""" This Python script is used to programmatically delete incidents in batches of 100. The user must also have enabled Incident Deletion via the UI in Administrator Settings -> Organization -> Settings -> Incident Deletion HOW TO USE: The basic command to run the deleteincidents.py script must include user credentials with permission to delete the intended incidents. For example, a Master Admin has permission to delete all incidents, so when this script is run with Master Admin credentials all incidents will be deleted. The usage structure for the command is as follows: usage (to be run via the command line): python deleteincidents.py [-h] --email EMAIL [--password PASSWORD] --host HOST [--port PORT] [--proxy [PROXY [PROXY ...]]] [--org ORG] [--cafile CAFILE] [--noverify] arguments: -h, --help show this help message and exit --email EMAIL The email address to use to authenticate to the Resilient server. --password PASSWORD WARNING: This is an insecure option since the password will be visible to other processes and stored in the command history. The password to use to authenticate to the Resilient server. If omitted, the you will be prompted. --host HOST Resilient server host name. --port PORT Resilient server REST API port number. --proxy [PROXY [PROXY ...]] An optional HTTP proxy to use when connecting. --org ORG The name of the organization to delete incidents from. --cafile CAFILE The name of a file that contains trusted certificates. --noverify Do not worry about verifying server certificates This script can be run from any location that can connect to the Resilient instance the user would like to delete incidents from. """ ##Sample code only for reference from __future__ import print_function import co3 class ArgumentParser(co3.ArgumentParser): def __init__(self): super(ArgumentParser, self).__init__() self.add_argument("--noverify", dest='verify', action='store_false', help='Do not worry about verifying server certificates') self.set_defaults(verify=True) # Parse arguments parser = ArgumentParser() opts = parser.parse_args() # Create SimpleClient and connect verify = opts.cafile or opts.verify url = 'https://{0}:{1}'.format(opts.host, opts.port) client = co3.SimpleClient(org_name=opts.org, proxies=opts.proxy, base_url=url, verify=verify) client.connect(opts.email, opts.password) # Query to get the next 100 incidents query = { 'length': 100, 'recordsTotal': 0, 'start': 0 } while True: # Gets a paged query page = client.post("/incidents/query_paged", query) # If there are no incidents left, break out of the while loop if len(page["data"]) == 0: break # Creates a list of the incident ID's using dict comprehension inc_ids = [incident["id"] for incident in page["data"]] # Batch delete client.put("/incidents/delete", inc_ids) # Print out the ids of the incidents deleted print("Deleted the following incidents:\n", inc_ids) # Print out a confirmation message when done print("Finished deleting incidents!")