ThreatIntelManagementGetIncidentsPerFeed

Total number of incidents per OOTB feed. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Threat Intelligence Management

Details

ID	`ThreatIntelManagementGetIncidentsPerFeed`
Language	python
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	Threat Intel Management

README

Total number of incidents per OOTB feed.

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name	Description
Script Type	python3
Tags	Threat Intel Management
Cortex XSOAR Version	5.5.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

ThreatIntelligenceManagementGetIncidentsPerFeed.py ThreatIntelligenceManagementGetIncidentsPerFeed_test.py ThreatIntelligenceManagementGetIncidentsPerFeed.yml

Download History Raw

import re

import demistomock as demisto
from ThreatIntelligenceManagementGetIncidentsPerFeed import get_incidents_per_feed

INDICATORS_TO_RETURN = [
    [
        {
            "sourceBrands": [
                "Test1 Feed",
                "Test2 Feed",
                "Test3",
            ]
        },
        {
            "sourceBrands": [
                "Test1 Feed",
                "Test3",
            ]
        },
    ],
    [
        {
            "sourceBrands": [
                "Test1 Feed",
                "Test2 Feed",
                "Test3",
            ]
        },
        {
            "sourceBrands": [
                "Test4",
            ]
        },
    ],
]

INCIDENTS_TO_RETURN = [{"Contents": {"total": 1, "data": [{"investigationId": 0}, {"investigationId": 1}]}, "Type": 1}]


def execute_command(name, args=None):
    if name == "getIncidents":
        return INCIDENTS_TO_RETURN
    else:
        return None


def search_indicators(fromDate="", toDate="", query="", size=None, page=None, value=None):
    query_list = re.split(r"\W+", query)
    investigation_id = int(query_list[-1])
    source_brands = query_list[1]
    indicators = INDICATORS_TO_RETURN[investigation_id]
    indicators_to_return = [
        indicator for indicator in indicators if [brand for brand in indicator["sourceBrands"] if source_brands in brand]
    ]
    return {"iocs": indicators_to_return, "total": len(indicators_to_return)}


def test_get_incidents_per_feed(mocker):
    mocker.patch.object(demisto, "executeCommand", side_effect=execute_command)
    mocker.patch.object(demisto, "searchIndicators", side_effect=search_indicators)
    from_date = "2020-03-12T00:00:00.000Z"
    actual_results = get_incidents_per_feed(from_date)
    expected_results = {"Test1 Feed": 2, "Test2 Feed": 2}
    assert actual_results == expected_results