Added resume_case_alerts_sla to soar_api for Case Playbook support

packages/integration_testing/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "integration-testing"
-version = "2.3.5"
+version = "2.3.7"
 description = "Blackbox testing infrastructure to test and run marketplace integration scripts locally using mocks."
 readme = "README.md"
 authors = [
@@ -48,7 +48,7 @@ testpaths = [
 ]
 
 [tool.uv.sources]
-tipcommon = { path = "../tipcommon/whls/TIPCommon-2.3.5-py3-none-any.whl" }
+tipcommon = { path = "../tipcommon/whls/TIPCommon-2.3.7-py3-none-any.whl" }
 environmentcommon = { path = "../envcommon/whls/EnvironmentCommon-1.0.2-py2.py3-none-any.whl" }
 soar-sdk = { git = "https://github.com/chronicle/soar-sdk.git" }
 

packages/tipcommon/TIPCommon/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "TIPCommon"
-version = "2.3.5"
+version = "2.3.7"
 description = "General Purpose CLI tool for Google SecOps Marketplace"
 readme = "README.md"
 authors = [

packages/tipcommon/TIPCommon/src/TIPCommon/rest/soar_api.py

@@ -958,6 +958,64 @@ def resume_alert_sla(
     validate_response(response, validate_json=False)
 
 
+def resume_case_alerts_sla(
+    chronicle_soar: ChronicleSOAR,
+    case_id: int,
+    alert_identifiers: list[str],
+    message: str,
+) -> tuple[list[str], list[str]]:
+    """Resume alert SLA for multiple alerts in a case.
+
+    Args:
+        chronicle_soar: A chronicle soar SDK object.
+        case_id: Chronicle SOAR case ID.
+        alert_identifiers: List of Chronicle SOAR Alert Identifiers.
+        message: Chronicle SOAR message.
+    Returns:
+        Success and failed alert identifiers.
+    """
+    success_alerts = []
+    failed_alerts = []
+    for alert_identifier in alert_identifiers:
+        try:
+            resume_alert_sla(chronicle_soar, case_id, alert_identifier, message)
+            success_alerts.append(alert_identifier)
+        except Exception as e:
+            chronicle_soar.LOGGER.error(f"Failed to resume SLA for alert {alert_identifier}: {e}")
+            failed_alerts.append(alert_identifier)
+
+    return success_alerts, failed_alerts
+
+
+def pause_case_alerts_sla(
+    chronicle_soar: ChronicleSOAR,
+    case_id: int,
+    alert_identifiers: list[str],
+    message: str,
+) -> tuple[list[str], list[str]]:
+    """Pause alert SLA for multiple alerts in a case.
+
+    Args:
+        chronicle_soar: A chronicle soar SDK object.
+        case_id: Chronicle SOAR case ID.
+        alert_identifiers: List of Chronicle SOAR Alert Identifiers.
+        message: Chronicle SOAR message.
+    Returns:
+        Success and failed alert identifiers.
+    """
+    success_alerts = []
+    failed_alerts = []
+    for alert_identifier in alert_identifiers:
+        try:
+            pause_alert_sla(chronicle_soar, case_id, alert_identifier, message)
+            success_alerts.append(alert_identifier)
+        except Exception as e:
+            chronicle_soar.LOGGER.error(f"Failed to pause SLA for alert {alert_identifier}: {e}")
+            failed_alerts.append(alert_identifier)
+
+    return success_alerts, failed_alerts
+
+
 def change_case_description(
     chronicle_soar: ChronicleSOAR,
     case_id: int,