admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update playbook to fix None assignee and support dispatch playbook

Browse Source
This commit is contained in:
Eric Li
2023-08-23 14:20:20 -07:00
parent 5efd19e4a9
commit 0cb8955bb0
2 changed files with 22 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/Jira_Related_Tickets_Search.json
+3 -3
View File
File diff suppressed because one or more lines are too long
playbooks/Jira_Related_Tickets_Search.py
+19 -2
View File
@@ -262,7 +262,11 @@ def build_output(action=None, success=None, container=None, results=None, handle
ticket['description'] = json.dumps(value['description']) # eliminate new line issues
ticket['create_time'] = value['fields'].get('created')
ticket['updated_time'] = value['fields'].get('updated')
ticket['assignee'] = value['fields'].get('assignee', {}).get('displayName', '')
asignee_dict = value['fields'].get('assignee')
if asignee_dict is not None:
ticket['assignee'] = asignee_dict.get('displayName', '')
else:
ticket['assignee'] = ''
ticket['reporter'] = value.get('reporter')
ticket['status'] = value.get('status')
ticket['ticket_type'] = value.get('issue_type')
@@ -280,7 +284,20 @@ def build_output(action=None, success=None, container=None, results=None, handle
# Construct observable object
observable_object = {
"value": key,
"ticket": ticket,
"ticket": {
'name': markdown_escape(ticket['summary']),
'number': markdown_escape(ticket['name']),
'message': markdown_escape(ticket['description']),
'start_time': markdown_escape(ticket['create_time']),
'updated_time': markdown_escape(ticket['updated_time']),
'end_time': '',
'assignee': markdown_escape(ticket['assignee']),
'creator_name': markdown_escape(ticket['reporter']),
'state': markdown_escape(ticket['status']),
'ticket_type': markdown_escape(ticket['ticket_type']),
'priority': markdown_escape(ticket['priority']),
'resolution': markdown_escape(ticket['resolution']),
},
"matched_fields": value['matched_fields'],
"source": ticket['source'],
"source_link": ticket['source_link']