ZTAPParseFields

Parses ZTAP event fields to display as key/value pairs in a dynamic table.

Details

ID	`ZTAPParseFields`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	ztap dynamic-section

README

Parses ZTAP event fields to display as key/value pairs in
a dynamic table.

Script Data

Name	Description
Script Type	python3
Tags	ztap, dynamic-section
Cortex XSOAR Version	6.0.0

Inputs

Argument Name	Description
max_fields	Maximum number of fields to display
max_value_length	Maximum number of characters to display per field
full	Do not truncate output

Outputs

There are no outputs for this script.

Source

ZTAPParseFields.py ZTAPParseFields_test.py ZTAPParseFields.yml

Download History Raw

import json


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def util_load_raw(path):
    with open(path, encoding="utf-8") as f:
        return f.read()


def test_parse_fields_truncated():
    from ZTAPParseFields import parse_fields

    events = util_load_json("test_data/event.json")
    output = parse_fields(events, full=False, max_fields=30, max_value_length=50)

    mock_markdown_result = util_load_raw("test_data/output-truncated.md")
    assert output == mock_markdown_result


def test_parse_fields_full():
    from ZTAPParseFields import parse_fields

    events = util_load_json("test_data/event.json")
    output = parse_fields(events, full=True, max_fields=1, max_value_length=1)

    mock_markdown_result = util_load_raw("test_data/output-full.md")
    assert output == mock_markdown_result