NCSCReportOverview

This script generates the report details for the individual CAF Section. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · NCSC Cyber Asssessment Framework

Source

import json

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def calculate_overall(data: dict = None) -> str:
    if not data:
        return ""
    results = [x["Result"] for x in data]
    if "Not Achieved" in results:
        return "Not Achieved"
    elif "Partially Achieved" in results:
        return "Partially Achieved"
    else:
        return "Achieved"


def main():
    query = '-status:closed -category:job type:"NCSC CAF Assessment"'
    incidents = demisto.executeCommand("getIncidents", {"query": query})[0]["Contents"]["data"]
    if len(incidents) < 1:
        return ""
    incidents = sorted(incidents, key=lambda x: x["id"])
    incident = incidents[0]

    if incident:
        md: str = ""
        achieved: int = 0
        partially_achieved: int = 0
        not_achieved: int = 0

        custom_fields = incident.get("CustomFields")
        assessment_a_details = json.loads(custom_fields.get("cafaresultraw"))
        assessment_a_achievement = calculate_overall(assessment_a_details)
        if assessment_a_achievement == "Achieved":
            achieved += 1
        elif assessment_a_achievement == "Partially Achieved":
            partially_achieved += 1
        else:
            not_achieved += 1

        assessment_b_details = json.loads(custom_fields.get("cafbresultraw"))
        assessment_b_achievement = calculate_overall(assessment_b_details)
        if assessment_b_achievement == "Achieved":
            achieved += 1
        elif assessment_b_achievement == "Partially Achieved":
            partially_achieved += 1
        else:
            not_achieved += 1

        assessment_c_details = json.loads(custom_fields.get("cafcresultraw"))
        assessment_c_achievement = calculate_overall(assessment_c_details)
        if assessment_c_achievement == "Achieved":
            achieved += 1
        elif assessment_c_achievement == "Partially Achieved":
            partially_achieved += 1
        else:
            not_achieved += 1

        assessment_d_details = json.loads(custom_fields.get("cafdresultraw"))
        assessment_d_achievement = calculate_overall(assessment_d_details)
        if assessment_d_achievement == "Achieved":
            achieved += 1
        elif assessment_d_achievement == "Partially Achieved":
            partially_achieved += 1
        else:
            not_achieved += 1

        md += (
            f"Out of the four objectives answered:\n\n### Achieved: **{achieved}**\n\n### Partially Achieved: "
            f"**{partially_achieved}**\n\n### Not Achieved: **{not_achieved}**\n\n"
        )

        if not_achieved or partially_achieved:
            md += (
                "There is material available on the NCSC Website under [Table view of principles and related "
                "guidance](https://www.ncsc.gov.uk/collection/caf/table-view-principles-and-related-guidance) that "
                "will help with achieving all those that are either 'Not Achieved' or 'Partially Achived'.\n\n"
            )

        else:
            md += (
                "This assessment was fully 'Achieved', great work! There is nothing more to do than ensure that "
                "your standards remain as high as they are now.\n\n"
            )

    else:
        md = ""
    demisto.results(md)  # noqa: RET503


if __name__ in ["__main__", "__builtin__", "builtins"]:
    main()

README

This script generates the report details for the individual CAF Section.

Permissions


This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data


Name Description
Script Type python3
Tags widget
Cortex XSOAR Version 6.0.0

Inputs


There are no inputs for this script.

Outputs


There are no outputs for this script.