IndicatorMaliciousRatioCalculation

Return indicators appears in resolved incidents, and resolved incident ids. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Common Scripts

Details

ID	`IndicatorMaliciousRatioCalculation`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	ml

README

Returns indicators that appear under resolved incidents, and resolved incident IDs.

Script Data

Name	Description
Script Type	python
Tags	ml
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
maxIncidents	The maximum number of incidents to query.
maxIndicators	The maximum number of indicators to query.
appearsInMinNumberOfIncidents	The indicator that appears in the minimum number of incidents.
query	The query to fetch the indicators from. The incident which are “bad”.
maxDisplayResults	The maximum number of results (indicators) to display as output.
fileResult	The generate file result.
fromDate	The start date by which to filter incidents.

Outputs

There are no outputs for this script.

Source

IndicatorMaliciousRatioCalculation.py IndicatorMaliciousRatioCalculation.yml

Download History Raw

commonfields:
  id: IndicatorMaliciousRatioCalculation
  version: -1
name: IndicatorMaliciousRatioCalculation
script: ''
type: python
subtype: python3
tags:
- ml
comment: |-
  Return indicators appears in resolved incidents, and resolved incident ids.

  This automation runs using the default Limited User role, unless you explicitly change the permissions.
  For more information, see the section about permissions here:
  - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
  - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
  - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
enabled: true
args:
- name: maxIncidents
  description: Max number of incidents to query.
  defaultValue: "100000"
- name: maxIndicators
  description: Max number of indicators to query.
  defaultValue: "100000"
- name: appearsInMinNumberOfIncidents
  description: Indicator appears in minimum number of incidents.
  defaultValue: "3"
- name: query
  description: The query to fetch the indicators from incident which are "bad".
  defaultValue: incident.closeReason:Resolved
- name: maxDisplayResults
  description: Maximum number of results (indicators) to display as output.
  defaultValue: "50"
- name: fileResult
  auto: PREDEFINED
  predefined:
  - "yes"
  - "no"
  description: Generate file result.
  defaultValue: "no"
- description: 'The start date by which to filter incidents. Date format will be the same as in the incidents query page, for example:"2021-01-01T00:00:00").'
  name: fromDate
scripttarget: 0
timeout: 300ns
fromversion: 5.0.0
tests:
- IndicatorMaliciousRatioCalculation_test
dockerimage: demisto/python3:3.12.13.10404775