iot-security-vuln-post-processing

IoT vulnerability post processing script to resolve the vulnerability incident in IoT security portal using API

Details

ID	`iot-security-vuln-post-processing`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	iot post-processing

README

An IoT vulnerability post processing script to resolve the vulnerability incident in IoT security portal using the API.

Script Data

Name	Description
Script Type	python3
Tags	iot, post-processing
Cortex XSOAR Version	5.5.0

This script is executing the ‘iot-security-resolve-vuln’ command to resolve a vulnerability in the Palo Alto Networks IoT security portal during post-processing.

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

iot_vuln_post_processing.py iot_vuln_post_processing_test.py iot_vuln_post_processing.yml iot_vuln_post_processing_description.md

Download History Raw

import demistomock as demisto
from CommonServerPython import *  # noqa: E402 lgtm [py/polluting-import]


def _get_incident():
    return demisto.incidents()[0]


def iot_resolve_vuln():
    incident = _get_incident()

    zb_ticketid = ""
    vulnerability_name = ""
    for label in incident["labels"]:
        if label["type"] == "zb_ticketid":
            zb_ticketid = label["value"]
        if label["type"] == "vulnerability_name":
            vulnerability_name = label["value"]

    if zb_ticketid == "":
        raise Exception("zb_ticketid was not found in the incident labels")
    if vulnerability_name == "":
        raise Exception("vulnerability_name was not found in the incident labels")

    demisto.executeCommand(
        "iot-security-resolve-vuln",
        {"id": zb_ticketid, "full_name": vulnerability_name, "reason": f'resolved by XSOAR incident {incident["id"]}'},
    )


def main():
    try:
        iot_resolve_vuln()
    except Exception as ex:
        return_error(f"Failed to execute iot-security-vuln-post-processing. Error: {ex!s}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()