name: ExpanseAggregateAttributionIP
comment: Deprecated. No available replacement. >
  Aggregate entries from multiple sources into AttributionIP.
deprecated: true
commonfields:
  id: ExpanseAggregateAttributionIP
  version: -1
args:
- name: input
  description: Input list.
  isArray: true
- name: current
  description: Current aggregation state.
  isArray: true
- name: source_ip_fields
  description: Comma separated list of fields to treat as source IPs.
  defaultValue: src,src_ip
  isArray: true
- name: internal_ip_networks
  description: Comma separated list of IPv4 Networks to be considered internal (default to RFC private networks).
  defaultValue: ''
  isArray: true
- name: sightings_fields
  description: Comma separated list of field names to be considered sighting counts.
  defaultValue: count
  isArray: true
outputs:
- contextPath: Expanse.AttributionIP.ip
  description: IP address.
  type: string
- contextPath: Expanse.AttributionIP.private
  description: Is the IP private?
  type: boolean
- contextPath: Expanse.AttributionIP.sightings
  description: Number of sessions seen on this device.
  type: number
script: '-'
tags: []
timeout: '0'
type: python
subtype: python3
dockerimage: demisto/python3:3.10.13.83255
fromversion: 6.0.0
tests:
- No tests (auto formatted)