RemoveEmptyEvidence

The automation removes evidence based on a query performed on the evidence content, if the provided string is found within the evidence- it will be removed.

python · Community Common Scripts

Details

ID	`RemoveEmptyEvidence`
Language	python
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.11879924`

README

The automation removes evidence based on a query performed on the evidence content,
if the provided string is found within the evidence- it will be removed.

Script Data

Name	Description
Script Type	python3
Tags

Inputs

Argument Name	Description
removeIfContains	String that if found in the entry of an evidence- the evidence will be removed. The default value is “No entries”

Outputs

There are no outputs for this script.

Troubleshooting

Multi-tenant environments should be configured with the Cortex Rest API instance when using this
automation. Make sure the Use tenant parameter (in the Cortex Rest API integration) is checked
to ensure that API calls are made to the current tenant instead of the master tenant.

Source

RemoveEmptyEvidence.py RemoveEmptyEvidence.yml

Download History Raw

args:
- defaultValue: No entries
  description: String that if found in the entry of an evidence- the evidence will be removed. The default value is "No entries".
  name: removeIfContains
comment: |-
  The automation removes evidence based on a query performed on the evidence content,
  if the provided string is found within the evidence- it will be removed.
commonfields:
  id: RemoveEmptyEvidence
  version: -1
contentitemexportablefields:
  contentitemfields:
    fromServerVersion: ""
dockerimage: demisto/python3:3.12.13.11879924
enabled: true
name: RemoveEmptyEvidence
runas: DBotWeakRole
script: ''
scripttarget: 0
subtype: python3
tags: []
type: python
fromversion: 6.5.0
tests:
- No tests (auto formatted)