SetRSANetWitnessAlertsMD

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

KEYS_INCIDENT_FIELDS = {
    "rsaalerts": "RSA Alerts",
}


def read_context_from_rsa_netwitness_alerts() -> dict:
    incident = demisto.incident().get("CustomFields", {})

    data: dict = {}
    for key in KEYS_INCIDENT_FIELDS:
        if field_content := incident.get(key):
            data[KEYS_INCIDENT_FIELDS[key]] = field_content

    return data


def parse_alerts(alerts: list) -> list:
    return [
        {
            "Created": alert.get("created"),
            "Events": alert.get("events"),
            "ID": alert.get("id"),
            "Risk Score": alert.get("riskScore"),
            "Title": alert.get("title"),
            "Type": alert.get("type"),
            "Detail": alert.get("detail"),
        }
        for alert in alerts
        if alerts
    ]


def json_to_md(incident_fields: dict) -> str:
    return tableToMarkdown(
        name="",
        t=parse_alerts(incident_fields.get("RSA Alerts", [])),
        headers=["ID", "Title", "Type", "Risk Score", "Created", "Events", "Detail"],
        removeNull=True,
        json_transform_mapping={
            "Events": JsonTransformer(
                keys=["destination", "domain", "eventSource", "eventSourceId", "source"],
                is_nested=True,
            )
        },
    )


def main():
    incident_fields = read_context_from_rsa_netwitness_alerts()
    return_results(CommandResults(readable_output=json_to_md(incident_fields) if incident_fields else "No data to present."))


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README

### Context Example

```json
 {
    "RSA Alerts": [
        {
            "created": "2023-07-03T11:04:16.408Z",
            "detail": null,
            "events": [],
            "id": "dummy_id",
            "riskScore": "50",
            "source": "NetWitness Investigate",
            "title": "sk_test300",
            "type": "Log",
        },
        {
            "created": "2023-07-03T11:04:24.256Z",
            "detail": null,
            "id": "dummy_id",
            "riskScore": "50",
            "source": "NetWitness Investigate",
            "title": "sk_test300",
            "type": "Log",
        },
    ]
}

|created|detail|events|id|riskScore|source|title|type|
|---|---|---|---|---|---|---|---|
| 2023-07-03T11:04:16.408Z |  |  | dummy_id | 50 | NetWitness Investigate | sk_test300 | Log |
| 2023-07-03T11:04:24.256Z |  |  | dummy_id | 50 | NetWitness Investigate | sk_test300 | Log |