from CommonServerPython import * # noqa: F401 def main(): close_reason, close_notes, incident_id, threat_id, verdict, status = _get_params() demisto.info(f"Resolving Gem Threat {threat_id} with status {status}, verdict {verdict} and close notes {close_notes}") demisto.executeCommand( "gem-update-threat-status", { "verdict": verdict, "reason": f"Closed from XSOAR, incident id: {incident_id}\n" f"\nClose Reason:\n{close_reason}" f"\nClose Notes:\n{close_notes}", "threat_id": threat_id, "status": status, }, ) demisto.info(f"Resolved Gem Threat {threat_id} with status {status}, verdict {verdict} and close notes {close_notes}") def _get_params(): incident = demisto.incident() close_reason = incident.get("closeReason", "") close_reason = close_reason if close_reason else demisto.args().get("closeReason", "") close_notes = incident.get("closeNotes", "") close_notes = close_notes if close_notes else demisto.args().get("closeNotes", "") incident_id = incident.get("id", "") threat_id = incident.get("CustomFields").get("gemthreatid") verdict = incident.get("CustomFields").get("gemverdict") verdict = verdict if verdict else demisto.args().get("gemverdict", "") verdict = verdict.replace(" ", "_").lower() status = "resolved" return close_reason, close_notes, incident_id, threat_id, verdict, status if __name__ in ("__main__", "__builtin__", "builtins"): main()