MarkAsEvidenceByTag

Mark entries as evidence if they are tagged with given tag.

Details

ID	`MarkAsEvidenceByTag`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	Utility

README

Mark entries as evidence if they are tagged with given tag

Script Data

Name	Description
Script Type	python3
Tags	Utility

Inputs

Argument Name	Description
tag	Entries with the given tag will be marked as evidence
description	Description for the Evidence item

Outputs

There are no outputs for this script.

Source

MarkAsEvidenceByTag.py MarkAsEvidenceByTag.yml

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

entries = demisto.executeCommand("getEntries", {})
if isError(entries[0]):
    demisto.results({"Type": entryTypes["error"], "ContentsFormat": formats["text"], "Contents": "Unable to retrieve entries"})
else:
    ids = []
    for e in entries:
        tags = e.get("Metadata", {}).get("tags")
        if not tags:
            tags = []
        if demisto.getArg("tag") in tags:
            ids.append(e["Metadata"]["id"])
    if len(ids) > 0:
        for i in ids:
            demisto.results(demisto.executeCommand("markAsEvidence", {"id": i, "description": demisto.getArg("description")}))
    else:
        demisto.results(
            {
                "Type": entryTypes["note"],
                "ContentsFormat": formats["text"],
                "Contents": "No entries with '" + demisto.getArg("tag") + "' found",
            }
        )