fix(sentinelone): accept a skipped UAM update when the alert is already set (1.17.3)
The console skips an alert already in the requested state, and 1.17.2 failed every skip: re-assigning an alert to its current holder, as a second run of the same playbook does, broke the block. A skipped alert is now read back. Already assigned to that user, or already carrying that status or verdict, the block succeeds with already_assigned / already_set; otherwise it fails naming the state the console holds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013u8PFdkYuuPiC6JdZBV5x3
This commit is contained in:
@@ -79,11 +79,15 @@ def main():
|
||||
sys.exit(1)
|
||||
result = resp.get("data") or {}
|
||||
|
||||
# A refused or skipped alert comes back in the payload, not in errors.
|
||||
# A refused alert comes back in the payload, not in errors. A skipped one is
|
||||
# what the console answers for an alert already assigned to that user — a
|
||||
# second run of the same playbook — so it is settled by the read-back below
|
||||
# rather than failed outright.
|
||||
triggered = (result.get("alertTriggerActions") or {}).get("actions") or []
|
||||
failures = [f for a in triggered for f in (a.get("failure") or [])]
|
||||
skipped = [s for a in triggered for s in (a.get("skip") or [])]
|
||||
if failures or skipped or not any(a.get("success") for a in triggered):
|
||||
succeeded = any(a.get("success") for a in triggered)
|
||||
if failures or not (succeeded or skipped):
|
||||
print(json.dumps({"error": "The console did not assign the alert",
|
||||
"failure": failures, "skip": skipped, "result": result}))
|
||||
sys.exit(1)
|
||||
@@ -101,13 +105,15 @@ def main():
|
||||
if str((assignee or {}).get("userId") or "") == user_id:
|
||||
break
|
||||
else:
|
||||
said = "reported success" if succeeded else "skipped the alert"
|
||||
print(json.dumps({
|
||||
"error": "The console reported success but the alert is not assigned to "
|
||||
"error": "The console " + said + " but the alert is not assigned to "
|
||||
+ user_id + " — check that this id is the console user's (assignee.userId)",
|
||||
"assignee_now": assignee, "result": result}))
|
||||
sys.exit(1)
|
||||
|
||||
print(json.dumps({"alert_id": alert_id, "assignee_user_id": user_id,
|
||||
"already_assigned": not succeeded,
|
||||
"assignee": assignee, "result": result}))
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user