SetByIncidentId

Works the same as the 'Set' command, but can work across incidents by specifying 'id' as an argument. Sets a value into the context with the given context key. Doesn't append by default. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Common Scripts

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def main():
    incident_id = demisto.args()["id"] if "id" in demisto.args() else demisto.incidents()[0]["id"]
    key = demisto.args()["key"]
    value = demisto.args()["value"]
    append = demisto.args()["append"]
    error_unfinished = argToBoolean(demisto.args().get("errorUnfinished", "false"))

    args = {"key": key, "value": value, "append": append}

    res = demisto.executeCommand(
        "executeCommandAt",
        {
            "incidents": incident_id,
            "command": "Set",
            "arguments": args,
        },
    )
    if error_unfinished:
        result_string = res[-1].get("Contents", "")
        result_string = result_string.strip(".")
        numbers = [int(s) for s in result_string.split() if s.isdigit()]
        if len(set(numbers)) > 1:  # check if all the numbers are the same. Supposed to be 2 numbers.
            # if the numbers are the same, Set succeed on all of the incidents.
            return_error("Not all incidents were set.\n" + result_string)

    demisto.results(res)


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README

Sets a value into the context with the given context key. By default this will not append. This script works the same as the Set command, but can work across incidents by specifying ID as an argument.

Permissions

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name	Description
Script Type	python3
Tags	DemistoAPI

Inputs

Argument Name	Description
id	The incident to set the context values in. The default is “current incident”.
key	The key to set.
value	The value to set to the key. THis can be an array. Usually, a DQ expression.
append	Whether the context key will be overwritten, this will occur when set to false. If it is set to true then the script will append to existing context key.
errorUnfinished	Returns an error if not all of the incidents where modified.

Outputs

There are no outputs for this script.