SetRSANetWitnessAlertsMD

This automation takes several alert fields from the RSA NetWitness alerts context and displays them as markdown in the layout.

python · NetWitness

Details

ID	`SetRSANetWitnessAlertsMD`
Language	python
From Version	6.9.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	dynamic-section

README

This automation takes several incident fields from the RSA NetWitness incident context and displays them as markdown in the layout.

Script Data

Name	Description
Script Type	python3
Tags	dynamic-section
Cortex XSOAR Version	6.2.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Script Examples

Example command


### Context Example

```json
 {
    "RSA Alerts": [
        {
            "created": "2023-07-03T11:04:16.408Z",
            "detail": null,
            "events": [],
            "id": "dummy_id",
            "riskScore": "50",
            "source": "NetWitness Investigate",
            "title": "sk_test300",
            "type": "Log",
        },
        {
            "created": "2023-07-03T11:04:24.256Z",
            "detail": null,
            "id": "dummy_id",
            "riskScore": "50",
            "source": "NetWitness Investigate",
            "title": "sk_test300",
            "type": "Log",
        },
    ]
}

Human Readable Output

RSA Alerts\n”

|created|detail|events|id|riskScore|source|title|type|
|---|---|---|---|---|---|---|---|
| 2023-07-03T11:04:16.408Z |  |  | dummy_id | 50 | NetWitness Investigate | sk_test300 | Log |
| 2023-07-03T11:04:24.256Z |  |  | dummy_id | 50 | NetWitness Investigate | sk_test300 | Log |

Source

SetRSANetWitnessAlertsMD.py SetRSANetWitnessAlertsMD_test.py SetRSANetWitnessAlertsMD.yml

Download History Raw

import pytest
from SetRSANetWitnessAlertsMD import json_to_md, read_context_from_rsa_netwitness_alerts


@pytest.mark.parametrize(
    "alerts_fields",
    [
        {
            "RSA Alerts": [
                {
                    "created": "2023-07-03T11:04:16.408Z",
                    "detail": None,
                    "events": [],
                    "id": "dummy_id",
                    "riskScore": "50",
                    "source": "NetWitness Investigate",
                    "title": "sk_test300",
                    "type": "Log",
                },
                {
                    "created": "2023-07-03T11:04:24.256Z",
                    "detail": None,
                    "id": "dummy_id",
                    "riskScore": "50",
                    "source": "NetWitness Investigate",
                    "title": "sk_test300",
                    "type": "Log",
                },
            ]
        },
    ],
)
def test_json_to_md(alerts_fields):
    assert json_to_md(alerts_fields) == (
        "|ID|Title|Type|Risk Score|Created|\n"
        "|---|---|---|---|---|\n"
        "| dummy_id | sk_test300 | Log | 50 | 2023-07-03T11:04:16.408Z |\n"
        "| dummy_id | sk_test300 | Log | 50 | 2023-07-03T11:04:24.256Z |\n"
    )


@pytest.mark.parametrize(
    "alerts_incident, expected_results",
    [
        ({"CustomFields": {1: "test", 2: "test"}}, {}),
        (
            {"CustomFields": {"rsaalerts": "test", "some_key": "test"}},
            {"RSA Alerts": "test"},
        ),
    ],
)
def test_read_context_from_rsa_netwitness_alerts(mocker, alerts_incident, expected_results):
    mocker.patch("SetRSANetWitnessAlertsMD.demisto.incident", return_value=alerts_incident)
    assert read_context_from_rsa_netwitness_alerts() == expected_results