Skip to content

Commit 4ab0bc3

Browse files
efelmandarmaimorag
efelmandar
authored and
maimorag
committed
Bugfix/Multiple-issues-with-Detonate-URL-FireEye-AX (demisto#29412)
* Fix wrong tasks inputs * Update release notes * Update lines to end with a period * Fix task inputs * Fix inputs according to customer tests
1 parent 9c0c080 commit 4ab0bc3

File tree

4 files changed

+63
-44
lines changed

4 files changed

+63
-44
lines changed

‎Packs/fireeye/Playbooks/playbook-Detonate_URL_-_FireEye_AX.yml

Lines changed: 34 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,13 @@ tasks:
3535
quietmode: 0
3636
isoversize: false
3737
isautoswitchedtoquietmode: false
38+
continueonerrortype: ""
3839
'1':
3940
id: '1'
40-
taskid: b553e4e7-adfb-4d47-822f-23c2baa6c75a
41+
taskid: d19b6d0f-7bce-4fb6-85ad-10899a219703
4142
type: condition
4243
task:
43-
id: b553e4e7-adfb-4d47-822f-23c2baa6c75a
44+
id: d19b6d0f-7bce-4fb6-85ad-10899a219703
4445
version: -1
4546
name: Is there an active FireEye AX instance?
4647
description: Check for an active instance.
@@ -69,7 +70,8 @@ tasks:
6970
iscontext: true
7071
right:
7172
value:
72-
simple: FireEye (AX Series)
73+
simple: fireeye
74+
ignorecase: true
7375
- - operator: isEqualString
7476
left:
7577
value:
@@ -78,6 +80,7 @@ tasks:
7880
right:
7981
value:
8082
simple: active
83+
ignorecase: true
8184
accessor: brand
8285
iscontext: true
8386
right:
@@ -96,6 +99,7 @@ tasks:
9699
quietmode: 0
97100
isoversize: false
98101
isautoswitchedtoquietmode: false
102+
continueonerrortype: ""
99103
'2':
100104
id: '2'
101105
taskid: 93a33cc8-1959-49e6-8bde-49bf5dd9b550
@@ -138,6 +142,7 @@ tasks:
138142
quietmode: 0
139143
isoversize: false
140144
isautoswitchedtoquietmode: false
145+
continueonerrortype: ""
141146
'3':
142147
id: '3'
143148
taskid: 70b2a5ea-ad97-4dcf-89ea-36eade5e0a59
@@ -186,12 +191,13 @@ tasks:
186191
quietmode: 0
187192
isoversize: false
188193
isautoswitchedtoquietmode: false
194+
continueonerrortype: ""
189195
'4':
190196
id: '4'
191-
taskid: d2a9dd93-a95a-4910-821f-4cffe8b019b8
197+
taskid: 415427e9-78ce-4dd0-8d95-da55b9c6908a
192198
type: playbook
193199
task:
194-
id: d2a9dd93-a95a-4910-821f-4cffe8b019b8
200+
id: 415427e9-78ce-4dd0-8d95-da55b9c6908a
195201
version: -1
196202
name: GenericPolling
197203
description: |-
@@ -211,17 +217,17 @@ tasks:
211217
- '7'
212218
scriptarguments:
213219
Ids:
214-
simple: ${FireEyeAX.Submissions.Key}
220+
simple: ${FireEyeAX.Submissions.URL.Key}
215221
Interval:
216222
simple: ${inputs.interval}
217223
PollingCommandArgName:
218-
simple: submissionID
224+
simple: submission_Key
219225
PollingCommandName:
220-
simple: fe-submit-status
226+
simple: fe-submit-url-status
221227
Timeout:
222228
simple: ${inputs.timeout}
223229
dt:
224-
simple: FireEyeAX.Submissions(val.Status == 'finished')
230+
simple: FireEyeAX.Submissions.URL(val.Status == 'In Progress').Key
225231
separatecontext: true
226232
loop:
227233
iscommand: false
@@ -242,6 +248,7 @@ tasks:
242248
quietmode: 0
243249
isoversize: false
244250
isautoswitchedtoquietmode: false
251+
continueonerrortype: ""
245252
'6':
246253
id: '6'
247254
taskid: bee9857d-c4a9-4e9f-8939-822514c68078
@@ -259,7 +266,7 @@ tasks:
259266
{
260267
"position": {
261268
"x": 50,
262-
"y": 1245
269+
"y": 1415
263270
}
264271
}
265272
note: false
@@ -269,6 +276,7 @@ tasks:
269276
quietmode: 0
270277
isoversize: false
271278
isautoswitchedtoquietmode: false
279+
continueonerrortype: ""
272280
'7':
273281
id: '7'
274282
taskid: 922099fa-9796-48f4-8b19-090d46bda6ac
@@ -287,7 +295,7 @@ tasks:
287295
- '6'
288296
scriptarguments:
289297
submission_Key:
290-
simple: ${FireEyeAX.Submissions.Key}
298+
simple: ${FireEyeAX.Submissions.URL.Key}
291299
separatecontext: false
292300
view: |-
293301
{
@@ -303,12 +311,13 @@ tasks:
303311
quietmode: 0
304312
isoversize: false
305313
isautoswitchedtoquietmode: false
314+
continueonerrortype: ""
306315
'8':
307316
id: '8'
308-
taskid: 26314852-2b16-4e29-84f7-47fa57ecfe90
317+
taskid: d1c216d8-d4c1-4394-8b75-94867431a9a8
309318
type: regular
310319
task:
311-
id: 26314852-2b16-4e29-84f7-47fa57ecfe90
320+
id: d1c216d8-d4c1-4394-8b75-94867431a9a8
312321
version: -1
313322
name: Sleep (let the sandbox create the task)
314323
description: sleep
@@ -332,30 +341,31 @@ tasks:
332341
}
333342
note: false
334343
timertriggers: []
335-
ignoreworker: false
344+
ignoreworker: true
336345
skipunavailable: false
337346
quietmode: 0
338347
isoversize: false
339348
isautoswitchedtoquietmode: false
349+
continueonerrortype: ""
340350
'9':
341351
id: '9'
342-
taskid: 43aabf88-212c-42eb-840b-09571fc1e200
352+
taskid: 482cc724-9e91-4603-8910-2fda3c9f3520
343353
type: regular
344354
task:
345-
id: 43aabf88-212c-42eb-840b-09571fc1e200
355+
id: 482cc724-9e91-4603-8910-2fda3c9f3520
346356
version: -1
347357
name: View task
348-
description: commands.server.feSubmitStatus.description
349-
script: fireeye|||fe-submit-status
358+
description: Get a status for a url submitted to FireEye analysis
359+
script: '|||fe-submit-url-status'
350360
type: regular
351361
iscommand: true
352-
brand: fireeye
362+
brand: ""
353363
nexttasks:
354364
'#none#':
355365
- '4'
356366
scriptarguments:
357367
submission_Key:
358-
simple: ${FireEyeAX.Submissions.Key}
368+
simple: ${FireEyeAX.Submissions.URL.Key}
359369
separatecontext: false
360370
view: |-
361371
{
@@ -371,12 +381,13 @@ tasks:
371381
quietmode: 0
372382
isoversize: false
373383
isautoswitchedtoquietmode: false
384+
continueonerrortype: ""
374385
view: |-
375386
{
376387
"linkLabelsPosition": {},
377388
"paper": {
378389
"dimensions": {
379-
"height": 1290,
390+
"height": 1430,
380391
"width": 605,
381392
"x": 50,
382393
"y": 50
@@ -400,12 +411,12 @@ inputs:
400411
playbookInputQuery:
401412
- key: timeout
402413
value:
403-
simple: '10'
414+
simple: '30'
404415
required: false
405416
description: How long to wait before giving up waiting for results.
406417
playbookInputQuery:
407418
outputs:
408-
- contextPath: FireEyeAX.Submissions.Key
419+
- contextPath: FireEyeAX.Submissions.URL.Key
409420
description: The submission key.
410421
- contextPath: FireEyeAX.Submissions.Severity
411422
description: The severity level of the file.

‎Packs/fireeye/Playbooks/playbook-Detonate_URL_-_FireEye_AX_README.md

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,50 @@
1-
Detonating URL with FireEye AX
1+
Detonating URL with FireEye AX.
22

33
## Dependencies
44

55
This playbook uses the following sub-playbooks, integrations, and scripts.
66

77
### Sub-playbooks
88

9-
GenericPolling
9+
* GenericPolling
1010

1111
### Integrations
1212

13-
fireeye
13+
* fireeye
14+
* Fireeye
1415

1516
### Scripts
1617

17-
Sleep
18+
* Sleep
1819

1920
### Commands
2021

21-
- fe-submit-result
22-
- fe-submit-status
23-
- fe-submit-url
22+
* fe-submit-url
23+
* fe-submit-result
24+
* fe-submit-url-status
2425

2526
## Playbook Inputs
2627

2728
---
2829

29-
| **Name** | **Description** | **Default Value** | **Required** |
30-
| -------- | ------------------------------------------------------ | ----------------- | ------------ |
31-
| URL | URL to detonate. | URL.Data | Optional |
32-
| interval | How often to poll for results. | 1 | Optional |
33-
| timeout | How long to wait before giving up waiting for results. | 10 | Optional |
30+
| **Name** | **Description** | **Default Value** | **Required** |
31+
| --- | --- | --- | --- |
32+
| URL | URL to detonate | URL.Data | Optional |
33+
| interval | How often to poll for results. | 1 | Optional |
34+
| timeout | How long to wait before giving up waiting for results. | 30 | Optional |
3435

3536
## Playbook Outputs
3637

3738
---
3839

39-
| **Path** | **Description** | **Type** |
40-
| ------------------------------- | ----------------------------------- | -------- |
41-
| FireEyeAX.Submissions.Key | The submission key. | unknown |
42-
| FireEyeAX.Submissions.Severity | The severity level of the file. | unknown |
43-
| FireEyeAX.Submissions.InfoLevel | The info level of the report. | unknown |
44-
| DBotScore.Score | The actual score. | unknown |
45-
| DBotScore.Indicator | The indicator that was tested. | unknown |
46-
| DBotScore.Vendor | Vendor used to calculate the score. | unknown |
40+
| **Path** | **Description** | **Type** |
41+
| --- | --- | --- |
42+
| FireEyeAX.Submissions.URL.Key | The submission key. | unknown |
43+
| FireEyeAX.Submissions.Severity | The severity level of the file. | unknown |
44+
| FireEyeAX.Submissions.InfoLevel | The info level of the report. | unknown |
45+
| DBotScore.Score | The actual score. | unknown |
46+
| DBotScore.Indicator | The indicator that was tested. | unknown |
47+
| DBotScore.Vendor | Vendor used to calculate the score. | unknown |
4748

4849
## Playbook Image
4950

‎Packs/fireeye/ReleaseNotes/1_0_15.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
2+
#### Playbooks
3+
4+
##### Detonate URL - FireEye AX
5+
6+
- Fixed an issue with wrong integration commands used in the following tasks: "View task", "GenericPolling".
7+
- Fixed an issue with wrong inputs for the following tasks: "Is there an active FireEye AX instance?", "View task" and "GenericPolling".

‎Packs/fireeye/pack_metadata.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "FireEye (AX Series)",
33
"description": "Perform malware dynamic analysis",
44
"support": "xsoar",
5-
"currentVersion": "1.0.14",
5+
"currentVersion": "1.0.15",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",

0 commit comments

Comments
 (0)