GetIncidentTasks

Get all tasks for a specific incident by the given state, name and/or tag.

javascript · Cortex REST API

Source

TASK_STATES = {
    "new": "",
    "inprogress": "inprogress",
    "completed": "Completed",
    "waiting": "Waiting",
    "error": "Error",
    "looperror": "LoopError",
    "skipped": "WillNotBeExecuted",
    "willnotbeexecuted": "WillNotBeExecuted",
    "blocked": "Blocked",
    undefined: undefined
}


function getPlaybookTasks(tasks){
    var readyTasks = [];

    for (var i = 0; i < tasks.length; i++) {
        var task = tasks[i];

        if (task.type === "playbook" && task.subPlaybook) {
            var subPlaybookTasks = [];

            if (task.subPlaybook.tasks) {
                for (var key in task.subPlaybook.tasks) {
                    if (task.subPlaybook.tasks.hasOwnProperty(key)) {
                        subPlaybookTasks.push(task.subPlaybook.tasks[key]);
                    }
                }
            }

            var nestedTasks = getPlaybookTasks(subPlaybookTasks);
            readyTasks = readyTasks.concat(nestedTasks);
        }

        readyTasks.push(task);
    }

    return readyTasks;
}


function isTaskMatch(task, name, tag, states) {
    var taskTask = task.task || {};

    var nameMatch = name === null || name === undefined ||
        (taskTask.name && taskTask.name.toLowerCase() === name.toLowerCase());

    var tagMatch = tag === null || tag === undefined ||
        (taskTask.tags && taskTask.tags.indexOf(tag) !== -1);

    var stateMatch = !states || states.length === 0 ||
        (states.indexOf(task.state) !== -1);

    return nameMatch && tagMatch && stateMatch;
}


function getStates(states) {
    // If "error" is in the input list, add "loopError"
    if (states.indexOf("error") !== -1) {
        states.push("loopError");
    }

    var readyStates = [];

    for (var i = 0; i < states.length; i++) {
        var state = states[i];
        var systemState = TASK_STATES[state.toLowerCase()];

        if (systemState && readyStates.indexOf(systemState) === -1) {
            readyStates.push(systemState);
        }
    }

    // If no matches were found, return all values from TASK_STATES
    if (readyStates.length === 0) {
        for (var key in TASK_STATES) {
            if (TASK_STATES.hasOwnProperty(key)) {
                var value = TASK_STATES[key];
                if (readyStates.indexOf(value) === -1) {
                    readyStates.push(value);
                }
            }
        }
    }

    return readyStates;
}

var name = args.name
var tag = args.tag
var inc_id = args.inc_id
var using = args.using
var states = getStates(argToList(args.states))

var executeArgs = {
    uri: `/investigation/${inc_id}/workplan`
};

if (using) {
    executeArgs.using = using;
}

var res = executeCommand('core-api-get', executeArgs);


if (!isValidRes(res))
{
    if(res[0].Contents){
          return {
              ContentsFormat: formats.markdown,
              Type: entryTypes.error,
              Contents: res[0].Contents
          };
    }
}

var tasks = undefined;
if (
    res &&
    res[0] &&
    res[0].Contents &&
    res[0].Contents.response &&
    res[0].Contents.response.invPlaybook &&
    res[0].Contents.response.invPlaybook.tasks
)
{
    tasks = res[0].Contents.response.invPlaybook.tasks;


    if (tasks == undefined){
        return{
            Type: entryTypes.note,
            ReadableContentsFormat: formats.text,
            Contents: `Workplan for incident ${inc_id} has no tasks.`,
        };
    }

    allTasks = getPlaybookTasks(Object.values(tasks));


    var res = [];

    for (var i = 0; i < allTasks.length; i++) {
        var task = allTasks[i];

        if (isTaskMatch(task, name, tag, states)) {
            res.push({
                id: task.id,
                name: (task.task && task.task.name) || "",
                type: task.type,
                owner: task.assignee,
                state: task.state,
                scriptId: task.task && task.task.scriptId,
                startDate: task.startDate,
                dueDate: task.dueDate,
                completedDate: task.completedDate,
                parentPlaybookID: task.parentPlaybookID,
                completedBy: task.completedBy
            });
        }
    }


    var ec = {'Tasks(val.id && val.id == obj.id)': res};


    return {
        Type: entryTypes.note,
        ReadableContentsFormat: formats.markdown,
        Contents: res,
        ContentsFormat: formats.json,
        HumanReadable: tableToMarkdown(`Incident #${inc_id} Playbook Tasks`, res, ["id", "name", "state", "owner", "scriptId"],removeNull=true),
        EntryContext: ec
    };

}




if (tasks == undefined){
    return{
        Type: entryTypes.note,
        ReadableContentsFormat: formats.text,
        Contents: `Workplan for incident ${inc_id} has no tasks.`,
    };
}

README

Get all tasks for a specific incident by the given state, name and/or tag.

Script Data


Name Description
Script Type javascript
Tags Utility
Cortex XSOAR Version 6.10.0

Dependencies


This script uses the following commands and scripts.

  • Core REST API
  • core-api-get

Inputs


Argument Name Description
inc_id Incident ID to get tasks from.
states Comma-separated list of states. Possible values: New, InProgress, Completed, Waiting, Error, LoopError, Skipped, Blocked. (Leave empty to get all tasks).
name The name of the task to search.
tag The tag to search.
using The Cortex REST API integration instance to use for the API request. If not provided, the default instance is used.

Outputs


Path Description Type
Tasks The entire task object. Unknown
Tasks.id Task ID. string
Tasks.name Task name. string
Tasks.type The type of the task (regular, condition, title, playbook, start). string
Tasks.owner Task owner. string
Tasks.state Task state (inprogress, Completed, WillNotBeExecuted, Error, LoopError, Waiting, Blocked, and empty string for not started). string
Tasks.scriptId Task related script (empty if manual). string
Tasks.startDate Task start date. unknown
Tasks.completedDate Task completed date. unknown
Tasks.dueDate Task due date (SLA). unknown
Tasks.parentPlaybookID Task parent playbook ID (in case the task is part of a sub-playbook). unknown
Tasks.completedBy Task completed by (username). string

Script Examples

Example command

!GetIncidentTasks inc_id=10 name="Email Campaign Search"

Context Example

{
    "Tasks": {
        "completedBy": "DBot",
        "completedDate": "2024-01-09T12:26:33.75641877Z",
        "dueDate": "0001-01-01T00:00:00Z",
        "id": "101",
        "name": "Email Campaign Search",
        "owner": "Dummy",
        "parentPlaybookID": null,
        "scriptId": null,
        "startDate": "0001-01-01T00:00:00Z",
        "state": "Completed",
        "type": "title"
    }
}

Human Readable Output

Incident #10 Playbook Tasks

id name state owner scriptId
101 Email Campaign Search Completed Dummy