NetwitnessSACreateIncident

Details

ID	`NetwitnessSACreateIncident`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	RSA NetWitness Security Analytics

README

Creates an incident inside NetWitness SA from a set of NetWitness events.

Script Data

Name	Description
Script Type	python
Tags	RSA NetWitness Security Analytics

Dependencies

This script uses the following commands and scripts.

nw-create-incident

Inputs

Argument Name	Description
alertSummary	The short summary of the alert which will be attached to incident. (string)
severity	The severity level. The default set to “50”. (optional string)
name	The name of the incident. (string)
assigned	Sets the assignee login name if the assignee has changed. You can execute `nw-get-available-assignees` to get the list of users. For example, demisto123. (optional string)
eventList	The list of event IDs separated by comma (,). This must not include spaces in it. In order to get the list of events you can should use the `nw-get-events` command.
deviceId	The ID of the device/component (Concentrator, Log Decoder, Packet Decoder, etc.) from which the events are retrieved. The list of devices can be retrieved by executing the `command nw-get-components`.
priority	The priority of the incident.
summary	The summary of the incident.
incidentManagementId	The ID of NetWitness INCIDENT_MANAGEMENT device/component ID. It can be received by running `nw-get-component` command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server. (optional number)

Outputs

There are no outputs for this script.

Source

NetwitnessSACreateIncident.py NetwitnessSACreateIncident_test.py NetwitnessSACreateIncident.yml

Download History Raw

commonfields:
  id: NetwitnessSACreateIncident
  version: -1
name: NetwitnessSACreateIncident
script: ''
type: python
subtype: python3
tags:
- RSA NetWitness Security Analytics
comment: Create an incident inside NetWitness SA from a set of NetWitness events.
system: true
args:
- name: alertSummary
  required: true
  description: '[string] Short summary of the alert which will be attached to incident.'
- name: severity
  description: '[optional string] Default set to "50". '
- name: name
  required: true
  description: '[string] The name of the incident.'
- name: assigned
  description: '[optional string] Set assignee login name if assignee has changed. You can execute nw-get-available-assignees to get the list of users. Example: demisto123.'
- name: eventList
  required: true
  description: List of event ids separated by comma [,] must not include spaces in it. In order to get list of events you can use nw-get-events.
- name: deviceId
  required: true
  description: The id of the device/component (Concentrator, Log Decoder, Packet Decoder, etc.) from which the events are. You can view the list of devices by executing the command nw-get-components.
- name: priority
  required: true
  auto: PREDEFINED
  predefined:
  - LOW
  - MEDIUM
  - HIGH
  - CRITICAL
  description: Priority of the incident.
- name: summary
  description: Summary of the incident.
- name: incidentManagementId
  description: '[optional number] This is the id of NetWitness INCIDENT_MANAGEMENT device/component id. It can be received by running nw-get-component command. If this argument is not filled/passed, the script will automatically get the first device of type INCIDENT_MANAGEMENT from the SA server.'
scripttarget: 0
dependson:
  must:
  - netwitness-im-create-incident
timeout: 0s
fromversion: 5.0.0
dockerimage: demisto/python3:3.12.13.10116658
tests:
- No tests (auto formatted)
skipprepare:
- script-name-incident-to-alert