VerifyEnoughIncidents

Check whether a given query returns enough incidents.

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def main():
    args = demisto.args()
    query = args.get("query")
    size = int(args.get("size"))

    try:
        raw_result = demisto.executeCommand("SearchIncidentsV2", {"query": query, "size": size})
        incidents_len = len(raw_result[0].get("Contents", [{}])[0].get("Contents", {}).get("data"))
    except Exception:
        incidents_len = 0
    outputs = {"Query": query, "Size": incidents_len, "ConditionMet": incidents_len >= size}
    return_results(CommandResults(outputs=outputs, outputs_key_field="Query", outputs_prefix="IncidentsCheck"))


if __name__ in ["__main__", "builtin", "builtins"]:
    main()

README

Check whether a given query returns enough incidents.

Script Data

Name	Description
Script Type	python3
Tags
Cortex XSOAR Version	6.0.0

Inputs

Argument Name	Description
query	Query used to check whether there are sufficient incidents in Cortex XSOAR.
size	The amount of incidents in which to check.

Outputs

Path	Description	Type
IncidentsCheck.Size	The number of incidents in Cortex XSOAR that is expected to match the query.	number
IncidentsCheck.ConditionMet	Whether there are sufficient incidents in Cortex XSOAR that match the query.	boolean
IncidentsCheck.Query	The incidents query which was used to check if the condition was met.	boolean

Script Example

!VerifyEnoughIncidents query="sourceInstance:Some_Integration_instance_1" size="1"

Context Example

{
    "IncidentsCheck": {
        "ConditionMet": true,
        "Query": "sourceInstance:Some_Integration_instance_1",
        "Size": 1
    }
}

Human Readable Output

Results

ConditionMet Query Size

true sourceInstance:Some_Integration_instance_1 1