MS365DefenderAddComment

Use this script to add a comment to a Microsoft 365 Defender incident. To be run within the incident.

python · Microsoft 365 Defender

Details

IDMS365DefenderAddComment
Languagepython
From Version6.10.0
Docker Imagedemisto/crypto:1.0.0.10120494
TagsMicrosoft 365 Defender

Source

MS365DefenderAddComment.py MS365DefenderAddComment_test.py MS365DefenderAddComment.yml
Download History Raw 
def test_add_comment(mocker):
    from MS365DefenderAddComment import add_comment, demisto

    mocker.patch.object(demisto, "executeCommand")
    add_comment({"id": "1", "comment": "test"})
    assert demisto.executeCommand.call_count == 1
    assert demisto.executeCommand.call_args[0][0] == "microsoft-365-defender-incident-update"
    assert demisto.executeCommand.call_args[0][1]["id"] == "1"
    assert demisto.executeCommand.call_args[0][1]["comment"] == "test"