import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 HTML_TEMPLATE = ( "
" "
" "{fetched}/{total}" "
" "
" "Fetched Events / Total" "
" "
" "{message}" "
" ) def main(): try: incident = demisto.incident() custom_fields = incident.get("CustomFields", {}) fetched = custom_fields.get("numberoffetchedevents", 0) # define which incident field to use total = custom_fields.get("numberofeventsinoffense", 0) # define which incident field to use if fetched == 0: message = ( "The offense contains Events but non were fetched. " "Event fetching can be configured in the integration instance settings." ) else: message = "Events details on this page are based on the fetched events." html = HTML_TEMPLATE.format(fetched=fetched, total=total, message=message) return {"ContentsFormat": "html", "Type": entryTypes["note"], "Contents": html} except Exception as exp: return_error("could not parse QRadar offense", error=exp) if __name__ in ("__main__", "__builtin__", "builtins"): return_results(main())