SplitCampaignContext

Splits incidents in the context data to below and above a similarity threshold. If a low similarity incident was already added to the campaign, then it will also be considered in the higher similarity incidents list. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Phishing Campaign

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

BELOW_THRESHOLD_ITEMS_CONTEXT_PATH = "LowerSimilarityIncidents"
ABOVE_THE_THRESHOLD_ITEMS_CONTEXT_PATH = "incidents"


def save_to_context(
    items: list, context_path: str, delete_existing: bool = False, is_sub_playbook: str = "auto", table_header="Incidents Result"
):  # pragma: no cover
    if delete_existing:
        res = demisto.executeCommand("DeleteContext", {"key": context_path, "subplaybook": is_sub_playbook})
        if is_error(res):
            return_error(f"Failed to delete current context. Error details:\n{get_error(res)}")

    return CommandResults(outputs_prefix=context_path, outputs=items, readable_output=tableToMarkdown(table_header, items))


def _get_incident_campaign(_id: int):
    res = demisto.executeCommand("getIncidents", {"id": _id})

    if is_error(res):
        return None

    res_custom_fields = res[0]["Contents"]["data"][0]["CustomFields"]
    return res_custom_fields.get("partofcampaign", None)


def filter_by_threshold(context: list, threshold: float) -> tuple[list, list]:
    low = []
    high = []
    for item in context:
        if item.get("similarity") >= threshold:
            high.append(item)
        else:
            campaign = _get_incident_campaign(item["id"])
            if campaign:
                high.append(item)
            else:
                low.append(item)
    return low, high


def main():  # pragma: no cover
    input_args = demisto.args()
    # If user did not provide a lower threshold then split is not needed.
    threshold = input_args.get("similarity_threshold")

    try:
        threshold = float(threshold)
    except ValueError as e:
        raise DemistoException(f"Could not use threshold: {threshold}. Error: {e}")

    root_context_path = "EmailCampaign"
    above_threshold_context_path = f"{root_context_path}.{ABOVE_THE_THRESHOLD_ITEMS_CONTEXT_PATH}"
    below_threshold_context_path = f"{root_context_path}.{BELOW_THRESHOLD_ITEMS_CONTEXT_PATH}"
    context = demisto.get(demisto.context(), f"{above_threshold_context_path}")

    # If there are no incident to split
    if not context:
        return
    only_lower_values, only_higher_values = filter_by_threshold(context, threshold)
    result = []
    result.append(
        save_to_context(only_lower_values, below_threshold_context_path, table_header="Low Similarity Incidents Result")
    )
    result.append(
        save_to_context(only_higher_values, above_threshold_context_path, True, table_header="High Similarity Incidents Result")
    )
    return_results(result)


if __name__ in ["__main__", "__builtin__", "builtins"]:
    main()

README

Permissions

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name	Description
Script Type	python3
Tags
Cortex XSOAR Version	5.5.0

Inputs

Argument Name	Description
SimilarityThresholdToSplitBy	The similarity value on which to split the context campaign data.
campaign_context_path	The context full path of the EmailCampaign.

Outputs

Path	Description	Type
EmailCampaign.incidents.id	The IDs of the incidents involved in the campaign.	Unknown
EmailCampaign.incidents.similarity	The textual similarity of the related emails to the current incident.	Unknown
EmailCampaign.incidents.emailfrom	The senders of the emails involved in the campaign.	Unknown
EmailCampaign.incidents.emailfromdomain	The domains of the email senders involved in the campaign.	Unknown
EmailCampaign.incidents.recipients	A list of email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”.	Unknown
EmailCampaign.incidents.recipientsdomain	A list of the domains of the email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”.	Unknown
EmailCampaign.LowerSimilarityIncidents.id	The IDs of the incidents involved in the campaign.	Unknown
EmailCampaign.LowerSimilarityIncidents.similarity	The textual similarity of the related emails to the current incident.	Unknown
EmailCampaign.LowerSimilarityIncidents.emailfrom	The senders of the emails involved in the campaign.	Unknown
EmailCampaign.LowerSimilarityIncidents.emailfromdomain	The domains of the email senders involved in the campaign.	Unknown
EmailCampaign.LowerSimilarityIncidents.recipients	A list of email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”.	Unknown
EmailCampaign.LowerSimilarityIncidents.recipientsdomain	A list of the domains of the email addresses of recipients involved in the campaign. The list is comprised of the following fields, “Email To”, “Email CC”, “Email BCC”.	Unknown