device-security-check-servicenow

Closes the Cortex XSOAR incident if the Device Security ServiceNow ticket was closed. This command should be run in a Job.

python · Device Security by Palo Alto Networks

Details

ID	`device-security-check-servicenow`
Language	python
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	device security

README

Closes the Cortex XSOAR incident if the Device Security ServiceNow ticket was closed. This command should be run in a Job.

Script Data

Name	Description
Script Type	python3
Tags	device security
Cortex XSOAR Version	6.10.0

Dependencies

This script uses the following commands and scripts.

ServiceNow
ServiceNow v2
servicenow-get-record

Used In

This script is used in the following playbooks and scripts.

PANW Device Security ServiceNow Tickets Check

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

device_security_check_servicenow.py device_security_check_servicenow_test.py device_security_check_servicenow.yml device_security_check_servicenow_description.md

Download History Raw

import demistomock as demisto
import device_security_check_servicenow
from device_security_check_servicenow import check_servicenow_and_close

_INCIDENTS = [
    {"id": 1, "status": 0, "type": "Device Security Alert"},
    {
        "id": 2,
        "status": 1,
        "type": "Device Security Vulnerability",
        "CustomFields": {"devicesecurityservicenowtablename": "incident", "devicesecurityservicenowrecordid": "snow_id"},
    },
]


def test_check_servicenow_and_close(monkeypatch):
    """
    Scenario: checking opened XSOAR Device Security incidents.
    If there's a ServiceNow ticket created, query its status, then close it accordingly

    Given
    - An opened incident with a ServiceNow ticket created for this

    When
    - Closing this incident

    Thens
    - Ensure the ServiceNow query command 'servicenow-get-record' is run
    - Ensure the close investigation is happening
    """
    monkeypatch.setattr(device_security_check_servicenow, "get_opened_device_security_incidents", lambda: _INCIDENTS)

    monkeypatch.setattr(
        demisto,
        "executeCommand",
        lambda command, args: {
            "servicenow-get-record": [
                {"Type": 1, "Contents": {"result": {"close_code": "Duplicate Ticket", "incident_state": "7"}}}
            ],
            "closeInvestigation": [{"Type": 1}],
        }.get(command),
    )

    assert check_servicenow_and_close() == "found 2 incidents, closed 1 incidents"