device-security-alert-post-processing

Resolves the alert in the Device Security portal via the API. Designed to run as a post-processing script.

python · Device Security by Palo Alto Networks

Details

ID	`device-security-alert-post-processing`
Language	python
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	device security post-processing

README

Resolves the alert in the Device Security portal via the API. Designed to run as a post-processing script.

Script Data

Name	Description
Script Type	python3
Tags	device security, post-processing
Cortex XSOAR Version	6.10.0

Inputs

Argument Name	Description
close_reason	The reason the alert was closed (either ‘Resolved’ or ‘No Action Needed’).

Outputs

There are no outputs for this script.

Source

device_security_alert_post_processing.py device_security_alert_post_processing_test.py device_security_alert_post_processing.yml device_security_alert_post_processing_description.md

Download History Raw

import demistomock as demisto
from CommonServerPython import *  # noqa: E402 lgtm [py/polluting-import]


def _get_incident():
    incidents = demisto.incidents()
    if not incidents:
        raise Exception("No incident found")
    return incidents[0]


def device_security_resolve_alert():
    incident = _get_incident()

    _id = ""
    for label in incident.get("labels", []):
        if label.get("type") == "id":
            _id = label.get("value", "")
            break

    if not _id:
        raise Exception("id was not found in the incident labels")

    args = demisto.args()
    close_reason = args.get("close_reason")

    result = demisto.executeCommand(
        "device-security-resolve-alert",
        {
            "id": _id,
            "reason": f'Resolved by XSOAR incident {incident.get("id", "")}',
            "reason_type": "Issue Mitigated" if close_reason == "Resolved" else "No Action Needed",
        },
    )
    if is_error(result):
        return_error(f"Failed to resolve the alert. Error: {get_error(result)}")


def main():
    try:
        device_security_resolve_alert()
    except Exception as ex:
        return_error(f"Failed to execute device-security-alert-post-processing. Error: {ex!s}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()