SetRSANetWitnessAlertsMD

This automation takes several alert fields from the RSA NetWitness alerts context and displays them as markdown in the layout.

python · NetWitness

Details

ID	`SetRSANetWitnessAlertsMD`
Language	python
From Version	6.9.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	dynamic-section

README

This automation takes several incident fields from the RSA NetWitness incident context and displays them as markdown in the layout.

Script Data

Name	Description
Script Type	python3
Tags	dynamic-section
Cortex XSOAR Version	6.2.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Script Examples

Example command


### Context Example

```json
 {
    "RSA Alerts": [
        {
            "created": "2023-07-03T11:04:16.408Z",
            "detail": null,
            "events": [],
            "id": "dummy_id",
            "riskScore": "50",
            "source": "NetWitness Investigate",
            "title": "sk_test300",
            "type": "Log",
        },
        {
            "created": "2023-07-03T11:04:24.256Z",
            "detail": null,
            "id": "dummy_id",
            "riskScore": "50",
            "source": "NetWitness Investigate",
            "title": "sk_test300",
            "type": "Log",
        },
    ]
}

Human Readable Output

RSA Alerts\n”

|created|detail|events|id|riskScore|source|title|type|
|---|---|---|---|---|---|---|---|
| 2023-07-03T11:04:16.408Z |  |  | dummy_id | 50 | NetWitness Investigate | sk_test300 | Log |
| 2023-07-03T11:04:24.256Z |  |  | dummy_id | 50 | NetWitness Investigate | sk_test300 | Log |

Source

SetRSANetWitnessAlertsMD.py SetRSANetWitnessAlertsMD_test.py SetRSANetWitnessAlertsMD.yml

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

KEYS_INCIDENT_FIELDS = {
    "rsaalerts": "RSA Alerts",
}


def read_context_from_rsa_netwitness_alerts() -> dict:
    incident = demisto.incident().get("CustomFields", {})

    data: dict = {}
    for key in KEYS_INCIDENT_FIELDS:
        if field_content := incident.get(key):
            data[KEYS_INCIDENT_FIELDS[key]] = field_content

    return data


def parse_alerts(alerts: list) -> list:
    return [
        {
            "Created": alert.get("created"),
            "Events": alert.get("events"),
            "ID": alert.get("id"),
            "Risk Score": alert.get("riskScore"),
            "Title": alert.get("title"),
            "Type": alert.get("type"),
            "Detail": alert.get("detail"),
        }
        for alert in alerts
        if alerts
    ]


def json_to_md(incident_fields: dict) -> str:
    return tableToMarkdown(
        name="",
        t=parse_alerts(incident_fields.get("RSA Alerts", [])),
        headers=["ID", "Title", "Type", "Risk Score", "Created", "Events", "Detail"],
        removeNull=True,
        json_transform_mapping={
            "Events": JsonTransformer(
                keys=["destination", "domain", "eventSource", "eventSourceId", "source"],
                is_nested=True,
            )
        },
    )


def main():
    incident_fields = read_context_from_rsa_netwitness_alerts()
    return_results(CommandResults(readable_output=json_to_md(incident_fields) if incident_fields else "No data to present."))


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()