GetEntries

Collect entries matching to the conditions in the war room.

python · Common Scripts

Details

IDGetEntries
Languagepython
From Version6.5.0
Docker Imagedemisto/python3:3.12.13.10404775
TagsUtility

README

Collect entries matching to the conditions in the war room.

Script Data


Name Description
Script Type python3
Tags Utility
Cortex XSOAR Version 6.5.0

Inputs


Argument Name Description
id Optional incident ID to fetch entries from. If not specified, current incident is used.
tags The list of tags.
categories The list of categories. (commandAndResults, playbookTaskResult, playbookTaskStartAndDone, playbookErrors, justFound, deleted, incidentInfo, chats, evidence, notes, attachments).
page_size The number of entries to return. Maximum is 1000.
last_id Return entries starting from the specified entry ID and backward.
first_id Return entries starting from the specified entry ID and forward.
selected_entry_id Return entries before and after the specified entry ID.
users Return entries with the specified users.
tags_and_operator Whether to return entries that include all specified tags.
from_time Return entries from this time and forward. Format is ISO8601 (i.e., ‘2020-04-30T10:35:00.000Z’).
parent_id The ID of the parent entry.

Outputs


Path Description Type
Entry.ID Entry ID. Unknown
Entry.Type Entry Type. Unknown
Entry.Tags Tags associated with the entry. Unknown
Entry.Category Entry categories. Unknown
Entry.Created Creation time of the entry. Unknown
Entry.Modified Last modified time of the entry. Unknown
import json

import demistomock as demisto
from CommonServerPython import *
from GetEntries import main


class SideEffectExecuteCommand:
    def __init__(self, ents):
        self.__ents = ents

    def execute_command(self, cmd, args, extract_contents=True, fail_on_error=True):
        assert cmd == "getEntries"
        return self.__ents


class TestGetEntries:
    def test_main(self, mocker):
        """

        Given:
            - A entry returns from getEntries.
        When:
            - No argument parameters are provided.
        Then:
            - The fields are being parsed properly in to context.

        """
        original_ents = [
            {
                "ID": "test-ID",
                "Type": "test-Type",
                "Metadata": {
                    "tags": "test-tags",
                    "category": "test-category",
                    "created": "test-created",
                    "modified": "test-modified",
                },
            }
        ]
        output_ents = {
            "Entry": [
                {
                    "ID": "test-ID",
                    "Type": "test-Type",
                    "Tags": "test-tags",
                    "Category": "test-category",
                    "Created": "test-created",
                    "Modified": "test-modified",
                }
            ]
        }

        mocker.patch.object(demisto, "executeCommand", side_effect=SideEffectExecuteCommand(original_ents).execute_command)
        mocker.patch.object(demisto, "results")
        main()
        assert demisto.results.call_count == 1
        results = demisto.results.call_args[0][0]
        entry_context = results.get("EntryContext")
        assert json.dumps(entry_context) == json.dumps(output_ents)

    def test_main_no_ents(self, mocker):
        """

        Given:
            - No entries returns from getEntries.
        When:
            - No argument parameters are provided.
        Then:
            - No entries parameters are given to context.

        """
        original_ents = []

        mocker.patch.object(demisto, "executeCommand", side_effect=SideEffectExecuteCommand(original_ents).execute_command)
        mocker.patch.object(demisto, "results")
        main()
        assert demisto.results.call_count == 1
        results = demisto.results.call_args[0][0]
        if isinstance(results, dict):
            assert not results.get("EntryContext")

    def test_main_error(self, mocker):
        """

        Given:
            - An error returns from getEntries.
        When:
            - No argument parameters are provided.
        Then:
            - An error entry returns to the results.

        """

        def __return_error(message, error="", outputs=None):
            demisto.results({"Type": EntryType.ERROR, "ContentsFormat": EntryFormat.TEXT, "Contents": message})

        original_ents = [{"Type": EntryType.ERROR, "Contents": "error"}]

        mocker.patch("GetEntries.return_error", side_effect=__return_error)
        mocker.patch.object(demisto, "executeCommand", side_effect=SideEffectExecuteCommand(original_ents).execute_command)
        mocker.patch.object(demisto, "error")
        mocker.patch.object(demisto, "results")
        main()
        assert demisto.results.call_count == 1
        results = demisto.results.call_args[0][0]
        assert results.get("Type") == EntryType.ERROR