​Hello all - In Circuits (Action Script) it is a well-supported process to resolve the enumerated value of Select/Multi-Select fields and Activity Fields etc, to get a displayable label.

For the first time I am trying to do the same thing for Artifact type and don't seem to be able to find how this is supported in the Python library.

Maybe I'm overlooking something obvious but would some kind person please point me in the right direction?

Best regards - Edwin Bolton

------------------------------
Edwin Bolton
------------------------------

I'm confused by what you are asking. Artifacts can only be of type string?

Can you explain what you mean by this? Perhaps with code?
      "it is a well-supported process to resolve the enumerated value of Select/Multi-Select fields and Activity Fields etc, to get a displayable label."

------------------------------
Jared Fagel
Cyber Security Analyst Intern
Public Utility
------------------------------

Hi, Jared - I have found that Resilient stores Select and Multiselect fields as an integer or set of integers which then need to be looked up to recover the displayable (text) label.  This is known as enumeration.

The same thing appears to be true for Artifacts.  I have written a little Python code to run in Circuits, initiated when an Ar​tifact is added to or removed from an Incident.  The attached screen capture shows the Table of other Incidents related to the current one and at the right I attempt to show the Artifact(s) as Label: Value that relate this Incident to the currently viewed one.

However the Label is 1 which I believe corresponds to IP Address and IIRC 27 equates to Port.

My code fragment shows how these are obtained from Resilient.

I am trying to find where the 'key' to this enumeration may be found so that I can convert the integers returned in the 'type' as displayable labels.  Equivalent keys for all the regular Select/Multiselect fields in Resilient Incidents are readily available so that is why I state that it is a well-established process to look up this enumerated 'type' to recover the displayable label.  I am sure you must have done this dozens of times, as I have.

Thanks and regards - Edwin Bolton

------------------------------
Edwin Bolton
------------------------------

Original Message:
Sent: 03-01-2019 04:12 PM
From: Jared Fagel
Subject: Artifact 'type' - resolving enumerated value to label

I'm confused by what you are asking. Artifacts can only be of type string?

Can you explain what you mean by this? Perhaps with code?
      "it is a well-supported process to resolve the enumerated value of Select/Multi-Select fields and Activity Fields etc, to get a displayable label."

------------------------------
Jared Fagel
Cyber Security Analyst Intern
Public Utility
------------------------------

Oh! Apparently '.py' is not an acceptable file type to upload - here it is in txt form...​

------------------------------
Edwin Bolton
------------------------------

Original Message:
Sent: 03-04-2019 04:37 AM
From: Edwin Bolton
Subject: Artifact 'type' - resolving enumerated value to label

Hi, Jared - I have found that Resilient stores Select and Multiselect fields as an integer or set of integers which then need to be looked up to recover the displayable (text) label.  This is known as enumeration.

The same thing appears to be true for Artifacts.  I have written a little Python code to run in Circuits, initiated when an Ar​tifact is added to or removed from an Incident.  The attached screen capture shows the Table of other Incidents related to the current one and at the right I attempt to show the Artifact(s) as Label: Value that relate this Incident to the currently viewed one.

However the Label is 1 which I believe corresponds to IP Address and IIRC 27 equates to Port.

My code fragment shows how these are obtained from Resilient.

I am trying to find where the 'key' to this enumeration may be found so that I can convert the integers returned in the 'type' as displayable labels.  Equivalent keys for all the regular Select/Multiselect fields in Resilient Incidents are readily available so that is why I state that it is a well-established process to look up this enumerated 'type' to recover the displayable label.  I am sure you must have done this dozens of times, as I have.

Thanks and regards - Edwin Bolton

------------------------------
Edwin Bolton
------------------------------


Original Message:
Sent: 03-01-2019 04:12 PM
From: Jared Fagel
Subject: Artifact 'type' - resolving enumerated value to label

I'm confused by what you are asking. Artifacts can only be of type string?

Can you explain what you mean by this? Perhaps with code?
      "it is a well-supported process to resolve the enumerated value of Select/Multi-Select fields and Activity Fields etc, to get a displayable label."

------------------------------
Jared Fagel
Cyber Security Analyst Intern
Public Utility

Hi Edwin,
To get artifacts type id and name mapping, you can use:
self.rest_client().get("/types/artifact/fields/type")
or
self.rest_client().get("/types/artifact_types")

If you only need to add the artifact type's name in your datatable, you can add "?handle_format=names" in the GET request which returns the lable instead of id. For example:
this_incident = self.rest_client().get("/incidents/{}?handle_format=names".format(this_ticket["id"]))

------------------------------
LILY WANG
------------------------------

Original Message:
Sent: 03-04-2019 04:44 AM
From: Edwin Bolton
Subject: Artifact 'type' - resolving enumerated value to label

Oh! Apparently '.py' is not an acceptable file type to upload - here it is in txt form...​

------------------------------
Edwin Bolton
------------------------------


Original Message:
Sent: 03-04-2019 04:37 AM
From: Edwin Bolton
Subject: Artifact 'type' - resolving enumerated value to label

Hi, Jared - I have found that Resilient stores Select and Multiselect fields as an integer or set of integers which then need to be looked up to recover the displayable (text) label.  This is known as enumeration.

The same thing appears to be true for Artifacts.  I have written a little Python code to run in Circuits, initiated when an Ar​tifact is added to or removed from an Incident.  The attached screen capture shows the Table of other Incidents related to the current one and at the right I attempt to show the Artifact(s) as Label: Value that relate this Incident to the currently viewed one.

However the Label is 1 which I believe corresponds to IP Address and IIRC 27 equates to Port.

My code fragment shows how these are obtained from Resilient.

I am trying to find where the 'key' to this enumeration may be found so that I can convert the integers returned in the 'type' as displayable labels.  Equivalent keys for all the regular Select/Multiselect fields in Resilient Incidents are readily available so that is why I state that it is a well-established process to look up this enumerated 'type' to recover the displayable label.  I am sure you must have done this dozens of times, as I have.

Thanks and regards - Edwin Bolton

------------------------------
Edwin Bolton


Original Message:
Sent: 03-01-2019 04:12 PM
From: Jared Fagel
Subject: Artifact 'type' - resolving enumerated value to label

I'm confused by what you are asking. Artifacts can only be of type string?

Can you explain what you mean by this? Perhaps with code?
      "it is a well-supported process to resolve the enumerated value of Select/Multi-Select fields and Activity Fields etc, to get a displayable label."

------------------------------
Jared Fagel
Cyber Security Analyst Intern
Public Utility

Hi, Lily and many thanks for such a comprehensive reply.  I have to confess I had not explored the request parameters thoroughly, so did not realise the significance of 'handle_format'.  It did the job for me in a few seconds.

I will review these parameters to see which are also significant for other purposes.

Best regards - Edwin​

------------------------------
Edwin Bolton
------------------------------

Original Message:
Sent: 03-04-2019 11:01 PM
From: LILY WANG
Subject: Artifact 'type' - resolving enumerated value to label

Hi Edwin,
To get artifacts type id and name mapping, you can use:
self.rest_client().get("/types/artifact/fields/type")
or
self.rest_client().get("/types/artifact_types")

If you only need to add the artifact type's name in your datatable, you can add "?handle_format=names" in the GET request which returns the lable instead of id. For example:
this_incident = self.rest_client().get("/incidents/{}?handle_format=names".format(this_ticket["id"]))

------------------------------
LILY WANG
------------------------------


Original Message:
Sent: 03-04-2019 04:44 AM
From: Edwin Bolton
Subject: Artifact 'type' - resolving enumerated value to label

Oh! Apparently '.py' is not an acceptable file type to upload - here it is in txt form...​

------------------------------
Edwin Bolton


Original Message:
Sent: 03-04-2019 04:37 AM
From: Edwin Bolton
Subject: Artifact 'type' - resolving enumerated value to label

Hi, Jared - I have found that Resilient stores Select and Multiselect fields as an integer or set of integers which then need to be looked up to recover the displayable (text) label.  This is known as enumeration.

The same thing appears to be true for Artifacts.  I have written a little Python code to run in Circuits, initiated when an Ar​tifact is added to or removed from an Incident.  The attached screen capture shows the Table of other Incidents related to the current one and at the right I attempt to show the Artifact(s) as Label: Value that relate this Incident to the currently viewed one.

However the Label is 1 which I believe corresponds to IP Address and IIRC 27 equates to Port.

My code fragment shows how these are obtained from Resilient.

I am trying to find where the 'key' to this enumeration may be found so that I can convert the integers returned in the 'type' as displayable labels.  Equivalent keys for all the regular Select/Multiselect fields in Resilient Incidents are readily available so that is why I state that it is a well-established process to look up this enumerated 'type' to recover the displayable label.  I am sure you must have done this dozens of times, as I have.

Thanks and regards - Edwin Bolton

------------------------------
Edwin Bolton


Original Message:
Sent: 03-01-2019 04:12 PM
From: Jared Fagel
Subject: Artifact 'type' - resolving enumerated value to label

I'm confused by what you are asking. Artifacts can only be of type string?

Can you explain what you mean by this? Perhaps with code?
      "it is a well-supported process to resolve the enumerated value of Select/Multi-Select fields and Activity Fields etc, to get a displayable label."

------------------------------
Jared Fagel
Cyber Security Analyst Intern
Public Utility