import demistomock as demisto from CommonServerPython import * # noqa # pylint: disable=unused-wildcard-import from CommonServerUserPython import * # noqa from typing import Dict, Any, List, Optional ''' COMMAND FUNCTION ''' def enrich(current_list: List[Dict[str, Any]], enrich_list: List[Dict[str, Any]], enrich_key: str, enrich_fields: List[str], key_field: str, outputs_prefix: str) -> CommandResults: for enrich_entry in enrich_list: key = enrich_entry.get(enrich_key, None) if key is None: continue for current_entry in current_list: current_key = current_entry[key_field].lower() if isinstance(key, list): if next((k for k in key if k.lower() == current_key), None) is None: continue else: if current_key != key.lower(): continue for enrich_field in enrich_fields: new_enrich_field = enrich_field if '=' in enrich_field: enrich_field, new_enrich_field = enrich_field.split('=', 1) if enrich_field not in enrich_entry: continue enrich_value = enrich_entry[enrich_field] if isinstance(enrich_value, list) and len(enrich_value) == 1: enrich_value = enrich_value[0] current_entry[new_enrich_field] = enrich_value return CommandResults( outputs_prefix=outputs_prefix, outputs_key_field=key_field, outputs=current_list if len(current_list) > 0 else None, readable_output="" ) def enrich_command(args: Dict[str, Any]) -> CommandResults: type_: Optional[str] if (type_ := args.get("type")) is not None: type_ = type_.lower() current_list = argToList(args.get('current', [])) enrich_list = argToList(args.get('enrich', [])) enrich_key = args.get('enrich_key', "") enrich_fields = argToList(args.get('enrich_fields', [])) if type_ == "ip": return enrich( current_list, enrich_list, enrich_key, enrich_fields, key_field="ip", outputs_prefix="Expanse.AttributionIP") elif type_ == "device": return enrich( current_list, enrich_list, enrich_key, enrich_fields, key_field="serial", outputs_prefix="Expanse.AttributionDevice") elif type_ == "user": return enrich( current_list, enrich_list, enrich_key, enrich_fields, key_field="username", outputs_prefix="Expanse.AttributionUser") raise ValueError("Invalid value for type argument") ''' MAIN FUNCTION ''' def main(): try: enrich_result = enrich_command(demisto.args()) return_results(enrich_result) except Exception as ex: return_error(f'Failed to execute ExpanseEnrichAttribution. Error: {str(ex)}') ''' ENTRY POINT ''' if __name__ in ('__main__', '__builtin__', 'builtins'): main()