SetThreatVaultIncidentMarkdownRepresentation

This automation takes several Incident fields from the Threat Vault incident context and displays them as markdown in the layout.

python · Threat Vault by Palo Alto Networks

Details

ID	`SetThreatVaultIncidentMarkdownRepresentation`
Language	python
From Version	6.2.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	dynamic-section

README

This automation takes several Incident fields from the Threat Vault incident context and displays them as markdown in the layout.

Script Data

Name	Description
Script Type	python3
Tags	dynamic-section

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Script Examples

Example command


### Context Example

```json
{"Spyware": 
    [
        {
            "severity": "medium",
            "pan_id": 22144,
            "attack_name": "WebCompanion Adware Traffic Detection",
            "category": "spyware",
            "action": "alert",
            "change_data": "new coverage",
            "min_version": "8.1.0",
            "max_version": ""
        },
        {
            "severity": "medium",
            "pan_id": 22145,
            "attack_name": "AdLoad Adware Traffic Detection",
            "category": "spyware",
            "action": "alert",
            "change_data": "new coverage",
            "min_version": "8.1.0",
            "max_version": ""
        }
    ]
}

Human Readable Output

Spyware

action	attack_name	category	change_data	max_version	min_version	pan_id	severity
alert	WebCompanion Adware Traffic Detection	spyware	new coverage		8.1.0	22144	medium
alert	AdLoad Adware Traffic Detection	spyware	new coverage		8.1.0	22145	medium

Source

SetThreatVaultIncidentMarkdownRepresentation.py SetThreatVaultIncidentMarkdownRepresentation_test.py SetThreatVaultIncidentMarkdownRepresentation.yml

Download History Raw

import pytest
from SetThreatVaultIncidentMarkdownRepresentation import json_to_md, read_context_from_threat_vault_incident


@pytest.mark.parametrize(
    "incident_fields, expected_results",
    [
        (
            {
                "Spyware": [
                    {
                        "severity": "medium",
                        "pan_id": 22144,
                        "attack_name": "WebCompanion Adware Traffic Detection",
                        "category": "spyware",
                        "action": "alert",
                        "change_data": "new coverage",
                        "min_version": "8.1.0",
                        "max_version": "",
                    },
                    {
                        "severity": "medium",
                        "pan_id": 22145,
                        "attack_name": "AdLoad Adware Traffic Detection",
                        "category": "spyware",
                        "action": "alert",
                        "change_data": "new coverage",
                        "min_version": "8.1.0",
                        "max_version": "",
                    },
                ],
                "Vulnerability": [
                    {
                        "severity": "high",
                        "pan_id": 93000,
                        "attack_name": "Ignite Realtime Openfire Cross-Site Request Forgery Vulnerability",
                        "cve": "CVE-2015-6973",
                        "vendor": "",
                        "category": "code-execution",
                        "action": "reset-server",
                        "change_data": "improved detection logic to cover a new exploit",
                        "min_version": "8.1.0",
                        "max_version": "",
                    },
                    {
                        "severity": "high",
                        "pan_id": 93056,
                        "attack_name": "Microsoft Internet Explorer Memory Corruption Vulnerability",
                        "cve": "CVE-2013-3882",
                        "vendor": "MS13-080",
                        "category": "code-execution",
                        "action": "reset-both",
                        "change_data": "improved detection logic to cover a new exploit",
                        "min_version": "8.1.0",
                        "max_version": "",
                    },
                ],
            },
            "### Spyware\n"
            "|action|attack_name|category|change_data|max_version|min_version|pan_id|severity|\n"
            "|---|---|---|---|---|---|---|---|\n"
            "| alert | WebCompanion Adware Traffic Detection | spyware | new coverage |  | 8.1.0 | 22144 | medium |\n"
            "| alert | AdLoad Adware Traffic Detection | spyware | new coverage |  | 8.1.0 | 22145 | medium |\n\n\n\n"
            "### Vulnerability\n"
            "|action|attack_name|category|change_data|cve|max_version|min_version|pan_id|severity|vendor|\n"
            "|---|---|---|---|---|---|---|---|---|---|\n"
            "| reset-server | Ignite Realtime Openfire Cross-Site Request Forgery Vulnerability | code-execution |"
            " improved detection logic to cover a new exploit | CVE-2015-6973 |  | 8.1.0 | 93000 | high |  |\n"
            "| reset-both | Microsoft Internet Explorer Memory Corruption Vulnerability | code-execution |"
            " improved detection logic to cover a new exploit | CVE-2013-3882 |  | 8.1.0 | 93056 | high | MS13-080 |\n\n\n\n",
        ),
        ({}, ""),
    ],
)
def test_json_to_md(incident_fields, expected_results):
    results = json_to_md(incident_fields)
    assert results == expected_results


@pytest.mark.parametrize(
    "incident, expected_results",
    [
        ({"CustomFields": {1: "test", 2: "test"}}, {}),
        (
            {
                "CustomFields": {
                    "threatvaultbypaloaltonetworksspyware": "test",
                    "threatvaultbypaloaltonetworksfiletype": "test",
                    "some_key": "test",
                }
            },
            {"File type": "test", "Spyware": "test"},
        ),
    ],
)
def test_read_context_from_threat_vault_incident(mocker, incident, expected_results):
    mocker.patch("SetThreatVaultIncidentMarkdownRepresentation.demisto.incident", return_value=incident)

    results = read_context_from_threat_vault_incident()
    assert results == expected_results