[Zerofox] Key Incidents Integration by DNRRomero · Pull Request #39506 · demisto/content

DNRRomero · 2025-04-07T18:42:56Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Description

Creates a new Pack for ingesting ZeroFox Key Incidents as Incident data

Must have

Tests
Documentation

CLAassistant · 2025-04-07T18:43:03Z

All committers have signed the CLA.

content-bot · 2025-04-07T18:45:34Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @MosheEichler will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

content-bot · 2025-04-07T18:45:36Z

Hi @DNRRomero, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

MosheEichler · 2025-04-10T11:26:17Z

Thank you very much for your contribution! Unfortunately, your PR review will be slightly delayed because of an Israeli holiday in the upcoming week (the 12th of April - the 19th of April). Thank you in advance for your patience and understanding.

DNRRomero · 2025-04-14T21:38:03Z

Hey @MosheEichler changes are ready for review
I spent a good amount of time correcting release notes for pre-commit hook to pass. However I keep running into errors with IncidentFields and the classifier name.
I would appreciate any help on this 🙏🏽

MosheEichler · 2025-04-21T10:56:11Z

Hey @DNRRomero

Don't worry about the release notes I'll take care of it I just started the review will keep you updated with the next steps Thank you for the contribution

MosheEichler

Hi @DNRRomero,
Thank you for your contribution!
Good work :)

Please see my comments

Feel free to reach out to me with any questions - I'm available here or on slack :)
Thanks again

Benimanela

Hi @DNRRomero, Thanks for contributing!
Please find below some feedback to help align with content standards and best practices.

General:

Run the demisto-sdk format command on all files to ensure they follow the correct structure.

Mapper:

Update the id field to use the integration name (this should be handled automatically by the format command).

Incident Fields:

Prefix all incident field names with ZeroFox, e.g., Analysis → ZeroFox Analysis.
Replace headline with the standard title common field, if applicable.

Incident Type:

Update the associated layout reference from layout ID to layout name.

Layout:

Update both layout id and layout name fields to reflect the actual layout name (should be handled by the format command).
Ensure headline and tags fields are properly mapped in the layout.

Let me know once the fixes are in place so I can take another look.

DNRRomero · 2025-04-21T17:34:14Z

Hi @MosheEichler , @Benimanela Thank you so much for your help
I worked on both your comments, let me know anything else you may need

…dent Pack (#149)

* Move key incidents integration to zerofox pack * correct pack readme to include zerofox ki integration

Benimanela · 2025-04-23T08:55:57Z

Hi @DNRRomero, I saw your changes. What about these points?

Incident Fields:

Prefix all incident field names with ZeroFox, e.g., Analysis → ZeroFox Analysis.
Replace headline with the standard title common field, if applicable.
Layout:

Ensure headline and tags fields are properly mapped in the layout.

DNRRomero · 2025-04-23T15:09:53Z

Hi @DNRRomero, I saw your changes. What about these points?

Incident Fields:

Prefix all incident field names with ZeroFox, e.g., Analysis → ZeroFox Analysis. Replace headline with the standard title common field, if applicable. Layout:

Ensure headline and tags fields are properly mapped in the layout.

Hey @Benimanela I already did those changes, pre -commit is failing due to something else

Benimanela

Hi @DNRRomero, Thank you for your updates.
Please ensure you're using the demisto-sdk format for the incident fields, and update the IDs as I mentioned above.

Benimanela · 2025-04-24T08:27:00Z

Change the id to incident_zerofoxkeyincidentanalysis

Benimanela · 2025-04-24T08:27:42Z

Change the id to incident_zerofoxkeyincidentheadline

DNRRomero · 2025-04-25T02:44:53Z

hey @Benimanela demisto-sdk format did not throw any corrections. I did add your comments though, thank you!

MosheEichler · 2025-04-27T16:26:52Z

Hi @DNRRomero, the code looks good!

We're ready for a demo. Please check this page, and let me know when you're available for one over DFIR.
Feel free also to send me a recording of a demo.

github-actions · 2025-05-06T13:33:45Z

Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.

* [Zerofox] Key Incidents Integration (#39506) * Add new base application (#142) * Format applications (#144) * add key incident client (#145) * add key incident attachment method (#146) * Add simple key mapper (#147) * add incident type, incident type field and layout to ZeroFox Key Incident Pack (#149) * Add Fetch Incidents (#148) * add key incident attachment command (#150) * fix classifier, layout and incident type formats (#152) * update release notes * move key incidents package to zerofox pack (#153) * Move key incidents integration to zerofox pack * correct pack readme to include zerofox ki integration * improve unit tests in ki integration (#154) * rename integration to ZeroFoxKeyIncidents * update release notes * correct incident field names * format ZeroFox pack files --------- Co-authored-by: Leonardo de Requeséns <[email protected]> * post demo fixes * fix incident name * ignore * fix incident name --------- Co-authored-by: Diego Ramirez R <[email protected]> Co-authored-by: Leonardo de Requeséns <[email protected]> Co-authored-by: meichler <[email protected]>

* [Zerofox] Key Incidents Integration (demisto#39506) * Add new base application (demisto#142) * Format applications (demisto#144) * add key incident client (demisto#145) * add key incident attachment method (demisto#146) * Add simple key mapper (demisto#147) * add incident type, incident type field and layout to ZeroFox Key Incident Pack (demisto#149) * Add Fetch Incidents (demisto#148) * add key incident attachment command (demisto#150) * fix classifier, layout and incident type formats (demisto#152) * update release notes * move key incidents package to zerofox pack (demisto#153) * Move key incidents integration to zerofox pack * correct pack readme to include zerofox ki integration * improve unit tests in ki integration (demisto#154) * rename integration to ZeroFoxKeyIncidents * update release notes * correct incident field names * format ZeroFox pack files --------- Co-authored-by: Leonardo de Requeséns <[email protected]> * post demo fixes * fix incident name * ignore * fix incident name --------- Co-authored-by: Diego Ramirez R <[email protected]> Co-authored-by: Leonardo de Requeséns <[email protected]> Co-authored-by: meichler <[email protected]>

content-bot added Contribution Thank you! Contributions are always welcome! External PR Partner Support Level Indicates that the contribution is for Partner supported pack labels Apr 7, 2025

content-bot changed the base branch from master to contrib/riskive_zerofox_key_incidents_app April 7, 2025 18:45

content-bot assigned MosheEichler and karinafishman Apr 7, 2025

content-bot added the Security Review label Apr 7, 2025

content-bot requested review from MosheEichler and karinafishman April 7, 2025 18:45

DNRRomero changed the title ~~Zerofox key incidents app~~ [Zerofox] Key Incidents Integration Apr 11, 2025

MosheEichler requested changes Apr 21, 2025

View reviewed changes

MosheEichler added pending-contributor The PR is pending the response of its creator Pending-Partner labels Apr 21, 2025

Benimanela suggested changes Apr 21, 2025

View reviewed changes

lderequesensS and others added 9 commits April 21, 2025 13:34

Add new base application (#142)

dfde2c6

Format applications (#144)

6ac1d8d

add key incident client (#145)

975288a

add key incident attachment method (#146)

ec724e8

Add simple key mapper (#147)

5b81644

add incident type, incident type field and layout to ZeroFox Key Inci…

056bce3

…dent Pack (#149)

Add Fetch Incidents (#148)

4c83798

add key incident attachment command (#150)

52f9d9f

fix classifier, layout and incident type formats (#152)

d7a24b2

DNRRomero added 5 commits April 21, 2025 13:34

move key incidents package to zerofox pack (#153)

a738235

* Move key incidents integration to zerofox pack * correct pack readme to include zerofox ki integration

improve unit tests in ki integration (#154)

2217515

rename integration to ZeroFoxKeyIncidents

05a0e4c

update release notes

0e2e509

correct incident field names

6a1d251

DNRRomero requested review from Benimanela and MosheEichler April 21, 2025 17:35

content-bot assigned edik24 Apr 21, 2025

content-bot added Partner-Approved Contribution Form Filled Whether contribution form filled or not. Partner labels Apr 21, 2025

Benimanela suggested changes Apr 24, 2025

View reviewed changes

format ZeroFox pack files

5d9fda3

DNRRomero requested a review from Benimanela April 25, 2025 02:44

Benimanela approved these changes Apr 27, 2025

View reviewed changes

MosheEichler added pending-demo Demo pending docs-approved Security Approved If a contribution has been approved for merge by the security team, then this will allow a merge labels Apr 27, 2025

MosheEichler approved these changes Apr 28, 2025

View reviewed changes

MosheEichler approved these changes May 6, 2025

View reviewed changes

MosheEichler merged commit ca124f4 into demisto:contrib/riskive_zerofox_key_incidents_app May 6, 2025
19 of 23 checks passed

content-bot mentioned this pull request May 6, 2025

[Zerofox] Key Incidents Integration #39834

Merged

5 tasks

Conversation

DNRRomero commented Apr 7, 2025

Contributing to Cortex XSOAR Content

Status

Description

Must have

Uh oh!

CLAassistant commented Apr 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

content-bot commented Apr 7, 2025

Uh oh!

content-bot commented Apr 7, 2025

Uh oh!

MosheEichler commented Apr 10, 2025

Uh oh!

DNRRomero commented Apr 14, 2025

Uh oh!

MosheEichler commented Apr 21, 2025

Uh oh!

MosheEichler left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Benimanela left a comment

Choose a reason for hiding this comment

Uh oh!

DNRRomero commented Apr 21, 2025

Uh oh!

Benimanela commented Apr 23, 2025

Uh oh!

DNRRomero commented Apr 23, 2025

Uh oh!

Benimanela left a comment

Choose a reason for hiding this comment

Uh oh!

Benimanela Apr 24, 2025

Choose a reason for hiding this comment

Uh oh!

DNRRomero Apr 25, 2025

Choose a reason for hiding this comment

Uh oh!

Benimanela Apr 24, 2025

Choose a reason for hiding this comment

Uh oh!

DNRRomero Apr 25, 2025

Choose a reason for hiding this comment

Uh oh!

DNRRomero commented Apr 25, 2025

Uh oh!

MosheEichler commented Apr 27, 2025

Uh oh!

Uh oh!

github-actions Bot commented May 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

CLAassistant commented Apr 7, 2025 •

edited

Loading

MosheEichler left a comment •

edited

Loading