varonis-alert-post-processing

Varonis alert post processing script to set the alert status to closed when an incident is closed.

Details

ID	`varonis-alert-post-processing`
Language	python
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	post-processing

README

Varonis alert post processing script to set the alert status in XSOAR to closed when an incident is closed.

Script Data

Name	Description
Script Type	python3
Tags	post-processing
Cortex XSOAR Version	6.5.0

This script set varonissaasalertstatus field to closed during post-processing when an incident is closed.

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

varonisalertpostprocessing.py varonisalertpostprocessing_test.py varonisalertpostprocessing.yml

Download History Raw

import demistomock as demisto
from CommonServerPython import *  # noqa: E402 lgtm [py/polluting-import]


def update_alert_status():
    incident = demisto.incident()
    incident_id = incident["id"]
    demisto.debug(f"Post processing incident: {incident_id}")
    demisto.executeCommand("setIncident", {"id": incident_id, "customFields": {"varonissaasalertstatus": "closed"}})


def main():
    update_alert_status()


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()