Axur Credentials Feed - ServiceNow

var AxurCredentialFeedMapper = {
    TABLE: 'incident',
    CREDENTIALS_URL: 'https://one.axur.com/data-leakage/credentials',
    SHORT_DESCRIPTION_LIMIT: 160,
    WORKSPACE: 'Data Leakage',

    TYPE_LABELS: {
        'employee': 'Employee',
        'user':     'User'
    },

    buildFields: function (item) {
        var id = item.id;
        var customer = item.customer || '';
        var user = item.user || '';
        var accessUrl = item['access.url'] || '';
        var typeLabel = this.typeLabel(item['credential.types'] || []);

        var prefix = this.WORKSPACE + ' - ' + typeLabel + ' credential exposed - ' + customer + ' - ';
        var target = accessUrl ? user + ' @ ' + accessUrl : user;
        var shortDescription = prefix + this.fit(target, prefix.length);

        var link = this.CREDENTIALS_URL + '?customerId=' + encodeURIComponent(customer)
            + '&text=' + encodeURIComponent(id);

        var description = [
            'Axur - one.axur.com',
            '',
            'New credential exposure detected (' + link + ')',
            '',
            'Detection ID: ' + id,
            this.assetsLine(item.assets || []),
            'Credential Type: ' + typeLabel,
            'User: ' + user + (item['user.type'] ? ' (' + item['user.type'] + ')' : ''),
            'Access URL: ' + accessUrl,
            'Source: ' + (item['source.name'] || ''),
            'Status: ' + (item.status || ''),
            'Detection Date: ' + this.formatDate(item.detectionDate || item.created)
        ].join('\n');

        return { id: id, shortDescription: shortDescription, description: description };
    },

    typeLabel: function (types) {
        var labels = [];
        for (var i = 0; i < types.length; i++) {
            labels.push(this.TYPE_LABELS[types[i]] || types[i]);
        }
        return labels.length ? labels.join(' and ') : 'Unknown';
    },

    fit: function (text, usedLength) {
        var available = this.SHORT_DESCRIPTION_LIMIT - usedLength;
        if (text.length <= available) return text;
        return text.substring(0, Math.max(available - 3, 0)) + '...';
    },

    assetsLine: function (assets) {
        if (assets.length === 0) return 'Asset: -';
        return assets.length === 1 ? 'Asset: ' + assets[0] : 'Assets: (' + assets.join(', ') + ')';
    },

    formatDate: function (iso) {
        if (!iso) return '';
        return iso.substring(8, 10) + '/' + iso.substring(5, 7) + '/' + iso.substring(0, 4);
    },

    upsert: function (item) {
        var f = this.buildFields(item);
        if (!f.id) return;

        var gr = new GlideRecord(this.TABLE);
        gr.addQuery('correlation_id', f.id);
        gr.query();
        var exists = gr.next();
        if (!exists) {
            gr.initialize();
            gr.state = 1;
        }
        gr.correlation_id = f.id;
        gr.correlation_display = f.id;
        gr.short_description = f.shortDescription;
        gr.description = f.description;
        if (exists) { gr.update(); } else { gr.insert(); }
    },

    processPayload: function (payload) {
        var detections = (payload && payload.collectionData && payload.collectionData.detections) || [];
        for (var i = 0; i < detections.length; i++) {
            this.upsert(detections[i]);
        }
        return detections.length;
    }
};

var FEED_URL = gs.getProperty('axur.credentials_feed.url');
var API_KEY = gs.getProperty('axur.feed.api_key');
var MAX_PAGES = 20;

for (var page = 0; page < MAX_PAGES; page++) {
    var request = new sn_ws.RESTMessageV2();
    request.setEndpoint(FEED_URL);
    request.setHttpMethod('GET');
    request.setRequestHeader('Authorization', 'Bearer ' + API_KEY);
    request.setRequestHeader('Accept', 'application/json');

    var response = request.execute();
    if (response.getStatusCode() != 200) {
        gs.error('Axur credentials feed: HTTP ' + response.getStatusCode() + ' - ' + response.getBody());
        break;
    }

    var processed = AxurCredentialFeedMapper.processPayload(JSON.parse(response.getBody()));
    if (processed === 0 || FEED_URL.indexOf('dry-run=true') > -1) break;
}

(function process(request, response) {
    var processed = AxurCredentialFeedMapper.processPayload(request.body.data);
    response.setStatus(200);
    response.setBody({ processed: processed });
})(request, response);