import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 def get_status_name(alert_id: str): get_alert = execute_command("sekoia-xdr-get-alert", {"id": alert_id}) return get_alert["status"]["name"] # type: ignore def get_username(username: str): user = execute_command("getUserByUsername", {"username": username}) return user["name"] # type: ignore def post_closure_comment( alert_id: str, close_reason: Optional[str], close_notes: Optional[str], username: Optional[str], ): # pragma: no cover try: execute_command( "sekoia-xdr-post-comment-alert", { "id": alert_id, "comment": (f"{close_reason}-{close_notes}" if close_reason and close_notes else None), "author": get_username(username), # type: ignore }, ) except Exception as e: return_error(f"Failed to post comment: {str(e)}") def close_alert( alert_id: str, reject: str, close_reason: Optional[str], close_notes: Optional[str], username: str, mirror_status: str, is_mirror_out: bool, ): # pragma: no cover readable_output = "" alert_status = get_status_name(alert_id) if alert_status not in ["Closed", "Rejected"]: if reject == "false": if mirror_status == "In" and is_mirror_out: execute_command( "sekoia-xdr-update-status-alert", {"id": alert_id, "status": "Closed"}, ) elif mirror_status is None and is_mirror_out: execute_command("setIncident", {"sekoiaxdralertstatus": "Closed"}) execute_command( "sekoia-xdr-update-status-alert", {"id": alert_id, "status": "Closed"}, ) else: execute_command("setIncident", {"sekoiaxdralertstatus": "Closed"}) readable_output = f"**** The alert {alert_id} has been closed. ****" if reject == "true": if mirror_status == "In" and is_mirror_out: execute_command( "sekoia-xdr-update-status-alert", {"id": alert_id, "status": "Rejected"}, ) elif mirror_status is None and is_mirror_out: execute_command("setIncident", {"sekoiaxdralertstatus": "Closed"}) execute_command( "sekoia-xdr-update-status-alert", {"id": alert_id, "status": "Rejected"}, ) else: execute_command("setIncident", {"sekoiaxdralertstatus": "Rejected"}) readable_output = f"**** The alert {alert_id} has been rejected. ****" post_closure_comment(alert_id, close_reason, close_notes, username) else: execute_command("setIncident", {"sekoiaxdralertstatus": alert_status}) readable_status = "closed" if alert_status.lower() == "closed" else "rejected" readable_output = f"**** The alert {alert_id} has been {readable_status}. ****" return_results( { "ContentsFormat": formats["markdown"], "Type": entryTypes["note"], "Contents": readable_output, } ) def main(): # pragma: no cover incident = demisto.incidents()[0] # type: ignore mirror_direction = incident.get("dbotMirrorDirection") is_mirror_out = incident.get("CustomFields", {}).get("sekoiaxdrmirrorout") alert_short_id = incident.get("CustomFields", {}).get("alertid") reject = demisto.getArg("sekoiaxdralertreject") # type: ignore close_reason = demisto.getArg("closeReason") close_notes = demisto.getArg("closeNotes") username = demisto.getArg("closingUserId") # type: ignore close_alert( alert_short_id, reject, close_reason, close_notes, username, mirror_direction, is_mirror_out, # type: ignore ) if __name__ in ("__main__", "__builtin__", "builtins"): main()