VerifyEnoughIncidents

Check whether a given query returns enough incidents.

python · Developer Tools

Details

IDVerifyEnoughIncidents
Languagepython
From Version6.0.0
Docker Imagedemisto/python3:3.12.8.3296088

README

Check whether a given query returns enough incidents.

Script Data

Name Description
Script Type python3
Tags  
Cortex XSOAR Version 6.0.0

Inputs

Argument Name Description
query Query used to check whether there are sufficient incidents in Cortex XSOAR.
size The amount of incidents in which to check.

Outputs

Path Description Type
IncidentsCheck.Size The number of incidents in Cortex XSOAR that is expected to match the query. number
IncidentsCheck.ConditionMet Whether there are sufficient incidents in Cortex XSOAR that match the query. boolean
IncidentsCheck.Query The incidents query which was used to check if the condition was met. boolean

Script Example

!VerifyEnoughIncidents query="sourceInstance:Some_Integration_instance_1" size="1"

Context Example

{
    "IncidentsCheck": {
        "ConditionMet": true,
        "Query": "sourceInstance:Some_Integration_instance_1",
        "Size": 1
    }
}

Human Readable Output

Results

ConditionMet Query Size
true sourceInstance:Some_Integration_instance_1 1

Source

VerifyEnoughIncidents.py VerifyEnoughIncidents.yml
Download History Raw 
import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def main():
    args = demisto.args()
    query = args.get("query")
    size = int(args.get("size"))

    try:
        raw_result = demisto.executeCommand("SearchIncidentsV2", {"query": query, "size": size})
        incidents_len = len(raw_result[0].get("Contents", [{}])[0].get("Contents", {}).get("data"))
    except Exception:
        incidents_len = 0
    outputs = {"Query": query, "Size": incidents_len, "ConditionMet": incidents_len >= size}
    return_results(CommandResults(outputs=outputs, outputs_key_field="Query", outputs_prefix="IncidentsCheck"))


if __name__ in ["__main__", "builtin", "builtins"]:
    main()