PublishThreatIntelReport

Sets a Threat Intel Report as published.

python · Threat Intel Reports (BETA)

Details

IDPublishThreatIntelReport
Languagepython
From Version6.5.0
Docker Imagedemisto/python3:3.12.13.10404775
TagsthreatIntelReport-action-button

README

Sets a Threat Intel Report as published.

Script Data

Name Description
Script Type python3
Tags threatIntelReport-action-button
Cortex XSOAR Version 6.5.0

Inputs

Argument Name Description
object The Threat Intel Report object to publish.

Outputs

There are no outputs for this script.

Source

PublishThreatIntelReport.py PublishThreatIntelReport.yml
Download History Raw 
from datetime import datetime

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def publish():
    now_utc = datetime.now(timezone.utc)
    object_id = demisto.getArg("object.id")
    roles = execute_command("getRoles", {})

    execute_command(
        "setThreatIntelReport",
        {
            "id": object_id,
            "xsoarReadOnlyRoles": demisto.dt(roles, "name"),
            "reportstatus": "Published",
            "published": now_utc.isoformat(),
        },
    )

    demisto.results("ok")


if __name__ in ("__main__", "__builtin__", "builtins"):
    publish()