[ASM] - Rapid7 & Splunk Cortex ASM Enrichment - Expander 1613 & 90 by BigEasyJ · Pull Request #24837 · demisto/content

BigEasyJ · 2023-02-22T20:38:12Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

EXPANDR-90
EXPANDR-1613

Description

Added New playbooks Cortex ASM - Splunk Enrichment and Cortex ASM - Rapid7 Enrichment to the Cortex ASM - Enrichment playbook.

Updated the Docker image to: *demisto/python3:3.10.10.48392 for:

Integration
- Cortex Attack Surface Management
Scripts
- RemediationPathRuleEvaluation
- SnmpDetection
- GenerateASMReport
- InferWhetherServiceIsDev

Minimum version of Cortex XSOAR

6.0.0
6.1.0
6.2.0
6.5.0

Does it break backward compatibility?

Yes
- Further details:
No

Must have

Tests (Found in related issues)
Documentation

ASM Splunk Playbook - Update search query to handle null represented as strings - Add Grid setup for asmowner Remove temporary values from ASM Enrichment playbook

Add Rapid7 and Splunk playbok information. Update ToC for Playbooks to be Alphanum order. Update "Automated Remediation requirements" to follow Alphanum order.

content-bot · 2023-02-22T20:39:57Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @daryakoval will know he can start review the proposed changes.

BigEasyJ · 2023-02-22T21:40:31Z

CC: @johnnywilkes @capanw for review

BigEasyJ · 2023-02-22T22:12:50Z

@daryakoval Thank you for approving. I have one question about a new validation check that I haven't seen before:

'InferWhetherServiceIsDev' using content items: setAlert which cannot be found in the repository.

The InferWhetherServiceIsDev was already using setAlert previously, as is other content and it's a Builtin. How could we go about resolving this error or is it a non-issue?

daryakoval · 2023-02-22T22:28:36Z

@BigEasyJ This is a new validation check. I will check why it is not recognizing setAlert as existing content, and update you.
Meanwhile please fix other validation errors.

- Add tasks to check asset ID and set it as an ASM system ID.

johnnywilkes

@BigEasyJ , please see my comments

johnnywilkes · 2023-02-23T14:09:06Z

+
+##### Cortex ASM - ASM Alert
+
+- Updated the from version to 6.8.0


Suggested change

- Updated the from version to 6.8.0

- Updated the from version to 6.8.0.

Resolved in 70f2b98.

johnnywilkes · 2023-02-23T14:09:22Z

+
+##### Cortex ASM - Enrichment
+
+- Updated the from version to 6.8.0


Suggested change

- Updated the from version to 6.8.0

- Updated the from version to 6.8.0.

Resolved in 70f2b98.

johnnywilkes · 2023-02-23T14:10:12Z

+
+##### InferWhetherServiceIsDev
+
+- Updated the Docker image to: *demisto/python3:3.10.10.4839*.


Suggested change

- Updated the Docker image to: *demisto/python3:3.10.10.4839*.

- Updated the Docker image to: *demisto/python3:3.10.10.48392*.

Resolved in 70f2b98.

johnnywilkes · 2023-02-23T14:12:32Z


-Playbook that given the IP address enriches Tenable.io information relevant to ASM alerts.
-![Cortex ASM - Tenable.io Enrichment](https://raw.githubusercontent.com/demisto/content/master/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Tenable.io_Enrichment.png)
+![Cortex ASM - Rapid7 Enrichment](https://raw.githubusercontent.com/demisto/content/master/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Rapid7_Enrichment.png)


You can change this later (separate PR right away or when the playbook is edited in the future).

Suggested change

![Cortex ASM - Rapid7 Enrichment](https://raw.githubusercontent.com/demisto/content/master/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Rapid7_Enrichment.png)

![Cortex ASM - Rapid7 Enrichment](https://raw.githubusercontent.com/demisto/content/8f2a866b666627cb0c6c7ea860e7f1337b4766b7/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Rapid7_Enrichment.png)

Resolved in 70f2b98.

johnnywilkes · 2023-02-23T14:13:45Z

-![Cortex ASM - Remediation Path Rules](https://raw.githubusercontent.com/demisto/content/master/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Remediation_Path_Rules.png)
+Playbook that given the IP address enriches Splunk information relevant to ASM alerts.
+
+![Cortex ASM - Splunk Enrichment](https://raw.githubusercontent.com/demisto/content/master/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Splunk_Enrichment.png)


Suggested change

![Cortex ASM - Splunk Enrichment](https://raw.githubusercontent.com/demisto/content/master/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Splunk_Enrichment.png)

![Cortex ASM - Splunk Enrichment](https://raw.githubusercontent.com/demisto/content/8f2a866b666627cb0c6c7ea860e7f1337b4766b7/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Splunk_Enrichment.png)

Resolved in 70f2b98.

johnnywilkes · 2023-02-23T14:21:52Z

+    note: false
+    timertriggers: []
+    ignoreworker: false
+    skipunavailable: false


https://qadium.atlassian.net/wiki/spaces/PM/pages/2383872027/XSOAR+XSIAM+Dev+Standards#Check-if-integration-enabled

Suggested change

skipunavailable: false

skipunavailable: true

Resolved in b2ffd19.

johnnywilkes · 2023-02-23T14:28:57Z

+
+| **Path** | **Description** | **Type** |
+| --- | --- | --- |
+| asmserviceowner | This is the potential service owners from splunk results. | unknown |


I don't think this is necessary because the GridFieldSetup automation in the playbook it exporting the value to the field, therefore it doesn't need to returned as raw context. What do you think?

Agreed, that was leftover from a previous change. I'll remove it.

Resolved in 92b7a41 & 2bfadbc.

johnnywilkes · 2023-02-23T14:31:44Z

+                iscontext: true
+              right:
+                value:
+                  simple: owner


Nitty question: Is it possible that only the owner AssetTag.Type could be found and therefore this would fail? The previous conditional seems to only check for Nexpose.AssetTag and not Nexpose.AssetTag where type != owner so I think there might be a potential failure scenario though I don't know how rare it is. Will leave it up to you to change if you please.

Resolved in b2ffd19.

- Removed output.

- Update conditional task for non-owner tags

johnnywilkes

@BigEasyJ , thanks for making these changes, this is now approved!

daryakoval · 2023-02-26T06:52:36Z

@BigEasyJ Hi, The GR103 validation error is a bug in our validation. We will force merge your PR, and fix the validation.

…24837) (#24868) * Add rapid7 ASM enrichment playbook and docs * Add Splunk ASM enrichment playbook and docs * Update Cortex ASM enrichment playbook and docs * Update ASM Splunk Playbook and ASM enrichment ASM Splunk Playbook - Update search query to handle null represented as strings - Add Grid setup for asmowner Remove temporary values from ASM Enrichment playbook * Update docker images in other scripts and integrations * Sort pack metadata dependecies, add Splunk/R7 * Update pack README Add Rapid7 and Splunk playbok information. Update ToC for Playbooks to be Alphanum order. Update "Automated Remediation requirements" to follow Alphanum order. * Add 1.5.3 release notes * Update Remedation Path Rules docker image * Update ReadMe format and alphanum order * Update release notes * Update Splunk README and pic * Update Rapid7 yml and README * Update pack ignore * Update format for Rapid7 playbook * Update from version of ASM enrichment playbook * Update from version of ASM alert playbook to 6.8 * Update release notes * Update ASM Rapid7 Enrichment playbook - Add tasks to check asset ID and set it as an ASM system ID. * Update ASM Splunk enrichment playbook. - Removed output. * Update ASM Rapid7 enrichment playbook - Update conditional task for non-owner tags * Update README and release notes * Update ASM Splunk playbook README Co-authored-by: John <[email protected]>

BigEasyJ added 13 commits February 22, 2023 13:38

Add rapid7 ASM enrichment playbook and docs

4847f8d

Add Splunk ASM enrichment playbook and docs

3e50ae2

Update Cortex ASM enrichment playbook and docs

bf4761e

Update ASM Splunk Playbook and ASM enrichment

d8f3078

ASM Splunk Playbook - Update search query to handle null represented as strings - Add Grid setup for asmowner Remove temporary values from ASM Enrichment playbook

Update docker images in other scripts and integrations

6948eba

Sort pack metadata dependecies, add Splunk/R7

eee722b

Update pack README

0452a3f

Add Rapid7 and Splunk playbok information. Update ToC for Playbooks to be Alphanum order. Update "Automated Remediation requirements" to follow Alphanum order.

Add 1.5.3 release notes

1de8a57

Update Remedation Path Rules docker image

11748db

Update ReadMe format and alphanum order

cb622ca

Update release notes

d89552b

Update Splunk README and pic

949f05f

Update Rapid7 yml and README

e633870

BigEasyJ changed the title ~~Rapid7 splunk cortex asm enrichment~~ [ASM] - Rapid7 & Splunk Cortex ASM Enrichment - Expander 1613 & 90 Feb 22, 2023

content-bot added the Contribution Thank you! Contributions are always welcome! label Feb 22, 2023

content-bot changed the base branch from master to contrib/BigEasyJ_rapid7-splunk-cortex-asm-enrichment February 22, 2023 20:39

content-bot added Community Contribution Form Filled Whether contribution form filled or not. labels Feb 22, 2023

content-bot assigned daryakoval Feb 22, 2023

content-bot requested a review from daryakoval February 22, 2023 20:39

Update pack ignore

b6d5cfd

daryakoval approved these changes Feb 22, 2023

View reviewed changes

daryakoval added the docs-approved label Feb 22, 2023

daryakoval self-requested a review February 22, 2023 20:54

BigEasyJ added 3 commits February 22, 2023 15:44

Update format for Rapid7 playbook

1fc6685

Update from version of ASM enrichment playbook

1a121fb

Update from version of ASM alert playbook to 6.8

4f660b1

Update release notes

e0be40f

Update ASM Rapid7 Enrichment playbook

8f2a866

- Add tasks to check asset ID and set it as an ASM system ID.

johnnywilkes suggested changes Feb 23, 2023

View reviewed changes

BigEasyJ added 4 commits February 23, 2023 10:48

Update ASM Splunk enrichment playbook.

2bfadbc

- Removed output.

Update ASM Rapid7 enrichment playbook

b2ffd19

- Update conditional task for non-owner tags

Update README and release notes

70f2b98

Update ASM Splunk playbook README

92b7a41

johnnywilkes approved these changes Feb 23, 2023

View reviewed changes

johnnywilkes mentioned this pull request Feb 24, 2023

[ASM] - RPR Resolution Notes #24863

Merged

11 tasks

daryakoval merged commit 3bdd91d into demisto:contrib/BigEasyJ_rapid7-splunk-cortex-asm-enrichment Feb 26, 2023

content-bot mentioned this pull request Feb 26, 2023

[ASM] - Rapid7 & Splunk Cortex ASM Enrichment - Expander 1613 & 90 #24868

Merged

11 tasks

BigEasyJ deleted the rapid7-splunk-cortex-asm-enrichment branch July 31, 2023 18:36


		##### Cortex ASM - ASM Alert

		- Updated the from version to 6.8.0

	- Updated the from version to 6.8.0
	- Updated the from version to 6.8.0.


		##### Cortex ASM - Enrichment

		- Updated the from version to 6.8.0


		##### InferWhetherServiceIsDev

		- Updated the Docker image to: demisto/python3:3.10.10.4839.

	![Cortex ASM - Rapid7 Enrichment](https://raw.githubusercontent.com/demisto/content/master/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Rapid7_Enrichment.png)
	![Cortex ASM - Rapid7 Enrichment](https://raw.githubusercontent.com/demisto/content/8f2a866b666627cb0c6c7ea860e7f1337b4766b7/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Rapid7_Enrichment.png)

	![Cortex ASM - Splunk Enrichment](https://raw.githubusercontent.com/demisto/content/master/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Splunk_Enrichment.png)
	![Cortex ASM - Splunk Enrichment](https://raw.githubusercontent.com/demisto/content/8f2a866b666627cb0c6c7ea860e7f1337b4766b7/Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Splunk_Enrichment.png)

Conversation

BigEasyJ commented Feb 22, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contributing to Cortex XSOAR Content

Status

Related Issues

Description

Minimum version of Cortex XSOAR

Does it break backward compatibility?

Must have

Uh oh!

content-bot commented Feb 22, 2023

Uh oh!

BigEasyJ commented Feb 22, 2023

Uh oh!

BigEasyJ commented Feb 22, 2023

Uh oh!

daryakoval commented Feb 22, 2023

Uh oh!

johnnywilkes left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johnnywilkes Feb 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BigEasyJ Feb 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johnnywilkes left a comment

Choose a reason for hiding this comment

Uh oh!

daryakoval commented Feb 26, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

BigEasyJ commented Feb 22, 2023 •

edited

Loading

johnnywilkes Feb 23, 2023 •

edited

Loading

BigEasyJ Feb 23, 2023 •

edited

Loading