name: ExpanseAggregateAttributionDevice
comment: Deprecated. No available replacement. >
  Aggregate entries from multiple sources into AttributionDevice.
deprecated: true
commonfields:
  id: ExpanseAggregateAttributionDevice
  version: -1
args:
- name: input
  description: Input list.
  isArray: true
- name: current
  description: Current aggregation state.
  isArray: true
- name: serial_fields
  description: Comma separated list of fields to treat as serial number.
  defaultValue: serial_number,serial,log_source_id
  isArray: true
- name: vsys_fields
  description: Comma separate list of field names to be used as vsys.
  defaultValue: vsys
  isArray: true
- name: sightings_fields
  description: Comma separated list of field names to be considered sighting counts.
  defaultValue: count
  isArray: true
- name: source_ip_fields
  description: Comma separated list of field names to be considered as source IPs.
  defaultValue: src,src_ip
  isArray: true
- name: internal_ip_networks
  description: Comma separated list of IPv4 Networks to be considered internal (default to RFC private networks).
  defaultValue: ''
  isArray: true
outputs:
- contextPath: Expanse.AttributionDevice.serial
  description: Serial Number of the device.
  type: string
- contextPath: Expanse.AttributionDevice.vsys
  description: VSYS of the device.
  type: string
- contextPath: Expanse.AttributionDevice.device-group
  description: Device Group inside Panorama.
  type: string
- contextPath: Expanse.AttributionDevice.xsoar-instance
  description: XSOAR Panorama instance for this device.
  type: string
- contextPath: Expanse.AttributionDevice.exposing_service
  description: Is the device exposing the asset?
  type: boolean
- contextPath: Expanse.AttributionDevice.sightings
  description: Number of sessions seen on this device.
  type: number
script: '-'
tags: []
timeout: '0'
type: python
subtype: python3
dockerimage: demisto/python3:3.10.13.83255
fromversion: 6.0.0
tests:
- No tests (auto formatted)