import demistomock as demisto from CommonServerPython import * def create_related_indicator_object(value: str, type_: str, description: str): """Creates a related indicator object to be added to table. Args: value (str): object value. type_ (str): object type. description (str): object description. Returns: Dict. Related indicator object. """ indicator_object = {"Value": value, "Type": type_} descriptions = [] for desc in argToList(description): desc = desc.strip() if re.match(urlRegex, desc): descriptions.append(f"[{desc}]({desc})") else: descriptions.append(desc) indicator_object["Description"] = f"{', '.join(descriptions)}\n\n" return indicator_object def feed_related_indicator(args) -> CommandResults: indicator = args["indicator"] feed_related_indicators = indicator.get("CustomFields", {}).get("feedrelatedindicators", []) content = [] for item in feed_related_indicators: ioc_value = item.get("value", "") search_indicators = IndicatorsSearcher() results = search_indicators.search_indicators_by_version(value=ioc_value).get("iocs", []) if results: ioc_id = results[0].get("id") content.append( create_related_indicator_object( f"[{item.get('value')}](#/indicator/{ioc_id})" if item.get("value") else "", item.get("type"), item.get("description"), ) ) else: # In case that no related indicators were found, return the table without the link. content.append(create_related_indicator_object(item.get("value", ""), item.get("type"), item.get("description"))) output = tableToMarkdown("", content, ["Type", "Value", "Description"], removeNull=True) return CommandResults(readable_output=output) def main(args): try: return_results(feed_related_indicator(args)) except Exception as e: return_error(f"Failed to execute FeedRelatedIndicatorsWidget. Error: {e!s}") if __name__ in ("__main__", "__builtin__", "builtins"): main(demisto.args())