Skip to content

Commit d546582

Browse files
bakatziramshamah419
bakatzir
and
amshamah419
authored
AF + threat vault - auto key (demisto#12169)
* add support for cortex xsoar AF api key * update RN * update DO * fix malformed yml * update api_key mock in UT * add to demistomock * added config without key * fix logic of override_default_credentials * add inline comment * support also threat vault * reformat to be used in a class * add rn * update conf.json * revert not needed change * added rn for threat vault * add @logger * add given/when/then * add docstring to the class * revert indentation * add more UT * re add changes * add newline * update conflicts * update conflicts2 * update conflicts3 * update conflicts vt * Update Packs/AutoFocus/Integrations/AutofocusV2/README.md Co-authored-by: Andrew Shamah <[email protected]> * Update Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.yml Co-authored-by: Andrew Shamah <[email protected]> * Update Packs/AutoFocus/ReleaseNotes/1_1_17.md Co-authored-by: Andrew Shamah <[email protected]> * Update Packs/Base/ReleaseNotes/1_9_0.md Co-authored-by: Andrew Shamah <[email protected]> * Update Packs/PaloAltoNetworks_Threat_Vault/ReleaseNotes/1_0_3.md Co-authored-by: Andrew Shamah <[email protected]> * Update Packs/AutoFocus/ReleaseNotes/1_1_17.md Co-authored-by: Andrew Shamah <[email protected]> * Update Packs/AutoFocus/ReleaseNotes/1_1_17.md Co-authored-by: Andrew Shamah <[email protected]> * update readme * Merge branch 'af_auto_key' of github.com:demisto/content into af_auto_key # Please enter a commit message to explain why this merge is necessary, # especially if it merges an updated upstream into a topic branch. # # Lines starting with '#' will be ignored, and an empty message aborts # the commit. * mitre feed conflicts * latest condflicts revert * use demistoexception * add more UT * improve err msg * rm override_default_credentials usage * rm override_default_credentials UT * added additionalinfo * rm blank line * rn * rn_fix Co-authored-by: Andrew Shamah <[email protected]>
1 parent 51b9565 commit d546582

21 files changed

Lines changed: 175 additions & 48 deletions

File tree

‎Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.py‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,4 @@
1-
from typing import Optional
2-
3-
import demistomock as demisto
41
from CommonServerPython import *
5-
from CommonServerUserPython import *
62

73
''' IMPORTS '''
84

@@ -17,7 +13,9 @@
1713

1814
''' GLOBALS/PARAMS '''
1915
PARAMS = demisto.params()
20-
API_KEY = PARAMS.get('api_key')
16+
17+
API_KEY = AutoFocusKeyRetriever(PARAMS.get('api_key')).key
18+
2119
# Remove trailing slash to prevent wrong URL path to service
2220
SERVER = 'https://autofocus.paloaltonetworks.com'
2321
# Should we use SSL
@@ -258,7 +256,6 @@
258256
for verdict in verdicts:
259257
VERDICTS_TO_DBOTSCORE[verdict] = 3
260258

261-
262259
''' HELPER FUNCTIONS '''
263260

264261

‎Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ commonfields:
33
id: AutoFocus V2
44
version: -1
55
configuration:
6-
- display: API Key
6+
- additionalinfo: TIM customers that upgraded to version 6.2 or above have this value pre-configured in their main account, so no additional input is needed.
7+
display: API Key
78
name: api_key
8-
required: true
9+
required: false
910
type: 4
1011
- additionalinfo: Reliability of the source providing the intelligence data.
1112
defaultvalue: B - Usually reliable
@@ -1117,7 +1118,7 @@ script:
11171118
- contextPath: Domain.Name
11181119
description: The domain name.
11191120
type: String
1120-
dockerimage: demisto/python3:3.9.2.17957
1121+
dockerimage: demisto/python3:3.9.4.18682
11211122
isfetch: false
11221123
longRunning: false
11231124
longRunningPort: false

‎Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2_test.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,14 @@
149149
]
150150

151151

152+
@pytest.fixture(autouse=True)
153+
def init_tests(mocker):
154+
params = {
155+
'api_key': '1234'
156+
}
157+
mocker.patch.object(demisto, 'params', return_value=params)
158+
159+
152160
def util_load_json(path):
153161
with io.open(path, mode='r', encoding='utf-8') as f:
154162
return json.loads(f.read())

‎Packs/AutoFocus/Integrations/AutofocusV2/README.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ To get your API key, you need to add an authorization code, and then activate th
2323
Use the API key when configuring the integration.
2424
For more information on activating the license see [Activating AutoFocus Licenses](https://docs.paloaltonetworks.com/autofocus/autofocus-admin/get-started-with-autofocus/activate-autofocus-licenses.html).
2525

26-
## Configure AutoFocus V2 on Demisto
26+
## Configure AutoFocus V2 on Cortex XSOAR
2727
---
2828

2929
1. Navigate to **Settings** > **Integrations** > **Servers & Services**.
@@ -35,9 +35,10 @@ For more information on activating the license see [Activating AutoFocus License
3535
| Name | A meaningful name for the integration instance. | AutoFocus V2_instance_2 |
3636
| API Key | Account's private token. | N/A |
3737
| Source Reliability | Reliability of the source providing the intelligence data. | B - Usually reliable |
38+
| Additional Malicious Verdicts | A comma-separated list of Palo Alto Networks verdicts to consider as malicious when calculating the DBot score. | malware,phishing,c2 |
39+
| Override default credentials | Whether to override the default AutoFocus API key given by the Cortex XSOAR platform. | False |
3840
| Trust any certificate (not secure) | When selected, certificates are not checked. | N/A |
39-
| Use System Proxy Settings | Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. | https:/<span></span>/www.markdownguide.org |
40-
| Additional Malicious Verdicts | A comma-separated list of Palo Alto Networks verdicts to consider as malicious when calculating the DBot score. | malware,phishing,c2 |
41+
| Use System Proxy Settings | Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. | N/A |
4142

4243

4344
4. Click **Test** to validate the URLs, token, and connection.

‎Packs/AutoFocus/Integrations/FeedAutofocus/FeedAutofocus.py‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -537,14 +537,6 @@ def main():
537537
feed_tags = argToList(params.get('feedTags'))
538538
tlp_color = params.get('tlp_color')
539539

540-
client = Client(api_key=params.get('api_key'),
541-
insecure=params.get('insecure'),
542-
proxy=params.get('proxy'),
543-
indicator_feeds=params.get('indicator_feeds'),
544-
custom_feed_urls=params.get('custom_feed_urls'),
545-
scope_type=params.get('scope_type'),
546-
sample_query=params.get('sample_query'))
547-
548540
command = demisto.command()
549541
demisto.info(f'Command being called is {command}')
550542
# Switch case
@@ -553,6 +545,15 @@ def main():
553545
'autofocus-get-indicators': get_indicators_command
554546
}
555547
try:
548+
auto_focus_key_retriever = AutoFocusKeyRetriever(params.get('api_key'))
549+
client = Client(api_key=auto_focus_key_retriever.key,
550+
insecure=params.get('insecure'),
551+
proxy=params.get('proxy'),
552+
indicator_feeds=params.get('indicator_feeds'),
553+
custom_feed_urls=params.get('custom_feed_urls'),
554+
scope_type=params.get('scope_type'),
555+
sample_query=params.get('sample_query'))
556+
556557
if demisto.command() == 'fetch-indicators':
557558
indicators = fetch_indicators_command(client, feed_tags, tlp_color)
558559
# we submit the indicators in batches

‎Packs/AutoFocus/Integrations/FeedAutofocus/FeedAutofocus.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,10 @@ configuration:
1616
- Samples Feed
1717
required: true
1818
type: 16
19-
- display: The AutoFocus API key
19+
- additionalinfo: TIM customers that upgraded to version 6.2 or above have this value pre-configured in their main account, so no additional input is needed.
20+
display: API Key
2021
name: api_key
21-
required: true
22+
required: false
2223
type: 4
2324
- additionalinfo: Only necessary in case a Custom Feed is fetched. Can also support
2425
a CSV of Custom feed URLs.
@@ -139,7 +140,7 @@ script:
139140
description: Gets the indicators from AutoFocus.
140141
execution: false
141142
name: autofocus-get-indicators
142-
dockerimage: demisto/python3:3.8.5.11789
143+
dockerimage: demisto/python3:3.9.4.18682
143144
feed: true
144145
isfetch: false
145146
longRunning: false

‎Packs/AutoFocus/Integrations/FeedAutofocus/README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ For more information click [here](https://docs.paloaltonetworks.com/autofocus/au
33
This Feed supports the AutoFocus Custom Feed and the AutoFocus Samples Feed.
44
To ingest the Daily Feed, use the [AutoFocus Daily Feed](https://xsoar.pan.dev/docs/reference/integrations/auto-focus-daily-feed).
55

6-
## Configure AutoFocus Feed on Demisto
6+
## Configure AutoFocus Feed on Cortex XSOAR
77

88
1. Navigate to **Settings** > **Integrations** > **Servers & Services**.
99
2. Search for AutoFocus Feed.
@@ -13,7 +13,7 @@ To ingest the Daily Feed, use the [AutoFocus Daily Feed](https://xsoar.pan.dev/d
1313
| --- | --- | --- |
1414
| feed | The fetch indicators. | False |
1515
| indicator_feeds | The indicator feed. Choose the requested indicator feeds. The Custom Feeds and Daily Threat Feed. | True |
16-
| api_key | The AutoFocus API key. | True |
16+
| api_key | API Key. | False |
1717
| custom_feed_urls | The URL for the custom feed to fetch. This applies only in cases where a Custom Feed is requested. | False |
1818
| scope_type | The scope of the samples to be fetched. | False |
1919
| sample_query | The query that will be used to fetch the samples. | False |
@@ -24,6 +24,7 @@ To ingest the Daily Feed, use the [AutoFocus Daily Feed](https://xsoar.pan.dev/d
2424
| feedExpirationInterval | The interval after which the feed expires. | False |
2525
| feedFetchInterval | The feed fetch interval. | False |
2626
| feedBypassExclusionList | Whether to bypass exclusion list. | False |
27+
| override_default_credentials | Override default credentials | False |
2728
| insecure | Whether to trust any certificate (not secure). | False |
2829
| proxy | Whether to use the system proxy settings. | False |
2930

‎Packs/AutoFocus/Integrations/FeedAutofocusDaily/FeedAutofocusDaily.py‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
import demistomock as demisto
2-
from CommonServerPython import *
3-
from CommonServerUserPython import *
1+
from typing import List, Tuple, Optional
42

53
# IMPORTS
64
import requests
7-
from typing import List, Tuple, Optional
5+
from CommonServerUserPython import *
6+
7+
from CommonServerPython import *
88

99
# Disable insecure warnings
1010
requests.packages.urllib3.disable_warnings()
@@ -237,17 +237,19 @@ def main():
237237
params = demisto.params()
238238
feed_tags = argToList(params.get('feedTags'))
239239
tlp_color = params.get('tlp_color')
240-
client = Client(api_key=params.get('api_key'),
241-
insecure=params.get('insecure'))
242240

243241
command = demisto.command()
244242
demisto.info(f'Command being called is {command}')
245-
# Switch case
243+
246244
commands = {
247245
'test-module': module_test_command,
248246
'autofocus-daily-get-indicators': get_indicators_command
249247
}
250248
try:
249+
auto_focus_key_retriever = AutoFocusKeyRetriever(params.get('api_key'))
250+
client = Client(api_key=auto_focus_key_retriever.key,
251+
insecure=params.get('insecure'))
252+
251253
if demisto.command() == 'fetch-indicators':
252254
indicators = fetch_indicators_command(client, feed_tags, tlp_color)
253255
# we submit the indicators in batches

‎Packs/AutoFocus/Integrations/FeedAutofocusDaily/FeedAutofocusDaily.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,10 @@ configuration:
88
required: false
99
defaultvalue: 'true'
1010
type: 8
11-
- display: The AutoFocus API key
11+
- additionalinfo: TIM customers that upgraded to version 6.2 or above have this value pre-configured in their main account, so no additional input is needed.
12+
display: API Key
1213
name: api_key
13-
required: true
14+
required: false
1415
type: 4
1516
- additionalinfo: Indicators from this integration instance will be marked with this reputation
1617
defaultvalue: Bad
@@ -118,7 +119,7 @@ script:
118119
description: Gets indicators from AutoFocus.
119120
execution: false
120121
name: autofocus-daily-get-indicators
121-
dockerimage: demisto/python3:3.8.5.10845
122+
dockerimage: demisto/python3:3.9.4.18682
122123
feed: true
123124
isfetch: false
124125
longRunning: false

‎Packs/AutoFocus/Integrations/FeedAutofocusDaily/README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Use the AutoFocus Feeds integration to fetch indicators from AutoFocus.
22
For more information click [here](https://docs.paloaltonetworks.com/autofocus/autofocus-admin/autofocus-feeds.html).
33

4-
## Configure AutoFocus Feed on Demisto
4+
## Configure AutoFocus Feed on Cortex XSOAR
55

66
1. Navigate to **Settings** > **Integrations** > **Servers & Services**.
77
2. Search for AutoFocus Feed.
@@ -10,14 +10,15 @@ For more information click [here](https://docs.paloaltonetworks.com/autofocus/au
1010
| **Parameter** | **Description** | **Required** |
1111
| --- | --- | --- |
1212
| feed | The fetch indicators. | False |
13-
| api_key | The AutoFocus API key. | True |
13+
| api_key | API Key. | False |
1414
| feedReputation | The indicator reputation. | False |
1515
| feedReliability | The source's reliability. | True |
1616
| tlp_color | The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. More information about the protocol can be found at https://us-cert.cisa.gov/tlp | False |
1717
| feedExpirationPolicy | The feed's expiration policy. | False |
1818
| feedExpirationInterval | The interval after which the feed expires. | False |
1919
| feedFetchInterval | The feed fetch interval. | False |
2020
| feedBypassExclusionList | Whether to bypass exclusion list. | False |
21+
| override_default_credentials | Override default credentials | False |
2122
| insecure | Whether to trust any certificate (not secure). | False |
2223
| proxy | Whether to use the system proxy settings. | False |
2324

0 commit comments

Comments
 (0)