InvestigationDetailedSummaryToTable
Shows InvestigationDetailedSummaryParse results as a markdown table.
python · Malware Investigation and Response
Details
| ID | InvestigationDetailedSummaryToTable |
|---|---|
| Language | python |
| From Version | 6.2.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Tags | dynamic-section field-change-triggered |
README
This script shows InvestigationDetailedSummaryParse results as a Markdown table.
NOTE: This script assumes the results of InvestigationDetailedSummaryParse are stored in the malwaredetailedinvestigationsummary incident field.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | basescript |
| Cortex XSOAR Version | 6.2.0 |
Inputs
There are no inputs for this script.
Outputs
There are no outputs for this script.
import json from pathlib import Path from InvestigationDetailedSummaryToTable import table_command TEST_DATA_DIR = Path(__file__).parent / "test_data" def _dump_test_file(file_name: str, content: dict | list): (TEST_DATA_DIR / file_name).write_text(json.dumps(content)) def _load_test_file(file_name: str): return json.loads((TEST_DATA_DIR / file_name).read_text()) def test_empty_context(): assert table_command({}).to_context() == _load_test_file("empty_context.json") def test_table_command(): context = { "Collection": [ { "Automated Collection": True, "Data Staged: Local Data Staging": True, "Data from Local System": True, "Email Collection": True, "Input Capture: Keylogging": True, "Screen Capture": True, } ], "Command & Control": [ { "Application Layer Protocol": True, "Encrypted Channel": True, "Encrypted Channel: Asymmetric Cryptography": True, "Encrypted Channel: Symmetric Cryptography": True, "Ingress Tool Transfer": True, "Non-Application Layer Protocol": True, "Proxy": True, } ], "Credential Access": [{"Credentials from Password Stores": True, "Input Capture: Keylogging": True}], "Defense Evasion": [ { "Abuse Elevation Control Mechanism: Bypass User Account Control": True, "Access Token Manipulation": True, "Access Token Manipulation: Token Impersonation/Theft": True, "Debugger Evasion": True, "Deobfuscate/Decode Files or Information": True, "Execution Guardrails": True, "File and Directory Permissions Modification": True, "Hide Artifacts": True, "Hijack Execution Flow: Hijack Execution Flow": True, "Impair Defenses: Disable or Modify Tools": True, "Indicator Removal: Clear Command History": True, "Indicator Removal: Indicator Removal": True, "Masquerading": True, "Modify Registry": True, "Obfuscated Files or Information": True, "Obfuscated Files or Information: Embedded Payloads": True, "Obfuscated Files or Information: Obfuscated Files or Information": True, "Process Injection": True, "Process Injection: Asynchronous Procedure Call": True, "Process Injection: Dynamic-link Library Injection": True, "Process Injection: Extra Window Memory Injection": True, "Process Injection: Thread Execution Hijacking": True, "Reflective Code Loading": True, "Virtualization/Sandbox Evasion: System Checks": True, "Virtualization/Sandbox Evasion: Time Based Evasion": True, } ], "Discovery": [ { "Account Discovery": True, "Application Window Discovery": True, "Debugger Evasion": True, "File and Directory Discovery": True, "Process Discovery": True, "Query Registry": True, "Remote System Discovery": True, "System Information Discovery": True, "System Location Discovery": True, "System Location Discovery: System Language Discovery": True, "System Owner/User Discovery": True, "System Service Discovery": True, "System Time Discovery": True, "Virtualization/Sandbox Evasion: System Checks": True, "Virtualization/Sandbox Evasion: Time Based Evasion": True, } ], "Execution": [ { "Command and Scripting Interpreter": False, "Command and Scripting Interpreter: PowerShell": True, "Inter-Process Communication": True, "Native API": True, "Shared Modules": True, "System Services: System Services": True, } ], "Exfiltration": [{"Scheduled Transfer": True}], "Impact": [ { "Data Encrypted for Impact": True, "Data Manipulation": True, "Service Stop": True, "System Shutdown/Reboot": True, } ], "Lateral Movement": [{"Lateral Tool Transfer": True, "Remote Services": False}], "Persistence": [ { "Boot or Logon Autostart Execution": True, "Create or Modify System Process": True, "Create or Modify System Process: Windows Service": True, "Event Triggered Execution: Event Triggered Execution": True, "Hijack Execution Flow: Hijack Execution Flow": True, } ], "Privilege Escalation": [ { "Abuse Elevation Control Mechanism: Bypass User Account Control": True, "Access Token Manipulation": True, "Access Token Manipulation: Token Impersonation/Theft": True, "Boot or Logon Autostart Execution": True, "Create or Modify System Process": True, "Create or Modify System Process: Windows Service": True, "Event Triggered Execution: Event Triggered Execution": True, "Hijack Execution Flow: Hijack Execution Flow": True, "Process Injection": True, "Process Injection: Asynchronous Procedure Call": True, "Process Injection: Dynamic-link Library Injection": True, "Process Injection: Extra Window Memory Injection": True, "Process Injection: Thread Execution Hijacking": True, } ], } assert table_command(context).to_context() == _load_test_file("table_command.json")