[DemistoClassApiModule] Why CustomFields in demisto.incident()

EnesOzdemir — Mon, 30 Jan 2023 11:51:33 GMT

Why is there a separate dictionary returned from demisto.incident? Does it matter whether a field is custom or builtin

demisto.incident()['CustomFields']['myfield']

I am asking this because I am thinking about implementing a custom function in CommonUserPython to grab field values without worrying about if the field is custom or built-in. Would this implementation cause any trouble?

Re: [DemistoClassApiModule] Why CustomFields in demisto.incident()

michaelsysec242 — Mon, 30 Jan 2023 12:53:22 GMT

Hey @EnesOzdemir ,

you could set all the details you want to a custom key of your choosing by using the !Set command. Afterwards you can use the

"demisto.get(demisto.context(), 'key_name')"

As long as the details you want are in the Context Data you can always access what you need. Use the Try and Except flow to catch errors yet you can test that the field exists and is not empty with other built-in tools.

In regards to the main difference between custom fields and incident fields I cant provide you with an exact difference between them in regards to CommonUserPython.

topic Re: [DemistoClassApiModule] Why CustomFields in demisto.incident() in Cortex XSOAR Discussions

[DemistoClassApiModule] Why CustomFields in demisto.incident()

Re: [DemistoClassApiModule] Why CustomFields in demisto.incident()