iot-security-alert-post-processing

IoT alert post processing script to resolve the alert in IoT security portal using API

Details

ID	`iot-security-alert-post-processing`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	iot post-processing

README

IoT alert post processing script to resolve the alert in IoT security portal using API.

Script Data

Name	Description
Script Type	python3
Tags	iot, post-processing
Cortex XSOAR Version	5.5.0

This script executes the ‘iot-security-resolve-alert’ command to resolve an alert in PANW IoT security portal during post-processing.

Inputs

Argument Name	Description
close_reason	The reason the alert was closed (either ‘Resolved’ or ‘No Action Needed’).

Outputs

There are no outputs for this script.

Source

iot_alert_post_processing.py iot_alert_post_processing_test.py iot_alert_post_processing.yml iot_alert_post_processing_description.md

Download History Raw

import demistomock as demisto
from CommonServerPython import *  # noqa: E402 lgtm [py/polluting-import]


def _get_incident():
    return demisto.incidents()[0]


def iot_resolve_alert():
    incident = _get_incident()

    _id = ""
    for label in incident["labels"]:
        if label["type"] == "id":
            _id = label["value"]
            break

    if _id == "":
        raise Exception("id was not found in the incident labels")

    args = demisto.args()
    close_reason = args.get("close_reason")

    demisto.executeCommand(
        "iot-security-resolve-alert",
        {
            "id": _id,
            "reason": f'resolved by XSOAR incident {incident["id"]}',
            "reason_type": "Issue Mitigated" if close_reason == "Resolved" else "No Action Needed",
        },
    )


def main():
    try:
        iot_resolve_alert()
    except Exception as ex:
        return_error(f"Failed to execute iot-security-alert-post-processing. Error: {ex!s}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()