RSA_DisplayMetasEvents

Use this script to display meta events inside the layout.

Details

ID	`RSA_DisplayMetasEvents`
Language	python
From Version	6.9.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	dynamic-section

README

Use this script to display meta events inside the layout.

Script Data

Name	Description
Script Type	python3
Tags	dynamic-section

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Script Examples

Example command


### Context Example

```json
 {
    "Metas Events": [
        {
            "meta1": "value meta 1",
            "meta2": "value meta 2",
            "meta3": "value meta 3",
            "id": "dummy_id",
            "riskScore": "50",
            "source": "NetWitness Investigate",
            "title": "sk_test300",
            "type": "Log",
        }
    ]
}

Human Readable Output

|meta1|meta2|meta3|
|---|---|---|
| value meta 1 | value meta 2 | value meta 3 |

Source

RSADisplayMetasEvents.py RSADisplayMetasEvents_test.py RSADisplayMetasEvents.yml

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

""" COMMAND FUNCTION """


def CamelCaseToDotCase(key: str) -> str:
    """
    Convert camel case string to dot case string.
    ex: eventSource => event.source
    """
    dot_format = ""
    for char in key:
        if char.isupper():
            dot_format += "." + char.lower()
        else:
            dot_format += char

    return dot_format


def display_metas() -> dict:
    """
    Return metas event alert markdown to display it in dynamic section.
    """
    incident = demisto.incident()

    if (
        not isinstance(incident, dict)
        or "CustomFields" not in incident
        or "rsametasevents" not in incident["CustomFields"]
        or not len(incident["CustomFields"]["rsametasevents"])
    ):
        return {
            "Type": entryTypes["note"],
            "ContentsFormat": formats["markdown"],
            "Contents": "No event available for this incident.",
        }

    rsametasevents = incident.get("CustomFields", {}).get("rsametasevents", [])[0]
    markdown = tableToMarkdown("", rsametasevents, headers=rsametasevents.keys(), headerTransform=CamelCaseToDotCase)
    return {"Type": entryTypes["note"], "ContentsFormat": formats["markdown"], "Contents": markdown}


""" MAIN FUNCTION """


def main():
    content = display_metas()
    return_results(content)


""" ENTRY POINT """


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()