def prepare_fetch_incidents_query(fetch_timestamp: str,
                                  fetch_severity: list,
                                  fetch_table: str,
                                  fetch_subtype: list,
                                  fetch_fields: str,
                                  fetch_limit: str) -> str:
    """
    Prepares the SQL query for fetch incidents command
    Args:
        fetch_limit: Indicates how many incidents should be queried
        fetch_timestamp: The date from which threat logs should be queried
        fetch_severity: Severity associated with the incident.
        fetch_subtype: Identifies the log subtype.
        fetch_table: Identifies the fetch type.
        fetch_fields: Fields to fetch fro the table.

    Returns:
        SQL query that matches the arguments
    """
    query = f'SELECT {fetch_fields} FROM `{fetch_table}` '  # guardrails-disable-line
    query += f'WHERE time_generated Between TIMESTAMP("{fetch_timestamp}") ' \
             f'AND CURRENT_TIMESTAMP'
    if fetch_subtype and 'all' not in fetch_subtype:
        sub_types = [f'sub_type.value = "{sub_type}"' for sub_type in fetch_subtype]
        query += f' AND ({" OR ".join(sub_types)})'
    if fetch_severity and 'all' not in fetch_severity:
        severities = [f'vendor_severity.value = "{severity}"' for severity in fetch_severity]
        query += f' AND ({" OR ".join(severities)})'
    query += f' ORDER BY time_generated ASC LIMIT {fetch_limit}'
    return query