GRAUpdateCaseStatus

GRA Update Case Status.

python · Gurucul Risk Analytics

Details

IDGRAUpdateCaseStatus
Languagepython
From Version5.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Tagspost-processing

README

GRA Update Case Status

Script Data


Name Description
Script Type python3
Tags post-processing
Cortex XSOAR Version 5.5.0

Inputs


Argument Name Description
closeNotes Close Note
closeReason Close reason

Outputs


There are no outputs for this script.

import demistomock as demisto
from CommonServerPython import *  # noqa: E402 lgtm [py/polluting-import]


def _get_incident():
    return demisto.incidents()[0]


def closeCase():
    incident = _get_incident()
    close_reason = demisto.args().get("closeReason")
    close_notes = demisto.args().get("closeNotes", "")
    action = "closeCase"
    subOption = "True Incident"

    if close_reason is not None and close_reason == "False Positive":
        action = "modelReviewCase"
        subOption = "Tuning Required"
    elif close_reason is not None and close_reason == "Other":
        action = "modelReviewCase"
        subOption = "Others"

    _caseId = ""
    for label in incident["labels"]:
        if label["type"] == "caseId":
            _caseId = label["value"]
            break

    if _caseId == "":
        raise Exception("caseId was not found in the incident labels")

    res = demisto.executeCommand("gra-validate-api", {"using": incident["sourceInstance"]})

    if res is not None and res[0]["Contents"] == "Error in service":
        raise Exception("Case cannot be closed as GRA services are currently unavailable.")

    demisto.executeCommand(
        "gra-case-action",
        {
            "action": action,
            "subOption": subOption,
            "caseId": _caseId,
            "caseComment": close_notes,
            "using": incident["sourceInstance"],
        },
    )


def main():
    try:
        closeCase()
    except Exception as ex:
        return_error(f"Failed to execute gra-case-close-post-processing. Error: {ex!s}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()