ResolveGemAlert

Post Processing Script that will resolve the relevant Threat in the Gem platform.

python · Gem

Details

ID	`ResolveGemAlert`
Language	python
From Version	6.12.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	post-processing field-change-triggered

README

Post Processing Script that will close linked Incidents when the Incident is closed. Will set the same close code as the parent, and add closing notes from the parent.

Script Data

Name	Description
Script Type	python3
Tags	post-processing, training, internal
Cortex XSOAR Version	6.8.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

ResolveGemAlert.py ResolveGemAlert_test.py ResolveGemAlert.yml

Download History Raw

from unittest.mock import patch

close_reason, close_notes, incident_id = "close_reason", "close_notes", "incident_id"
threat_id, verdict, status = "11111111-1111-1111-1111-111111111111", "inconclusive", "resolved"
mock_incident = {
    "closeReason": close_reason,
    "closeNotes": close_notes,
    "id": incident_id,
    "CustomFields": {"gemthreatid": threat_id, "gemverdict": verdict},
}


@patch("demistomock.executeCommand", return_value=None)
@patch("demistomock.incident", return_value=mock_incident)
def test_resolve_gem_alert(incident, executeCommand):
    from ResolveGemAlert import main

    main()
    executeCommand.assert_called_once_with(
        "gem-update-threat-status",
        {
            "verdict": verdict,
            "reason": f"Closed from XSOAR, incident id: {incident_id}\n"
            f"\nClose Reason:\n{close_reason}"
            f"\nClose Notes:\n{close_notes}",
            "threat_id": threat_id,
            "status": status,
        },
    )