import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 HTML_TEMPLATE = ( "
" "
" "{status}" "
" "
" "{message}" "
" "
" "
" "
" "" "Last Mirrored Time Stamp" "" "
" "
" "" "
" "
" "
" "{last_mirror_in_time}" "
" "
" "
" "
" "
" "
" "
" ) def main(): try: incident = demisto.incident() custom_fields = incident.get("CustomFields", {}) last_mirror_in_time = custom_fields.get("lastmirroredtimestamp", None) message = custom_fields.get("incomingmirrorerror", "") if message == "": status = "Not Started" elif message == "Fetching events has reached events limit in this incident.": status = "Completed and Stopped" elif message == "All available events in the offense were fetched.": status = "Completed" elif message == "In queue.": status = "In Progress" else: status = "Failure" html = HTML_TEMPLATE.format(status=status, message=message, last_mirror_in_time=last_mirror_in_time) return {"ContentsFormat": "html", "Type": entryTypes["note"], "Contents": html} except Exception as exp: return_error("could not parse QRadar offense", error=exp) if __name__ in ("__main__", "__builtin__", "builtins"): return_results(main())