SiemplifyAction module

class `SiemplifyAction.SiemplifyAction`

SiemplifyAction.SiemplifyAction(mock_stdin=None, get_source_file=False)

Bases: Siemplify

add_alert_entities_to_custom_list

add_alert_entities_to_custom_list(category_name)

Add the alert's entities to the custom list record with the given category.

Parameters

Param name	Param type	Definition	Possible values	Comments
category_name	{string}	Custom list category	"CustomList"	N/A

Returns

{[CustomList]} list of the added objects

Example

Input: Explicitly, category_name. Implicitly, entities via scope.
Running add_alert_entities_to_custom_list will result in a list of "CustomList" objects and a configuration change in the settings.

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
result = siemplify.add_alert_entities_to_custom_list("WhiteListed HOSTs")

Result behavior

Adds the WhiteListed HOSTs category.

Result value

[<SiemplifyDataModel.CustomList object at 0x0000000003476E10>, <SiemplifyDataModel.CustomList object at 0x0000000003476B00>]

add_attachment

add_attachment(file_path, case_id=None, alert_identifier=None, description=None, is_favorite=False)

Add an attachment to the case wall.

Parameters

Param name	Param type	Definition	Possible values	Comments
file_path	{string}	File path	"C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe"	N/A
case_id	{string}	Case identifier	234	N/A
alert_identifier	{string}	Alert identifier	12345	N/A
description	{string}	The description for the file	N/A	N/A
is_favorite	boolean	N/A	True/False	N/A

Returns

{long} attachment_id

Example

Input: Explicitly, File path, description, and is_favorite. Implicitly, case_id and alert_identifier.

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
result = siemplify.add_attachment("C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe", case_id="234", alert_identifier=None, description=None, is_favorite=True)

Result behavior

The file mentioned in the file path will be attached to case id 234 and the attachment ID will be returned.

Result value

5 [The attachment ID]

add_comment

add_comment(comment, case_id=None, alert_identifier=None)

Add a new comment to a specific case.

Parameters

Param name	Param type	Definition	Possible values	Comments
comment	{string}	Comment to be added to case wall	N/A	N/A
case_id	{string}	Case identifier	234	If a `case_id` is not provided, the current case will be used. None by default (optional)
alert_identifier	{string}	Alert identifier	12345	If an `alert_identifier` is not provided, the current alert will be used. None by default (optional)

Returns

NoneType

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
comment = "Ran some tests on the hash and it seems fine"
siemplify.add_comment(comment=comment)

Result behavior

The specified comment is added to the current case.

Result value

None

add_entity_insight

add_entity_insight(domain_entity_info, message, triggered_by=None, original_requesting_user=None)

Add an entity insight to the case it is being used in.

Parameters

Param name	Param type	Definition	Possible values	Comments
domain_entity_info	{DomainEntityInfo}	The entity object that represents an entity to add insight to	N/A	N/A
message	{string}	Insight message	N/A	N/A
triggered_by	{string}	Integration name	N/A	If no integration name is provided, the selected integration for the action will be used. None by default (optional)
original_requesting_user	{string}	Requesting user	N/A	None by default (optional)

Returns

{boolean} True if success. Otherwise, False.

Example

Result behavior

Result value

add_entity_to_case

add_entity_to_case(entity_identifier, entity_type, is_internal, is_suspicous, is_enriched, is_vulnerable, properties, case_id=None, alert_identifier=None, environment=None)

Add an entity to the current case.

Parameters

Param name	Param type	Definition	Possible values	Comments
entity_identifier	{string}	Entity identifier	192.0.2.1, example.com	N/A
entity_type	{string}	Entity type	"ADDRESS"	N/A
is_internal	{boolean}	N/A	Internal/External	N/A
is_suspicous	{boolean}	N/A	Suspicious/Not suspicious	N/A
is_enriched	{boolean}	N/A	True/False	False by default
is_vulnerable	{boolean}	N/A	True/False	False by default
properties	{dict}	{"Property1":"PropertyValue", "Property2":"PropertyValue2"}	N/A	N/A

Returns

NoneType

If there is an existing Entity, the following error appears: /

500 Server Error: Internal Server Error for url: https://localhost:8443/api/external/v1/sdk/CreateEntity?format=snake: \"ErrorMessage\":\"Cannot add entity [Identifier:Entities Identifies - Type:siemplify.parameters[] to alert [MONITORED MAILBOX <EXAMPLE@EXAMPLE.COM>_633997CB-D23B-4A2B-92F2-AD1D350284FF] in case [12345] because the entity already exists >there.\"

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
siemplify.add_entity_to_case(entity_identifier, entity_type, is_internal, is_suspicous, is_enriched, is_vulnerable, properties, case_id, alert_identifier, environment)

Result behavior

This function will add a new entity to the case if it is not present in the case.

Result value

None

add_tag

add_tag(tag, case_id=None, alert_identifier=None)

Add a new tag to a specific case.

Parameters

Param name	Param type	Definition	Possible values	Comments
tag	{string}	Tag to be added	Any string to be used as a tag	N/A
case_id	{string}	Case identifier	12345	If a `case_id` is not provided, then the current case ID will be used. None by default (optional)
alert_identifier	{string}	Alert identifier	123	If an `alert_identifier` is not provided, then the current alert ID will be used. None by default(optional)

Returns

NoneType

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
tag_to_be_added = "MaliciousMail"
siemplify.add_tag(tag=tag_to_be_added)

Result behavior

The "MaliciousMail" tag is added to the current case.

Result value

None

any_alert_entities_in_custom_list

any_alert_entities_in_custom_list(category_name)

Check if any of the alert's entities has a custom list record with the given category.
This function gets a category name from CustomLists and returns True (Boolean) if any of the entities in the scope is in that category. An entity is considered in the category if its identifier is listed with this category in the settings in the CustomLists table.

Parameters

Param name	Param type	Definition	Possible values	Comments
category_name	{string}	The custom list category name	`BlackListed IPs`	N/A

Returns

{boolean} True if there is an entity in the category, False otherwise.

Example 1

from SiemplifyAction import SiemplifyAction \
siemplify = SiemplifyAction() \
result = siemplify.any_entity_in_custom_list("BlackListed IPs")

Example 2

from SiemplifyAction import SiemplifyAction \
siemplify = SiemplifyAction() \
result = siemplify.any_entity_in_custom_list("Executive IPs")

Result behavior

Sample Code 1 result is True. Sample Code 2 result is False.

Result value

True/False

assign_case

assign_case(user, case_id=None, alert_identifier=None)

Assign case to user.

Parameters

Param name	Param type	Definition	Possible values	Comments
user	{string}	User/role	Admin, @Tier1	N/A
case_id	{string}	Case identifier	12345	If a `case_id` is not provided, then the current case id will be used. None by default (optional)
alert_identifier	{string}	Alert identifier	123	If an `alert_identifier` is not provided, then the current alert ID will be used. None by default (optional)

Returns

NoneType

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
assigned_user= "Admin"
siemplify.assign_case(assigned_user)

Result behavior

The case gets assigned to the Admin user.

Result value

None

attach_workflow_to_case

attach_workflow_to_case(workflow_name, cyber_case_id=None, indicator_identifier=None)

Attach a playbook to the current alert.

Parameters

Param name	Param type	Definition	Possible values	Comments
workflow_name	{string}	Workflow (playbook) name	N/A	N/A
cyber_case_id	{string}	Case identifier	234	If no case is provided, the current case is used. None by default (optional)
indicator_identifier	{string}	Alert identifier	12345	If no alert identifier is provided, the current alert is used. None by default (optional)

Returns

NoneType

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
siemplify.attach_workflow_to_case(workflow_name, cyber_case_id, indicator_identifier)

Result behavior

Attaches the given workflow to the case for the given indicator identifier.

Result value

None

property case

change_case_priority

change_case_priority(priority, case_id=None, alert_identifier=None)

Change case priority.

Parameters

Param name	Param type	Definition	Possible values	Comments
priority	{int}	Priority represented by each number, respectively, is: Low, Medium, High, and Critical	{"Low": 40, "Medium": 60, "High": 80, "Critical": 100}	N/A
case_id	{string}	Case identifier	12345	If no case is provided, the current case is used
alert_identifier	{string}	Alert identifier	123	If no alert identifier is provided, the current alert is used

Returns

NoneType

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
priority_to_change_to = 60
siemplify.change_case_priority(priority=priority_to_change_to )

Result behavior

The case priority gets changed to "Medium".

Result value

None

change_case_stage

change_case_stage(stage, case_id=None, alert_identifier=None)

Change case stage

Parameters

Param name	Param type	Definition	Possible values	Comments
stage	{string}	Stage should match exactly the string that is defined in the case stages table	Incident, Investigation	N/A
case_id	{string}	Case identifier	12345	If no case is provided, the current case is used
alert_identifier	{string}	Alert identifier	123	If no alert identifier is provided, the current alert is used

Returns

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
stage_to_change_to = "Investigation"
siemplify.change_case_stage(stage=stage_to_change_to)

Result behavior

The case state is changed to "investigation".

Result value

None

close_alert

close_alert(root_cause, comment, reason, case_id=None, alert_id=None)

Close current alert.

Parameters

Param name	Param type	Definition	Possible values	Comments
root_cause	{string}	Close case root cause	A string taken from the "Case close root cause" table in the settings	N/A
comment	{string}	Comment	Any string could be used here	Comment should describe the case, but is not restricted
reason	{ApiSyncAlertCloseReasonEnum}		One of three predefined strings available in the popup when done manually: "NotMalicious", "Malicious", and "Maintenance"	See SiemplifyDataModel.ApiSyncAlertCloseReasonEnum

Returns

{dict} result of server operation

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
reason = "Maintenance"
root_cause = "Employee Error"
comment = "User accidentally activated a correlation before it was ready to be used and triggered this alert"
siemplify.close_alert(reason=reason, root_cause=root_cause, comment=comment)

Result behavior

The current alert is moved to a new case and subsequently closed with the alert.

Result value

None

close_case

close_case(root_cause, comment, reason, case_id=None, alert_identifier=None)

Close case.

Parameters

Param name	Param type	Definition	Possible values	Comments
root_cause	{string}	Close case root cause	N/A	N/A
comment	{string}	Comment	Any string could be used here	Comment should describe the case, but is not restricted
reason	{ApiSyncAlertCloseReasonEnum}	Close case reason	One of three predefined strings available in the popup when done manually: "NotMalicious", "Malicious", and "Maintenance"
case_id	{string}	Case identifier	12345	If no case is provided, the current case is used
alert_identifier	{string}	Alert identifier	123	If no alert identifier is provided, the current alert is used

Returns

NoneType

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
reason = "Maintenance"
root_cause = "Employee Error"
comment = "User accidentally activated a correlation before it was ready to be used and triggered this alert"
siemplify.close_case(reason=reason, root_cause=root_cause, comment=comment)

Result behavior

The case gets closed with the specified reason, root cause and comment.

Result value

None

create_case_insight

create_case_insight(triggered_by, title, content, entity_identifier, severity, insight_type, additional_data=None, additional_data_type=None, additional_data_title=None)

Add insight to the case.

Parameters

Param name	Param type	Definition	Possible values	Comments
triggered_by	{string}	Integration name	VirusTotal, XForce	N/A
title	{string}	Insight title	Enriched by VirusTotal	N/A
content	{string}	Insight message	Insight Message	N/A
entity_identifier	{string}	Entity identifier	example.com	N/A
severity	{int}	Severity level	0 = info, 1 = warning, 2 = error
insight_type	{int}	Insight type	0 = general, 1 = entity	N/A
additional_data	{string}	Additional data for insight	{"checked against": "VT", "malicious": "No"}	N/A
additional_data_type	{int}	Type of the additional data	'General'=0, 'Entity'=1	N/A
additional_data_title	{string}	Additional data title for insight	VT check	N/A

Returns

{boolean} True if success. Otherwise, False.

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
siemplify.create_case_insight(triggered_by, title, content, entity_identifier, severity, insight_type, additional_data, additional_data_type, additional_data_title)

Result behavior

Creates the insight for a case with defined data.
True if case insight is created. Otherwise, False.

Result value

True/False

property current_alert

dismiss_alert

dismiss_alert(alert_group_identifier, should_close_case_if_all_alerts_were_dismissed, case_id=None)

property environment

escalate_case

escalate_case(comment, case_id=None, alert_identifier=None)

Escalate case.

Parameters

Param name	Param type	Definition	Possible values	Comments
comment	{string}	Escalate comment	N/A	N/A
case_id	{string}	Case identifier	12345	N/A
alert_identifier	{string}	Alert identifier	123	N/A

extract_action_param

extract_action_param(param_name, default_value=None, input_type=<class 'str'>, is_mandatory=False, print_value=False)

Get an action script parameter.

Parameters

Param name	Param type	Definition	Possible values	Comments
param_name	{string}	Name of the parameter	Any of the parameters names available for the action	N/A
default_value	{any}	The default value of the parameter	The given value will be returned if the parameter was not set (if `is_mandatory` is set to False)	If the parameter is not passed, use this value by default. None by default (optional)
input_type	{obj}	Cast the parameter to a different type	int	str by default (optional)
is_mandatory	{boolean}	Raise an exception if the parameter is empty	True/False	False by default
print_value	{boolean}	Print the value to the log	True/False	False by default

Returns

The parameter value, {string} by default, unless input_type is specified.

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
param_value= siemplify.extract_action_param(
 "Threshold",
 default_value=-1,
 input_type=int,
 is_mandatory=False,
 print_value=False)

Result behavior

The value of the selected parameter will be returned, casted to the selected type.

Result value

fetch_and_save_timestamp

fetch_and_save_timestamp(datetime_format=False, timezone=False, new_timestamp=1683033493671)

Fetch timestamp and save it to case context.

Parameters

Param name	Param type	Definition	Possible values	Comments
datetime_format	{boolean}	Format for date/time	True for getting in date time format, False for Unix	False by default (optional)
timezone	Parameter not supported anymore
new_timestamp	{int}	The time stamp to save	N/A	Unix time by default (optional)

Returns

Datetime/int

Example

from SiemplifyAction import SiemplifyAction
sa = SiemplifyAction()
sa.fetch_and_save_timestamp(self, datetime_format=False, new_timestamp=SiemplifyUtils.Unix_now())

Result behavior

The latest timestamp is fetched and is saved as TIMESTAMP file in the current directory.

Result value

datetime.datetime(2019, 7, 16, 14, 26, 2, 26000)/1563276380

fetch_timestamp

fetch_timestamp(datetime_format=False, timezone=False)

Get the timestamp saved with save_timestamp.

Parameters

Param name	Param type	Definition	Possible values	Comments
datetime_format	{boolean}	If True, return timestamp as datetime. Else, return in Unix	True/False	False by default (optional)
timezone	Parameter not supported anymore

Returns

Saved Unix time/datetime

Example

from SiemplifyAction import SiemplifyAction
sa = SiemplifyAction()
result = sa.fetch_timestamp(datetime_format=True)

Result behavior

The latest timestamp is fetched and is saved as TIMESTAMP file in the current directory.

Result value

datetime.datetime(2019, 7, 16, 14, 26, 2, 26000)/1563276380

get_alert_context_property

get_alert_context_property(property_key)

Get context property from current alert.

Parameters

Param name	Param type	Definition	Possible values	Comments
property_key	{string}	The key of the requested property	N/A	N/A

Returns

{string} The property value

get_alerts_ticket_ids_from_cases_closed_since_timestamp

get_alerts_ticket_ids_from_cases_closed_since_timestamp(timestamp_unix_ms, rule_generator)

Get alerts from cases that were closed since timestamp.

Parameters

Param name	Param type	Definition	Possible values	Comments
timestamp_unix_ms	{long}	Timestamp	1550409785000L
rule_generator	{string}	N/A	Phishing email detector	N/A

Returns

{[string]} list of alert IDs

get_attachments

get_attachments(case_id=None)

Get attachments from a case.
This function gets a list of custom list items from category and entities list and returns a list of custom list item objects.

Parameters

Param name	Param type	Definition	Possible values	Comments
case_id	{string}	Case identifier	234	If no case provided, the current case will be used (optional)

Returns

{dict} attachments

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
result = siemplify.get_attachments(case_id="234")

Result behavior

A list of dictionaries of attachments will be returned for the case id 234.

Result value

[{u'is_favorite': False, u'description': u'test', u'type': u'.exe', u'id': 4, u'name': u'chrome_proxy'}]

get_case_comments

get_case_comments(case_id=None)

Get case comments.

Parameters

Param name	Param type	Definition	Possible values	Comments
case_id	{string}	Case identifier	234	If no case provided, the current case will be used

Returns

{[dict]} of case comments

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
siemplify.get_case_comments(case_id)

Result behavior

All comments belonging to the case will be fetched.

Result value

[{‘comment': u'this is a comment',
u'is_deleted': False,
u'last_editor_full_name': u'example user',
u'modification_time_unix_time_in_ms_for_client': 0,
u'creation_time_unix_time_in_ms': 1681904404087, u'id': 12,
u'modification_time_unix_time_in_ms': 1681904404087,
u'case_id': 234,
u'is_favorite': False,
u'alert_identifier': None,
u'creator_user_id': u'cd1c112a-0277-44a9-b68d-98ceef9b0399',
u'last_editor': u'cd1c112a-0277-44a9-b68d-98ceef9b0399',
u'type': 5,
u'comment_for_client': None,
u'creator_full_name': u'example user'}]

get_case_context_property

get_case_context_property(property_key)

Get a case context property.

Parameters

Param name	Param type	Definition	Possible values	Comments
property_key	{string}	The requested key property	N/A	N/A

Returns

{string} the property value

get_configuration

get_configuration(provider, environment=None, integration_instance=None)

Get integration configuration.

Parameters

Param name	Param type	Definition	Possible values	Comments
provider	{string}	Integration name	VirusTotal
environment	{string}	Configuration for specific environment or ‘all'		Optional. If provided, the credentials will be taken from the relevant environment's configuration. If no environment is stated, the case's environment is used by default. If there is no configuration for the specific environment, the default configuration will be returned.
integration_instance	{string}	The identifier of the integration instance	N/A	N/A

Returns

{dict} configuration details

get_similar_cases

get_similar_cases(consider_ports, consider_category_outcome, consider_rule_generator, consider_entity_identifiers, days_to_look_back, case_id=None, end_time_unix_ms=None)

Get similar cases.

Parameters

Param name	Param type	Definition	Possible values	Comments
consider_ports	{boolean}	Parameter configures whether to use a port filter or not	True/false	N/A
consider_category_outcome	{boolean}	Parameter configures whether to consider category outcome of the events	True/false	N/A
consider_rule_generator	{boolean}	Parameter configures whether to consider the rule generator for the alerts	True/false	N/A
consider_entity_identifiers	{boolean}	Parameter configures whether to consider entity identifiers for the alerts	True/false	N/A
days_to_look_back	{int}	Parameter configures the number of days prior to look for similar cases	365	N/A

Returns

{[int]} list of case IDs

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
result = siemplify.get_similar_cases(consider_ports=True,
 consider_category_outcome=False,
 consider_rule_generator=False,
 consider_entity_identifiers=False,
 days_to_look_back=30, case_id="234", end_time_unix_ms=None)

Result behavior

A list of case IDs similar to the case 234 will be returned.

Result value

[4, 231]

get_ticket_ids_for_alerts_dismissed_since_timestamp

get_ticket_ids_for_alerts_dismissed_since_timestamp(timestamp_unix_ms)

property is_timeout_reached

load_case_data

load_case_data()

This function loads the case data.

Parameters

No parameters required.

Returns

NoneType

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
result = siemplify.load_case_data()

Result behavior

The case data gets loaded.

Result value

None

property log_location

mark_case_as_important

mark_case_as_important(case_id=None, alert_identifier=None)

Mark case as important.

Parameters

Param name	Param type	Definition	Possible values	Comments
case_id	{string}	Case identifier	234	N/A
alert_identifier	{string}	Alert identifier	12345	N/A

Returns

NoneType

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
siemplify.mark_case_as_important()

Result behavior

The current case is marked as important.

Result value

None

raise_incident

raise_incident(case_id=None, alert_identifier=None)

Raise incident.

Parameters

Param name	Param type	Definition	Possible values	Comments
case_id	{string}	Case identifier	234	N/A
alert_identifier	{string}	Alert identifier	12345	N/A

Returns

NoneType

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
siemplify.raise_incident(case_id, alert_identifier)

Result behavior

The case raised to Incident status.

Result value

None

remove_alert_entities_from_custom_list

remove_alert_entities_from_custom_list(category_name)

Remove the alert's entities to the custom list record with the given category.

Parameters

Param name	Param type	Definition	Possible values	Comments
category_name	{string}	The custom list category	`WhiteListed HOSTs`	N/A

Returns

{[CustomList]} list of the removed CustomList objects

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
result = siemplify.remove_alert_entities_from_custom_list("WhiteListed HOSTs")

Result behavior

The WhiteListed HOSTS is removed.

Result value

[<SiemplifyDataModel.CustomList object at 0x0000000003476E10>,
<SiemplifyDataModel.CustomList object at 0x0000000003476B00>]

save_timestamp

save_timestamp(datetime_format=False, timezone=False, new_timestamp=1683033493671)

Save timestamp to current script context.

Parameters

Param name	Param type	Definition	Possible values	Comments
datetime_format	{boolean}	N/A	True for datetime format, False for Unix	Default is False (optional)
timezone	Parameter not supported anymore
new_timestamp	{long}	Timestamp to save to context	N/A	Timestamp will default to Unix timestamp of calling the method

Returns

NoneType

Example

from SiemplifyAction import SiemplifyAction
sa = SiemplifyAction()
sa.save_timestamp(self, datetime_format=False, new_timestamp=SiemplifyUtils.unix_now())

Result behavior

New timestamp will be saved as TIMESTAMP file in the current directory.

Result value

None

set_alert_context_property

set_alert_context_property(property_key, property_value)

Set an alert context property by key and value pairs.

Parameters

Param name	Param type	Definition	Possible values	Comments
property_key	{string}	Key of the property to store to context	N/A	N/A
property_value	{string}	Value of the property to store to context	N/A	N/A

set_alert_sla

set_alert_sla(period_time, period_type, critical_period_time, critical_period_type, case_id=None, alert_id=None)

Sets the SLA of the given alert_identifier of case_id. SLA being set using this API should surpass all other alert SLA types.

Parameters

Param name	Param type	Definition	Possible values	Comments
period_time	{int/str}	The total SLA period	N/A	period_time > 0
period_type	{string}	Time units of period_time, represented by ApiPeriodTypeEnum	N/A	N/A
critical_period_time	{int/str}	The critical SLA period	N/A	critical_period_time >= 0 Critical period (after scaling with its time units) should be smaller than the total period.
critical_period_type	{string}	the time units of critical_period_time, represented by ApiPeriodTypeEnum
case_id	{long}	Case identifier	234	N/A
alert_id	{string}	Alert identifier	12345	N/A

set_case_context_property

set_case_context_property(property_key, property_value)

Set a case context property using the key value pair.

Parameters

Param name	Param type	Definition	Possible values	Comments
property_key	{string}	Key of the property	N/A	N/A
property_value	{string}	Value of the property	N/A	N/A

set_case_sla

set_case_sla(period_time, period_type, critical_period_time, critical_period_type, case_id=None)

Sets the SLA of the given case_id if given, otherwise sets the SLA of the current case. SLA being set using this API should surpass all other case SLA types.

Parameters

Param name	Param type	Definition	Possible values	Comments
period_time	{int/str}	The total SLA period	N/A	period_time > 0
period_type	{string}	Time units of period_time, represented by ApiPeriodTypeEnum	N/A	N/A
critical_period_time	{int/str}	The critical SLA period	N/A	critical_period_time >0 Critical period (after scaling with its time units) should be smaller than the total period.
critical_period_type	{string}	the time units of critical_period_time, represented by ApiPeriodTypeEnum	N/A	N/A
case_id	{long}	Case identifier	N/A	N/A

signal_handler

signal_handler(sig, frame)

property target_entities

try_set_alert_context_property

try_set_alert_context_property(property_key, property_value)

try_set_case_context_property

try_set_case_context_property(property_key, property_value)

update_alerts_additional_data

update_alerts_additional_data(alerts_additional_data, case_id=None)

Update alerts additional data.

Parameters

Param name	Param type	Definition	Possible values	Comments
case_id	{string}	Case identifier	234	N/A
alerts_additional_data	{string:string}	N/A	N/A	N/A

Returns

NoneType

Example

from SiemplifyAction import SiemplifyAction
siemplify = SiemplifyAction()
additional_data = {"testKey":"testValue"}
siemplify.update_alerts_additional_data(alerts_additional_data=additional_data, case_id=caseid)

Result behavior

Updates the alert with additional data i.e. testKey:testValue.

Result value

None

SiemplifyAction module

class SiemplifyAction.SiemplifyAction

add_alert_entities_to_custom_list

Parameters

Returns

Example

Result behavior

Result value

add_attachment

Parameters

Returns

Example

Result behavior

Result value

add_comment

Parameters

Returns

Example

Result behavior

Result value

add_entity_insight

Parameters

Returns

Example

Result behavior

Result value

add_entity_to_case

Parameters

Returns

Example

Result behavior

Result value

add_tag

Parameters

Returns

Example

Result behavior

Result value

any_alert_entities_in_custom_list

Parameters

Returns

Example 1

Example 2

Result behavior

Result value

assign_case

Parameters

Returns

Example

Result behavior

Result value

attach_workflow_to_case

Parameters

Returns

Example

Result behavior

Result value

property case

change_case_priority

Parameters

Returns

Example

Result behavior

Result value

change_case_stage

Parameters

Returns

Example

Result behavior

Result value

close_alert

Parameters

Returns

Example

Result behavior

Result value

close_case

Parameters

Returns

Example

class `SiemplifyAction.SiemplifyAction`