Skip to content

Commit 403f09b

Browse files
YuvHayunYuvHayun
authored
Fix akamai time var (demisto#38216)
* remove _time from code * update rn * added a way to send with time * tests fixes
1 parent 3a1b061 commit 403f09b

File tree

5 files changed

+42
-14
lines changed

5 files changed

+42
-14
lines changed

‎Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.py

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -558,6 +558,18 @@ def decode_url(headers: str) -> dict:
558558
return decoded_dict
559559

560560

561+
def post_latest_event_time(latest_event, base_msg):
562+
try:
563+
if isinstance(latest_event, str):
564+
latest_event = json.loads(latest_event)
565+
latest_event_time = date_format_converter(
566+
from_format='epoch', date_before=latest_event.get("httpMessage", {}).get("start", "0"))
567+
demisto.info(f"{base_msg} latest event time is: {latest_event_time}")
568+
except Exception as e:
569+
demisto.debug(f"caught an exception when attempting to execute latest_event_time {e}")
570+
demisto.info(base_msg)
571+
572+
561573
############################################## Beginning of beta part ##############################################
562574
BETA_FETCH_EVENTS_MAX_PAGE_SIZE = 600000 # Allowed events limit per request.
563575
MAX_ALLOWED_CONCURRENT_TASKS = 10000
@@ -702,7 +714,10 @@ async def process_and_send_events_to_xsiam(events: list[str], should_skip_decode
702714
demisto.debug(f"Couldn't decode {event=}, reason: {e}")
703715
finally:
704716
processed_events.append(event)
705-
demisto.info(f"Running in interval = {counter}. Sending {len(processed_events)} events to xsiam.")
717+
post_latest_event_time(
718+
latest_event=processed_events[-1],
719+
base_msg=f"Running in interval = {counter}. Sending {len(processed_events)} events to xsiam."
720+
)
706721
tasks = send_events_to_xsiam_akamai(processed_events, VENDOR, PRODUCT, should_update_health_module=False,
707722
chunk_size=SEND_EVENTS_TO_XSIAM_CHUNK_SIZE, send_events_asynchronously=True,
708723
url_key="host", data_format="json", data_size_expected_to_split_evenly=True,
@@ -1189,8 +1204,10 @@ def main(): # pragma: no cover
11891204
should_skip_decode_events=should_skip_decode_events
11901205
)):
11911206
if events:
1192-
demisto.info(f"Sending {len(events)} events to xsiam using multithreads."
1193-
f"latest event time is: {events[-1]['_time']}")
1207+
post_latest_event_time(
1208+
latest_event=events[-1],
1209+
base_msg=f"Sending {len(events)} events to xsiam using multithreads."
1210+
)
11941211
futures = send_events_to_xsiam(events, VENDOR, PRODUCT, should_update_health_module=False,
11951212
chunk_size=SEND_EVENTS_TO_XSIAM_CHUNK_SIZE,
11961213
multiple_threads=True, data_format="json")

‎Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM_test.py

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -703,8 +703,8 @@ async def test_process_and_send_events_to_xsiam_skip_events_decoding(mocker):
703703
"%20GMT%0AConnection%3A%20keep-alive%0AServer-Timing%3A%20cdn-cache%3B%20desc%3DMISS%0AServer-Timing%3A%20edge%3B"
704704
"%20dur%3D23%0AServer-Timing%3A%20origin%3B%20dur%3D72%0AServer-Timing%3A%20intid%3Bdesc%3Ddd%0A"
705705
"Strict-Transport-Security%3A%20max-age%3D31536000%20%3B%20includeSubDomains%20%3B%20preload%0A"
706-
events = [f'{{"id": 1, "httpMessage": {{"start": 1, "requestHeaders": "{requestHeaders}"}}}}',
707-
f'{{"id": 2, "httpMessage": {{"start": 2, "requestHeaders": "{requestHeaders}"}}}}']
706+
events = [f'{{"id": 1, "httpMessage": {{"start": 1591303422, "requestHeaders": "{requestHeaders}"}}}}',
707+
f'{{"id": 2, "httpMessage": {{"start": 1591303422, "requestHeaders": "{requestHeaders}"}}}}']
708708
demisto_info = mocker.patch.object(demisto, 'info')
709709
send_events_to_xsiam_akamai = mocker.patch("Akamai_SIEM.send_events_to_xsiam_akamai",
710710
side_effect=Exception("Interrupted execution")) # to break endless loop.
@@ -716,7 +716,8 @@ async def test_process_and_send_events_to_xsiam_skip_events_decoding(mocker):
716716
demisto_info.assert_has_calls([
717717
mocker.call(f"Running in interval = 1. got {len(events)} events, moving to processing events data."),
718718
mocker.call("Running in interval = 1. Skipping decode events."),
719-
mocker.call(f"Running in interval = 1. Sending {len(events)} events to xsiam.")
719+
mocker.call(f"Running in interval = 1. Sending {len(events)} events to xsiam. "
720+
"latest event time is: 2020-06-04T20:43:42Z")
720721
])
721722

722723

@@ -736,26 +737,29 @@ async def test_process_and_send_events_to_xsiam_with_events_decoding(mocker):
736737
"%20GMT%0AConnection%3A%20keep-alive%0AServer-Timing%3A%20cdn-cache%3B%20desc%3DMISS%0AServer-Timing%3A%20edge%3B"
737738
"%20dur%3D23%0AServer-Timing%3A%20origin%3B%20dur%3D72%0AServer-Timing%3A%20intid%3Bdesc%3Ddd%0A"
738739
"Strict-Transport-Security%3A%20max-age%3D31536000%20%3B%20includeSubDomains%20%3B%20preload%0A"
739-
events = [f'{{"id": 1, "httpMessage": {{"start": 1, "requestHeaders": "{requestHeaders}"}}}}',
740-
f'{{"id": 2, "httpMessage": {{"start": 2, "requestHeaders": "{requestHeaders}"}}}}']
740+
events = [f'{{"id": 1, "httpMessage": {{"start": 1491303422, "requestHeaders": "{requestHeaders}"}}}}',
741+
f'{{"id": 2, "httpMessage": {{"start": 1591303422, "requestHeaders": "{requestHeaders}"}}}}']
741742
demisto_info = mocker.patch.object(demisto, 'info')
742743
send_events_to_xsiam_akamai = mocker.patch("Akamai_SIEM.send_events_to_xsiam_akamai",
743744
side_effect=Exception("Interrupted execution")) # to break endless loop.
744745
with pytest.raises(Exception) as e:
745746
await Akamai_SIEM.process_and_send_events_to_xsiam(events, should_skip_decode_events=False, offset="test", counter=1)
746747
assert str(e.value) == "Interrupted execution" # Ensure the exception indeed was the planned one.
747748
processed_events = [
748-
{"id": 1, "httpMessage": {"start": 1, "requestHeaders": {'Content_Type': 'application/json;charset=UTF-8',
749-
'user': '[email protected]', 'client': ''}, "responseHeaders": {}}},
750-
{"id": 2, "httpMessage": {"start": 2, "requestHeaders": {'Content_Type': 'application/json;charset=UTF-8',
751-
'user': '[email protected]', 'client': ''}, "responseHeaders": {}}}
749+
{"id": 1, "httpMessage": {"start": 1491303422, "requestHeaders": {'Content_Type': 'application/json;charset=UTF-8',
750+
'user': '[email protected]', 'client': ''},
751+
"responseHeaders": {}}},
752+
{"id": 2, "httpMessage": {"start": 1591303422, "requestHeaders": {'Content_Type': 'application/json;charset=UTF-8',
753+
'user': '[email protected]', 'client': ''},
754+
"responseHeaders": {}}}
752755
]
753756
assert send_events_to_xsiam_akamai.call_args_list[0][0][0] == processed_events
754757
assert isinstance(send_events_to_xsiam_akamai.call_args_list[0][0][0][0], dict)
755758
demisto_info.assert_has_calls([
756759
mocker.call(f"Running in interval = 1. got {len(events)} events, moving to processing events data."),
757760
mocker.call("Running in interval = 1. decoding events."),
758-
mocker.call(f"Running in interval = 1. Sending {len(events)} events to xsiam.")
761+
mocker.call(f"Running in interval = 1. Sending {len(events)} events to xsiam. "
762+
"latest event time is: 2020-06-04T20:43:42Z")
759763
])
760764

761765

‎Packs/Akamai_SIEM/ReleaseNotes/1_2_0.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
***WARNING: This version is invalid. Please install a different version.***
12

23
#### Integrations
34

‎Packs/Akamai_SIEM/ReleaseNotes/1_2_1.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
2+
#### Integrations
3+
4+
##### Akamai WAF SIEM
5+
6+
- Fixed and issue where **fetch-events** would fail due to missing **_time** field.

‎Packs/Akamai_SIEM/pack_metadata.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Akamai WAF SIEM",
33
"description": "Use the Akamai WAF SIEM integration to retrieve security events from Akamai Web Application Firewall (WAF) service.",
44
"support": "xsoar",
5-
"currentVersion": "1.2.0",
5+
"currentVersion": "1.2.1",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",

0 commit comments

Comments
 (0)