GetIncidentsByQuery

Gets a list of incident objects and the associated incident outputs that match the specified query and filters. The results are returned in a structured data file. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Base

Source

import pickle
import uuid

from CommonServerPython import *
from GetIncidentsApiModule import *


def encode_outputs(incidents: list[dict], output_format: str) -> str | bytes:
    match output_format:
        case "pickle":
            return pickle.dumps(incidents, protocol=2)  # guardrails-disable-line
        case "json":
            return json.dumps(incidents)
        case _:
            raise DemistoException(f"Invalid output format: {output_format}")


def to_file_entry(incidents: list[dict], output_format: str) -> dict[str, Any]:
    file_name = str(uuid.uuid4())
    encoded_data = encode_outputs(incidents, output_format)
    return fileResult(file_name, encoded_data) | {
        "Contents": incidents,
        "HumanReadable": f"Fetched {len(incidents)} incidents successfully",
        "EntryContext": {
            "GetIncidentsByQuery": {
                "Filename": file_name,
                "FileFormat": output_format,
            },
        },
    }


def main():
    try:
        args = demisto.args()
        incidents = get_incidents_by_query(args)
        return_results(to_file_entry(incidents, args["outputFormat"]))
    except Exception as e:
        return_error(str(e))


if __name__ in ["builtins", "__main__"]:
    main()

README

Gets a list of incident objects and the associated incident outputs that
match the specified query and filters. The results are returned in a structured data file.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name Description
Script Type python3
Tags ml
Cortex XSOAR Version 5.0.0

Used In

This script is used in the following playbooks and scripts.

  • DBot Create Phishing Classifier V2

Inputs

Argument Name Description
query Additional text by which to query incidents.
incidentTypes A comma-separated list of incident types by which to filter.
fromDate The start date by which to filter incidents. Date format will be the same as in the incidents query page, for example: “3 days ago”, ““2019-01-01T00:00:00 +0200”).
toDate The end date by which to filter incidents. Date format will be the same as in the incidents query page, for example: “3 days ago”, ““2019-01-01T00:00:00 +0200”).
limit The maximum number of incidents to fetch.
includeContext Deprecated due to performance considerations. Rather than using this argument, it is recommended to retrieve the context of the incidents separately, preferably for a limited number of incidents.
timeField The incident field to specify for the date range. Can be “created” or “modified”. The default is “created”. Due to performance considerations, you should only use “modified” if you have a large number of incidents.
NonEmptyFields A comma-separated list of non-empty value incident field names by which to filter incidents.
outputFormat The output file format.
populateFields A comma-separated list of fields in the object to poplulate.
pageSize Incidents query batch size

Outputs

Path Description Type
GetIncidentsByQuery.Filename The output file name. String
GetIncidentsByQuery.FileFormat The output file format. String