from pprint import pformat import demistomock as demisto from CommonServerPython import * def main(): # get incident fields res = demisto.executeCommand("core-api-get", {"uri": "/incidentfields"}) if is_error(res): return_error(res[0]["Contents"]) fields = res[0]["Contents"]["response"] # 'fields' contains non-incident fields (evidence and indicator), as well, so let's make a version # containing only incident fields incident_fields = [field for field in fields if field["id"].startswith("incident_")] # get arguments args = demisto.args() incident_type = args["incident_type"] exclude_system = False if "exclude_system" in args and argToBoolean(args["exclude_system"]): exclude_system = True name_key = "name" if "short_names" in args and argToBoolean(args["short_names"]): name_key = "cliName" explicit_only = False if "explicit_only" in args and argToBoolean(args["explicit_only"]): explicit_only = True # generate results matched_fields = [] for field in incident_fields: # using multiple if statements for readability if exclude_system and not field["system"]: # skip non-system fields if exclude_system is true continue elif field["associatedToAll"] and not explicit_only: # if explicit_only is false, include fields associated to all incident types matched_fields.append(field[name_key]) elif field["associatedTypes"] is not None and incident_type in field["associatedTypes"]: # include fields where incident type is in associatedTypes matched_fields.append(field[name_key]) # output results if "pprint" in args and argToBoolean(args["pprint"]): demisto.results(pformat(matched_fields)) else: demisto.results(matched_fields) if __name__ in ["__builtin__", "builtins"]: main()