class_docstr: DemistoOutput handles all alert dispatching to Demisto
class_docstr_tok: ["DemistoOutput","handles","all","alert","dispatching","to","Demisto"]
docstr: Send a new Incident to Demisto
  
  Publishing:
      Demisto offers a suite of default incident values. You can override any of the
      following:
  
      - @demisto.incident_type (str):
  
      - @demisto.severity (str):
              Controls the severity of the incident. Any of the following:
              'info', 'informational', 'low', 'med', 'medium', 'high', 'critical', 'unknown'
  
      - @demisto.owner (str):
              Controls which name shows up under the owner. This can be any name, even of
              users that are not registered on Demisto. Incidents can be filtered by name.
  
      - @demisto.details (str):
              A string that briefly describes the nature of the incident and how to respond.
  
      - @demisto.incident_name (str):
              Incident name shows up as the title of the Incident.
  
      - @demisto.label_data (dict):
              By default, this output sends the entire publication into the Demisto labels
              section, where the label names are the keys of the publication and the label
              values are the values of the publication.
  
              For deeply nested dictionary publications, the label names become the full path
              of all nest dictionary keys, concatenated with periods (".").
  
              By providing this override field, you can send a different dict of data to
              Demisto, other than the entire publication. Just like in the default case,
              if this provided dict is deeply nested, the keys will be flattened.
  
  
  Args:
      alert (Alert): Alert instance which triggered a rule
      descriptor (str): Output descriptor
  
  Returns:
      bool: True if alert was sent successfully, False otherwise
docstr_tok: ["Send","a","new","Incident","to","Demisto","Publishing",":","Demisto","offers","a","suite","of","default","incident","values",".","You","can","override","any","of","the","following",":","-","@","demisto.incident_type","(","str",")",":","-","@","demisto.severity","(","str",")",":","Controls","the","severity","of","the","incident",".","Any","of","the","following",":","'info","'",",","'informational","'",",","'low","'",",","'med","'",",","'medium","'",",","'high","'",",","'critical","'",",","'unknown'","-","@","demisto.owner","(","str",")",":","Controls","which","name","shows","up","under","the","owner",".","This","can","be","any","name",",","even","of","users","that","are","not","registered","on","Demisto",".","Incidents","can","be","filtered","by","name",".","-","@","demisto.details","(","str",")",":","A","string","that","briefly","describes","the","nature","of","the","incident","and","how","to","respond",".","-","@","demisto.incident_name","(","str",")",":","Incident","name","shows","up","as","the","title","of","the","Incident",".","-","@","demisto.label_data","(","dict",")",":","By","default",",","this","output","sends","the","entire","publication","into","the","Demisto","labels","section",",","where","the","label","names","are","the","keys","of","the","publication","and","the","label","values","are","the","values","of","the","publication",".","For","deeply","nested","dictionary","publications",",","the","label","names","become","the","full","path","of","all","nest","dictionary","keys",",","concatenated","with","periods","(","``",".","''",")",".","By","providing","this","override","field",",","you","can","send","a","different","dict","of","data","to","Demisto",",","other","than","the","entire","publication",".","Just","like","in","the","default","case",",","if","this","provided","dict","is","deeply","nested",",","the","keys","will","be","flattened",".","Args",":","alert","(","Alert",")",":","Alert","instance","which","triggered","a","rule","descriptor","(","str",")",":","Output","descriptor","Returns",":","bool",":","True","if","alert","was","sent","successfully",",","False","otherwise"]
code: def _dispatch(self, alert, descriptor):
      """Send a new Incident to Demisto
  
      Publishing:
          Demisto offers a suite of default incident values. You can override any of the
          following:
  
          - @demisto.incident_type (str):
  
          - @demisto.severity (str):
                  Controls the severity of the incident. Any of the following:
                  'info', 'informational', 'low', 'med', 'medium', 'high', 'critical', 'unknown'
  
          - @demisto.owner (str):
                  Controls which name shows up under the owner. This can be any name, even of
                  users that are not registered on Demisto. Incidents can be filtered by name.
  
          - @demisto.details (str):
                  A string that briefly describes the nature of the incident and how to respond.
  
          - @demisto.incident_name (str):
                  Incident name shows up as the title of the Incident.
  
          - @demisto.label_data (dict):
                  By default, this output sends the entire publication into the Demisto labels
                  section, where the label names are the keys of the publication and the label
                  values are the values of the publication.
  
                  For deeply nested dictionary publications, the label names become the full path
                  of all nest dictionary keys, concatenated with periods (".").
  
                  By providing this override field, you can send a different dict of data to
                  Demisto, other than the entire publication. Just like in the default case,
                  if this provided dict is deeply nested, the keys will be flattened.
  
  
      Args:
          alert (Alert): Alert instance which triggered a rule
          descriptor (str): Output descriptor
  
      Returns:
          bool: True if alert was sent successfully, False otherwise
      """
      creds = self._load_creds(descriptor)
      if not creds:
          return False
  
      request = DemistoRequestAssembler.assemble(
          alert, compose_alert(alert, self, descriptor)
      )
      integration = DemistoApiIntegration(creds, self)
  
      LOGGER.debug("Sending alert to Demisto: %s", creds["url"])
  
      try:
          integration.send(request)
          return True
      except OutputRequestFailure as e:
          LOGGER.exception("Failed to create Demisto incident: %s.", e)
          return False
  
imports: from collections import OrderedDict
  from streamalert.alert_processor.helpers import compose_alert
  from streamalert.alert_processor.outputs.output_base import OutputDispatcher, OutputProperty, StreamAlertOutput, OutputRequestFailure
  from streamalert.shared.logger import get_logger
label_desc: Use image node_id 2 for calling the DemistoOutput obj's underlying member method code with example usage: obj._dispatch(alert, descriptor) and returns: False, True, False