NCSCReportOverview
This script generates the report details for the individual CAF Section. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
python · NCSC Cyber Asssessment Framework
Source
import json import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 def calculate_overall(data: dict = None) -> str: if not data: return "" results = [x["Result"] for x in data] if "Not Achieved" in results: return "Not Achieved" elif "Partially Achieved" in results: return "Partially Achieved" else: return "Achieved" def main(): query = '-status:closed -category:job type:"NCSC CAF Assessment"' incidents = demisto.executeCommand("getIncidents", {"query": query})[0]["Contents"]["data"] if len(incidents) < 1: return "" incidents = sorted(incidents, key=lambda x: x["id"]) incident = incidents[0] if incident: md: str = "" achieved: int = 0 partially_achieved: int = 0 not_achieved: int = 0 custom_fields = incident.get("CustomFields") assessment_a_details = json.loads(custom_fields.get("cafaresultraw")) assessment_a_achievement = calculate_overall(assessment_a_details) if assessment_a_achievement == "Achieved": achieved += 1 elif assessment_a_achievement == "Partially Achieved": partially_achieved += 1 else: not_achieved += 1 assessment_b_details = json.loads(custom_fields.get("cafbresultraw")) assessment_b_achievement = calculate_overall(assessment_b_details) if assessment_b_achievement == "Achieved": achieved += 1 elif assessment_b_achievement == "Partially Achieved": partially_achieved += 1 else: not_achieved += 1 assessment_c_details = json.loads(custom_fields.get("cafcresultraw")) assessment_c_achievement = calculate_overall(assessment_c_details) if assessment_c_achievement == "Achieved": achieved += 1 elif assessment_c_achievement == "Partially Achieved": partially_achieved += 1 else: not_achieved += 1 assessment_d_details = json.loads(custom_fields.get("cafdresultraw")) assessment_d_achievement = calculate_overall(assessment_d_details) if assessment_d_achievement == "Achieved": achieved += 1 elif assessment_d_achievement == "Partially Achieved": partially_achieved += 1 else: not_achieved += 1 md += ( f"Out of the four objectives answered:\n\n### Achieved: **{achieved}**\n\n### Partially Achieved: " f"**{partially_achieved}**\n\n### Not Achieved: **{not_achieved}**\n\n" ) if not_achieved or partially_achieved: md += ( "There is material available on the NCSC Website under [Table view of principles and related " "guidance](https://www.ncsc.gov.uk/collection/caf/table-view-principles-and-related-guidance) that " "will help with achieving all those that are either 'Not Achieved' or 'Partially Achived'.\n\n" ) else: md += ( "This assessment was fully 'Achieved', great work! There is nothing more to do than ensure that " "your standards remain as high as they are now.\n\n" ) else: md = "" demisto.results(md) # noqa: RET503 if __name__ in ["__main__", "__builtin__", "builtins"]: main()
README
This script generates the report details for the individual CAF Section.
Permissions
This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | widget |
| Cortex XSOAR Version | 6.0.0 |
Inputs
There are no inputs for this script.
Outputs
There are no outputs for this script.