NCSCReportDetails_A

This script generates the report details for the individual CAF Section. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · NCSC Cyber Asssessment Framework

Details

IDNCSCReportDetails_A
Languagepython
From Version6.0.0
Docker Imagedemisto/python3:3.12.8.3296088
Tagswidget

README

This script generates the report details for the individual CAF Section.

Permissions


This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data


Name Description
Script Type python3
Tags widget
Cortex XSOAR Version 6.0.0

Inputs


There are no inputs for this script.

Outputs


There are no outputs for this script.

import json

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def calculate_overall(data: dict = None) -> str:
    if not data:
        return ""
    results = [x["Result"] for x in data]
    if "Not Achieved" in results:
        return "Not Achieved"
    elif "Partially Achieved" in results:
        return "Partially Achieved"
    else:
        return "Achieved"


def main():
    query = '-status:closed -category:job type:"NCSC CAF Assessment"'

    result_field = "cafaresultraw"
    answers_field = "cafaanswers"
    questions_field = "cafaquestions"
    assessment_field = "AssessmentA"

    incidents = demisto.executeCommand("getIncidents", {"query": query})[0]["Contents"]["data"]
    if len(incidents) < 1:
        return ""
    incidents = sorted(incidents, key=lambda x: x["id"])
    incident = incidents[0]
    original_question_data = json.loads(demisto.executeCommand("getList", {"listName": "NCSC CAF Assessment"})[0]["Contents"])
    original_question_data = original_question_data[assessment_field]
    if incident:
        md: str = ""

        custom_fields = incident.get("CustomFields")
        assessment_questions = json.loads(custom_fields.get(questions_field))
        assessment_answers = json.loads(custom_fields.get(answers_field))
        assessment_details = json.loads(custom_fields.get(result_field))
        assessment_result = calculate_overall(assessment_details)
        answered_questions = ""
        for x in range(len(assessment_questions)):
            table = []
            original_answers = [
                a.get("answers") for a in original_question_data if a["question"] == assessment_questions.get(str(x))
            ][0]
            these_answers = assessment_answers.get(str(x))
            for answer in these_answers:
                verdict = [b["score"] for b in original_answers if b["answer"] == answer][0]
                verdict = "Achieved" if verdict == 2 else "Not Achieved" if verdict == 0 else "Partially Achieved"
                table.append({"Answer": answer, "Result": verdict})
                answers_markdown = tableToMarkdown(assessment_questions.get(str(x)), table, ["Answer", "Result"])
            answered_questions += f"{answers_markdown}\n\n"

        md += (
            f"### Provided answers\n\nBelow are the individual questions and responses provided for this objective:"
            f"\n\n{answered_questions}\n\n"
        )

        if assessment_result in ["Not Achieved", "Partially Achieved"]:
            md += (
                "### Recommendations\n\nPlease review the following questions and their responses that result in an "
                "'Achieved' outcome for this objective (the list only includes questions which have "
                "not resulted in 'Achieved'):\n\n"
            )
            failed_questions = [x["Question"] for x in assessment_details if x["Result"] != "Achieved"]
            for question in original_question_data:
                if question.get("question") in failed_questions:
                    md += f"#### {question.get('question')}\n"
                    for answer in [x["answer"] for x in question["answers"] if x["score"] == 2]:
                        md += f"- {answer}\n"
                    md += "\n"

        else:
            md += (
                "### Recommendations\n\nThere are no further recommendations to improve your result for this "
                "objectve. Good work!"
            )

    else:
        md = ""
    demisto.results(md)  # noqa: RET503


if __name__ in ["__main__", "__builtin__", "builtins"]:
    main()