Details
| ID | SetGridField |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/pandas:1.0.0.10120494 |
README
Update Grid Table from items or key value pairs.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | |
| XSOAR Version | 5.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| context_path | Context path to list of items with similar properties or key value pairs. |
| grid_id | Grid ID to modify. This argument can be either: 1) Grid name as it appears in the layout. 2) Grid “Machine name”, as can be found in the grid incident field editor under Settings->Advanced->Fields (Incidents). |
| overwrite | True if to overwrite Grid Data, False otherwise. |
| columns | Comma-separated list of column header names, for example: columns=”columnheader1,columnheader2,..” |
| keys | Keys to retrieve from items or "*" for max keys (limited when item list to columns amount) - Key will not be columns correlated. If you want to leave an empty column, provide a place holder name that should not be in the context data such as “PLACE_HOLDER” Make sure the key is lower case and does not contain spaces. For example, for a column header named USER ID, key=”userid”. |
| sort_by | Columns names by which to sort the rows. |
| unpack_nested_elements | Set to ‘true’ to unpack nested elements. |
| keys_from_nested | Keys to retrieve from nested dictionaries. Can be used only when the unpack_nested_elements argument is set to false. Keys will not be columns correlated. Default is all keys. Note: when the number of values exceeds the number of columns, it truncates the last values that are outside the range for table. |
Command Example
Assume the following:
- Entry Context:
{
"EWS": {
"Items": {
"HeadersMap": {
"X-MS-Exchange-Organization-AuthSource": "Value1",
"Received": "Value2",
"Thread-Index": "Value3",
"Accept-Language": "Value4"
},
"headers": [
{
"name": "name1",
"value": "value1"
},
{
"name": "name2",
"value": "value2"
},
{
"name": "name3",
"value": "value3"
},
{
"name": "name4",
"value": "value4"
}
]
}
}
}
- Grid: \
Considering the following cases:
- Key value to Grid:
```shell script
!SetGridField columns=”columnheader1,columnheader2” context_path=EWS.Items.HeadersMap grid_id=mygrid
keys=”Received,Thread-Index,X-MS-Exchange-Organization-AuthSource,Accept-Language”
Grid after update: \
2. List of item properties to Grid:
```shell script
!SetGridField columns="columnheader1,columnheader2" context_path=EWS.Items.headers grid_id=mygrid
keys="name, value"
Grid after update: \
Entry Context:
{
"PaloAltoNetworksXDR": {
"RiskyUser": [
{
"email": null,
"id": "1",
"norm_risk_score": 1000,
"reasons": [
{
"date created": "2023-08-20",
"description": "test",
"points": 90,
"severity": "test",
"status": "test"
},
{
"date created": "2023-08-20",
"description": "test",
"points": 90,
"severity": "test",
"status": "test"
}
],
"risk_level": "HIGH",
"score": 244,
"type": "user"
}
]
}
}
!SetGridField_CopyForInvestigation columns=`User id,Risk level,Score,Reasons` grid_id=xdrriskyusers context_path=`PaloAltoNetworksXDR.RiskyUser` keys=`id,risk_level,score,reasons` keys_from_nested=description,points,severity
Troubleshooting
The first time you run SetGridField on a newly created grid field, you may see an error similar to the following:
To resolve the error:
- Make sure the grid field is associated with the incident type the field is being used in.
- Run the following command to initialize the grid field:
!setIncident <GRID_FIELD_NAME>=[]
args: - description: Context path to list of items with similar properties or key-value pairs. name: context_path required: true - description: Grid ID to modify. name: grid_id required: true - auto: PREDEFINED defaultValue: 'true' description: Set to 'true' to overwrite Grid Data. name: overwrite predefined: - 'false' - 'true' - description: 'Comma-separated list of grid columns, for example: (col1,col2,..,coln).' isArray: true name: columns required: true - defaultValue: '*' description: 'Keys to retrieve from items. Keys will not be columns correlated. Default is all keys. **Note**: when the number of values exceeds the number of columns, it truncates the last values that are outside the range for table. If you want to leave an empty column, provide a place holder name that should not be in the context data, such as "PLACE_HOLDER".' isArray: true name: keys - description: Columns names by which to sort the rows. isArray: true name: sort_by - auto: PREDEFINED defaultValue: 'false' description: Set to 'true' to unpack nested elements. name: unpack_nested_elements predefined: - 'false' - 'true' - defaultValue: '*' description: 'Keys to retrieve from nested dictionaries. Can be used only when the unpack_nested_elements argument is set to false. Keys will not be columns correlated. Default is all keys.' isArray: true name: keys_from_nested comment: Creates a Grid table from items or key-value pairs. commonfields: id: SetGridField version: -1 name: SetGridField script: '-' subtype: python3 timeout: '0' type: python dockerimage: demisto/pandas:1.0.0.10120494 fromversion: 5.0.0 tests: - No tests