Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

XDR IR fix in close_xdr_incident error 500 #37246

Open
wants to merge 19 commits into
base: master
Choose a base branch
from
+34 −5
Open

XDR IR fix in close_xdr_incident error 500 #37246

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
76ac6b1
popping resolve_comment from update_args when closr_xdr_incident is F…
Nov 17, 2024
e2e3c03
Added release note and updated metadata
Nov 17, 2024
10c03b1
remove a space
Nov 17, 2024
3ac4aa6
added another case to unittest
Nov 17, 2024
93152cb
added another case to unittest
Nov 17, 2024
f83cfd7
run pre commit locally
Nov 17, 2024
520733f
Apply suggestions from code review
noydavidi Nov 17, 2024
946e9c0
Added another fix when close_alerts_in_xdr is marked but close_xdr_in…
Nov 17, 2024
384b991
added documentation for close_all_alerts part
Nov 17, 2024
0feb526
pulled
Nov 17, 2024
9603a6b
popped back the status when close_alerts_in_xdr is true
Nov 17, 2024
52dd29b
minor changes
Nov 17, 2024
d26ddb7
minor changes
Nov 17, 2024
1b9c762
minor changes
Nov 17, 2024
646a5a4
minor changes
Nov 17, 2024
d3c676c
Added another sentence to release note
Nov 17, 2024
fda1454
Added a unittest for the new case
Nov 17, 2024
26bbf69
Apply suggestions from code review
noydavidi Nov 18, 2024
38bf46b
Merge branch 'master' into xdr-ir-fix-in-close-xdr-incident-error-500
noydavidi Nov 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1041,7 +1041,10 @@ def update_remote_system_command(client, args):

if not close_xdr_incident and (update_args.get('status') in XSOAR_RESOLVED_STATUS_TO_XDR.values()):
status = update_args.pop('status')
demisto.debug(f"Popped {status=} from update_args, incident status won't be updated in XDR.")
resolve_comment = update_args.pop('resolve_comment', None)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure that the only field causing this issue is the resolve_comment?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about this?


demisto.debug(f"Popped {status=} and {resolve_comment=} from update_args,"
f" incident status won't be updated in XDR.")

update_incident_command(client, update_args)

Expand Down
7 changes: 6 additions & 1 deletion Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -729,7 +729,9 @@ def test_update_remote_system_command(incident_changed, delta):
@pytest.mark.parametrize("data", [
{'close_reason': 'Resolved', 'status': 'Other'},
{'CortexXDRIRstatus': 'resolved', 'close_reason': 'Resolved', 'status': 'False Positive'},
{'status': 'under_investigation'}
{'status': 'under_investigation'},
{'status': 'Resolved', 'resolve_comment': 'comment'},
{'status': 'False Positive', 'resolve_comment': 'comment'}
])
def test_update_remote_system_command_should_not_close_xdr_incident(mocker, data):
"""
Expand Down Expand Up @@ -765,8 +767,11 @@ def test_update_remote_system_command_should_not_close_xdr_incident(mocker, data
update_args = mock_update_incident_command.call_args[0][1]
if data.get('status') in XSOAR_RESOLVED_STATUS_TO_XDR:
assert 'status' not in update_args
assert 'resolve_comment' not in update_args
else:
assert 'status' in update_args
if data.get('resolve_comment'):
assert 'resolve_comment' in update_args


@freeze_time("1997-10-05 15:00:00 GMT")
Expand Down
5 changes: 5 additions & 0 deletions Packs/CortexXDR/ReleaseNotes/6_1_91.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
#### Integrations

##### Palo Alto Networks Cortex XDR - Investigation and Response

Fixed an issue with outgoing mirroring when closing an incident in Cortex XSOAR with *close_xdr_incident* set to False resulted in a 500 error.
2 changes: 1 addition & 1 deletion Packs/CortexXDR/pack_metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Cortex XDR by Palo Alto Networks",
"description": "Automates Cortex XDR incident response, and includes custom Cortex XDR incident views and layouts to aid analyst investigations.",
"support": "xsoar",
"currentVersion": "6.1.90",
"currentVersion": "6.1.91",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
Loading