De widget

Packs/Code42/Integrations/Code42/CHANGELOG.md

@@ -1,5 +1,7 @@
 ## [Unreleased]
 Added new commands:
+    - **Code42GetDepartingEmployeeAlerts** automation script which gets departing employees with alerts.
+    - **code42-alert-search** that searches alerts by username.
     - **code42-departingemployee-get-all** that gets all the employees on the Departing Employee List.
     - **code42-highriskemployee-add** that takes a username and adds the employee to the High Risk Employee List.
     - **code42-highriskemployee-remove** that takes a username and remove the employee from the High Risk Employee List.

Packs/Code42/Integrations/Code42/Code42.py

@@ -20,7 +20,7 @@
     FileCategory,
 )
 from py42.sdk.queries.alerts.alert_query import AlertQuery
-from py42.sdk.queries.alerts.filters import DateObserved, Severity, AlertState
+from py42.sdk.queries.alerts.filters import DateObserved, Severity, AlertState, Actor as AlertActor
 
 # Disable insecure warnings
 requests.packages.urllib3.disable_warnings()
@@ -216,6 +216,10 @@ def fetch_alerts(self, start_time, event_severity_filter):
         res = self._sdk.alerts.search(query)
         return res["alerts"]
 
+    def search_alerts(self, username):
+        query = AlertQuery(AlertActor.eq(username))
+        return self._sdk.alerts.search(query)["alerts"]
+
     def get_alert_details(self, alert_id):
         res = self._sdk.alerts.get_details(alert_id)["alerts"]
         if not res:
@@ -509,6 +513,27 @@ def alert_resolve_command(client, args):
         return_error(create_command_error_message(demisto.command(), e))
 
 
+def alert_search_command(client, args):
+    username = args["username"]
+    try:
+        alerts = client.search_alerts(username)
+        alert_context = []
+        for alert in alerts:
+            alert_context.append(map_to_code42_alert_context(alert))
+        readable_outputs = tableToMarkdown(
+            "Code42 Security Alert Search",
+            alert_context,
+            headers=SECURITY_ALERT_HEADERS,
+        )
+        return (
+            readable_outputs,
+            {"Code42.SecurityAlert": alert_context},
+            alerts
+        )
+
+    except Exception as e:
+        return_error(create_command_error_message(demisto.command(), e))
+
 @logger
 def departingemployee_add_command(client, args):
     departing_date = args.get("departuredate")
@@ -815,6 +840,7 @@ def main():
         commands = {
             "code42-alert-get": alert_get_command,
             "code42-alert-resolve": alert_resolve_command,
+            "code42-alert-search": alert_search_command,
             "code42-securitydata-search": securitydata_search_command,
             "code42-departingemployee-add": departingemployee_add_command,
             "code42-departingemployee-remove": departingemployee_remove_command,

Packs/Code42/Integrations/Code42/Code42.yml

@@ -240,7 +240,7 @@ script:
     - contextPath: Code42.SecurityAlert.Severity
       description: The severity of the alert.
       type: string
-    description: Retrieve alert details by alert ID
+    description: Retrieve alert details by alert ID.
   - name: code42-alert-resolve
     arguments:
     - name: id
@@ -252,6 +252,37 @@ script:
       description: The alert ID of the resolved alert.
       type: string
     description: Resolves a Code42 Security alert.
+  - name: code42-alert-search
+    arguments:
+    - name: username
+      required: true
+      description: The username for the user to search alerts for.
+    outputs:
+    - contextPath: Code42.SecurityAlert.Username
+      description: The username associated with the alert.
+      type: string
+    - contextPath: Code42.SecurityAlert.Occurred
+      description: The timestamp when the alert occurred.
+      type: date
+    - contextPath: Code42.SecurityAlert.Description
+      description: The description of the alert.
+      type: string
+    - contextPath: Code42.SecurityAlert.ID
+      description: The alert ID.
+      type: string
+    - contextPath: Code42.SecurityAlert.Name
+      description: The alert rule name that generated the alert.
+      type: string
+    - contextPath: Code42.SecurityAlert.State
+      description: The alert state.
+      type: string
+    - contextPath: Code42.SecurityAlert.Type
+      description: The alert type.
+      type: string
+    - contextPath: Code42.SecurityAlert.Severity
+      description: The severity of the alert.
+      type: string
+    description: Search alerts by username.
   - name: code42-departingemployee-add
     arguments:
     - name: username
@@ -362,6 +393,7 @@ script:
       type: string
     - contextPath: Code42.HighRiskEmployee.RiskTags
       description: Risk tags to associate with the High Risk Employee.
+    description: Add the given risk tags to the user with the given username.
   - name: code42-highriskemployee-remove-risk-tags
     arguments:
     - name: username
@@ -379,6 +411,7 @@ script:
       type: string
     - contextPath: Code42.HighRiskEmployee.RiskTags
       description: Risk tags to disassociate from the High Risk Employee.
+    description: Remove the given risk tags from the user with the given username.
   dockerimage: demisto/py42:1.0.0.9242
   isfetch: true
   runonce: false

Packs/Code42/Integrations/Code42/Code42_test.py

@@ -12,6 +12,7 @@
     map_to_file_context,
     alert_get_command,
     alert_resolve_command,
+    alert_search_command,
     departingemployee_add_command,
     departingemployee_remove_command,
     departingemployee_get_all_command,
@@ -994,6 +995,12 @@ def test_alert_resolve_command(code42_alerts_mock):
     assert res["id"] == "36fb8ca5-0533-4d25-9763-e09d35d60610"
 
 
+def test_alert_search_command(code42_alerts_mock):
+    client = create_client(code42_alerts_mock)
+    _, _, res = alert_search_command(client, {"username": "[email protected]"})
+    assert res == json.loads(MOCK_ALERTS_RESPONSE)["alerts"]
+
+
 def test_departingemployee_add_command(code42_sdk_mock):
     client = create_client(code42_sdk_mock)
     _, _, res = departingemployee_add_command(

Packs/Code42/Integrations/Code42/integration-Code42.yml

@@ -81,7 +81,7 @@ script:
 
     from py42.sdk.queries.alerts.alert_query import AlertQuery
 
-    from py42.sdk.queries.alerts.filters import DateObserved, Severity, AlertState
+    from py42.sdk.queries.alerts.filters import DateObserved, Severity, AlertState, Actor as AlertActor
 
 
     # Disable insecure warnings
@@ -287,6 +287,10 @@ script:
             res = self._sdk.alerts.search(query)
             return res["alerts"]
 
+        def search_alerts(self, username):
+            query = AlertQuery(AlertActor.eq(username))
+            return self._sdk.alerts.search(query)["alerts"]
+
         def get_alert_details(self, alert_id):
             res = self._sdk.alerts.get_details(alert_id)["alerts"]
             if not res:
@@ -588,6 +592,27 @@ script:
             return_error(create_command_error_message(demisto.command(), e))
 
 
+    def alert_search_command(client, args):
+        username = args["username"]
+        try:
+            alerts = client.search_alerts(username)
+            alert_context = []
+            for alert in alerts:
+                alert_context.append(map_to_code42_alert_context(alert))
+            readable_outputs = tableToMarkdown(
+                "Code42 Security Alert Search",
+                alert_context,
+                headers=SECURITY_ALERT_HEADERS,
+            )
+            return (
+                readable_outputs,
+                {"Code42.SecurityAlert": alert_context},
+                alerts
+            )
+
+        except Exception as e:
+            return_error(create_command_error_message(demisto.command(), e))
+
     @logger
 
     def departingemployee_add_command(client, args):
@@ -903,6 +928,7 @@ script:
             commands = {
                 "code42-alert-get": alert_get_command,
                 "code42-alert-resolve": alert_resolve_command,
+                "code42-alert-search": alert_search_command,
                 "code42-securitydata-search": securitydata_search_command,
                 "code42-departingemployee-add": departingemployee_add_command,
                 "code42-departingemployee-remove": departingemployee_remove_command,
@@ -1128,7 +1154,7 @@ script:
     - contextPath: Code42.SecurityAlert.Severity
       description: The severity of the alert.
       type: string
-    description: Retrieve alert details by alert ID
+    description: Retrieve alert details by alert ID.
   - name: code42-alert-resolve
     arguments:
     - name: id
@@ -1139,6 +1165,37 @@ script:
       description: The alert ID of the resolved alert.
       type: string
     description: Resolves a Code42 Security alert.
+  - name: code42-alert-search
+    arguments:
+    - name: username
+      required: true
+      description: The username for the user to search alerts for.
+    outputs:
+    - contextPath: Code42.SecurityAlert.Username
+      description: The username associated with the alert.
+      type: string
+    - contextPath: Code42.SecurityAlert.Occurred
+      description: The timestamp when the alert occurred.
+      type: date
+    - contextPath: Code42.SecurityAlert.Description
+      description: The description of the alert.
+      type: string
+    - contextPath: Code42.SecurityAlert.ID
+      description: The alert ID.
+      type: string
+    - contextPath: Code42.SecurityAlert.Name
+      description: The alert rule name that generated the alert.
+      type: string
+    - contextPath: Code42.SecurityAlert.State
+      description: The alert state.
+      type: string
+    - contextPath: Code42.SecurityAlert.Type
+      description: The alert type.
+      type: string
+    - contextPath: Code42.SecurityAlert.Severity
+      description: The severity of the alert.
+      type: string
+    description: Search alerts by username.
   - name: code42-departingemployee-add
     arguments:
     - name: username
@@ -1249,6 +1306,7 @@ script:
       type: string
     - contextPath: Code42.HighRiskEmployee.RiskTags
       description: Risk tags to associate with the High Risk Employee.
+    description: Add the given risk tags to the user with the given username.
   - name: code42-highriskemployee-remove-risk-tags
     arguments:
     - name: username
@@ -1266,6 +1324,7 @@ script:
       type: string
     - contextPath: Code42.HighRiskEmployee.RiskTags
       description: Risk tags to disassociate from the High Risk Employee.
+    description: Remove the given risk tags from the user with the given username.
   dockerimage: demisto/py42:1.0.0.9242
   isfetch: true
   runonce: false

Packs/Code42/Scripts/Code42GetDepartingEmployeeAlerts/CHANGELOG.md

@@ -0,0 +1,2 @@
+## [Unreleased]
+-

Packs/Code42/Scripts/Code42GetDepartingEmployeeAlerts/Code42GetDepartingEmployeeAlerts.py

@@ -0,0 +1,36 @@
+import demistomock as demisto
+from CommonServerPython import *
+
+
+def main():
+    res = {"total": 0}
+    res_data = []
+    top = demisto.args().get("top") or 10
+
+    try:
+        employees = demisto.executeCommand("code42-departingemployee-get-all", {})[0]["Contents"]
+        res["total"] = len(employees)
+
+        # Get each employee on the Departing Employee List and their total alerts.
+        for employee in employees:
+            username = employee["userName"]
+            alerts = demisto.executeCommand("code42-alert-search", {"username": username})[0]["Contents"]
+            alerts_count = len(alerts)
+
+            # Ignores employees without alerts
+            if alerts_count:
+                employee_res = {"Username": username, "Alerts Count": alerts_count}
+                res_data.append(employee_res)
+
+        # Sort such that highest alert counts are first and get top.
+        res["data"] = sorted(res_data, key=lambda x: x["Alerts Count"], reverse=True)[:top]
+        demisto.results(res)
+    except Exception as e:
+        res["total"] = -1
+        res["data"] = str(e)
+
+    # Submit final results to Cortex XSOAR
+    demisto.results(res)
+
+if __name__ in ("__main__", "__builtin__", "builtins"):
+    main()

Packs/Code42/Scripts/Code42GetDepartingEmployeeAlerts/Code42GetDepartingEmployeeAlerts.yml

@@ -0,0 +1,24 @@
+args:
+- defaultValue: 10
+  description: To limit results to x number of employees with the highest alert count.
+  name: top
+  type: number
+comment: Gets all departing employees and alerts for each.
+commonfields:
+  id: 468c8e6f-6f50-486f-8cde-7dabe4cbeb2b
+  version: -1
+dependson:
+  must:
+  - Code42|||code42-departingemployee-get-all
+  - Code42|||code42-alerts-search
+dockerimage: demisto/py42:1.0.0.9242
+enabled: true
+name: Code42GetDepartingEmployeeAlerts
+pswd: ""
+runas: DBotWeakRole
+runonce: false
+script: ''
+scripttarget: 0
+subtype: python3
+tags: ['dynamic-section', 'widget']
+type: python

Packs/Code42/Widgets/widget-Departing_Employee_Alerts.json

@@ -0,0 +1,40 @@
+{
+    "category": "",
+    "dataType": "scripts",
+    "dateRange": {
+        "fromDate": "0001-01-01T00:00:00Z",
+        "fromDateLicense": "0001-01-01T00:00:00Z",
+        "period": {
+            "by": "",
+            "byFrom": "days",
+            "byTo": "",
+            "field": "",
+            "fromValue": null,
+            "toValue": null
+        },
+        "toDate": "0001-01-01T00:00:00Z"
+    },
+    "id": "570ec235-7ee4-43ea-8fc7-eba94a0cca71",
+    "isPredefined": false,
+    "name": "Departing Employee Alerts",
+    "params": {
+        "tableColumns": [
+            {
+                "displayed": true,
+                "isDefault": true,
+                "key": "Username"
+            },
+            {
+                "displayed": true,
+                "isDefault": true,
+                "key": "Alerts Count"
+            }
+        ]
+    },
+    "query": "Code42GetDepartingEmployeeAlerts",
+    "size": 0,
+    "sort": null,
+    "sortValues": null,
+    "version": -1,
+    "widgetType": "table"
+}