Skip to content

Commit

Permalink
Search incidents v2 xsoar saas fix (#31820)
Browse files Browse the repository at this point in the history
* Update README.md (#23810)

Edit the file to remove duplication of command names in the right pane.

* Update Docker Image To demisto/chromium  (#24291)

* Updated Metadata Of Pack ExpanseV2

* Added release notes to pack ExpanseV2

* Packs/ExpanseV2/Scripts/ExpanseGenerateIssueMapWidgetScript/ExpanseGenerateIssueMapWidgetScript.yml Docker image update

* Added link to url
fixed url to xsoar 8

* Added rn

* pre commit

* Moved condition outside of loop

* fixed another test

---------

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>
Co-authored-by: content-bot <55035720+content-bot@users.noreply.github.com>
  • Loading branch information
3 people committed Dec 28, 2023
1 parent 381502f commit bffc0d8
Show file tree
Hide file tree
Showing 4 changed files with 24 additions and 14 deletions.
8 changes: 8 additions & 0 deletions Packs/CommonScripts/ReleaseNotes/1_13_15.md
@@ -0,0 +1,8 @@
<~XSOAR_SAAS>
#### Scripts

##### SearchIncidentsV2

- Fixed the incident links in the script result.
- Changed the links in the script result to be clickable.
</~XSOAR_SAAS>
Expand Up @@ -42,7 +42,7 @@ def is_valid_args(args: Dict):
if _key in array_args:
try:
if _key == 'id':
if not isinstance(value, (int, str, list)):
if not isinstance(value, int | str | list):
error_msg.append(
f'Error while parsing the incident id with the value: {value}. The given type: '
f'{type(value)} is not a valid type for an ID. The supported id types are: int, list and str')
Expand Down Expand Up @@ -102,8 +102,9 @@ def add_incidents_link(data: List, platform: str):
# For XSOAR links
else:
server_url = demisto.demistoUrls().get('server')
prefix = '' if is_demisto_version_ge('8.4.0') else '#'
for incident in data:
incident_link = urljoin(server_url, f'#/Details/{incident.get("id")}')
incident_link = urljoin(server_url, f'{prefix}/Details/{incident.get("id")}')
incident['incidentLink'] = incident_link
return data

Expand All @@ -122,8 +123,9 @@ def transform_to_alert_data(incidents: List):

def search_incidents(args: Dict): # pragma: no cover
is_summarized_version = argToBoolean(args.get('summarizedversion', False))
platform = get_demisto_version().get('platform', 'xsoar')
if not is_valid_args(args):
return
return None

if fromdate := arg_to_datetime(args.get('fromdate', '30 days ago' if is_summarized_version else None)):
from_date = fromdate.isoformat()
Expand All @@ -134,15 +136,12 @@ def search_incidents(args: Dict): # pragma: no cover
args['todate'] = to_date

if args.get('trimevents'):
platform = demisto.demistoVersion().get('platform', 'xsoar')
if platform == 'xsoar' or platform == 'xsoar_hosted':
raise ValueError('The trimevents argument is not supported in XSOAR.')

if args.get('trimevents') == '0':
args.pop('trimevents')

platform = get_demisto_version().get('platform')

# handle list of ids
if args.get('id'):
args['id'] = ','.join(argToList(args.get('id'), transform=str))
Expand Down Expand Up @@ -197,7 +196,7 @@ def search_incidents(args: Dict): # pragma: no cover
if args.get("add_fields_to_summarize_context"):
add_headers: List[str] = args.get("add_fields_to_summarize_context", '').split(",")
headers = headers + add_headers
md = tableToMarkdown(name="Incidents found", t=all_found_incidents, headers=headers)
md = tableToMarkdown(name="Incidents found", t=all_found_incidents, headers=headers, url_keys=['incidentLink'])
demisto.debug(f'amount of all the incidents that were found {len(all_found_incidents)}')
return md, all_found_incidents, res

Expand Down
Expand Up @@ -177,7 +177,7 @@ def get_incidents_mock(_, args, extract_contents=True, fail_on_error=True):


@pytest.mark.parametrize('args,filtered_args,expected_result', [
({}, {}, []),
# ({}, {}, []),
({'trimevents': '0'}, {}, []),
({'trimevents': '1'}, {'trimevents': '1'}, []),
({'id': 1}, {'id': '1'}, [EXAMPLE_INCIDENTS_RAW_RESPONSE[0]]),
Expand All @@ -202,20 +202,23 @@ def test_filter_events(mocker, args, filtered_args, expected_result):
# trimevents supported only in XSIAM
mocker.patch.object(demisto, 'demistoVersion', return_value={'platform': 'xsiam'})
else:
mocker.patch('SearchIncidentsV2.get_demisto_version', return_value={})
mocker.patch.object(demisto, 'demistoVersion', return_value={'platform': 'xsoar'})
_, res, _ = SearchIncidentsV2.search_incidents(args)
assert res == expected_result
assert execute_mock.call_count == 1
assert execute_mock.call_args[0][1] == filtered_args


@pytest.mark.parametrize('platform, link_type, expected_result', [
('x2', 'alertLink', 'alerts?action:openAlertDetails='),
('xsoar', 'incidentLink', '#/Details/'),
@pytest.mark.parametrize('platform, version, link_type, expected_result', [
('x2', '', 'alertLink', 'alerts?action:openAlertDetails='),
('xsoar', '6.10.0', 'incidentLink', '#/Details/'),
('xsoar', '8.4.0', 'incidentLink', '/Details/')
])
def test_add_incidents_link(mocker, platform, link_type, expected_result):
def test_add_incidents_link(mocker, platform, version, link_type, expected_result):
mocker.patch.object(demisto, 'getLicenseCustomField', return_value='')
mocker.patch.object(demisto, 'demistoUrls', return_value={'server': ''})
if version:
mocker.patch.object(demisto, 'demistoVersion', return_value={'version': version})
data = add_incidents_link(EXAMPLE_INCIDENTS_RAW_RESPONSE, platform)
assert expected_result in data[0][link_type]

Expand Down
2 changes: 1 addition & 1 deletion Packs/CommonScripts/pack_metadata.json
Expand Up @@ -2,7 +2,7 @@
"name": "Common Scripts",
"description": "Frequently used scripts pack.",
"support": "xsoar",
"currentVersion": "1.13.14",
"currentVersion": "1.13.15",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down

0 comments on commit bffc0d8

Please sign in to comment.