ShowCampaignIncidentsOwners

Displays all the campaign incident owners and their quantity. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Phishing Campaign

Source

import demistomock as demisto
from CommonServerPython import *

from CommonServerUserPython import *


def get_incident_ids() -> list | None:
    """
    Gets all the campaign incident ids.

    Returns:
        List of all the ids.
    """
    incidents = demisto.get(demisto.context(), "EmailCampaign.incidents")
    return [incident["id"] for incident in incidents] if incidents else None


def get_incident_owners(incident_ids: list[str]) -> list:
    """
    Gets the campaign incident owners by their ids.

    Args:
        incident_ids: All the campaign incident ids.

    Returns:
        List of the incident owners.
    """

    res = demisto.executeCommand("GetIncidentsByQuery", {"query": f"id:({' '.join(incident_ids)})"})

    if isError(res):
        return_error(f"Error occurred while trying to get incidents by query: {get_error(res)}")

    incidents_from_query = json.loads(res[0]["Contents"])

    incident_owners = {incident["owner"] for incident in incidents_from_query}
    incident_owners.add(demisto.incident()["owner"])  # Add the campaign incident owner
    incident_owners_res = list(filter(lambda x: x, incident_owners))

    return incident_owners_res


def main():
    try:
        if incident_ids := get_incident_ids():
            incident_owners = get_incident_owners(incident_ids)

            html_readable_output = (
                f"<div style='font-size:17px; text-align:center; padding: 50px;'> Incident Owners"
                f"</br> <div style='font-size:32px;'> {len(incident_owners)} </div> "
                f"<div style='font-size:17px;'> {', '.join(incident_owners)} </div></div>"
            )

        else:
            html_readable_output = (
                "<div style='font-size:17px; text-align:center; padding: 50px;'> Incident Owners"
                "</br> <div style='font-size:17px;'> No incident owners. </div></div>"
            )

        return_results(CommandResults(content_format="html", raw_response=html_readable_output))
    except Exception as err:
        return_error(str(err))


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README

Displays all the campaign incident owners and their quantity.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data


Name Description
Script Type python3
Tags dynamic-section
Cortex XSOAR Version 6.0.0

Inputs


There are no inputs for this script.

Outputs


There are no outputs for this script.