def create_sentinel_indicator(self):
        """To map cofense data to microsoft sentinel indicator data."""
        __method_name = inspect.currentframe().f_code.co_name
        try:
            applogger.info(
                "{}(method={}) : {}: started creating indicators in microsoft sentinel.".format(
                    LOGS_STARTS_WITH, __method_name, COFENSE_TO_SENTINEL
                )
            )
            list_indicator_url = "{}{}".format(COFENSE_BASE_URL, ENDPOINTS["get_lists"])
            params = {
                self.cofense_page_number: COFENSE_PAGE_NUMBER,
                "page[size]": COFENSE_PAGE_SIZE,
                "sort": "updated_at",
            }
            last_checkpoint = self.state_obj.get(COFENSE_TO_SENTINEL)
            # To do: remove "is not None".
            if last_checkpoint is not None:
                params["filter[updated_at_gteq]"] = last_checkpoint
                applogger.info(
                    "{}(method={}) : {} : last checkpoint is {}".format(
                        LOGS_STARTS_WITH,
                        __method_name,
                        COFENSE_TO_SENTINEL,
                        last_checkpoint,
                    )
                )
            else:
                today_datetime = datetime.datetime.utcnow() - datetime.timedelta(days=15)
                from_datetime = datetime.datetime.strftime(today_datetime, DATETIMEFORMAT)
                params["filter[updated_at_gteq]"] = from_datetime
                applogger.info(
                    "{}(method={}) : {} : getting indicators data of last 15 days from {}".format(
                        LOGS_STARTS_WITH,
                        __method_name,
                        COFENSE_TO_SENTINEL,
                        from_datetime,
                    )
                )
            applogger.debug(
                "{}(method={}) : {} : when getting indicators URL: {}, headers: {}".format(
                    LOGS_STARTS_WITH,
                    __method_name,
                    COFENSE_TO_SENTINEL,
                    list_indicator_url,
                    self.cofense_triage_obj.headers,
                )
            )
            while True:
                indicators_data_json = self.cofense_triage_obj.get_indicators_from_cofense(
                    url=list_indicator_url, params=params
                )
                indicator_data = indicators_data_json.get("data", [])
                if indicator_data:
                    self.process_indicator_data(indicator_data)
                    if not indicators_data_json.get("links", {}).get("next", ""):
                        applogger.info(
                            "{}(method={}) : {} : all indicators created successfully.".format(
                                LOGS_STARTS_WITH, __method_name, COFENSE_TO_SENTINEL
                            )
                        )
                        break
                    params[self.cofense_page_number] += 1
                else:
                    applogger.warning(
                        "{}(method={}) : {} : no new indicator data found.".format(
                            LOGS_STARTS_WITH, __method_name, COFENSE_TO_SENTINEL
                        )
                    )
                    break
        except CofenseException:
            raise CofenseException()
        except Exception as error:
            applogger.error(
                "{}(method={}) : {} : error occurred while creating sentinel indicators : {}.".format(
                    LOGS_STARTS_WITH, __method_name, COFENSE_TO_SENTINEL, error
                )
            )
            raise CofenseException()
To map cofense data to microsoft sentinel indicator data.
Solutions/CofenseTriage/Data Connectors/CofenseTriageDataConnector/CofenseBasedIndicatorCreator/cofense_to_sentinel_mapping.py