Skip to content

XDR integrations - adding terminate commands#35226

Merged
maimorag merged 72 commits intomasterfrom
117833-xdr-api-playbooks
Oct 1, 2024
Merged

XDR integrations - adding terminate commands#35226
maimorag merged 72 commits intomasterfrom
117833-xdr-api-playbooks

Conversation

@maimorag
Copy link
Copy Markdown
Contributor

@maimorag maimorag commented Jul 4, 2024

Status

  • In Progress
  • Ready
  • In Hold - (Reason for hold)

Related Issues

fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-11041.

Description

Adding support in 2 new API endpoints as commands

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jul 4, 2024

Coverage

Coverage Report
FileStmtsMissCoverMissing
Packs/ApiModules/Scripts/CoreIRApiModule
   CoreIRApiModule.py170826184%243, 286, 289, 294, 308, 339, 346, 360, 364, 368, 375, 382, 389, 396, 417, 463, 468, 509, 524, 535, 547, 606–607, 613–618, 643, 649, 655, 667, 677, 683, 702, 714, 720, 726, 738, 748, 754, 790, 804, 829, 858, 874, 876, 984, 1014, 1017, 1027, 1096, 1102, 1122, 1128, 1130, 1157, 1173, 1359, 1383, 1389, 1402, 1404–1405, 1407, 1413–1414, 1420–1421, 1427, 1434–1435, 1468, 1470, 1516, 1523, 1530, 1536, 1542, 1549, 1556, 1566, 1611, 1613, 1642, 1725–1731, 1736, 1741–1744, 1746–1747, 1749–1750, 1755, 1761, 1763, 1767, 1774–1775, 1790–1791, 1807, 1812, 1820, 1868–1870, 1874, 1877, 1901, 1986, 1992, 1996, 2000, 2005, 2011, 2023–2024, 2030, 2035, 2041, 2044–2046, 2078, 2081–2084, 2198, 2271, 2277, 2281, 2285, 2288, 2492, 2506–2508, 2511, 2564–2566, 2569, 2723, 2734, 2737–2739, 2743–2746, 2750–2751, 2757, 2759–2763, 2767, 2773, 2775–2776, 2778, 2782–2785, 2787, 2794, 2796–2797, 2800–2804, 2807, 2809, 2811, 2813–2816, 2820–2821, 2823–2828, 2830, 2861, 3036–3039, 3043–3044, 3055, 3155, 3184, 3186, 3188, 3435–3436, 3528–3530, 3538, 3559, 3678–3681, 3768, 3776, 3780–3781, 3839–3841, 3847, 3886, 3900, 3907, 3914, 3956, 3963, 3970, 3977, 3984, 4188, 4224–4227, 4229–4231, 4334, 4368, 4374, 4381, 4383, 4390, 4392, 4410, 4433
Packs/Core/Integrations/CoreIOCs
   CoreIOCs.py3088173%53, 61, 63, 73, 89, 94, 111, 173–174, 235, 264, 294–301, 303–305, 307–308, 316, 337, 342, 351, 355–359, 363–364, 366, 370–372, 383, 396–407, 409, 433–441, 448–453, 459–468, 470–472
Packs/Core/Integrations/CortexCoreIR
   CortexCoreIR.py571278%39–42, 44, 47, 50, 57, 62, 65, 67, 111
Packs/CortexXDR/Integrations/CortexXDRIR
   CortexXDRIR.py6418586%59, 67, 71–73, 144–145, 206–210, 212, 215, 218, 222, 248–252, 254, 261–264, 275, 278, 281, 287, 290, 316, 321, 329, 331, 334–338, 340, 430–435, 484, 522, 537–538, 555, 565, 625, 628, 655, 662, 664, 741–742, 744, 797, 986–988, 991, 994, 999, 1034, 1042, 1065, 1094–1095, 1134, 1149–1151, 1154, 1163, 1196–1199, 1231, 1248
Packs/ctf01/Integrations/CortexXDRIRCTF
   CortexXDRIRCTF.py4644640%1–7, 10, 12–14, 16–18, 20, 37, 44, 52–57, 60–68, 71–72, 75–76, 79–80, 83–88, 91–98, 101, 109–121, 123–125, 128, 130, 134–138, 140, 143, 145, 153, 159, 163, 166–171, 173, 179–182, 184, 186, 210–211, 213, 218–219, 221–222, 226–227, 232–234, 240–241, 247–248, 253, 258–262, 265–266, 272–273, 279–280, 286–287, 293–294, 300–301, 303, 309, 311, 313, 321, 326, 333, 335, 337–342, 344, 346–347, 353, 360, 362–363, 369, 377, 379–380, 386, 389–391, 394, 402–404, 406, 410–412, 414, 417–418, 420–425, 428–429, 431, 434, 443–445, 447–449, 451–452, 455, 457–458, 547–554, 556, 558–559, 562, 564–565, 567, 569–570, 572, 574, 579, 582, 584–591, 593–597, 599, 601–609, 616, 618, 631, 634–638, 642–643, 648–650, 652, 654, 656, 658, 671, 673, 680, 683–687, 689, 692, 694, 697, 699, 706, 709–711, 713–715, 717–718, 720–722, 724–725, 727, 729–730, 732, 735–739, 741, 744, 748–753, 756–760, 769–770, 772–775, 777, 780–783, 785–786, 788, 791–793, 795, 797–799, 801, 803–806, 808, 811–813, 815–816, 819, 821, 825–826, 828–829, 831, 834, 837–838, 842, 845, 847–850, 852, 854, 860, 865, 870–871, 874–875, 877–879, 882, 885, 890, 896, 902, 1156, 1159, 1175–1176, 1180–1181, 1183–1184, 1186–1188, 1190–1191, 1196–1197, 1202, 1208–1210, 1212, 1214–1215, 1219–1220, 1222, 1224–1225, 1227–1229, 1235–1236, 1239–1240, 1242–1243, 1245–1247, 1249–1251, 1254, 1256–1257, 1259, 1261, 1263, 1266–1267, 1269–1270, 1275, 1280, 1283, 1285, 1293–1297, 1300, 1308, 1312, 2225–2228, 2230–2231, 2233, 2235, 2247, 2256–2258, 2260–2265, 2267, 2271, 2273, 2276, 2285, 2288–2293, 2295–2296, 2302, 2306, 2308, 2310, 2314
TOTAL317890371% 

Tests Skipped Failures Errors Time
269 4 💤 0 ❌ 0 🔥 17.299s ⏱️

ilaredo and others added 28 commits July 4, 2024 16:01
…35004)

* Added external last updated time incident field to the commontypes

* RN

* fomated the incident field

* RN modified

* changed from verison

* RN

* commit

* unsearchable true
* Updated the MP to support only the right one

* Update rn
* Revert "Revert "[Marketplace Contribution] FTP (#34659) (#35177)" (#35199)"

This reverts commit c34a2a4.

* added noqa

---------

Co-authored-by: RotemAmit <[email protected]>
* Update PaloAltoNetworks_Cortex_XDR_Incident_Sync_README.md

* Update Packs/CortexXDR/Playbooks/PaloAltoNetworks_Cortex_XDR_Incident_Sync_README.md

Co-authored-by: ShirleyDenkberg <[email protected]>

---------

Co-authored-by: Mai Morag <[email protected]>
* [SplunkPy] Update the Troubleshooting

* Update Packs/SplunkPy/Integrations/SplunkPy/README.md

Co-authored-by: ShirleyDenkberg <[email protected]>

* Update Packs/SplunkPy/Integrations/SplunkPy/README.md

Co-authored-by: ShirleyDenkberg <[email protected]>

---------

Co-authored-by: ShirleyDenkberg <[email protected]>
* import problematic packs

* update

* changes

* import problematic packs

* update dockers

* update dockers

* added rns

* reverts

* update dockers

* cr fixes
* fix ComonServerPython docstring

* RN
* New pack for CVE-2024-6387

* exclude-known-url

* adjust the playbook and pack readme

* adjust the playbook and pack readme

---------

Co-authored-by: Chanan Welt <[email protected]>
* Fixed an issue with the data collection tasks to send emails to the corresponding roles in XSIAM (Investigator) and XSOAR (Analyst).

* RN

* Removed administrator role from the data collection tasks

* udpated RN
* Creating modeling rules

* Updating schema

* Removing url portal link

* Adding release notes and test data
* update image

* bump image

* Update Packs/ProofpointEmailSecurity/ReleaseNotes/1_0_2.md

* Update Packs/ProofpointEmailSecurity/Integrations/ProofpointEmailSecurityEventCollector/ProofpointEmailSecurityEventCollector.yml
* updated the classifier and layout of the qradar integration

* added the release notes

* commit

* RN
* improved implementation of IsIncidentPartOfCampaign

* was found

* docker update

* skip none string
* Zerofox/add cac data (#35183)

* add compromised credentials command (#138)

* fix mypy check and tests

* Fix yml file format

* Add period to yaml description

* Include PR comments

- fix release notes comment
- add unit test
- format code

* update docker

* update RN

---------

Co-authored-by: Diego Ramirez R <[email protected]>
Co-authored-by: ipolishuk <[email protected]>
* fixed xpanse

* add RN

* fixed

* adding rn

* fix test

* fix test

* fix testcommonserver pyton

* fix unit tests and revert changes in demistomock

* add xplanatory docstring

* Bump pack from version Base to 1.34.24.

* adding memory threshold to incident enrichment

---------

Co-authored-by: sapirshuker <[email protected]>
Co-authored-by: Content Bot <[email protected]>
* added client credentials flow - working

* updated readme and description

* changed to default value for token_retrieval_url

* created release notes and run pre commit

* changed redme and description after code review

* updated docker image

* changed some mistakes in readme

* changed some mistakes in discription

---------

Co-authored-by: noy <nodavidi.paloaltonetworks.com>
* changed yml file

* added client credentials to py

* added client credentials to py

* added release note

* changed readme and description for client credentials

* run pre commit

* updated docker image

* changed some mistakes in readme

* changed some mistakes in discription

---------

Co-authored-by: noy <nodavidi.paloaltonetworks.com>
updated integration logo to align with Prisma Cloud V2

Co-authored-by: epartington <[email protected]>
Co-authored-by: Danny Fried <[email protected]>
* changed the py file to match client credentials

* changed the yml file to match client cre4dentials

* changed the scope for client credentails

* changed the scope

* py

* getting 203 error from api

* made the final changes for client credentials

* changed description

* changed some description and added client credentials for README

* ran precommit and created release nores

* added global var for scope

* fixed pre commit

* made changes in readme and in description after doc review

* removed in description and in readme 'using cortex xsoar azure app'

* changed to default value for token_retrieval_url

* changed condition for scope

* changed test test_generate_login_urlplaybook to match the new scope

* changes cope global name

* updated docker image

* deleted the word Demisto - not relevant

* changed docker image and removed demisto word from description

---------

Co-authored-by: noy <nodavidi.paloaltonetworks.com>
* fix + RN + test

* RN

* fix ruff

* CR changes

* fix pre commit

* CR changes
* fixed token to be with ?

* RN

* pre commit and docker

* fixed test AzureStorageTable_test.py

* fixed test AzureStorageQueue_test.py

* fixed test AzureStorageFileShare_test.py

* fixed test AzureStorageContainer_test.py

---------

Co-authored-by: okarkkatz <[email protected]>
@maimorag maimorag marked this pull request as ready for review September 19, 2024 07:19
Copy link
Copy Markdown
Contributor

@eyalpalo eyalpalo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets schedule a demo as well

Comment thread Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py Outdated
Comment thread Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py Outdated
Comment thread Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py
Comment thread Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py Outdated
Comment thread Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py Outdated
Comment thread Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py Outdated
Comment thread Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule_test.py
Comment thread Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.py Outdated
Comment thread Packs/Core/Integrations/CortexCoreIR/README.md
@maimorag maimorag requested a review from eyalpalo September 23, 2024 11:10
Comment thread Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml Outdated
Comment thread Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml Outdated
Comment thread Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml Outdated
Comment thread Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml Outdated
Comment thread Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml Outdated
Comment thread Packs/Core/Integrations/CortexCoreIR/README.md Outdated
Comment thread Packs/Core/Integrations/CortexCoreIR/README.md Outdated
Comment thread Packs/Core/Integrations/CortexCoreIR/README.md Outdated
Comment thread Packs/Core/Integrations/CortexCoreIR/README.md Outdated
Comment thread Packs/Core/ReleaseNotes/3_0_69.md Outdated
Comment thread Packs/ctf01/ReleaseNotes/1_0_29.md
Comment thread Packs/CortexXDR/ReleaseNotes/6_1_77.md
@ShirleyDenkberg
Copy link
Copy Markdown
Contributor

@eyalpalo Doc review completed.

maimorag and others added 3 commits September 29, 2024 15:36
Copy link
Copy Markdown
Contributor

@eyalpalo eyalpalo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice

maimorag added 2 commits September 30, 2024 21:34
@maimorag maimorag merged commit 0ca66e1 into master Oct 1, 2024
@maimorag maimorag deleted the 117833-xdr-api-playbooks branch October 1, 2024 11:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.