{"action":"created","comment":{"url":"https://api.github.com/repos/demisto/content/pulls/comments/183243418","pull_request_review_id":114207532,"id":183243418,"diff_hunk":"@@ -0,0 +1,110 @@\n+commonfields:\n+  id: IndicatorMaliciousRatioCalculation\n+  version: -1\n+name: IndicatorMaliciousRatioCalculation\n+script: |-\n+  import json, hashlib\n+\n+  APPEARS_IN_MIN_NUMBER_OF_INCIDENTS = int(demisto.args()['appearsInMinNumberOfIncidents'])\n+  MAX_INCIDENTS = int(demisto.args()['maxIncidents'])\n+  MAX_INDICATORS = int(demisto.args()['maxIndicators'])\n+  QUERY = demisto.args()['query']\n+\n+  def get_incident_labels_map(labels):\n+      if labels is None:\n+          return {}\n+      labels_map = {}\n+\n+      for label in labels:\n+          label_type = label['type'].lower()\n+          labels_map[label_type] = label['value']\n+      return labels_map\n+\n+  def hash_object(str_list_dict):\n+      if str_list_dict == \"\" or str_list_dict is None:\n+          return str_list_dict\n+      if (type(str_list_dict)) == dict:\n+          return dict(map(lambda (k, v): (k, hash_object(v)), str_list_dict.iteritems()))\n+      if (type(str_list_dict) == list):\n+          return map(lambda x: hash_object(x), str_list_dict)\n+\n+      if (type(str_list_dict) in [str, unicode]):\n+          str_value = str_list_dict.encode('utf-8')\n+      else:\n+          str_value = str(str_list_dict)\n+      return hashlib.md5(str_value).hexdigest()\n+\n+  def get_indiator_data(indicator):\n+      return {k: v for k,v in indicator.items() if k in ['indicator_type', 'firstSeen', 'lastSeen', 'investigationIDs', 'manualScore', 'id', 'score', 'value']}\n+\n+  def get_incident_data(incident):\n+      result = {k: v for k,v in incident.items() if k in ['id', 'type', 'occurred', 'CustomFields', 'labels']}\n+      result['labels'] = hash_object(get_incident_labels_map(result.get('labels')))\n+      result['CustomFields'] = hash_object(result.get('CustomFields'))\n+      return result\n+\n+\n+  res = demisto.executeCommand(\"findIndicators\", {'query': QUERY, 'size': MAX_INDICATORS})\n+  indicators = res[0]['Contents']\n+  indicators_result = map(get_indiator_data, indicators)\n+  res = demisto.executeCommand(\"getIncidents\", {'query': QUERY.replace('incident.', ''), 'size': MAX_INCIDENTS})","path":"Scripts/script-IndicatorMaliciousRatioCalculation.yml","position":50,"original_position":50,"commit_id":"86cc12bf9dea4ff82a9c4116059e4b04ebd2f264","original_commit_id":"86cc12bf9dea4ff82a9c4116059e4b04ebd2f264","user":{"login":"meirwah","id":6059211,"avatar_url":"https://avatars0.githubusercontent.com/u/6059211?v=4","gravatar_id":"","url":"https://api.github.com/users/meirwah","html_url":"https://github.com/meirwah","followers_url":"https://api.github.com/users/meirwah/followers","following_url":"https://api.github.com/users/meirwah/following{/other_user}","gists_url":"https://api.github.com/users/meirwah/gists{/gist_id}","starred_url":"https://api.github.com/users/meirwah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/meirwah/subscriptions","organizations_url":"https://api.github.com/users/meirwah/orgs","repos_url":"https://api.github.com/users/meirwah/repos","events_url":"https://api.github.com/users/meirwah/events{/privacy}","received_events_url":"https://api.github.com/users/meirwah/received_events","type":"User","site_admin":false},"body":"better to query all incidents that have the indicators ids found in indicators_result\r\nMore efficient and correct","created_at":"2018-04-22T16:53:46Z","updated_at":"2018-04-22T16:57:13Z","html_url":"https://github.com/demisto/content/pull/1497#discussion_r183243418","pull_request_url":"https://api.github.com/repos/demisto/content/pulls/1497","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/demisto/content/pulls/comments/183243418"},"html":{"href":"https://github.com/demisto/content/pull/1497#discussion_r183243418"},"pull_request":{"href":"https://api.github.com/repos/demisto/content/pulls/1497"}}},"pull_request":{"url":"https://api.github.com/repos/demisto/content/pulls/1497","id":183282402,"html_url":"https://github.com/demisto/content/pull/1497","diff_url":"https://github.com/demisto/content/pull/1497.diff","patch_url":"https://github.com/demisto/content/pull/1497.patch","issue_url":"https://api.github.com/repos/demisto/content/issues/1497","number":1497,"state":"open","locked":false,"title":"add MRation script","user":{"login":"erezh31","id":12199595,"avatar_url":"https://avatars3.githubusercontent.com/u/12199595?v=4","gravatar_id":"","url":"https://api.github.com/users/erezh31","html_url":"https://github.com/erezh31","followers_url":"https://api.github.com/users/erezh31/followers","following_url":"https://api.github.com/users/erezh31/following{/other_user}","gists_url":"https://api.github.com/users/erezh31/gists{/gist_id}","starred_url":"https://api.github.com/users/erezh31/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erezh31/subscriptions","organizations_url":"https://api.github.com/users/erezh31/orgs","repos_url":"https://api.github.com/users/erezh31/repos","events_url":"https://api.github.com/users/erezh31/events{/privacy}","received_events_url":"https://api.github.com/users/erezh31/received_events","type":"User","site_admin":false},"body":"","created_at":"2018-04-22T16:46:51Z","updated_at":"2018-04-22T16:57:13Z","closed_at":null,"merged_at":null,"merge_commit_sha":"b0d68849238c0c9f909dfb74fbc3651c57e935fb","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/demisto/content/pulls/1497/commits","review_comments_url":"https://api.github.com/repos/demisto/content/pulls/1497/comments","review_comment_url":"https://api.github.com/repos/demisto/content/pulls/comments{/number}","comments_url":"https://api.github.com/repos/demisto/content/issues/1497/comments","statuses_url":"https://api.github.com/repos/demisto/content/statuses/86cc12bf9dea4ff82a9c4116059e4b04ebd2f264","head":{"label":"demisto:MRatioScript","ref":"MRatioScript","sha":"86cc12bf9dea4ff82a9c4116059e4b04ebd2f264","user":{"login":"demisto","id":11011767,"avatar_url":"https://avatars1.githubusercontent.com/u/11011767?v=4","gravatar_id":"","url":"https://api.github.com/users/demisto","html_url":"https://github.com/demisto","followers_url":"https://api.github.com/users/demisto/followers","following_url":"https://api.github.com/users/demisto/following{/other_user}","gists_url":"https://api.github.com/users/demisto/gists{/gist_id}","starred_url":"https://api.github.com/users/demisto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/demisto/subscriptions","organizations_url":"https://api.github.com/users/demisto/orgs","repos_url":"https://api.github.com/users/demisto/repos","events_url":"https://api.github.com/users/demisto/events{/privacy}","received_events_url":"https://api.github.com/users/demisto/received_events","type":"Organization","site_admin":false},"repo":{"id":60525392,"name":"content","full_name":"demisto/content","owner":{"login":"demisto","id":11011767,"avatar_url":"https://avatars1.githubusercontent.com/u/11011767?v=4","gravatar_id":"","url":"https://api.github.com/users/demisto","html_url":"https://github.com/demisto","followers_url":"https://api.github.com/users/demisto/followers","following_url":"https://api.github.com/users/demisto/following{/other_user}","gists_url":"https://api.github.com/users/demisto/gists{/gist_id}","starred_url":"https://api.github.com/users/demisto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/demisto/subscriptions","organizations_url":"https://api.github.com/users/demisto/orgs","repos_url":"https://api.github.com/users/demisto/repos","events_url":"https://api.github.com/users/demisto/events{/privacy}","received_events_url":"https://api.github.com/users/demisto/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/demisto/content","description":"This repository contains all Demisto content and from here we share content updates","fork":false,"url":"https://api.github.com/repos/demisto/content","forks_url":"https://api.github.com/repos/demisto/content/forks","keys_url":"https://api.github.com/repos/demisto/content/keys{/key_id}","collaborators_url":"https://api.github.com/repos/demisto/content/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/demisto/content/teams","hooks_url":"https://api.github.com/repos/demisto/content/hooks","issue_events_url":"https://api.github.com/repos/demisto/content/issues/events{/number}","events_url":"https://api.github.com/repos/demisto/content/events","assignees_url":"https://api.github.com/repos/demisto/content/assignees{/user}","branches_url":"https://api.github.com/repos/demisto/content/branches{/branch}","tags_url":"https://api.github.com/repos/demisto/content/tags","blobs_url":"https://api.github.com/repos/demisto/content/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/demisto/content/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/demisto/content/git/refs{/sha}","trees_url":"https://api.github.com/repos/demisto/content/git/trees{/sha}","statuses_url":"https://api.github.com/repos/demisto/content/statuses/{sha}","languages_url":"https://api.github.com/repos/demisto/content/languages","stargazers_url":"https://api.github.com/repos/demisto/content/stargazers","contributors_url":"https://api.github.com/repos/demisto/content/contributors","subscribers_url":"https://api.github.com/repos/demisto/content/subscribers","subscription_url":"https://api.github.com/repos/demisto/content/subscription","commits_url":"https://api.github.com/repos/demisto/content/commits{/sha}","git_commits_url":"https://api.github.com/repos/demisto/content/git/commits{/sha}","comments_url":"https://api.github.com/repos/demisto/content/comments{/number}","issue_comment_url":"https://api.github.com/repos/demisto/content/issues/comments{/number}","contents_url":"https://api.github.com/repos/demisto/content/contents/{+path}","compare_url":"https://api.github.com/repos/demisto/content/compare/{base}...{head}","merges_url":"https://api.github.com/repos/demisto/content/merges","archive_url":"https://api.github.com/repos/demisto/content/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/demisto/content/downloads","issues_url":"https://api.github.com/repos/demisto/content/issues{/number}","pulls_url":"https://api.github.com/repos/demisto/content/pulls{/number}","milestones_url":"https://api.github.com/repos/demisto/content/milestones{/number}","notifications_url":"https://api.github.com/repos/demisto/content/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/demisto/content/labels{/name}","releases_url":"https://api.github.com/repos/demisto/content/releases{/id}","deployments_url":"https://api.github.com/repos/demisto/content/deployments","created_at":"2016-06-06T12:17:02Z","updated_at":"2018-04-19T18:25:57Z","pushed_at":"2018-04-22T16:46:52Z","git_url":"git://github.com/demisto/content.git","ssh_url":"git@github.com:demisto/content.git","clone_url":"https://github.com/demisto/content.git","svn_url":"https://github.com/demisto/content","homepage":"","size":20660,"stargazers_count":132,"watchers_count":132,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":51,"mirror_url":null,"archived":false,"open_issues_count":27,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit"},"forks":51,"open_issues":27,"watchers":132,"default_branch":"master"}},"base":{"label":"demisto:master","ref":"master","sha":"d0792a7d28215723ac5197598600fdcac35b8646","user":{"login":"demisto","id":11011767,"avatar_url":"https://avatars1.githubusercontent.com/u/11011767?v=4","gravatar_id":"","url":"https://api.github.com/users/demisto","html_url":"https://github.com/demisto","followers_url":"https://api.github.com/users/demisto/followers","following_url":"https://api.github.com/users/demisto/following{/other_user}","gists_url":"https://api.github.com/users/demisto/gists{/gist_id}","starred_url":"https://api.github.com/users/demisto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/demisto/subscriptions","organizations_url":"https://api.github.com/users/demisto/orgs","repos_url":"https://api.github.com/users/demisto/repos","events_url":"https://api.github.com/users/demisto/events{/privacy}","received_events_url":"https://api.github.com/users/demisto/received_events","type":"Organization","site_admin":false},"repo":{"id":60525392,"name":"content","full_name":"demisto/content","owner":{"login":"demisto","id":11011767,"avatar_url":"https://avatars1.githubusercontent.com/u/11011767?v=4","gravatar_id":"","url":"https://api.github.com/users/demisto","html_url":"https://github.com/demisto","followers_url":"https://api.github.com/users/demisto/followers","following_url":"https://api.github.com/users/demisto/following{/other_user}","gists_url":"https://api.github.com/users/demisto/gists{/gist_id}","starred_url":"https://api.github.com/users/demisto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/demisto/subscriptions","organizations_url":"https://api.github.com/users/demisto/orgs","repos_url":"https://api.github.com/users/demisto/repos","events_url":"https://api.github.com/users/demisto/events{/privacy}","received_events_url":"https://api.github.com/users/demisto/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/demisto/content","description":"This repository contains all Demisto content and from here we share content updates","fork":false,"url":"https://api.github.com/repos/demisto/content","forks_url":"https://api.github.com/repos/demisto/content/forks","keys_url":"https://api.github.com/repos/demisto/content/keys{/key_id}","collaborators_url":"https://api.github.com/repos/demisto/content/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/demisto/content/teams","hooks_url":"https://api.github.com/repos/demisto/content/hooks","issue_events_url":"https://api.github.com/repos/demisto/content/issues/events{/number}","events_url":"https://api.github.com/repos/demisto/content/events","assignees_url":"https://api.github.com/repos/demisto/content/assignees{/user}","branches_url":"https://api.github.com/repos/demisto/content/branches{/branch}","tags_url":"https://api.github.com/repos/demisto/content/tags","blobs_url":"https://api.github.com/repos/demisto/content/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/demisto/content/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/demisto/content/git/refs{/sha}","trees_url":"https://api.github.com/repos/demisto/content/git/trees{/sha}","statuses_url":"https://api.github.com/repos/demisto/content/statuses/{sha}","languages_url":"https://api.github.com/repos/demisto/content/languages","stargazers_url":"https://api.github.com/repos/demisto/content/stargazers","contributors_url":"https://api.github.com/repos/demisto/content/contributors","subscribers_url":"https://api.github.com/repos/demisto/content/subscribers","subscription_url":"https://api.github.com/repos/demisto/content/subscription","commits_url":"https://api.github.com/repos/demisto/content/commits{/sha}","git_commits_url":"https://api.github.com/repos/demisto/content/git/commits{/sha}","comments_url":"https://api.github.com/repos/demisto/content/comments{/number}","issue_comment_url":"https://api.github.com/repos/demisto/content/issues/comments{/number}","contents_url":"https://api.github.com/repos/demisto/content/contents/{+path}","compare_url":"https://api.github.com/repos/demisto/content/compare/{base}...{head}","merges_url":"https://api.github.com/repos/demisto/content/merges","archive_url":"https://api.github.com/repos/demisto/content/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/demisto/content/downloads","issues_url":"https://api.github.com/repos/demisto/content/issues{/number}","pulls_url":"https://api.github.com/repos/demisto/content/pulls{/number}","milestones_url":"https://api.github.com/repos/demisto/content/milestones{/number}","notifications_url":"https://api.github.com/repos/demisto/content/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/demisto/content/labels{/name}","releases_url":"https://api.github.com/repos/demisto/content/releases{/id}","deployments_url":"https://api.github.com/repos/demisto/content/deployments","created_at":"2016-06-06T12:17:02Z","updated_at":"2018-04-19T18:25:57Z","pushed_at":"2018-04-22T16:46:52Z","git_url":"git://github.com/demisto/content.git","ssh_url":"git@github.com:demisto/content.git","clone_url":"https://github.com/demisto/content.git","svn_url":"https://github.com/demisto/content","homepage":"","size":20660,"stargazers_count":132,"watchers_count":132,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":51,"mirror_url":null,"archived":false,"open_issues_count":27,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit"},"forks":51,"open_issues":27,"watchers":132,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/demisto/content/pulls/1497"},"html":{"href":"https://github.com/demisto/content/pull/1497"},"issue":{"href":"https://api.github.com/repos/demisto/content/issues/1497"},"comments":{"href":"https://api.github.com/repos/demisto/content/issues/1497/comments"},"review_comments":{"href":"https://api.github.com/repos/demisto/content/pulls/1497/comments"},"review_comment":{"href":"https://api.github.com/repos/demisto/content/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/demisto/content/pulls/1497/commits"},"statuses":{"href":"https://api.github.com/repos/demisto/content/statuses/86cc12bf9dea4ff82a9c4116059e4b04ebd2f264"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"meirwah"}}