IbmUpdateNote

Use this script to add a note entry in Cortex XSOAR, which will then be mirrored as a note to an IBM QRadar SOAR incident. This script should be run within an incident.

python · IBM Security QRadar SOAR

Details

ID	`IbmUpdateNote`
Language	python
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`

README

Use this script to update a note in an IBM QRadar SOAR incident. This script should be run within an incident.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	6.8.0

Dependencies

This script uses the following commands and scripts.

rs-update-incident-note
IBM Resilient Systems

Inputs

Argument Name	Description
note_id	ID of the note to be updated.
note_body	Note body.
tags	The note tag. Use the note entry tag (defined in your instance configuration) to mirror the note to IBM QRadar SOAR.

Outputs

There are no outputs for this script.

Source

IbmUpdateNote.py IbmUpdateNote_test.py IbmUpdateNote.yml

Download History Raw

import demistomock as demisto
from IbmUpdateNote import update_note


def test_update_note_with_all_args(mocker):
    """Test update_note function with all arguments."""
    mock_execute_command = mocker.patch.object(demisto, "executeCommand", return_value=[])
    mocker.patch.object(demisto, "incident", return_value={"dbotMirrorId": "1000"})
    result = update_note({"note_id": "123", "note_body": "Full Update", "tags": "FROM XSOAR"})

    mock_execute_command.assert_called_once_with(
        "rs-update-incident-note", args={"note_id": "123", "note": "Full Update", "incident_id": "1000"}
    )
    assert result.readable_output == "Full Update"
    assert result.tags == ["FROM XSOAR"]
    assert result.mark_as_note