def remove_temp_lists(action=None,
success=None,
container=None,
results=None,
handle=None,
filtered_artifacts=None,
filtered_results=None):
phantom.debug('remove_temp_lists() called')
results_data_1 = phantom.collect2(
container=container,
datapath=['get_temp_lists:action_result.data.*.response_body'],
action_results=results)
results_item_1_0 = [item[0] for item in results_data_1]
################################################################################
## Custom Code Start
################################################################################
# Write your custom code here...
phantom.debug(results_item_1_0)
for item in results_item_1_0[0]['data']:
phantom.remove_list(item['name'])
################################################################################
## Custom Code End
################################################################################
return
def Make_List(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):
phantom.debug('Make_List() called')
results_data_1 = phantom.collect2(container=container, datapath=['run_query_1:action_result.data'], action_results=results)
results_item_1_0 = [item[0] for item in results_data_1]
################################################################################
## Custom Code Start
################################################################################
# Write your custom code here...
list_name = "temp_peer_list_%s" % container['id']
# Store list name in container data
data = phantom.get_container(container['id'])['data']
data.update({"peer_list":list_name})
phantom.update(container, {'data':data} )
phantom.remove_list(list_name)
#phantom.debug(results_item_1_0)
for row in results_item_1_0[0]:
phantom.add_list(list_name, [row["peer"],row["count"], row["priority"]])
################################################################################
## Custom Code End
################################################################################
add_comment_1(container=container)
return
def L5_CF_Get_Query_Results_py3_SOAR53(peer=None,
priority=None,
count=None,
container=None,
**kwargs):
"""
created with SOAR 5.3
Args:
peer
priority
count
container (CEF type: phantom container id)
Returns a JSON-serializable object that implements the configured data paths:
results_list_name
"""
############################ Custom Code Goes Below This Line #################################
import json
import phantom.rules as phantom
outputs = {}
# Write your custom code here...
phantom.debug(container)
phantom.debug(type(container))
list_name = "temp_peer_list_%s" % container
# You need the container object in order to update it.
update_container = phantom.get_container(container)
# Get the data node of the container
data = phantom.get_container(container)['data']
data.update({"peer_list": list_name})
phantom.update(update_container, {'data': data})
phantom.remove_list(list_name)
for i in range(0, len(peer)):
phantom.add_list(list_name, [peer[i], priority[i], count[i]])
# The actual list is in slot 3 of the tuple returned by phantom.get_list()
results_list = phantom.get_list(list_name)[2]
phantom.debug(results_list)
outputs = {'results_list_name': list_name}
# Return a JSON-serializable object
assert json.dumps(
outputs
) # Will raise an exception if the :outputs: object is not JSON-serializable
return outputs
def on_finish(container, summary):
phantom.debug('on_finish() called')
phantom.remove_list(list_name='Threats-Reported', empty_list=True)
phantom.remove_list(list_name='Threats-Repeated', empty_list=True)
# phantom.debug("create_ticket_1:action_result.parameter.id")
phantom.debug(phantom.get_format_data(name="format_1"))
# This function is called after all actions are completed.
# summary of all the action and/or all detals of actions
# can be collected here.
# summary_json = phantom.get_summary()
# if 'result' in summary_json:
# for action_result in summary_json['result']:
# if 'action_run_id' in action_result:
# action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)
# phantom.debug(action_results)
return
def delete_lists(action=None,
success=None,
container=None,
results=None,
handle=None,
filtered_artifacts=None,
filtered_results=None,
custom_function=None,
**kwargs):
phantom.debug("delete_lists() called")
get_temp_custom_lists_result_data = phantom.collect2(
container=container,
datapath=[
"get_temp_custom_lists:action_result.data.*.parsed_response_body"
],
action_results=results)
get_temp_custom_lists_result_item_0 = [
item[0] for item in get_temp_custom_lists_result_data
]
################################################################################
## Custom Code Start
################################################################################
# Write your custom code here...
# phantom.debug(get_temp_custom_lists_result_data)
for item in get_temp_custom_lists_result_item_0[0]['data']:
# phantom.debug(item['name'])
phantom.remove_list(item['name'])
################################################################################
## Custom Code End
################################################################################
return