NetwitnessSAAddEventsToIncident

This command will add new events to an existing NetWitness SA incident.

python · RSA NetWitness Security Analytics

Details

ID	`NetwitnessSAAddEventsToIncident`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	RSA NetWitness Security Analytics

README

Adds new events to an existing NetWitness SA incident.

Script Data

Name	Description
Script Type	python
Tags	RSA NetWitness Security Analytics

Dependencies

This script uses the following commands and scripts.

nw-add-events-to-incident

Inputs

Argument Name	Description
incidentId	The existing incident ID. (string)
eventList	The list of event IDs separated by a comma (,), this must not include spaces in it. In order to get list of events you can use `nw-get-events`. For example, “23,12,3”. (array of strings)
alertSummary	The short summary of the alert that will be attached to incident. (string)
severity	The severity of the incident. For example, 50. (number)
deviceId	The ID of the device/component. For example, Concentrator, Log Decoder, Packet Decoder, etc… from which the events are. The list of devices can be viewed by executing the `command nw-get-components`. (number)
incidentManagementId	The ID of the NetWitness INCIDENT_MANAGEMENT device/component ID. It can be received by running `nw-get-component` command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server. (optional number)

Outputs

There are no outputs for this script.

Source

NetwitnessSAAddEventsToIncident.py NetwitnessSAAddEventsToIncident_test.py NetwitnessSAAddEventsToIncident.yml

Download History Raw

commonfields:
  id: NetwitnessSAAddEventsToIncident
  version: -1
name: NetwitnessSAAddEventsToIncident
script: ''
type: python
subtype: python3
tags:
- RSA NetWitness Security Analytics
comment: This command will add new events to an existing NetWitness SA incident.
system: true
args:
- name: incidentId
  required: true
  default: true
  description: '[string] Existing incident id. '
- name: eventList
  required: true
  description: '[array of strings] List of event ids separated by comma [,] must not include spaces in it. In order to get list of events you can use nw-get-events. Example: "23,12,3".'
- name: alertSummary
  required: true
  description: '[string] Short summary of the alert which will be attached to incident.'
- name: severity
  required: true
  description: '[number] Severity of the incident. Example: 50.'
- name: deviceId
  required: true
  description: '[number] The id of the device/component (Concentrator, Log Decoder, Packet Decoder, etc.) from which the events are. You can view the list of devices by executing the command nw-get-components.'
- name: incidentManagementId
  description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running nw-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
scripttarget: 0
dependson:
  must:
  - netwitness-im-add-events-to-incident
timeout: 0s
fromversion: 5.0.0
dockerimage: demisto/python3:3.12.13.10116658
tests:
- No tests (auto formatted)
skipprepare:
- script-name-incident-to-alert