VerifyEnoughIncidents

Check whether a given query returns enough incidents.

python · Developer Tools

Details

IDVerifyEnoughIncidents
Languagepython
From Version6.0.0
Docker Imagedemisto/python3:3.12.8.3296088

README

Check whether a given query returns enough incidents.

Script Data

Name Description
Script Type python3
Tags  
Cortex XSOAR Version 6.0.0

Inputs

Argument Name Description
query Query used to check whether there are sufficient incidents in Cortex XSOAR.
size The amount of incidents in which to check.

Outputs

Path Description Type
IncidentsCheck.Size The number of incidents in Cortex XSOAR that is expected to match the query. number
IncidentsCheck.ConditionMet Whether there are sufficient incidents in Cortex XSOAR that match the query. boolean
IncidentsCheck.Query The incidents query which was used to check if the condition was met. boolean

Script Example

!VerifyEnoughIncidents query="sourceInstance:Some_Integration_instance_1" size="1"

Context Example

{
    "IncidentsCheck": {
        "ConditionMet": true,
        "Query": "sourceInstance:Some_Integration_instance_1",
        "Size": 1
    }
}

Human Readable Output

Results

ConditionMet Query Size
true sourceInstance:Some_Integration_instance_1 1

Source

VerifyEnoughIncidents.py VerifyEnoughIncidents.yml
Download History Raw 
commonfields:
  id: VerifyEnoughIncidents
  version: -1
name: VerifyEnoughIncidents
fromversion: 6.0.0
script: ''
type: python
tags: []
comment: Check whether a given query returns enough incidents.
enabled: true
args:
- name: query
  required: true
  description: The query used to check whether there are sufficient incidents in Cortex XSOAR.
- name: size
  required: true
  description: The amount of incidents in which to check.
outputs:
- contextPath: IncidentsCheck.Size
  description: The number of incidents in Cortex XSOAR that is expected to match the query.
  type: number
- contextPath: IncidentsCheck.ConditionMet
  description: Whether there are enough incidents in Cortex XSOAR that match the query.
  type: boolean
- contextPath: IncidentsCheck.Query
  description: The incidents query used to check whether the condition was met.
  type: boolean
scripttarget: 0
subtype: python3
dockerimage: demisto/python3:3.12.8.3296088
runas: DBotWeakRole
tests:
- No test