IsIncidentPartOfCampaign

Gets the ID of an incident campaign that is linked to at least one of the given incidents.

Details

ID	`IsIncidentPartOfCampaign`
Language	python
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	phishing campaign

README

Gets the ID of an incident campaign that is linked to at least one of the given incidents.

Permissions

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name	Description
Script Type	python3
Tags	phishing, campaign
Cortex XSOAR Version	5.5.0

Inputs

Argument Name	Description
IncidentIDs	A comma-separated list of incidents ids to search an incident campaign for.

Outputs

Path	Description	Type
ExistingCampaignID	The ID of an incident campaign that is linked to at least one of the given incidents.	String

Source

IsIncidentPartOfCampaign.py IsIncidentPartOfCampaign_test.py IsIncidentPartOfCampaign.yml

Download History Raw

import re

import demistomock as demisto
import pytest
from IsIncidentPartOfCampaign import main

INCIDENTS: list[dict] = [
    {"id": "1", "type": "Phishing Campaign"},
    {"id": "2", "type": "Phishing Campaign"},
    {"id": "3", "type": "Phishing"},
    {"id": "4", "type": "Phishing", "partofcampaign": "1"},
    {"id": "5", "type": "Phishing", "partofcampaign": "2"},
    {"id": "6", "type": "Phishing"},
]


def get_incidents_by_query_func(args):
    query = args["query"]
    match = re.search(r"incident.id:\(([^\)]*)\)", query)
    incident_ids = set(match.group(1).split(" ") if match and match.group(1) else [])
    return [i for i in INCIDENTS if i.get("id") in incident_ids and i.get("partofcampaign")]


@pytest.fixture(autouse=True)
def mock_get_incidents_by_query(mocker):
    mocker.patch(
        "IsIncidentPartOfCampaign.get_incidents_by_query",
        side_effect=get_incidents_by_query_func,
    )


def test_success(mocker):
    """Given a list of incident IDs that are part of a campaign, make sure results are returned"""
    mocker.patch.object(demisto, "args", return_value={"IncidentIDs": "3,5"})
    results = main()
    assert "Found campaign with ID" in results.readable_output
    assert results.outputs["ExistingCampaignID"] in ["1", "2"]


def test_no_results(mocker):
    """Given a list of incident IDs, but they are not part of a campaign, make sure no results are returned"""
    mocker.patch.object(demisto, "args", return_value={"IncidentIDs": "1"})
    results = main()
    assert "No campaign was found" in results.readable_output
    assert not results.outputs["ExistingCampaignID"]