topic create table show incident close reason group by incident type in Cortex XSOAR Discussions

create table show incident close reason group by incident type

LinsongGuo — Fri, 05 Nov 2021 05:51:35 GMT

I am new to XSOAR and I am trying to create table show incident close reason group by incident type looks like below

	Ture positive	False positive	Duplicate
incident type 1	1	2	11
incident type 2	2	4	33
incident type 3	4	16	22

I cant find any widget can do this so I try to look into the automation script but I have no idea how it going to work.

If anyone can give a hit on this would be great?

In addition, does anyone can share some good starting tutorial relate with automation scripting would be appricated

Regards

Re: create table show incident close reason group by incident type

kiwi — Tue, 09 Nov 2021 13:06:29 GMT

Hi @LinsongGuo ,

In order to get better traction for this, I have moved your query to the Cortex XSOAR area.
I would recommend that you visit this area to see your discussion and others on Cortex XSOAR.

Cheers !

-Kiwi.

Re: create table show incident close reason group by incident type

ABurt — Tue, 09 Nov 2021 15:16:23 GMT

Take a look at the automation script widgets here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/widgets/create-a-custom-widget-using-an-automation-script/widget-type-examples-using-automation-scripts.html

As an example for you use case (and assuming you have fields called "True Positive" and "False Positive" that are boolean (bear in mind this is pseudo code and not tested):

page = 0 size = 100 table_results = dict() data = demisto.executeCommand("getIncidents", {"page": page, "size": size})[0]['Contents'] while data.get('data'): for incident in data.get('data'): inc_type = incident.get('type') custom_fields = incident.get('CustomFields') if inc_type not in table_results: table_results[inc_type] = { "True Positive": int(custom_fields.get('truepositive')) or 0, "False Positive": int(custom_fields.get('falsepositive')) or 0, "Duplicate": custom_fields.get('dropppedcount') or 0, } else: if custom_fields.get('truepositive'): table_results[inc_type]['True Positive'] += 1 if custom_fields.get('falsepositive'): table_results[inc_type]['False Positive'] += 1 table_results[inc_type]['Duplicate'] += incident.get('droppedcount') page += 1 data = demisto.executeCommand("getIncidents", {"page": page, "size": size})[0]['Contents'] return_results = [{ "Type": k, "True Positive": v.get('True Positive'), "False Positive": v.get('False Positive'), "Duplicate": v.get('Duplicate') } for k, v in table_results.items()] return_results(return_results)