topic Re: demisto-py - Specify Playbook in Cortex XSOAR Discussions

demisto-py - Specify Playbook

twjolson — Mon, 04 Oct 2021 14:03:15 GMT

Hello All,

I have a python script using demisto-py that creates tickets based on an input Word document.

However, specifying the playbook isn't working.

When I call demisto_client.demisto_api.CreateIncidentRequest() with the "playbookid" field is populated with the Playbook name, as found in Playbooks page. I thought this field invoked the playbook in older versions of my script, but I may be incorrect.

When I create the incident via create_incident(), "playbookid" isn't present, but "playbook_id" is, and it is empty. The case is created fine, but in the context data, "playbookid" is an empty string. "playbook_id" is not present.

Changing the field name to "playbook_id" I get a "Item not found" error and the case isn't created. You'd think playbook_id is the field to use as that is the field used by default and is listed in one of the examples on github. But, I've never gotten it to work.

Any ideas? Am I missing something?

Re: demisto-py - Specify Playbook

ABurt — Tue, 05 Oct 2021 08:10:28 GMT

Can you share the script you are using? There are 2 invocations of create incident. One using a single incident creation with specific fields and the other using JSON.

Re: demisto-py - Specify Playbook

twjolson — Tue, 05 Oct 2021 13:36:22 GMT

Thank you for taking the time to reply.

Here is the relevant part (the script is fairly long and involved, and the rest doesn't come into play) :

# Create ticket request object oTicket = demisto_client.demisto_api.CreateIncidentRequest() # Write common case data oTicket.name = sCaseNum.split(' ')[0] for k, v in dBase.items() : setattr(oTicket, k, v) # Write the custom fields to the case setattr(oTicket, 'custom_fields', dCustom) try : # Create the incident api_response = oAPI.create_incident(create_incident_request=oTicket) # Parse the returned data iCreatedId = api_response.to_dict().get('id')

Prior to this, the script gathers all relevant data, either through an input Word document or by prompting the user. The data has been split into two Python dictionaries - one for the base fields and one for the custom_fields.

Once this function has the data, it attaches it to the case (oTicket) via setattr. It then creates the case and saves the case number.

No other fields have issues, so I think the coding is solid. It is just this one - I get conflicting hints on whether it should be playbookid or playbook_id.

I'm at a loss, but need to figure this out because I want to be able to arbitrarily run playbooks when this script runs.