VerdictResult

This widget displays the incident verdict or the alert verdict based on the 'incident.verdict' or 'alert.verdict' field.

python · Common Scripts

Details

ID	`VerdictResult`
Language	python
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	dynamic-section

README

This widget displays the incident verdict or the alert verdict based on the ‘incident.verdict’ or ‘alert.verdict’ field.

Script Data

Name	Description
Script Type	python3
Tags	dynamic-section
Cortex XSOAR Version	6.10.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

VerdictResult.py VerdictResult_test.py VerdictResult.yml

Download History Raw

import demistomock as demisto
import pytest
from VerdictResult import main


@pytest.mark.parametrize(
    "verdict, html",
    [
        ("Malicious", "<h1 style=color:#FF1744;text-align:center;font-size:300%;padding-top:1em>Malicious</h1>"),
        ("Non-Malicious", "<h1 style=color:#00CD33;text-align:center;font-size:300%;padding-top:1em>Non-Malicious</h1>"),
        ("Suspicious", "<h1 style=color:#FF9000;text-align:center;font-size:300%;padding-top:1em>Suspicious</h1>"),
        ("blabla", "<h1 style=color:#808080;text-align:center;font-size:300%;padding-top:1em>Not Determined</h1>"),
    ],
)
def test_main(mocker, verdict, html):
    mocker.patch.object(demisto, "incidents", return_value=[{"CustomFields": {"verdict": verdict}}])
    mock_results = mocker.patch.object(demisto, "results")
    main()
    assert mock_results.call_args[0][0]["Contents"] == html