class_docstr: Factory class for DemistoCreateIncidentRequest objects
class_docstr_tok: ["Factory","class","for","DemistoCreateIncidentRequest","objects"]
docstr: Args:
      alert (Alert): Instance of the alert
      alert_publication (Dict): Published alert data of the alert that triggered a rule
  
  Returns:
      DemistoCreateIncidentRequest
docstr_tok: ["Args",":","alert","(","Alert",")",":","Instance","of","the","alert","alert_publication","(","Dict",")",":","Published","alert","data","of","the","alert","that","triggered","a","rule","Returns",":","DemistoCreateIncidentRequest"]
code: def assemble(alert, alert_publication):
      """
      Args:
          alert (Alert): Instance of the alert
          alert_publication (Dict): Published alert data of the alert that triggered a rule
  
      Returns:
          DemistoCreateIncidentRequest
      """
      # Default presentation values
      default_incident_name = alert.rule_name
      default_incident_type = "Unclassified"
      default_playbook = "Unknown"
      default_severity = "unknown"
      default_owner = "StreamAlert"
      default_details = alert.rule_description
      default_label_data = alert_publication
  
      # Special keys that publishers can use to modify default presentation
      incident_type = alert_publication.get(
          "@demisto.incident_type", default_incident_type
      )
      playbook = alert_publication.get(
          "@demisto.playbook", default_playbook
      )
      severity = DemistoCreateIncidentRequest.map_severity_string_to_severity_value(
          alert_publication.get("@demisto.severity", default_severity)
      )
      owner = alert_publication.get("@demisto.owner", default_owner)
      details = alert_publication.get(
          "@demisto.details", default_details
      )
      incident_name = alert_publication.get(
          "@demisto.incident_name", default_incident_name
      )
      label_data = alert_publication.get(
          "@demisto.label_data", default_label_data
      )
  
      request = DemistoCreateIncidentRequest(
          incident_name=incident_name,
          incident_type=incident_type,
          severity=severity,
          owner=owner,
          details=details,
          playbook=playbook,
          create_investigation=True,  # Important: Trigger workbooks automatically
      )
  
      # The alert is a nested JSON structure which does not render well on
      # Demisto's UI; flatten it into a series of discrete key-values.
      def enumerate_fields(record, path=""):
          if isinstance(record, list):
              for index, item in enumerate(record):
                  enumerate_fields(item, "{}[{}]".format(path, index))
  
          elif isinstance(record, dict):
              for key in record:
                  enumerate_fields(
                      record[key],
                      "{prefix}{key}".format(
                          prefix="{}.".format(path)
                          if path
                          else "",  # Omit first period
                          key=key,
                      ),
                  )
  
          else:
              request.add_label(path, record)
  
      enumerate_fields(label_data)
  
      return request
  
imports: from collections import OrderedDict
  from streamalert.alert_processor.helpers import compose_alert
  from streamalert.alert_processor.outputs.output_base import OutputDispatcher, OutputProperty, StreamAlertOutput, OutputRequestFailure
  from streamalert.shared.logger import get_logger
label_desc: Use image node_id 1 for calling the DemistoRequestAssembler obj's underlying member method code with example usage: obj.assemble(alert, alert_publication) and returns: request