IncidentFields

Returns a dict of all incident fields that exist in the system.

Details

ID	`IncidentFields`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`

README

Returns a dict of all incident fields that exist in the system.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	5.0.0

Dependencies

This script uses the following commands and scripts.

core-api-get

Inputs

Argument Name	Description
exclude_system_fields	Whether to only return non-system fields. If “true”, will only output non-system fields. The default value is “false”.
short_names	Whether to shorten the incident field names. If “true”, will cause output to use shortened field names. The default value is “true”.

Outputs

There are no outputs for this script.

Script Examples

Example command

!IncidentFields exclude_system_fields="false" short_names="true"

Context Example

{}

Human Readable Output

{
   "accountgroups": {
       "associatedToAll": false,
       "associatedTypes": [
           "Brute Force"
       ],
       "name": "Account Groups",
       "shortName": "accountgroups",
       "type": "shortText"
   },
   "accountid": {
       "associatedToAll": false,
       "associatedTypes": [
           "Prisma Cloud",
           "GCP Compute Engine Misconfiguration",
           "AWS CloudTrail Misconfiguration",
           "AWS IAM Policy Misconfiguration",
           "AWS EC2 Instance Misconfiguration"
       ],
       "name": "Account ID",
       "shortName": "accountid",
       "type": "shortText"
   },
   "accountname": {
       "associatedToAll": false,
       "associatedTypes": [
           "Prisma Cloud",
           "GCP Compute Engine Misconfiguration",
           "AWS CloudTrail Misconfiguration",
           "AWS IAM Policy Misconfiguration",
           "AWS EC2 Instance Misconfiguration",
           "Microsoft CAS Alert",
           "CrowdStrike Falcon Detection"
       ],
       "name": "Account Name",
       "shortName": "accountname",
       "type": "shortText"
   },
   "acquisitionhire": {
       "associatedToAll": false,
       "associatedTypes": [
           "IAM - AD User Activation"
       ],
       "name": "Acquisition Hire",
       "shortName": "acquisitionhire",
       "type": "shortText"
   },
   "activedirectoryaccountstatus": {
       "associatedToAll": false,
       "associatedTypes": [
           "Employee Offboarding"
       ],
       "name": "Active Directory Account Status",
       "shortName": "activedirectoryaccountstatus",
       "type": "singleSelect"
   },
   "activedirectorydisplayname": {
       "associatedToAll": false,
       "associatedTypes": [
           "Employee Offboarding"
       ],
       "name": "Active Directory Display Name",
       "shortName": "activedirectorydisplayname",
       "type": "shortText"
   },
   "activedirectorypasswordstatus": {
       "associatedToAll": false,
       "associatedTypes": [
           "Employee Offboarding"
       ],
       "name": "Active Directory Password Status",
       "shortName": "activedirectorypasswordstatus",
       "type": "singleSelect"
   },
   "agentid": {
       "associatedToAll": true,
       "associatedTypes": "all",
       "name": "Agent ID",
       "shortName": "agentid",
       "type": "shortText"
   },
   "agentsid": {
       "associatedToAll": true,
       "associatedTypes": "all",
       "name": "Agents ID",
       "shortName": "agentsid",
       "type": "multiSelect"
   },
   "agentversion": {
       "associatedToAll": true,
       "associatedTypes": "all",
       "name": "Agent Version",
       "shortName": "agentversion",
       "type": "multiSelect"
   },

Troubleshooting

Multi-tenant environments should be configured with the Cortex Rest API instance when using this
automation. Make sure the Use tenant parameter (in the Cortex Rest API integration) is checked
to ensure that API calls are made to the current tenant instead of the master tenant.

Source

IncidentFields.py IncidentFields_test.py IncidentFields.yml

Download History Raw

import json

import demistomock as demisto


def executeCommand(name, args=None):
    if name == "core-api-get" and args and "uri" in args and args["uri"] == "/incidentfields":
        file_name = "TestData/integration_incidentfields.json"
    else:
        raise ValueError(f"Unimplemented command called: {name}")

    with open(file_name) as f:
        raw_data = f.read()
        data = json.loads(raw_data)
        return data


def parseJsonFile(file_name):
    with open(file_name) as f:
        raw_data = f.read()
        data = json.loads(raw_data)
        return data


def test_main(mocker):
    from IncidentFields import main

    mocker.patch.object(demisto, "executeCommand", side_effect=executeCommand)

    # test custom fields with short names
    mocker.patch.object(demisto, "args", return_value={"exclude_system_fields": "true", "short_names": "true"})
    mocker.patch.object(demisto, "results")
    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0][0]
    assert results == parseJsonFile("./TestData/output_exclude_system_fields_true_shortnames.json")
    assert "dbotcreated" not in results

    # test custom fields with long names
    mocker.patch.object(demisto, "args", return_value={"exclude_system_fields": "true", "short_names": "false"})
    mocker.patch.object(demisto, "results")
    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0][0]
    assert results == parseJsonFile("./TestData/output_exclude_system_fields_true_longnames.json")
    assert "dbotClosed" not in results

    # test system fields with short names
    mocker.patch.object(demisto, "args", return_value={"exclude_system_fields": "false", "short_names": "true"})
    mocker.patch.object(demisto, "results")
    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0][0]
    assert results == parseJsonFile("./TestData/output_exclude_system_fields_false_shortnames.json")
    assert "labels" in results