SetThreatVaultIncidentMarkdownRepresentation

This automation takes several Incident fields from the Threat Vault incident context and displays them as markdown in the layout.

python · Threat Vault by Palo Alto Networks

Details

ID	`SetThreatVaultIncidentMarkdownRepresentation`
Language	python
From Version	6.2.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	dynamic-section

README

This automation takes several Incident fields from the Threat Vault incident context and displays them as markdown in the layout.

Script Data

Name	Description
Script Type	python3
Tags	dynamic-section

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Script Examples

Example command


### Context Example

```json
{"Spyware": 
    [
        {
            "severity": "medium",
            "pan_id": 22144,
            "attack_name": "WebCompanion Adware Traffic Detection",
            "category": "spyware",
            "action": "alert",
            "change_data": "new coverage",
            "min_version": "8.1.0",
            "max_version": ""
        },
        {
            "severity": "medium",
            "pan_id": 22145,
            "attack_name": "AdLoad Adware Traffic Detection",
            "category": "spyware",
            "action": "alert",
            "change_data": "new coverage",
            "min_version": "8.1.0",
            "max_version": ""
        }
    ]
}

Human Readable Output

Spyware

action	attack_name	category	change_data	max_version	min_version	pan_id	severity
alert	WebCompanion Adware Traffic Detection	spyware	new coverage		8.1.0	22144	medium
alert	AdLoad Adware Traffic Detection	spyware	new coverage		8.1.0	22145	medium

Source

SetThreatVaultIncidentMarkdownRepresentation.py SetThreatVaultIncidentMarkdownRepresentation_test.py SetThreatVaultIncidentMarkdownRepresentation.yml

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

KEYS_INCIDENT_FIELDS = {
    "threatvaultbypaloaltonetworksspyware": "Spyware",
    "threatvaultbypaloaltonetworksvulnerability": "Vulnerability",
    "threatvaultbypaloaltonetworksfiletype": "File type",
    "threatvaultbypaloaltonetworksdatacorrelation": "Data correlation",
    "threatvaultbypaloaltonetworksdecoders": "Decoders",
    "threatvaultbypaloaltonetworksapplications": "Applications",
}


def read_context_from_threat_vault_incident():
    incident = demisto.incident().get("CustomFields", {})

    data: dict = {}
    for key in KEYS_INCIDENT_FIELDS:
        if field_content := incident.get(key):
            data.update({KEYS_INCIDENT_FIELDS[key]: field_content})

    return data


def json_to_md(incident_fields: dict) -> str:
    md = ""

    for incident_field in incident_fields:
        md += tableToMarkdown(name=incident_field, t=incident_fields[incident_field])
        md += "\n\n\n"

    return md


def main():
    incident_fields = read_context_from_threat_vault_incident()
    md = json_to_md(incident_fields)

    return_results(CommandResults(readable_output=md or "No data to present"))


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()