import demistomock as demisto # noqa: F401
from CommonServerPython import * # noqa: F401
HTML_TEMPLATE = (
""
"
"
"{status}"
"
"
""
"{message}"
"
"
""
"
"
""
"
"
"
"
""
"
"
"
"
"{last_mirror_in_time}"
"
"
"
"
"
"
""
"
"
"
"
"
"
)
def main():
try:
incident = demisto.incident()
custom_fields = incident.get("CustomFields", {})
last_mirror_in_time = custom_fields.get("lastmirroredtimestamp", None)
message = custom_fields.get("incomingmirrorerror", "")
if message == "":
status = "Not Started"
elif message == "Fetching events has reached events limit in this incident.":
status = "Completed and Stopped"
elif message == "All available events in the offense were fetched.":
status = "Completed"
elif message == "In queue.":
status = "In Progress"
else:
status = "Failure"
html = HTML_TEMPLATE.format(status=status, message=message, last_mirror_in_time=last_mirror_in_time)
return {"ContentsFormat": "html", "Type": entryTypes["note"], "Contents": html}
except Exception as exp:
return_error("could not parse QRadar offense", error=exp)
if __name__ in ("__main__", "__builtin__", "builtins"):
return_results(main())