IsDomainInternal

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def is_domain_internal(domain: str, internal_domains: List[str]) -> bool:
    parts = domain.split(".")
    for i in range(len(parts), 0, -1):
        sub = ".".join(parts[-i:])
        if sub in internal_domains:
            return True
    return False


def main():
    args = demisto.args()
    internal_domains_list_name = args.get("InternalDomainsListName", "InternalDomains")
    domains_to_check = argToList(args.get("Domains", ()))

    # Get the list of internal domains from the XSOAR list:
    internal_domains = demisto.executeCommand("getList", {"listName": internal_domains_list_name})[0]["Contents"]
    if "Item not found" in internal_domains:
        return_error(f"The list name {internal_domains_list_name} does not exist.")

    # Split internal domains from XSOAR list to be a list:
    if internal_domains:
        try:
            internal_domains = internal_domains.split("\n")
        except Exception as ex:
            return_error(
                f"Could not parse the internal domains list. Please make sure that the list contains domain names,"
                f" separated by new lines.\nThe exact error is: {ex}"
            )
    else:
        return_results(f"No internal domains were found under {internal_domains_list_name}.")
        return

    # Create list of domain names with internal property
    domain_list = [{"Name": domain, "Internal": is_domain_internal(domain, internal_domains)} for domain in domains_to_check]

    for domain in domain_list:
        args_exists_check = {"indicator": domain.get("Name")}

        # Check if indicator exists:
        is_exist_res = demisto.executeCommand("CheckIndicatorValue", args_exists_check)
        indicator_exists = is_exist_res[0]["Contents"][0]["Exists"]

        args_create_or_set_indicator = {"value": domain.get("Name"), "type": "Domain", "internal": domain.get("Internal")}

        # If indicator doesn't exist, create it and continuously poll for its creation (which happens asynchronously):
        if indicator_exists:
            # If indicator exists, update it with the correct Internal property:
            # Note: theoretically the custom field mapping of the Domain indicator should already map Domain.Internal
            # context to the "Internal" indicator field.
            # However, the mapping occurs only AFTER the indicator reputation script, which DOES NOT run before this
            # script completes, so in order to successfully set the Internal property of the domain name,
            # we need to ensure creation and then edit the indicator ourselves.
            demisto.executeCommand("setIndicator", args_create_or_set_indicator)
        else:
            demisto.executeCommand("createNewIndicator", args_create_or_set_indicator)

    # Create entry context and human-readable results
    entry_context = {"Domain(val.Name == obj.Name)": domain_list}
    md_table = tableToMarkdown(
        name="Domain Names", t=sorted(domain_list, key=lambda x: not x["Internal"]), headers=["Name", "Internal"]
    )
    entry_to_return = {
        "Type": entryTypes["note"],
        "Contents": domain_list,
        "ContentsFormat": "text",
        "HumanReadable": md_table,
        "EntryContext": entry_context,
        "Tags": ["Internal_Domain_Check_Results"],
    }

    # Return results
    return_results(entry_to_return)


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README