '{set_key}'.", outputs=entry_context, ) def main(): """Get arguments and call primary function""" inc_id = demisto.args().get("incident_id", demisto.incidents()[0]["id"]) get_k = demisto.args()["get_key"] set_k = demisto.args().get("set_key", get_k) get_by_incident_id(inc_id, get_k, set_k) if __name__ == "__builtin__" or __name__ == "builtins": main()
README
Gets a value from the specified incident’s context.
Note This script can only retrieve incident fields that appear under the investigation context. To get incident basic information, use the searchIncidentsV2 automation to pull the relevant incident and extract the needed fields from the automation output.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Cortex XSOAR Version | 5.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| incident_id | The ID of the incident from which to get context values. The default is the current incident. |
| get_key | The key to get |
| set_key | The key to set. The default is “get_key”. |
Outputs
There are no outputs for this script.