TimeStampCompare

Compares a single timestamp to a list of timestamps.

Source

import dateparser
import demistomock as demisto
from CommonServerPython import *  # noqa: E402 lgtm [py/polluting-import]

from CommonServerUserPython import *  # noqa: E402 lgtm [py/polluting-import]

EQUAL = "equal"
BEFORE = "before"
AFTER = "after"

TIMESTAMP_FORMAT = "%Y-%m-%dT%H:%M:%S%Z"
DT_STRING = (
    "TimeStampCompare(val.TestedTime && val.TestedTime == obj.TestedTime && "
    "val.ComparedTime && val.ComparedTime == obj.ComparedTime)"
)


def time_stamp_compare_command(args):
    tested_time = args.get("tested_time")
    values_to_compare = argToList(args.get("values_to_compare"))
    time_format = args.get("time_format", None)
    if time_format == "":
        time_format = None
    elif time_format is not None:
        time_format = [time_format]

    results = []
    parsed_tested_time = dateparser.parse(
        tested_time, date_formats=time_format, settings={"TIMEZONE": "UTC", "RELATIVE_BASE": datetime(datetime.now().year, 1, 1)}
    )
    for compared_time in values_to_compare:
        parsed_compared_time = dateparser.parse(
            compared_time,
            date_formats=time_format,
            settings={"TIMEZONE": "UTC", "RELATIVE_BASE": datetime(datetime.now().year, 1, 1)},
        )
        assert parsed_compared_time is not None
        assert parsed_tested_time is not None
        result = compare_times(parsed_compared_time.timestamp(), parsed_tested_time.timestamp())

        results.append({"TestedTime": tested_time, "ComparedTime": compared_time, "Result": result})

    human_readable = tableToMarkdown("Timestamp compare", results, ["TestedTime", "ComparedTime", "Result"])

    return (human_readable, {DT_STRING: results}, results)


def compare_times(parsed_compared_time, parsed_tested_time):
    if parsed_compared_time < parsed_tested_time:
        result = BEFORE
    elif parsed_compared_time > parsed_tested_time:
        result = AFTER
    else:
        result = EQUAL

    return result


def main():
    try:
        return_outputs(*time_stamp_compare_command(demisto.args()))
    except Exception as exc:
        return_error(f"Failed to execute TimeStampCompare. Error: {exc!s}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README

Compares a single timestamp to a list of timestamps.

Script Data

Name	Description
Script Type	python3
Tags
Cortex XSOAR Version	0.0.0

Used In

This script is used in the following playbooks and scripts.

TIM - Process Domain Age With Whois

Inputs

Argument Name	Description
tested_time	Timestamp to compare to the list of timestamps.
values_to_compare	Values to compare the tested_time against. The script checks each value and determines whether it’s before/after/equal to the tested_time.
time_format	Time format of the times you entered. By default, the script uses automatic parsing. This should be used for cases like DD/MM/YYYY. Automatic parsing will detect formats such as: February 15th 2009, 02-15-2020, 02-15-2020T14:30:00Z

Outputs

Path	Description	Type
TimeStampCompare.TestedTime	The tested time	Date
TimeStampCompare.ComapredTime	The compared time	Date
TimeStampCompare.Result	Whether the tested time was before, after, or equal to the comapred time.	String

Script Example

!TimeStampCompare tested_time='01-01-2020' values_to_compare='2020-02-01T00:00:00,31.12.2019'

Context Example

{
    "TimeStampCompare": [
        {
            "ComparedTime": "'2020-02-01T00:00:00",
            "Result": "after",
            "TestedTime": "'01-01-2020'"
        },
        {
            "ComparedTime": "31.12.2019'",
            "Result": "before",
            "TestedTime": "'01-01-2020'"
        }
    ]
}

Human Readable Output

Timestamp compare

TestedTime	ComparedTime	Result
‘01-01-2020’	‘2020-02-01T00:00:00	after
‘01-01-2020’	31.12.2019’	before