Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

XDR integrations - adding terminate commands #35226

Merged
merged 72 commits into from
Oct 1, 2024
Merged

Conversation

maimorag
Copy link
Contributor

@maimorag maimorag commented Jul 4, 2024

Status

  • In Progress
  • Ready
  • In Hold - (Reason for hold)

Related Issues

fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-11041.

Description

Adding support in 2 new API endpoints as commands

Copy link

github-actions bot commented Jul 4, 2024

Coverage

Coverage Report
FileStmtsMissCoverMissing
Packs/ApiModules/Scripts/CoreIRApiModule
   CoreIRApiModule.py170826184%243, 286, 289, 294, 308, 339, 346, 360, 364, 368, 375, 382, 389, 396, 417, 463, 468, 509, 524, 535, 547, 606–607, 613–618, 643, 649, 655, 667, 677, 683, 702, 714, 720, 726, 738, 748, 754, 790, 804, 829, 858, 874, 876, 984, 1014, 1017, 1027, 1096, 1102, 1122, 1128, 1130, 1157, 1173, 1359, 1383, 1389, 1402, 1404–1405, 1407, 1413–1414, 1420–1421, 1427, 1434–1435, 1468, 1470, 1516, 1523, 1530, 1536, 1542, 1549, 1556, 1566, 1611, 1613, 1642, 1725–1731, 1736, 1741–1744, 1746–1747, 1749–1750, 1755, 1761, 1763, 1767, 1774–1775, 1790–1791, 1807, 1812, 1820, 1868–1870, 1874, 1877, 1901, 1986, 1992, 1996, 2000, 2005, 2011, 2023–2024, 2030, 2035, 2041, 2044–2046, 2078, 2081–2084, 2198, 2271, 2277, 2281, 2285, 2288, 2492, 2506–2508, 2511, 2564–2566, 2569, 2723, 2734, 2737–2739, 2743–2746, 2750–2751, 2757, 2759–2763, 2767, 2773, 2775–2776, 2778, 2782–2785, 2787, 2794, 2796–2797, 2800–2804, 2807, 2809, 2811, 2813–2816, 2820–2821, 2823–2828, 2830, 2861, 3036–3039, 3043–3044, 3055, 3155, 3184, 3186, 3188, 3435–3436, 3528–3530, 3538, 3559, 3678–3681, 3768, 3776, 3780–3781, 3839–3841, 3847, 3886, 3900, 3907, 3914, 3956, 3963, 3970, 3977, 3984, 4188, 4224–4227, 4229–4231, 4334, 4368, 4374, 4381, 4383, 4390, 4392, 4410, 4433
Packs/Core/Integrations/CoreIOCs
   CoreIOCs.py3088173%53, 61, 63, 73, 89, 94, 111, 173–174, 235, 264, 294–301, 303–305, 307–308, 316, 337, 342, 351, 355–359, 363–364, 366, 370–372, 383, 396–407, 409, 433–441, 448–453, 459–468, 470–472
Packs/Core/Integrations/CortexCoreIR
   CortexCoreIR.py571278%39–42, 44, 47, 50, 57, 62, 65, 67, 111
Packs/CortexXDR/Integrations/CortexXDRIR
   CortexXDRIR.py6418586%59, 67, 71–73, 144–145, 206–210, 212, 215, 218, 222, 248–252, 254, 261–264, 275, 278, 281, 287, 290, 316, 321, 329, 331, 334–338, 340, 430–435, 484, 522, 537–538, 555, 565, 625, 628, 655, 662, 664, 741–742, 744, 797, 986–988, 991, 994, 999, 1034, 1042, 1065, 1094–1095, 1134, 1149–1151, 1154, 1163, 1196–1199, 1231, 1248
Packs/ctf01/Integrations/CortexXDRIRCTF
   CortexXDRIRCTF.py4644640%1–7, 10, 12–14, 16–18, 20, 37, 44, 52–57, 60–68, 71–72, 75–76, 79–80, 83–88, 91–98, 101, 109–121, 123–125, 128, 130, 134–138, 140, 143, 145, 153, 159, 163, 166–171, 173, 179–182, 184, 186, 210–211, 213, 218–219, 221–222, 226–227, 232–234, 240–241, 247–248, 253, 258–262, 265–266, 272–273, 279–280, 286–287, 293–294, 300–301, 303, 309, 311, 313, 321, 326, 333, 335, 337–342, 344, 346–347, 353, 360, 362–363, 369, 377, 379–380, 386, 389–391, 394, 402–404, 406, 410–412, 414, 417–418, 420–425, 428–429, 431, 434, 443–445, 447–449, 451–452, 455, 457–458, 547–554, 556, 558–559, 562, 564–565, 567, 569–570, 572, 574, 579, 582, 584–591, 593–597, 599, 601–609, 616, 618, 631, 634–638, 642–643, 648–650, 652, 654, 656, 658, 671, 673, 680, 683–687, 689, 692, 694, 697, 699, 706, 709–711, 713–715, 717–718, 720–722, 724–725, 727, 729–730, 732, 735–739, 741, 744, 748–753, 756–760, 769–770, 772–775, 777, 780–783, 785–786, 788, 791–793, 795, 797–799, 801, 803–806, 808, 811–813, 815–816, 819, 821, 825–826, 828–829, 831, 834, 837–838, 842, 845, 847–850, 852, 854, 860, 865, 870–871, 874–875, 877–879, 882, 885, 890, 896, 902, 1156, 1159, 1175–1176, 1180–1181, 1183–1184, 1186–1188, 1190–1191, 1196–1197, 1202, 1208–1210, 1212, 1214–1215, 1219–1220, 1222, 1224–1225, 1227–1229, 1235–1236, 1239–1240, 1242–1243, 1245–1247, 1249–1251, 1254, 1256–1257, 1259, 1261, 1263, 1266–1267, 1269–1270, 1275, 1280, 1283, 1285, 1293–1297, 1300, 1308, 1312, 2225–2228, 2230–2231, 2233, 2235, 2247, 2256–2258, 2260–2265, 2267, 2271, 2273, 2276, 2285, 2288–2293, 2295–2296, 2302, 2306, 2308, 2310, 2314
TOTAL317890371% 

Tests Skipped Failures Errors Time
269 4 💤 0 ❌ 0 🔥 17.299s ⏱️

ilaredo and others added 28 commits July 4, 2024 16:01
…35004)

* Added external last updated time incident field to the commontypes

* RN

* fomated the incident field

* RN modified

* changed from verison

* RN

* commit

* unsearchable true
* Updated the MP to support only the right one

* Update rn
* Revert "Revert "[Marketplace Contribution] FTP (#34659) (#35177)" (#35199)"

This reverts commit c34a2a4.

* added noqa

---------

Co-authored-by: RotemAmit <[email protected]>
* Update PaloAltoNetworks_Cortex_XDR_Incident_Sync_README.md

* Update Packs/CortexXDR/Playbooks/PaloAltoNetworks_Cortex_XDR_Incident_Sync_README.md

Co-authored-by: ShirleyDenkberg <[email protected]>

---------

Co-authored-by: Mai Morag <[email protected]>
* [SplunkPy] Update the Troubleshooting

* Update Packs/SplunkPy/Integrations/SplunkPy/README.md

Co-authored-by: ShirleyDenkberg <[email protected]>

* Update Packs/SplunkPy/Integrations/SplunkPy/README.md

Co-authored-by: ShirleyDenkberg <[email protected]>

---------

Co-authored-by: ShirleyDenkberg <[email protected]>
* import problematic packs

* update

* changes

* import problematic packs

* update dockers

* update dockers

* added rns

* reverts

* update dockers

* cr fixes
* fix ComonServerPython docstring

* RN
* New pack for CVE-2024-6387

* exclude-known-url

* adjust the playbook and pack readme

* adjust the playbook and pack readme

---------

Co-authored-by: Chanan Welt <[email protected]>
* Fixed an issue with the data collection tasks to send emails to the corresponding roles in XSIAM (Investigator) and XSOAR (Analyst).

* RN

* Removed administrator role from the data collection tasks

* udpated RN
* Creating modeling rules

* Updating schema

* Removing url portal link

* Adding release notes and test data
* update image

* bump image

* Update Packs/ProofpointEmailSecurity/ReleaseNotes/1_0_2.md

* Update Packs/ProofpointEmailSecurity/Integrations/ProofpointEmailSecurityEventCollector/ProofpointEmailSecurityEventCollector.yml
* updated the classifier and layout of the qradar integration

* added the release notes

* commit

* RN
* improved implementation of IsIncidentPartOfCampaign

* was found

* docker update

* skip none string
* Zerofox/add cac data (#35183)

* add compromised credentials command (#138)

* fix mypy check and tests

* Fix yml file format

* Add period to yaml description

* Include PR comments

- fix release notes comment
- add unit test
- format code

* update docker

* update RN

---------

Co-authored-by: Diego Ramirez R <[email protected]>
Co-authored-by: ipolishuk <[email protected]>
* fixed xpanse

* add RN

* fixed

* adding rn

* fix test

* fix test

* fix testcommonserver pyton

* fix unit tests and revert changes in demistomock

* add xplanatory docstring

* Bump pack from version Base to 1.34.24.

* adding memory threshold to incident enrichment

---------

Co-authored-by: sapirshuker <[email protected]>
Co-authored-by: Content Bot <[email protected]>
* added client credentials flow - working

* updated readme and description

* changed to default value for token_retrieval_url

* created release notes and run pre commit

* changed redme and description after code review

* updated docker image

* changed some mistakes in readme

* changed some mistakes in discription

---------

Co-authored-by: noy <nodavidi.paloaltonetworks.com>
* changed yml file

* added client credentials to py

* added client credentials to py

* added release note

* changed readme and description for client credentials

* run pre commit

* updated docker image

* changed some mistakes in readme

* changed some mistakes in discription

---------

Co-authored-by: noy <nodavidi.paloaltonetworks.com>
updated integration logo to align with Prisma Cloud V2

Co-authored-by: epartington <[email protected]>
Co-authored-by: Danny Fried <[email protected]>
* changed the py file to match client credentials

* changed the yml file to match client cre4dentials

* changed the scope for client credentails

* changed the scope

* py

* getting 203 error from api

* made the final changes for client credentials

* changed description

* changed some description and added client credentials for README

* ran precommit and created release nores

* added global var for scope

* fixed pre commit

* made changes in readme and in description after doc review

* removed in description and in readme 'using cortex xsoar azure app'

* changed to default value for token_retrieval_url

* changed condition for scope

* changed test test_generate_login_urlplaybook to match the new scope

* changes cope global name

* updated docker image

* deleted the word Demisto - not relevant

* changed docker image and removed demisto word from description

---------

Co-authored-by: noy <nodavidi.paloaltonetworks.com>
* fix + RN + test

* RN

* fix ruff

* CR changes

* fix pre commit

* CR changes
* fixed token to be with ?

* RN

* pre commit and docker

* fixed test AzureStorageTable_test.py

* fixed test AzureStorageQueue_test.py

* fixed test AzureStorageFileShare_test.py

* fixed test AzureStorageContainer_test.py

---------

Co-authored-by: okarkkatz <[email protected]>
@maimorag maimorag marked this pull request as ready for review September 19, 2024 07:19
Copy link
Contributor

@eyalpalo eyalpalo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets schedule a demo as well

Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml Outdated Show resolved Hide resolved
Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml Outdated Show resolved Hide resolved
Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml Outdated Show resolved Hide resolved
Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml Outdated Show resolved Hide resolved
Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml Outdated Show resolved Hide resolved
Packs/Core/Integrations/CortexCoreIR/README.md Outdated Show resolved Hide resolved
Packs/Core/Integrations/CortexCoreIR/README.md Outdated Show resolved Hide resolved
Packs/Core/Integrations/CortexCoreIR/README.md Outdated Show resolved Hide resolved
Packs/Core/Integrations/CortexCoreIR/README.md Outdated Show resolved Hide resolved
Packs/Core/ReleaseNotes/3_0_69.md Outdated Show resolved Hide resolved
@ShirleyDenkberg
Copy link
Contributor

@eyalpalo Doc review completed.

Copy link
Contributor

@eyalpalo eyalpalo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice

@maimorag maimorag merged commit 0ca66e1 into master Oct 1, 2024
16 checks passed
@maimorag maimorag deleted the 117833-xdr-api-playbooks branch October 1, 2024 11:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.