@@ -473,6 +473,19 @@ def severity_to_level(severity):
473473 return 0
474474
475475
476+ def severity_filter (min_severity ):
477+ """
478+ Create Severity Filter when min_severity >= Low.
479+ """
480+ severity_levels = ["Low" , "Medium" , "High" ]
481+ severity_filter = ""
482+ if min_severity in severity_levels :
483+ min_level = severity_to_level (min_severity )
484+ conditions = [f"properties/severity eq '{ s } for s in severity_levels if severity_to_level (s ) >= min_level ]
485+ severity_filter = f"and ({ ' or ' .join (conditions ) }
486+ return severity_filter
487+
488+
476489def generic_list_incident_items (client , incident_id , items_kind , key_in_raw_result , outputs_prefix , xsoar_transformer ):
477490 """
478491 Get a list of incident's items
@@ -1312,7 +1325,7 @@ def fetch_incidents_additional_info(client: AzureSentinelClient, incidents: List
13121325 incident [info_type ] = client .http_request (method , f'incidents/{ incident_id } { info_type } ).get (results_key )
13131326
13141327
1315- def fetch_incidents (client : AzureSentinelClient , last_run : dict , first_fetch_time : str , min_severity : int ) -> tuple :
1328+ def fetch_incidents (client : AzureSentinelClient , last_run : dict , first_fetch_time : str , min_severity : str ) -> tuple :
13161329 """Fetching incidents.
13171330 Args:
13181331 first_fetch_time: The first fetch time.
@@ -1346,21 +1359,23 @@ def fetch_incidents(client: AzureSentinelClient, last_run: dict, first_fetch_tim
13461359
13471360 latest_created_time_str = latest_created_time .strftime (DATE_FORMAT )
13481361 command_args = {
1349- 'filter' : f'properties/createdTimeUtc ge { latest_created_time_str } ,
1362+ 'filter' : f'properties/createdTimeUtc ge { latest_created_time_str } { severity_filter ( min_severity ) } ,
13501363 'orderby' : 'properties/createdTimeUtc asc' ,
13511364 'limit' : limit
13521365 }
1366+ demisto .debug (f"Filter query used:{ command_args ['filter' ]} )
13531367
13541368 else :
13551369 demisto .debug ("last fetch time is empty, trying to fetch incidents by last incident id" )
13561370 latest_created_time = dateparser .parse (last_fetch_time )
13571371 if latest_created_time is None :
13581372 raise DemistoException (f"{ last_fetch_time = } )
13591373 command_args = {
1360- 'filter' : f'properties/incidentNumber gt { last_incident_number } ,
1374+ 'filter' : f'properties/incidentNumber gt { last_incident_number } { severity_filter ( min_severity ) } ,
13611375 'orderby' : 'properties/incidentNumber asc' ,
13621376 'limit' : limit
13631377 }
1378+ demisto .debug (f"Filter query used:{ command_args ['filter' ]} )
13641379
13651380 raw_incidents = list_incidents_command (client , command_args , is_fetch_incidents = True ).outputs
13661381 if isinstance (raw_incidents , dict ):
@@ -1371,14 +1386,14 @@ def fetch_incidents(client: AzureSentinelClient, last_run: dict, first_fetch_tim
13711386
13721387 fetch_incidents_additional_info (client , raw_incidents )
13731388
1374- return process_incidents (raw_incidents , min_severity ,
1389+ return process_incidents (raw_incidents ,
13751390 latest_created_time , last_incident_number ) # type: ignore[attr-defined]
13761391
13771392
13781393def fetch_incidents_command (client , params ):
13791394 # How much time before the first fetch to retrieve incidents
13801395 first_fetch_time = params .get ('fetch_time' , '3 days' ).strip ()
1381- min_severity = severity_to_level ( params .get ('min_severity' , 'Informational' ) )
1396+ min_severity = params .get ('min_severity' , 'Informational' )
13821397 # Set and define the fetch incidents command to run after activated via integration settings.
13831398 last_run = demisto .getLastRun ()
13841399 demisto .debug (f"Current last run is { last_run } )
@@ -1393,14 +1408,13 @@ def fetch_incidents_command(client, params):
13931408 demisto .incidents (incidents )
13941409
13951410
1396- def process_incidents (raw_incidents : list , min_severity : int , latest_created_time : datetime ,
1411+ def process_incidents (raw_incidents : list , latest_created_time : datetime ,
13971412 last_incident_number ):
13981413 """Processing the raw incidents
13991414 Args:
14001415 raw_incidents: The incidents that were fetched from the API.
14011416 last_incident_number: The last incident number that was fetched.
14021417 latest_created_time: The latest created time.
1403- min_severity: The minimum severity.
14041418
14051419 Returns:
14061420 A next_run dictionary, and an array of incidents.
@@ -1417,23 +1431,20 @@ def process_incidents(raw_incidents: list, min_severity: int, latest_created_tim
14171431
14181432 incident_created_time = dateparser .parse (incident .get ('CreatedTimeUTC' ))
14191433 current_fetch_ids .append (incident .get ('ID' ))
1420- if incident_severity >= min_severity :
1421- add_mirroring_fields (incident )
1422- xsoar_incident = {
1423- 'name' : '[Azure Sentinel] ' + incident .get ('Title' ),
1424- 'occurred' : incident .get ('CreatedTimeUTC' ),
1425- 'severity' : incident_severity ,
1426- 'rawJSON' : json .dumps (incident )
1427- }
1428- incidents .append (xsoar_incident )
1429- else :
1430- demisto .debug (f"drop creation of { incident .get ('IncidentNumber' )= }
1431- f"due to the { incident_severity = } { min_severity = } )
1434+ add_mirroring_fields (incident )
1435+ xsoar_incident = {
1436+ 'name' : '[Azure Sentinel] ' + incident .get ('Title' ),
1437+ 'occurred' : incident .get ('CreatedTimeUTC' ),
1438+ 'severity' : incident_severity ,
1439+ 'rawJSON' : json .dumps (incident )
1440+ }
14321441
14331442 # Update last run to the latest fetch time
14341443 if incident_created_time is None :
14351444 raise DemistoException (f"{ incident .get ('CreatedTimeUTC' )= } )
14361445
1446+ incidents .append (xsoar_incident )
1447+
14371448 if incident_created_time > latest_created_time :
14381449 latest_created_time = incident_created_time
14391450 if incident .get ('IncidentNumber' ) > last_incident_number :
0 commit comments