SetThreatVaultIncidentMarkdownRepresentation

This automation takes several Incident fields from the Threat Vault incident context and displays them as markdown in the layout.

python · Threat Vault by Palo Alto Networks

Details

IDSetThreatVaultIncidentMarkdownRepresentation
Languagepython
From Version6.2.0
Docker Imagedemisto/python3:3.12.13.10116658
Tagsdynamic-section

README

This automation takes several Incident fields from the Threat Vault incident context and displays them as markdown in the layout.

Script Data


Name Description
Script Type python3
Tags dynamic-section

Inputs


There are no inputs for this script.

Outputs


There are no outputs for this script.

Script Examples

Example command


### Context Example

```json
{"Spyware": 
    [
        {
            "severity": "medium",
            "pan_id": 22144,
            "attack_name": "WebCompanion Adware Traffic Detection",
            "category": "spyware",
            "action": "alert",
            "change_data": "new coverage",
            "min_version": "8.1.0",
            "max_version": ""
        },
        {
            "severity": "medium",
            "pan_id": 22145,
            "attack_name": "AdLoad Adware Traffic Detection",
            "category": "spyware",
            "action": "alert",
            "change_data": "new coverage",
            "min_version": "8.1.0",
            "max_version": ""
        }
    ]
}

Human Readable Output

Spyware

action attack_name category change_data max_version min_version pan_id severity
alert WebCompanion Adware Traffic Detection spyware new coverage   8.1.0 22144 medium
alert AdLoad Adware Traffic Detection spyware new coverage   8.1.0 22145 medium
commonfields:
  id: SetThreatVaultIncidentMarkdownRepresentation
  version: -1
name: SetThreatVaultIncidentMarkdownRepresentation
script: ''
type: python
tags:
- dynamic-section
comment: This automation takes several Incident fields from the Threat Vault incident context and displays them as markdown in the layout.
enabled: true
scripttarget: 0
subtype: python3
dockerimage: demisto/python3:3.12.13.10116658
runas: DBotWeakRole
fromversion: 6.2.0
tests:
- No tests (auto formatted)
skipprepare:
- script-name-incident-to-alert