XDRConnectedEndpoints
The widget returns the number of the connected endpoints using xdr-get-endpoints command.
python · Cortex XDR by Palo Alto Networks
Source
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 def main(): try: args = demisto.args() last_seen_gte = args.get("from") last_seen_lte = args.get("to") get_endpoints_args = {"status": "connected"} if last_seen_gte: get_endpoints_args["last_seen_gte"] = last_seen_gte if last_seen_lte and last_seen_lte != "0001-01-01T00:00:00Z": get_endpoints_args["last_seen_lte"] = last_seen_lte res = demisto.executeCommand("xdr-get-endpoints-by-status", get_endpoints_args) if isError(res): return_error(f"Error occurred while trying to get XDR endpoints: {get_error(res)}") count = list(res[0].get("EntryContext").values())[0].get("count") return_results(count) except Exception as ex: return_error(f"Failed to execute XDRConnectedEndpoints. Error: {ex!s}") if __name__ in ("__main__", "__builtin__", "builtins"): main()
README
The widget returns the number of the connected endpoints using xdr-get-endpoints command.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | widget |
| Cortex XSOAR Version | 6.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| from | The start date by which to filter incidents. Date format will be the same as in the incidents query page, for example: “3 days ago”, “2019-01-01T00:00:00 +0200”). |
| to | The end date by which to filter incidents. Date format will be the same as in the incidents query page, for example: “3 days ago”, “2019-01-01T00:00:00 +0200”). |
| limit | The maximum number of incidents to fetch. The default value is 100. |
Outputs
There are no outputs for this script.