content/automation-CBPFindComputer.yml at master · mmomin-crest/content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
args:
- default: true
  description: Only show computers matching this query. If omitted, displays all computers.
    Query is in CBEP/Bit9 syntax documented in https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api/#query-condition
    - e.g. "name:*srv*"
  name: query
comment: Find a computer in CBEP/Bit9.
commonfields:
  id: CBPFindComputer
  version: -1
dependson:
  must:
  - cbp-computer-search
name: CBPFindComputer
runonce: false
script: |-
  # query syntax is according to Carbon Black Enterprise Protection query language documented in https://developer.carbonblack.com/reference/enterprise-protection/7.2/rest-api/#query-condition - e.g. "name:*srv*"
  res = []
  dArgs = demisto.args()
  if not "limit" in demisto.args():
      dArgs["limit"] = "10"
  resCmd1 = demisto.executeCommand("cbp-computer-search", dArgs)
  for entry in resCmd1:
      if isError(entry):
          res.append(entry)
      else:
          matches = entry["Contents"]
          if matches:
              res.append(  { "Type" : entryTypes["note"], "ContentsFormat" : formats["table"], "Contents" : matches } )
          else:
              res.append(  { "Type" : entryTypes["note"], "ContentsFormat" : formats["text"], "Contents" : "No matches." } )
  demisto.results(res)
scripttarget: 0
system: true
tags:
- carbon-black-protection
- bit9
type: python