device-security-vuln-post-processing

Resolves the vulnerability incident in the Device Security portal via the API. Designed to run as a post-processing script.

python · Device Security by Palo Alto Networks

Details

ID	`device-security-vuln-post-processing`
Language	python
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	device security post-processing

README

Resolves the vulnerability incident in the Device Security portal via the API. Designed to run as a post-processing script.

Script Data

Name	Description
Script Type	python3
Tags	device security, post-processing
Cortex XSOAR Version	6.10.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

device_security_vuln_post_processing.py device_security_vuln_post_processing_test.py device_security_vuln_post_processing.yml device_security_vuln_post_processing_description.md

Download History Raw

import demistomock as demisto
from CommonServerPython import *  # noqa: E402 lgtm [py/polluting-import]


def _get_incident():
    return demisto.incidents()[0]


def device_security_resolve_vuln():
    incident = _get_incident()

    zb_ticketid = ""
    vulnerability_name = ""
    for label in incident.get("labels", []):
        if label.get("type") == "zb_ticketid":
            zb_ticketid = label.get("value", "")
        if label.get("type") == "vulnerability_name":
            vulnerability_name = label.get("value", "")

    if zb_ticketid == "":
        raise Exception("zb_ticketid was not found in the incident labels")
    if vulnerability_name == "":
        raise Exception("vulnerability_name was not found in the incident labels")

    result = demisto.executeCommand(
        "device-security-resolve-vuln",
        {
            "id": zb_ticketid,
            "full_name": vulnerability_name,
            "reason": f'Resolved by XSOAR incident {incident.get("id")}',
        },
    )
    if is_error(result):
        return_error(f"Failed to resolve the vulnerability. Error: {get_error(result)}")


def main():
    try:
        device_security_resolve_vuln()
    except Exception as ex:
        return_error(f"Failed to execute device-security-vuln-post-processing. Error: {ex!s}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()