create table show incident close reason group by incident type

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

create table show incident close reason group by incident type

L0 Member

I am new to XSOAR and I am trying to create table show incident close reason group by incident type looks like below

 

 Ture positiveFalse positiveDuplicate
incident type 11211
incident type 22433
incident type 341622

I cant find any widget can do this so I try to look into the automation script but I have no idea how it going to work.

 

If anyone can give a hit on this would be great?

 

In addition, does anyone can share some good starting tutorial relate with automation scripting would be appricated

 

Regards

 

1 ACCEPTED SOLUTION

Accepted Solutions

L3 Networker

Take a look at the automation script widgets here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/widgets/create-a-custom...

 

 

As an example for you use case (and assuming you have fields called "True Positive" and "False Positive" that are boolean (bear in mind this is pseudo code and not tested):


page = 0
size = 100

table_results = dict()

data = demisto.executeCommand("getIncidents", {"page": page, "size": size})[0]['Contents']

while data.get('data'):
    for incident in data.get('data'):
        inc_type = incident.get('type')
        custom_fields = incident.get('CustomFields')
        if inc_type not in table_results:
            table_results[inc_type] = {
                "True Positive": int(custom_fields.get('truepositive')) or 0,
                "False Positive": int(custom_fields.get('falsepositive')) or 0,
                "Duplicate": custom_fields.get('dropppedcount') or 0,
            }
        else:
            if custom_fields.get('truepositive'):
                table_results[inc_type]['True Positive'] += 1
            if custom_fields.get('falsepositive'):
                table_results[inc_type]['False Positive'] += 1
            table_results[inc_type]['Duplicate'] += incident.get('droppedcount')
    page += 1
    data = demisto.executeCommand("getIncidents", {"page": page, "size": size})[0]['Contents']

return_results = [{
    "Type": k,
    "True Positive": v.get('True Positive'),
    "False Positive": v.get('False Positive'),
    "Duplicate": v.get('Duplicate')
    } for k, v in table_results.items()]
    

return_results(return_results)

View solution in original post

2 REPLIES 2

Community Team Member

Hi @LinsongGuo ,

 

In order to get better traction for this, I have moved your query to the Cortex XSOAR area.
I would recommend that you visit this area to see your discussion and others on Cortex XSOAR.

 

Cheers !

-Kiwi.

 
LIVEcommunity team member, CISSP
Cheers,
Kiwi
Don't forget to hit that Like button if a post is helpful to you!

L3 Networker

Take a look at the automation script widgets here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/widgets/create-a-custom...

 

 

As an example for you use case (and assuming you have fields called "True Positive" and "False Positive" that are boolean (bear in mind this is pseudo code and not tested):


page = 0
size = 100

table_results = dict()

data = demisto.executeCommand("getIncidents", {"page": page, "size": size})[0]['Contents']

while data.get('data'):
    for incident in data.get('data'):
        inc_type = incident.get('type')
        custom_fields = incident.get('CustomFields')
        if inc_type not in table_results:
            table_results[inc_type] = {
                "True Positive": int(custom_fields.get('truepositive')) or 0,
                "False Positive": int(custom_fields.get('falsepositive')) or 0,
                "Duplicate": custom_fields.get('dropppedcount') or 0,
            }
        else:
            if custom_fields.get('truepositive'):
                table_results[inc_type]['True Positive'] += 1
            if custom_fields.get('falsepositive'):
                table_results[inc_type]['False Positive'] += 1
            table_results[inc_type]['Duplicate'] += incident.get('droppedcount')
    page += 1
    data = demisto.executeCommand("getIncidents", {"page": page, "size": size})[0]['Contents']

return_results = [{
    "Type": k,
    "True Positive": v.get('True Positive'),
    "False Positive": v.get('False Positive'),
    "Duplicate": v.get('Duplicate')
    } for k, v in table_results.items()]
    

return_results(return_results)
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!