I am trying to create a job that helps me get all alerts from a specific product (Cortex XDR, for example) that were closed recently. This is what I have for the moment:
from SiemplifyJob import SiemplifyJob
from SiemplifyUtils import convert_datetime_to_unix_time
from datetime import datetime, timedelta
def main():
siemplify = SiemplifyJob()
# Get alerts closed modified in the last X hours
hours = 1
threshold_time = datetime.utcnow() - timedelta(hours=hours)
threshold_timestamp = convert_datetime_to_unix_time(threshold_time)
recent_alerts = []
case_ids = siemplify.get_cases_ids_by_filter(
status="CLOSE",
update_time_from_unix_time_in_ms=threshold_timestamp,
sort_by="UPDATE_TIME",
sort_order="DESC",
max_results=1000
)
for case_id in case_ids:
case = siemplify._get_case_by_id(case_id)
for alert in case.get("cyber_alerts", []):
product = alert.get("additional_properties", {}).get("DeviceProduct")
mod_time = alert.get("modification_time")
if product == "Cortex XDR" and mod_time and mod_time > threshold_timestamp:
recent_alerts.append(alert)
siemplify.LOGGER.info(f"Found {len(recent_alerts)} closed Cortex XDR alerts recently modified.")
if __name__ == "__main__":
main()This code, however, only gets the alerts where the Device Product is "Cortex XDR" from the cases closed recently, and doesn't include the closed alerts from cases that are still open. I want to get all closed alerts that were recently closed (defined by the hours variable), both the ones in an open or closed cases.
Is there any possible way to do this?
Any suggestions or best practices would be appreciated!
