conditional check if Azure Entities command returns with "No entries."

jboyd98 — Fri, 11 Feb 2022 15:11:58 GMT

Any thoughts on why this is failing; this always returns Entries Found regardless if there are entities or not.

You can see in the screenshot above there are 0 results, no entries.

When I run this script, you'll see the screenshot below.

------Script------

##Check Sentinel for entities, if none, write a message to war room
external_id=demisto.incidents()[0]["CustomFields"]["externalid"]
entities = demisto.executeCommand("azure-sentinel-list-incident-entities", {"incident_id":external_id})

if not entities:
return_results("No entries")
elif "No entries." in entities:
return_results("No entries with period")
elif "No entries" in entities:
return_results("No entries without period")
elif len(entities)==0:
return_results("Length 0")
else:
return_results("Entries Found")

--------------------

If i print the object type, entities is a "list."

Any help would be greatly appreciated,

Thanks,

Boyd

Re: conditional check if Azure Entities command returns with "No entries."

jwilkes — Fri, 11 Feb 2022 16:05:19 GMT

Sorry, i don't have Sentinel integration up to test, but typically what is returned from demisto.executeCommand is a list and then you look into the "Contents" dictionary key inside the first value of that list to see what is returned. I would try:
entities = demisto.executeCommand("azure-sentinel-list-incident-entities", {"incident_id":external_id})[0]['Contents']

Also might want to add some print statements just for testing

topic conditional check if Azure Entities command returns with "No entries." in Cortex XSOAR Discussions

conditional check if Azure Entities command returns with "No entries."

Re: conditional check if Azure Entities command returns with "No entries."