JSONtoCSV

Convert a JSON War Room output via EntryID to a CSV file.

python · Common Scripts

Source

import csv
import io
import sys

import demistomock as demisto
from CommonServerPython import *


def main():
    args = demisto.args()
    entry_id = args.get("entryid")

    if isinstance(entry_id, list):
        entry_id = entry_id[0]

    dictlist = demisto.executeCommand("getEntry", {"id": entry_id})[0]["Contents"]
    csv_final = json_to_csv(dictlist)

    if "filename" in args:
        # Send CSV as file in War Room
        demisto.results(fileResult(args.get("filename"), csv_final))

    else:
        # Send CSV to War Room
        demisto.results(csv_final)


def json_to_csv(data: list):
    """
    Takes a list of dictionaries and parses them into CSV format.
    JSON should be only a list that contains dictionaries.

    json:
        [
            {
                "dn": "DC=demisto,DC=int",
                "provider": "activedir"
            },
            {
                "dn": "CN=Users,DC=demisto,DC=int",
                "provider": "activedir"
            }
        ]

    csv:
        "dn", "provider"
        "DC=demisto,DC=int" , "activedir"
        "CN=Users,DC=demisto, DC=int" ,"activedir"
    """
    result = io.StringIO()
    csv_data = csv.writer(result)

    try:
        keys = list(data[0].keys())

    except KeyError:
        demisto.debug("The given JSON is not an iterable list.")
        sys.exit(0)

    csv_data.writerow(keys)

    for d in data:
        val_lst = []
        for k in keys:
            val_lst.append(d[k])

        csv_data.writerow(val_lst)

    return result.getvalue().strip()


if __name__ in ["__builtin__", "builtins", "__main__"]:
    main()

README

Convert a JSON War Room output via EntryID to a CSV file.

Script Data


Name Description
Script Type python3
Cortex XSOAR Version 5.0.0

Inputs


Argument Name Description
entryid Entry id of json
delimiter CSV Delimiter.
filename If provided will output CSV to file. Default output is to War Room.

Outputs


Path Description Type
File.Name Filename (only in case of report type=json) Unknown
File.Type File type e.g. “PE” (only in case of report type=json) Unknown
File.Size File size (only in case of report type=json) Unknown
File.MD5 MD5 hash of the file (only in case of report type=json) Unknown
File.SHA1 SHA1 hash of the file (only in case of report type=json) Unknown
File.SHA256 SHA256 hash of the file (only in case of report type=json) Unknown