import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 def get_dict(d, keys): for key in keys: try: d = d[key] except (KeyError, TypeError): return None return d def get_data_from_context(incident_context, objects): result = {} found = False for var in objects: data = get_dict(incident_context[0], ["Contents", "context", var]) if data is not None: result[var] = data found = True if not found: result = {"Button Results": "No button execution output found"} return result def convert_to_kv_table(data): """Converts data to key-value table""" def dict_to_kv_string(dict_obj): return "
".join([f"{key}: {value}" for key, value in dict_obj.items()]) items = [] for key, value in data.items(): if isinstance(value, dict): value = dict_to_kv_string(value) items.append((key, value)) return items def convert_to_kv_list(data): """Converts a list of tuples to a list of key-value tuples""" kv_list = [] for t in data: if len(t) == 2: kv_list.append((t[0], t[1])) return kv_list def format_data_to_table(items): """Formats the extracted data into a dynamic width HTML table format""" table = "\n" for key, value in items: if isinstance(value, dict): value = format_data_to_table(convert_to_kv_list(value)) elif isinstance(value, list): if all(isinstance(v, tuple) and len(v) == 2 for v in value): value = "" else: value = "" else: value = str(value) table += "\n" table += f"\n" table += f"\n" table += "\n" table += "
{key}{value}
" return table def main(): incident = demisto.incident() incident_context = demisto.executeCommand("getContext", {"id": incident.get("id")}) objects = ["Base64", "digresults", "EntropyResult", "ResolveShortenedURL", "Endpoint"] # Get data from context data = get_data_from_context(incident_context, objects) # Convert the data to a key-value table items = convert_to_kv_table(data) fixed_items = convert_to_kv_list(items) # Format the data into a dynamic width HTML table table = format_data_to_table(fixed_items) return_results( { "ContentsFormat": EntryFormat.HTML, "Type": EntryType.NOTE, "Contents": table, } ) if __name__ in ("builtins", "__builtin__", "__main__"): main()