commonfields:
  id: IndicatorMaliciousRatioCalculation
  version: -1
name: IndicatorMaliciousRatioCalculation
script: ''
type: python
subtype: python3
tags:
- ml
comment: |-
  Return indicators appears in resolved incidents, and resolved incident ids.

  This automation runs using the default Limited User role, unless you explicitly change the permissions.
  For more information, see the section about permissions here:
  - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
  - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
  - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
enabled: true
args:
- name: maxIncidents
  description: Max number of incidents to query.
  defaultValue: "100000"
- name: maxIndicators
  description: Max number of indicators to query.
  defaultValue: "100000"
- name: appearsInMinNumberOfIncidents
  description: Indicator appears in minimum number of incidents.
  defaultValue: "3"
- name: query
  description: The query to fetch the indicators from incident which are "bad".
  defaultValue: incident.closeReason:Resolved
- name: maxDisplayResults
  description: Maximum number of results (indicators) to display as output.
  defaultValue: "50"
- name: fileResult
  auto: PREDEFINED
  predefined:
  - "yes"
  - "no"
  description: Generate file result.
  defaultValue: "no"
- description: 'The start date by which to filter incidents. Date format will be the same as in the incidents query page, for example:"2021-01-01T00:00:00").'
  name: fromDate
scripttarget: 0
timeout: 300ns
fromversion: 5.0.0
tests:
- IndicatorMaliciousRatioCalculation_test
dockerimage: demisto/python3:3.12.13.10404775