Source
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 from time import sleep res = [] dArgs = demisto.args() burstSize = demisto.get(dArgs, 'burstsize') burstSize = int(burstSize) if burstSize else 10 remaining = burstSize waitSeconds = demisto.get(dArgs, 'waitms') waitSeconds = float(waitSeconds) / 1000.0 if waitSeconds else 0.5 dArgs["using-brand"] = "ProtectWise" eventIDs = argToList(demisto.get(dArgs, 'eventId')) for eid in eventIDs: dArgs['eventId'] = eid dArgs['filename'] = eid + '.pcap' if remaining: remaining -= 1 else: sleep(waitSeconds) # pylint: disable=sleep-exists remaining = burstSize resCmd = demisto.executeCommand("protectwise-event-pcap-download", dArgs) try: res += resCmd except Exception as ex: res.append({"Type": entryTypes["error"], "ContentsFormat": formats["text"], "Contents": "Error occurred while parsing output from command. Exception info:\n" + str(ex) + "\n\nInvalid output:\n" + str(resCmd)}) demisto.results(res)
README
Downloads PCAPs related to the requested events. This supports rate throttling.
Script Data
| Name | Description |
|---|---|
| Script Type | python |
| Tags | protectwise |
Dependencies
This script uses the following commands and scripts.
- event-pcap-download
Inputs
| Argument Name | Description |
|---|---|
| eventId | The event ID(s). (comma-seperated) |
| filename | The filename for the download. |
| burstsize | Downloads burstsize files every time, and wait waitms milliseconds each time. The defaults are 10 files and 500ms. |
| waitms | Downloads burstsize files every time, and wait waitms milliseconds each time. The defaults are 10 files and 500ms. |
Outputs
There are no outputs for this script.