NumberOfPhishingAttemptPerUser

Shows a bar chart of the number of incident the 'To' and 'From' email addresses. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Common Scripts

Details

IDNumberOfPhishingAttemptPerUser
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10404775
Tagsdynamic-section

README

Shows a bar chart of the number of incident the ‘To’ and ‘From’ email addresses.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name Description
Script Type python3
Tags dynamic-section
Cortex XSOAR Version 5.0.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

NumberOfPhishingAttemptPerUser.py NumberOfPhishingAttemptPerUser_test.py NumberOfPhishingAttemptPerUser.yml
Download History Raw 
from CommonServerPython import *
from NumberOfPhishingAttemptPerUser import get_relevant_incidents

incident = [
    {
        "ModuleName": "InnerServicesModule",
        "Brand": "Builtin",
        "Category": "Builtin",
        "ID": "",
        "Version": 0,
        "Type": 1,
        "Contents": {
            "ErrorsPrivateDoNotUse": None,
            "data": [
                {
                    "CustomFields": {
                        "customercityselect": "",
                        "customercountryselect": "",
                        "customerstateselect": "",
                        "dbotpredictionprobability": 0,
                        "detectionsla": {
                            "accumulatedPause": 0,
                            "breachTriggered": False,
                            "dueDate": "0001-01-01T00:00:00Z",
                            "endDate": "0001-01-01T00:00:00Z",
                            "lastPauseDate": "0001-01-01T00:00:00Z",
                            "runStatus": "idle",
                            "sla": 20,
                            "slaStatus": -1,
                            "startDate": "0001-01-01T00:00:00Z",
                            "totalDuration": 0,
                        },
                        "emailfrom": "bark@demisto.com",
                        "emailto": "bark@demisto.com",
                        "remediationsla": {
                            "accumulatedPause": 0,
                            "breachTriggered": False,
                            "dueDate": "0001-01-01T00:00:00Z",
                            "endDate": "0001-01-01T00:00:00Z",
                            "lastPauseDate": "0001-01-01T00:00:00Z",
                            "runStatus": "idle",
                            "sla": 7200,
                            "slaStatus": -1,
                            "startDate": "0001-01-01T00:00:00Z",
                            "totalDuration": 0,
                        },
                        "tasklist": [],
                        "timetoassignment": {
                            "accumulatedPause": 0,
                            "breachTriggered": False,
                            "dueDate": "0001-01-01T00:00:00Z",
                            "endDate": "0001-01-01T00:00:00Z",
                            "lastPauseDate": "0001-01-01T00:00:00Z",
                            "runStatus": "idle",
                            "sla": 0,
                            "slaStatus": -1,
                            "startDate": "0001-01-01T00:00:00Z",
                            "totalDuration": 0,
                        },
                        "urlsslverification": [],
                    },
                    "ShardID": 0,
                    "account": "Content",
                    "activated": "0001-01-01T00:00:00Z",
                    "attachment": None,
                    "autime": 1594242451076699000,
                    "canvases": None,
                    "category": "",
                    "closeNotes": "",
                    "closeReason": "",
                    "closed": "0001-01-01T00:00:00Z",
                    "closingUserId": "",
                    "created": "2020-07-08T14:07:31.076698991-07:00",
                    "dbotCreatedBy": "sbe@example.com",
                    "details": "",
                    "droppedCount": 0,
                    "dueDate": "2020-07-18T14:07:31.076698991-07:00",
                    "feedBased": False,
                    "hasRole": False,
                    "id": "29432",
                    "investigationId": "29432",
                    "isPlayground": False,
                    "labels": [
                        {"type": "Instance", "value": "sbe@example.com"},
                        {"type": "Brand", "value": "Manual"},
                    ],
                    "lastJobRunTime": "0001-01-01T00:00:00Z",
                    "lastOpen": "0001-01-01T00:00:00Z",
                    "linkedCount": 0,
                    "linkedIncidents": None,
                    "modified": "2020-07-19T01:04:21.930897901-07:00",
                    "name": "shahaf2",
                    "notifyTime": "0001-01-01T00:00:00Z",
                    "occurred": "2020-07-08T14:07:31.076698769-07:00",
                    "openDuration": 0,
                    "owner": "sbe@example.com",
                    "parent": "",
                    "phase": "",
                    "playbookId": "566f7816-998d-4e5d-8359-056f98260fbc",
                    "previousRoles": None,
                    "rawCategory": "",
                    "rawCloseReason": "",
                    "rawJSON": "",
                    "rawName": "shahaf2",
                    "rawPhase": "",
                    "rawType": "Unclassified",
                    "reason": "",
                    "reminder": "0001-01-01T00:00:00Z",
                    "roles": None,
                    "runStatus": "completed",
                    "severity": 0,
                    "sla": 0,
                    "sortValues": ["_score"],
                    "sourceBrand": "Manual",
                    "sourceInstance": "sbe@example.com",
                    "status": 1,
                    "type": "Unclassified",
                    "version": 7,
                }
            ],
            "total": 1,
        },
        "HumanReadable": None,
        "ImportantEntryContext": None,
        "EntryContext": None,
        "IgnoreAutoExtract": False,
        "ReadableContentsFormat": "",
        "ContentsFormat": "json",
        "File": "",
        "FileID": "",
        "FileMetadata": None,
        "System": "",
        "Note": False,
        "Evidence": False,
        "EvidenceID": "",
        "Tags": None,
        "Metadata": {
            "id": "",
            "version": 0,
            "modified": "0001-01-01T00:00:00Z",
            "sortValues": None,
            "roles": None,
            "previousRoles": None,
            "hasRole": False,
            "dbotCreatedBy": "",
            "ShardID": 0,
            "type": 1,
            "created": "2020-07-19T01:05:57.974757746-07:00",
            "retryTime": "0001-01-01T00:00:00Z",
            "user": "",
            "errorSource": "",
            "contents": "",
            "format": "json",
            "investigationId": "29432",
            "file": "",
            "fileID": "",
            "parentId": "280@29432",
            "pinned": False,
            "fileMetadata": None,
            "parentContent": '!getIncidents query="emailto:bark@demisto.com --status:Closed"',
            "parentEntryTruncated": False,
            "system": "",
            "reputations": None,
            "category": "",
            "note": False,
            "isTodo": False,
            "tags": None,
            "tagsRaw": None,
            "startDate": "0001-01-01T00:00:00Z",
            "times": 0,
            "recurrent": False,
            "endingDate": "0001-01-01T00:00:00Z",
            "timezoneOffset": 0,
            "cronView": False,
            "scheduled": False,
            "entryTask": None,
            "taskId": "",
            "playbookId": "",
            "reputationSize": 0,
            "contentsSize": 0,
            "brand": "Builtin",
            "instance": "Builtin",
            "IndicatorTimeline": None,
        },
        "IndicatorTimeline": None,
    }
]


def test_get_relevant_incidents_with_results(mocker):
    """Unit test
    Given
    - get_relevant_incidents command
    - command args
    When
    - mock the raw response with a response.
    Then
    - run the get_relevant_incidents
    Validate the amount of incidents returned is 1, 1.
    """
    email_to = email_from = "bark@demisto.com"
    from_date = "2016-01-02T15:04:05Z"
    mocker.patch.object(demisto, "executeCommand", return_value=incident)
    assert get_relevant_incidents(email_to, email_from, from_date) == (1, 1)


no_incident = [
    {
        "ModuleName": "InnerServicesModule",
        "Brand": "Builtin",
        "Category": "Builtin",
        "ID": "",
        "Version": 0,
        "Type": 1,
        "Contents": {"ErrorsPrivateDoNotUse": None, "data": None, "total": 0},
        "HumanReadable": None,
        "ImportantEntryContext": None,
        "EntryContext": None,
        "IgnoreAutoExtract": False,
        "ReadableContentsFormat": "",
        "ContentsFormat": "json",
        "File": "",
        "FileID": "",
        "FileMetadata": None,
        "System": "",
        "Note": False,
        "Evidence": False,
        "EvidenceID": "",
        "Tags": None,
        "Metadata": {
            "id": "",
            "version": 0,
            "modified": "0001-01-01T00:00:00Z",
            "sortValues": None,
            "roles": None,
            "previousRoles": None,
            "hasRole": False,
            "dbotCreatedBy": "",
            "ShardID": 0,
            "type": 1,
            "created": "2020-07-19T11:01:20.769494+03:00",
            "retryTime": "0001-01-01T00:00:00Z",
            "user": "",
            "errorSource": "",
            "contents": "",
            "format": "json",
            "investigationId": "951",
            "file": "",
            "fileID": "",
            "parentId": "144@951",
            "pinned": False,
            "fileMetadata": None,
            "parentContent": '!getIncidents query="--status:Closed fromdate: 2020-07-09T08:01:20Z"',
            "parentEntryTruncated": False,
            "system": "",
            "reputations": None,
            "category": "",
            "note": False,
            "isTodo": False,
            "tags": None,
            "tagsRaw": None,
            "startDate": "0001-01-01T00:00:00Z",
            "times": 0,
            "recurrent": False,
            "endingDate": "0001-01-01T00:00:00Z",
            "timezoneOffset": 0,
            "cronView": False,
            "scheduled": False,
            "entryTask": None,
            "taskId": "",
            "playbookId": "",
            "reputationSize": 0,
            "contentsSize": 0,
            "brand": "Builtin",
            "instance": "Builtin",
            "IndicatorTimeline": None,
            "mirrored": False,
        },
        "IndicatorTimeline": None,
    }
]


def test_get_relevant_incidents_without_results(mocker):
    """Unit test
    Given
    - get_relevant_incidents command
    - command args
    When
    - mock the raw response with an empty response.
    Then
    - run the get_relevant_incidents
    Validate the amount of incidents returned is 0, 0.
    """
    email_to = email_from = "barka@demisto.com"
    from_date = "2016-01-02T15:04:05Z"
    mocker.patch.object(demisto, "executeCommand", return_value=no_incident)
    assert get_relevant_incidents(email_to, email_from, from_date) == (0, 0)