NCSCReportDetails_A
This script generates the report details for the individual CAF Section. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
python · NCSC Cyber Asssessment Framework
Details
| ID | NCSCReportDetails_A |
|---|---|
| Language | python |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.8.3296088 |
| Tags | widget |
README
This script generates the report details for the individual CAF Section.
Permissions
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | widget |
| Cortex XSOAR Version | 6.0.0 |
Inputs
There are no inputs for this script.
Outputs
There are no outputs for this script.
import json import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 def calculate_overall(data: dict = None) -> str: if not data: return "" results = [x["Result"] for x in data] if "Not Achieved" in results: return "Not Achieved" elif "Partially Achieved" in results: return "Partially Achieved" else: return "Achieved" def main(): query = '-status:closed -category:job type:"NCSC CAF Assessment"' result_field = "cafaresultraw" answers_field = "cafaanswers" questions_field = "cafaquestions" assessment_field = "AssessmentA" incidents = demisto.executeCommand("getIncidents", {"query": query})[0]["Contents"]["data"] if len(incidents) < 1: return "" incidents = sorted(incidents, key=lambda x: x["id"]) incident = incidents[0] original_question_data = json.loads(demisto.executeCommand("getList", {"listName": "NCSC CAF Assessment"})[0]["Contents"]) original_question_data = original_question_data[assessment_field] if incident: md: str = "" custom_fields = incident.get("CustomFields") assessment_questions = json.loads(custom_fields.get(questions_field)) assessment_answers = json.loads(custom_fields.get(answers_field)) assessment_details = json.loads(custom_fields.get(result_field)) assessment_result = calculate_overall(assessment_details) answered_questions = "" for x in range(len(assessment_questions)): table = [] original_answers = [ a.get("answers") for a in original_question_data if a["question"] == assessment_questions.get(str(x)) ][0] these_answers = assessment_answers.get(str(x)) for answer in these_answers: verdict = [b["score"] for b in original_answers if b["answer"] == answer][0] verdict = "Achieved" if verdict == 2 else "Not Achieved" if verdict == 0 else "Partially Achieved" table.append({"Answer": answer, "Result": verdict}) answers_markdown = tableToMarkdown(assessment_questions.get(str(x)), table, ["Answer", "Result"]) answered_questions += f"{answers_markdown}\n\n" md += ( f"### Provided answers\n\nBelow are the individual questions and responses provided for this objective:" f"\n\n{answered_questions}\n\n" ) if assessment_result in ["Not Achieved", "Partially Achieved"]: md += ( "### Recommendations\n\nPlease review the following questions and their responses that result in an " "'Achieved' outcome for this objective (the list only includes questions which have " "not resulted in 'Achieved'):\n\n" ) failed_questions = [x["Question"] for x in assessment_details if x["Result"] != "Achieved"] for question in original_question_data: if question.get("question") in failed_questions: md += f"#### {question.get('question')}\n" for answer in [x["answer"] for x in question["answers"] if x["score"] == 2]: md += f"- {answer}\n" md += "\n" else: md += ( "### Recommendations\n\nThere are no further recommendations to improve your result for this " "objectve. Good work!" ) else: md = "" demisto.results(md) # noqa: RET503 if __name__ in ["__main__", "__builtin__", "builtins"]: main()