ShowIncidentIndicators

This script is used to display the indicators of an incident in an incident field of type Array. It can be used to select indicators from the incident in order to later perform some actions, like tagging the indicators for blocking via EDL. This script is a field-display script, so it needs to be configured as such, when editing the incident field that will be used to display the indicators.

python · Common Scripts

Details

ID	`ShowIncidentIndicators`
Language	python
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	field-display

README

This script is used to display the indicators of an incident in an incident field of type Array. It can be used to select indicators from the incident in order to later perform some actions, like tagging the indicators for blocking via EDL.
This script is a field-display script, so it needs to be configured as such, when editing the incident field that will be used to display the indicators.

Script Data

Name	Description
Script Type	python3
Tags	field-display
Cortex XSOAR Version	6.5.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

ShowIncidentIndicators.py ShowIncidentIndicators_test.py ShowIncidentIndicators.yml

Download History Raw

import demistomock as demisto
from ShowIncidentIndicators import get_indicators_from_incident, group_by_type


def test_group_by_type():
    indicators = [
        {
            "Contents": [
                {"indicator_type": "IP", "value": "1.1.1.1"},
                {"indicator_type": "IP", "value": "2.2.2.2"},
                {"indicator_type": "Domain", "value": "test.com"},
            ]
        }
    ]
    expected = ["--- IP ---", "1.1.1.1", "2.2.2.2", "", "--- Domain ---", "test.com", ""]
    result = group_by_type(indicators)
    assert result == expected


def test_get_indicators_from_incident(mocker):
    execute_command_output = [
        {
            "Contents": [
                {"indicator_type": "IP", "value": "1.1.1.1"},
                {"indicator_type": "IP", "value": "2.2.2.2"},
                {"indicator_type": "Domain", "value": "test.com"},
            ]
        }
    ]
    mocker.patch.object(demisto, "executeCommand", return_value=execute_command_output)
    mocker.patch.object(demisto, "incidents", return_value=[{"id": 123}])

    expected = {"hidden": False, "options": ["--- IP ---", "1.1.1.1", "2.2.2.2", "", "--- Domain ---", "test.com", ""]}
    result = get_indicators_from_incident()
    assert result == expected