varonis-alert-post-processing

Varonis alert post processing script to set the alert status to closed when an incident is closed.

Details

ID	`varonis-alert-post-processing`
Language	python
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	post-processing

README

Varonis alert post processing script to set the alert status in XSOAR to closed when an incident is closed.

Script Data

Name	Description
Script Type	python3
Tags	post-processing
Cortex XSOAR Version	6.5.0

This script set varonissaasalertstatus field to closed during post-processing when an incident is closed.

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

varonisalertpostprocessing.py varonisalertpostprocessing_test.py varonisalertpostprocessing.yml

Download History Raw

import demistomock as demisto
from varonisalertpostprocessing import update_alert_status


def test_update_alert_status(mocker):
    incident = {
        "id": "20212",
        "rawType": "Varonis SaaS Incident",
        "reason": "",
        "reminder": "0001-01-01T00:00:00Z",
        "runStatus": "",
        "severity": 3,
        "sla": 0,
        "sourceBrand": "VaronisSaaS",
        "sourceInstance": "VaronisSaaS_instance_1",
        "status": 1,
        "type": "Varonis SaaS Incident",
    }
    mocker.patch.object(demisto, "debug", return_value=None)
    mocker.patch.object(demisto, "incident", return_value=incident)
    execute_mocker = mocker.patch.object(demisto, "executeCommand")
    expected_command = "setIncident"
    expected_args = {"id": incident["id"], "customFields": {"varonissaasalertstatus": "closed"}}
    update_alert_status()
    execute_mocker.assert_called_with(expected_command, expected_args)