diff --git a/.circleci/config.yml b/.circleci/config.yml index 1fc1c2346a6..6317c133dac 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -3,12 +3,11 @@ jobs: build: docker: - image: devdemisto/content-build:3.0.0.7332 # disable-secrets-detection - resource_class: medium+ parallelism: 2 environment: - CONTENT_VERSION: "20.5.3" + CONTENT_VERSION: "20.6.0" SERVER_VERSION: "5.5.0" - GIT_SHA1: "bb4ac8b7943a6cba0c22935ebad6b6e17939840d" # guardrails-disable-line disable-secrets-detection + GIT_SHA1: "63646dff0fba977f91d6d9fc2d7fd233bfb5561b" # guardrails-disable-line disable-secrets-detection steps: - checkout - setup_remote_docker @@ -88,6 +87,17 @@ jobs: else echo ".circleci/config.yml is up to date!" fi + - run: + name: Update Tests step + when: always + command: | + if [ $CIRCLE_NODE_INDEX -ne 0 ] ; + then + echo "Skipping - running only in container number 0" + exit 0 + fi + python3 ./Tests/scripts/update_conf_json.py + cp "./Tests/conf.json" "$CIRCLE_ARTIFACTS/conf.json" - run: name: Create ID Set when: always @@ -116,9 +126,9 @@ jobs: name: Validate Files and Yaml when: always command: | - if [ -n "${INSTANCE_TESTS}" ] || [ $CIRCLE_NODE_INDEX -ne 0 ] ; + if [ -n "${INSTANCE_TESTS}" ] || [ $CIRCLE_NODE_INDEX -ne 0 ] || [ -n "${NIGHTLY}" ]; then - echo "Skipping - not running in INSTANCE_TESTS build or unit-tests container" + echo "Skipping - not running in INSTANCE_TESTS build or unit-tests container or Nightly run" exit 0 fi @@ -171,10 +181,14 @@ jobs: fi if [ -n "${GITHUB_TOKEN}" ] ; then - python3 release_notes.py $CONTENT_VERSION $GIT_SHA1 $CIRCLE_BUILD_NUM $SERVER_VERSION --github-token $GITHUB_TOKEN + # python3 release_notes.py $CONTENT_VERSION $GIT_SHA1 $CIRCLE_BUILD_NUM $SERVER_VERSION --github-token $GITHUB_TOKEN || echo "ignore errors" + # new release notes summary generator in packs format + python3 Utils/release_notes_generator.py $CONTENT_VERSION $GIT_SHA1 $CIRCLE_BUILD_NUM --output $CIRCLE_ARTIFACTS/packs-release-notes.md --github-token $GITHUB_TOKEN else - python3 release_notes.py $CONTENT_VERSION $GIT_SHA1 $CIRCLE_BUILD_NUM $SERVER_VERSION + # python3 release_notes.py $CONTENT_VERSION $GIT_SHA1 $CIRCLE_BUILD_NUM $SERVER_VERSION || echo "ignore errors" + # new release notes summary generator in packs format + python3 Utils/release_notes_generator.py $CONTENT_VERSION $GIT_SHA1 $CIRCLE_BUILD_NUM --output $CIRCLE_ARTIFACTS/packs-release-notes.md fi - run: name: Common Server Documentation @@ -309,25 +323,11 @@ jobs: echo 'Skipping - running only in container number 0.' exit 0; fi - ./Tests/scripts/prepare_content_packs_for_testing.sh - - run: - name: Zip Content Packs From GCS - command: | if [[ $CIRCLE_BRANCH =~ pull/[0-9]+ ]]; then echo "Skipping, Should not run on contributor's branch." exit 0 fi - if [ $CIRCLE_NODE_INDEX -ne 0 ] ; - then - echo 'Skipping - running only in container number 0.' - exit 0; - fi - GCS_PATH=$(mktemp) - ZIP_FOLDER=$(mktemp -d) - echo $GCS_MARKET_KEY > $GCS_PATH - python3 ./Tests/Marketplace/zip_packs.py -b 'marketplace-ci-build' -z $ZIP_FOLDER -a $CIRCLE_ARTIFACTS -s $GCS_PATH -n $CIRCLE_BUILD_NUM -br $CIRCLE_BRANCH - rm $GCS_PATH - when: always + ./Tests/scripts/prepare_content_packs_for_testing.sh - store_artifacts: path: artifacts destination: artifacts @@ -352,7 +352,7 @@ jobs: export IFRA_ENV_TYPE=Nightly # disable-secrets-detection elif [ -n "${INSTANCE_TESTS}" ] ; then - export IFRA_ENV_TYPE="Demisto Marketplace" # disable-secrets-detection + export IFRA_ENV_TYPE="Demisto PreGA" # disable-secrets-detection else export IFRA_ENV_TYPE=Content-Env # disable-secrets-detection @@ -476,9 +476,9 @@ jobs: echo "Skipping instance tests for forked PRs" exit 0 fi - if [ -n "${INSTANCE_TESTS}" ] || [ $CIRCLE_NODE_INDEX -ne 0 ] ; + if [ -n "${INSTANCE_TESTS}" ] || [ $CIRCLE_NODE_INDEX -ne 0 ] || [ -n "${NIGHTLY}" ]; then - echo "Skipping - not running in INSTANCE_TESTS build or unit-tests container" + echo "Skipping - not running in INSTANCE_TESTS build, unit-tests container or Nightly run" exit 0 fi export TEMP=$(cat ./Tests/filter_envs.json | jq '."Demisto PreGA"') @@ -508,9 +508,9 @@ jobs: echo "Skipping instance tests for forked PRs" exit 0 fi - if [ -n "${INSTANCE_TESTS}" ] || [ $CIRCLE_NODE_INDEX -ne 0 ] || [ -n "${NIGHTLY}" ]; + if [ -n "${INSTANCE_TESTS}" ] || [ $CIRCLE_NODE_INDEX -ne 0 ] ; then - echo "Skipping - not running in INSTANCE_TESTS build, unit-tests container or Nightly run" + echo "Skipping - not running in INSTANCE_TESTS build or unit-tests container" exit 0 fi export TEMP=$(cat ./Tests/filter_envs.json | jq '."Demisto Marketplace"') @@ -556,6 +556,9 @@ jobs: if [ -n "${INSTANCE_TESTS}" ] && [ $CIRCLE_NODE_INDEX -ne 1 ] ; then ./Tests/scripts/instance_test.sh + export RETVAL=$? + cp ./Tests/failed_instances.txt $CIRCLE_ARTIFACTS/failed_instances.txt + exit $RETVAL else echo "Skipping instance tests" exit 0 @@ -599,9 +602,28 @@ jobs: ID_SET=$CIRCLE_ARTIFACTS/id_set.json GCS_PATH=$(mktemp) echo $GCS_MARKET_KEY > $GCS_PATH - python3 ./Tests/Marketplace/upload_packs.py -a $PACK_ARTIFACTS -e $EXTRACT_FOLDER -b 'marketplace-dist' -d $PACKS_DEPENDENCIES -i $ID_SET -s $GCS_PATH -n $CIRCLE_BUILD_NUM -k $PACK_SIGNING_KEY -pb 'marketplace-dist-private' -o + python3 ./Tests/Marketplace/upload_packs.py -a $PACK_ARTIFACTS -e $EXTRACT_FOLDER -b 'marketplace-dist' -d $PACKS_DEPENDENCIES -i $ID_SET -s $GCS_PATH -n $CIRCLE_BUILD_NUM -k $PACK_SIGNING_KEY -pb 'marketplace-dist-private' rm $GCS_PATH when: on_success + - run: + name: Zip Content Packs From GCS + command: | + if [[ $CIRCLE_BRANCH != master ]]; then + echo "Skipping packs zipping on non master branch" + exit 0 + fi + + if [ $CIRCLE_NODE_INDEX -ne 0 ] ; + then + echo 'Skipping - running only in container number 0.' + exit 0; + fi + GCS_PATH=$(mktemp) + ZIP_FOLDER=$(mktemp -d) + echo $GCS_MARKET_KEY > $GCS_PATH + python3 ./Tests/Marketplace/zip_packs.py -b 'marketplace-dist' -z $ZIP_FOLDER -a $CIRCLE_ARTIFACTS -s $GCS_PATH -gp content/packs -rt False + rm $GCS_PATH + when: always - store_artifacts: path: artifacts destination: artifacts diff --git a/.gitattributes b/.gitattributes deleted file mode 100644 index f8ff2b5de18..00000000000 --- a/.gitattributes +++ /dev/null @@ -1 +0,0 @@ -*.mp4 filter=lfs diff=lfs merge=lfs -text diff --git a/Documentation/doc-howto.json b/Documentation/doc-howto.json index 83e48308c54..22815d42db5 100644 --- a/Documentation/doc-howto.json +++ b/Documentation/doc-howto.json @@ -2,17 +2,17 @@ { "body": "\u003col\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as simple text entry to War Room\u003c/strong\u003e\u003cbr\u003e\n demisto.results(\"Mission Accomplished\")\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as a complex entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n \u003ch3\u003eFields\u003c/h3\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Type\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e:\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003eThe value is the number that corresponds to the entry type: \"1 (note)\", \"3 (file)\", \"4 (error)\", \"7 (image)\". There are several additional entry types that Demisto uses internally.\u003c/span\u003e\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Specifies the type of entry. Default is \"1\".\u0026nbsp;\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Contents\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Raw data of the command or script. If no HumanReadable is provided, this also displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:88px\" width=\"433\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:429px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ContentsFormat\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\", \"text\", \"image\", \"html\"\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the Content field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: HumanReadable\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Content that displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ReadableContentsFormat\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\"\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the HumanReadable field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: EntryContext\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Data added to the investigation context (Output Context), which you can use in playbooks.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ch3\u003eExample\u003c/h3\u003e\n \u003cp\u003e\n entry = {'Type' : entryTypes['note'],\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'Contents': data,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'ContentsFormat' : formats['json'],\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'HumanReadable': md,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'ReadableContentsFormat' : formats['markdown'],\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'EntryContext' : context}\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn data to the war room as a file\u003c/strong\u003e\u003cbr\u003e\n demisto.results(fileResult('filename',data))\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn an error to War Room\u003cbr\u003e\u003c/strong\u003emyErrorText\u0026nbsp; = \"No matching\n sensors.\"\u003cbr\u003e\n demisto.results( { \"Type\" : entryTypes[\"error\"], \"ContentsFormat\" : formats[\"text\"],\n \"Contents\" : myErrorText } )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn multiple entries to War Room\u003cbr\u003e\u003c/strong\u003eoutput = []\u003cbr\u003e\n output.append( { \"Type\" : entryTypes[\"error\"], \"ContentsFormat\" : formats[\"text\"],\n \"Contents\" : \"First part of the script failed.\" } )\u003cbr\u003e\n output += [ { \"Type\" : entryTypes[\"note\"], \"ContentsFormat\" : formats[\"text\"],\n \"Contents\" : \"Second part of the script completed successfully.\" } ]\u003cbr\u003e\n demisto.results( output )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGet context value\u003c/strong\u003e\u003cbr\u003e\n Fetches the value from the context by it's key. demisto.get(demisto.context(),\n 'key')\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Context\u003c/strong\u003e\u003cbr\u003e\n To set context from an integration, you can inject context through the returned\n entry. In this example an entry result is sent to the War Room that adds\n the \u003ccode\u003ekey.subkey\u003c/code\u003e to the current incident context.\u0026nbsp;\u003cbr\u003e\n demisto.results( { \"Type\" : entryTypes[\"note\"], \"ContentsFormat\" : formats[\"text\"],\n \"Contents\" : \"data\", \"EntryContext\": { \"key.subkey\": \"value\" } } )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSave data in playbook\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003e\n Saves data into context for later task scripts within the currently executing\n playbook.\n \u003c/p\u003e\n \u003cp\u003edemisto.setContext('myIPs', ['1.1.1.1','2.2.2.2']);\u003c/p\u003e\n \u003cp\u003edemisto.setContext('sender', 'john@acme.com');\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eFormat Results as a table\u003cbr\u003e\u003c/strong\u003eIn addition to plain text,\n you can return results to the war room formatted as a table. Error entries\n can also be formatted as tables, by setting the `entryType`to `error`.\n \u003cp\u003eres = [ {\"col1\" : \"val1\", \"col2\" : 1} ]\u003c/p\u003e\n \u003cp\u003eres.append( {\"col1\" : \"val2\", \"col2\" : 2} )\u003c/p\u003e\n demisto.results( {'ContentsFormat': formats['table'], 'Type': entryTypes['note'],\n 'Contents': res} )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eFormat Results using Markdown\u003cbr\u003e\u003c/strong\u003eResults can also be formatted\n using\n \u003ca href=\"https://en.wikipedia.org/wiki/Markdown\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eMarkdown\u003c/a\u003e.\n \u003cp\u003e\n if entry['Type'] != entryTypes['error'] and entry['ContentsFormat'] ==\n formats['json']:\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; res += '\\n### Users:'\u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;\u0026nbsp;\u0026nbsp; res += '\\n- High Risk: ' + str(demisto.get(entry,\n 'Contents.highRisk'))\n \u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;\u0026nbsp;\u0026nbsp; res += '\\n- Recent: ' + str(demisto.get(entry, 'Contents.recent'))\n \u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;\u0026nbsp;\u0026nbsp; res += '\\n- Total: ' + str(demisto.get(entry, 'Contents.total'))\n \u003c/p\u003e\n demisto.results({'ContentsFormat': formats['markdown'], 'Type': entryTypes['note'],\n 'Contents': res})\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Results As Notes\u003cbr\u003e\u003c/strong\u003eResults can be tagged as Notes\n \u003cp\u003eres = '## This is a note\\n'\u003c/p\u003e\n \u003cp\u003eres += 'It has important information\\n'\u003c/p\u003e\n demisto.results({'ContentsFormat': formats['markdown'], 'Type': entryTypes['note'],\n 'Contents': res, 'Note': True})\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAccess Investigation Metadata\u003c/strong\u003e\u003cbr\u003e\n \u003col\u003e\n \u003cli\u003e\n When you run a script in a War Room, whether manually or through\n a playbook, sometimes there is a need to access the investigation\n metadata, which is accessible through the `investigation` and `incidents`\n objects which are mapped into the script by the platform. Try the\n following example in a war room, and in the playground, to see the\n structure of the object in different investigations. Then you can\n extract the fields that interest your for your script’s logic and\n purpose.\n \u003c/li\u003e\n \u003c/ol\u003e\n \u003cp\u003e\n \u0026nbsp;To see the structure of the investigation metadata object:\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;demisto.results( demisto.investigation() )\u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;To see the structure of the incidents metadata object:\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;demisto.results( demisto.incidents() )\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003ePrinting to Log\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003eTo print to war room: demisto.log(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in INFO: demisto.info(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in DEBUG: demisto.debug(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in ERROR: demisto.error(...)\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Severity Levels\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003eUnknown: 0\u003c/li\u003e\n \u003cli\u003eInformational: .5\u003c/li\u003e\n \u003cli\u003eLow: 1\u003c/li\u003e\n \u003cli\u003eMedium: 2\u003c/li\u003e\n \u003cli\u003eHigh: 3\u003c/li\u003e\n \u003cli\u003eCritical: 4\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Statuses\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003ePending: 0\u003c/li\u003e\n \u003cli\u003eActive: 1\u003c/li\u003e\n \u003cli\u003eDone: 2\u003c/li\u003e\n \u003cli\u003eArchive: 3\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n\u003c/ol\u003e", "language": "python", - "editorType": "integrations" + "editorType": "integration" }, { - "body": "\u003col\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as simple text entry to War Room\u003c/strong\u003e\u003cbr\u003e\n return \"Mission Accomplished\";\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as a complex entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n \u003ch3\u003eFields\u003c/h3\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Type\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e:\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003eThe value is the number that corresponds to the entry type: \"1 (note)\", \"3 (file)\", \"4 (error)\", \"7 (image)\". There are several additional entry types that Demisto uses internally.\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Specifies the type of entry. Default is \"1\".\u0026nbsp;\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Contents\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Raw data of the command or script. If no HumanReadable is provided, this also displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:88px\" width=\"433\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:429px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ContentsFormat\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\", \"text\", \"image\", \"html\"\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the Content field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: HumanReadable\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Content that displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ReadableContentsFormat\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\"\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the HumanReadable field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: EntryContext\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Data added to the investigation context (Output Context), which you can use in playbooks.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ch3\u003eExample\u003c/h3\u003e\n \u003cp\u003e\n entry = {'Type' : entryTypes.note,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'Contents': data,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'ContentsFormat' : formats.json,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'HumanReadable': md,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'ReadableContentsFormat' : formats.markdown,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'EntryContext' : context}\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn data to the war room as a file\u003c/strong\u003e\u003cbr\u003e\n return saveFile(res.Body);\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn an error to War Room\u003c/strong\u003e\u003cbr\u003e\n return { ContentsFormat: formats.text, Type: entryTypes.error, Contents:\n 'First part of the script failed.' };\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn multiple entries to War Room\u003cbr\u003e\u003c/strong\u003evar output = [];\u003cbr\u003e\n output.push( { ContentsFormat: formats.text, Type: entryTypes.error, Contents:\n 'First part of the script failed.' } );\u003cbr\u003e\n output.push( { ContentsFormat: formats.text, Type: entryTypes.note, Contents:\n 'Second part of the script completed successfully.' } );\u003cbr\u003e\n return output;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGet Context value\u003c/strong\u003e\u003cbr\u003e\n Fetches the value from the context by it's key. dq(invContext,'key.path')\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Context\u003c/strong\u003e\u003cbr\u003e\n setContext(args.key, args.value);\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSending an HTTP request or file\u003c/strong\u003e\u003cbr\u003e\n http(url,{Method: method,Headers: headers,Body: body, Username: username,Password:\n password},params.insecure,params.proxy);\u003cbr\u003e\n httpMultipart(url,file_id,{Headers: headers, Username: username,Password:\n password},body,params.insecure,params.proxy,false,'uploadFile', file_name,true);\u003cbr\u003e\n \u003cstrong\u003ehttp\u003c/strong\u003e sends a request and receives a response and\n \u003cstrong\u003ehttpMultipart\u003c/strong\u003e sends a file in HTTP protocol\u003cbr\u003e\n where:\u003cbr\u003e\n \u003cstrong\u003eURL\u003c/strong\u003e: the site url (mandatory)\u003cbr\u003e\n method is the http method such as 'GET', 'POST', 'PUT' (mandatory)\u003cbr\u003e\n fileID is the entry ID of the file in the War room\u003cbr\u003e\n headers is the HTTP request headers\u003cbr\u003e\n body is the http request body\u003cbr\u003e\n username and password are the authentication details if needed\u003cbr\u003e\n insecure is a Boolean parameter that is true if secure and false if not secure.\u003cbr\u003e\n proxy is a Boolean parameter that is true to use proxy and false if not use\n proxy.\u003cbr\u003e\n file_name is the name of the file that is sent. Can be different than the\n file ID.;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSave data in playbook\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003e\n Saves data into context for later task scripts within the currently executing\n playbook.\n \u003c/p\u003e\n \u003cp\u003esetContext('myIPs', ['1.1.1.1','2.2.2.2']);\u003c/p\u003e\n \u003cp\u003esetContext('sender', 'john@acme.com');\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003e\n \u003cstrong\u003eFormat Results as a table\u003cbr\u003e\u003c/strong\u003eIn addition to plain text,\n you can return results to the war room formatted as a table. Error entries\n can also be formatted as tables, by setting the `entryType` to `error`.\n \u003c/p\u003e\n \u003cp\u003e\n rows = [ { col1 : 'val1', col2 : 1 } , { col1 : 'val2', col2 : 2 } ]\n \u003c/p\u003e\n \u003cp\u003e\n return {ContentsFormat: formats.table, Type: entryTypes.note, Contents:\n rows};\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eFormat Results using Markdown\u003c/strong\u003e\u003cbr\u003e\n \u003cp\u003e\n Results can also be formatted using\n \u003ca href=\"https://en.wikipedia.org/wiki/Markdown\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eMarkdown\u003c/a\u003e.\n \u003c/p\u003e\n \u003cp\u003evar res = '## My title\\n### My subsection\\n'\u003c/p\u003e\n \u003cp\u003e\n rows = [ { col1 : 'val1', col2 : 1 } , { col1 : 'val2', col2 : 2 } ]\n \u003c/p\u003e\n \u003cp\u003emarkdownBasedTable = 'num|col1|col2\\n'\u003c/p\u003e\n \u003cp\u003emarkdownBasedTable += '---|---|---\\n'\u003c/p\u003e\n \u003cp\u003efor (var i = 0; i \u0026lt; rows.length; i++)\u003c/p\u003e\n \u003cp\u003e\n markdownBasedTable += (i+1) + '|' + rows[i].col1 + '|' + rows[i].col2\n + '\\n'\n \u003c/p\u003e\n \u003cp\u003eres += markdownBasedTable\u003c/p\u003e\n return { ContentsFormat: formats.markdown, Type: entryTypes.note, Contents:\n res } ;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Results As Notes\u003c/strong\u003e\u003cbr\u003e\n \u003cp\u003eResults can be set as notes\u003c/p\u003e\n \u003cp\u003evar res = '## This is a note\\n';\u003c/p\u003e\n \u003cp\u003eres += 'It has important information\\n';\u003c/p\u003e\n return { ContentsFormat: formats.markdown, Type: entryTypes.note, Contents:\n res, Note: true } ;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eBase 64\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003ebtoa: encode string to base 64\u003c/p\u003e\n \u003cp\u003eatob: decode base 64 to string\u003c/p\u003e\n \u003cp\u003e\n entrytoa: gets a file entry ID and returns the file in base 64.\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAccess Investigation Metadata\u003c/strong\u003e\n \u003cp\u003e\n When you run a script in a War Room, whether manually or through a playbook,\n sometimes there is a need to access the investigation metadata, which\n is accessible through the `investigation` and `incidents` objects which\n are mapped into the script by the platform. Try the following example\n in a war room, and in the playground, to see the structure of the object\n in different investigations. Then you can extract the fields that interest\n your for your script’s logic and purpose.\n \u003c/p\u003e\n \u003cp\u003eTo see the structure of the investigation metadata object:\u003c/p\u003e\n \u003cp\u003ereturn investigation;\u003c/p\u003e\n \u003cp\u003eTo see the structure of the incidents metadata object:\u003c/p\u003e\n \u003cp\u003ereturn incidents;\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003ePrinting to Log\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003eTo print to war room: log(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in INFO: logInfo(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in DEBUG: logDebug(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in ERROR: logError(...)\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Severity Levels\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003eUnknown: 0\u003c/li\u003e\n \u003cli\u003eInformational: .5\u003c/li\u003e\n \u003cli\u003eLow: 1\u003c/li\u003e\n \u003cli\u003eMedium: 2\u003c/li\u003e\n \u003cli\u003eHigh: 3\u003c/li\u003e\n \u003cli\u003eCritical: 4\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Statuses\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003ePending: 0\u003c/li\u003e\n \u003cli\u003eActive: 1\u003c/li\u003e\n \u003cli\u003eDone: 2\u003c/li\u003e\n \u003cli\u003eArchive: 3\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n\u003c/ol\u003e", + "body": "\u003col\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as simple text entry to War Room\u003c/strong\u003e\u003cbr\u003e\n return \"Mission Accomplished\";\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as a complex entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n \u003ch3\u003eFields\u003c/h3\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Type\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e:\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003eThe value is the number that corresponds to the entry type: \"1 (note)\", \"3 (file)\", \"4 (error)\", \"7 (image)\". There are several additional entry types that Demisto uses internally.\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Specifies the type of entry. Default is \"1\".\u0026nbsp;\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Contents\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Raw data of the command or script. If no HumanReadable is provided, this also displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:88px\" width=\"433\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:429px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ContentsFormat\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\", \"text\", \"image\", \"html\"\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the Content field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: HumanReadable\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Content that displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ReadableContentsFormat\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\"\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the HumanReadable field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: EntryContext\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Data added to the investigation context (Output Context), which you can use in playbooks.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ch3\u003eExample\u003c/h3\u003e\n \u003cp\u003e\n entry = {'Type' : entryTypes.note,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'Contents': data,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'ContentsFormat' : formats.json,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'HumanReadable': md,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'ReadableContentsFormat' : formats.markdown,\u003cbr\u003e\n \u0026nbsp; \u0026nbsp; 'EntryContext' : context}\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn data to the war room as a file\u003c/strong\u003e\u003cbr\u003e\n return saveFile(res.Body);\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn an error to War Room\u003c/strong\u003e\u003cbr\u003e\n return { ContentsFormat: formats.text, Type: entryTypes.error, Contents:\n 'First part of the script failed.' };\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn multiple entries to War Room\u003cbr\u003e\u003c/strong\u003evar output = [];\u003cbr\u003e\n output.push( { ContentsFormat: formats.text, Type: entryTypes.error, Contents:\n 'First part of the script failed.' } );\u003cbr\u003e\n output.push( { ContentsFormat: formats.text, Type: entryTypes.note, Contents:\n 'Second part of the script completed successfully.' } );\u003cbr\u003e\n return output;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGet Context value\u003c/strong\u003e\u003cbr\u003e\n Fetches the value from the context by it's key. dq(invContext,'key.path')\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Context\u003c/strong\u003e\u003cbr\u003e\n setContext(args.key, args.value);\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSending an HTTP request or file\u003c/strong\u003e\u003cbr\u003e\n http(url,{Method: method,Headers: headers,Body: body, Username: username,Password:\n password},params.insecure,params.proxy);\u003cbr\u003e\n httpMultipart(url,file_id,{Headers: headers, Username: username,Password:\n password},body,params.insecure,params.proxy,false,'uploadFile', file_name,true);\u003cbr\u003e\n \u003cstrong\u003ehttp\u003c/strong\u003e sends a request and receives a response and\n \u003cstrong\u003ehttpMultipart\u003c/strong\u003e sends a file in HTTP protocol\u003cbr\u003e\n where:\u003cbr\u003e\n \u003cstrong\u003eURL\u003c/strong\u003e: the site url (mandatory)\u003cbr\u003e\n method is the http method such as 'GET', 'POST', 'PUT' (mandatory)\u003cbr\u003e\n fileID is the entry ID of the file in the War room\u003cbr\u003e\n headers is the HTTP request headers\u003cbr\u003e\n body is the http request body\u003cbr\u003e\n username and password are the authentication details if needed\u003cbr\u003e\n insecure is a Boolean parameter that is true if secure and false if not secure.\u003cbr\u003e\n proxy is a Boolean parameter that is true to use proxy and false if not use\n proxy.\u003cbr\u003e\n file_name is the name of the file that is sent. Can be different than the\n file ID.;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSave data in playbook\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003e\n Saves data into context for later task scripts within the currently executing\n playbook.\n \u003c/p\u003e\n \u003cp\u003esetContext('myIPs', ['1.1.1.1','2.2.2.2']);\u003c/p\u003e\n \u003cp\u003esetContext('sender', 'john@acme.com');\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003e\n \u003cstrong\u003eFormat Results as a table\u003cbr\u003e\u003c/strong\u003eIn addition to plain text,\n you can return results to the war room formatted as a table. Error entries\n can also be formatted as tables, by setting the `entryType` to `error`.\n \u003c/p\u003e\n \u003cp\u003e\n rows = [ { col1 : 'val1', col2 : 1 } , { col1 : 'val2', col2 : 2 } ]\n \u003c/p\u003e\n \u003cp\u003e\n return {ContentsFormat: formats.table, Type: entryTypes.note, Contents:\n rows};\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eFormat Results using Markdown\u003c/strong\u003e\u003cbr\u003e\n \u003cp\u003e\n Results can also be formatted using\n \u003ca href=\"https://en.wikipedia.org/wiki/Markdown\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eMarkdown\u003c/a\u003e.\n \u003c/p\u003e\n \u003cp\u003evar res = '## My title\\n### My subsection\\n'\u003c/p\u003e\n \u003cp\u003e\n rows = [ { col1 : 'val1', col2 : 1 } , { col1 : 'val2', col2 : 2 } ]\n \u003c/p\u003e\n \u003cp\u003emarkdownBasedTable = 'num|col1|col2\\n'\u003c/p\u003e\n \u003cp\u003emarkdownBasedTable += '---|---|---\\n'\u003c/p\u003e\n \u003cp\u003efor (var i = 0; i \u0026lt; rows.length; i++)\u003c/p\u003e\n \u003cp\u003e\n markdownBasedTable += (i+1) + '|' + rows[i].col1 + '|' + rows[i].col2\n + '\\n'\n \u003c/p\u003e\n \u003cp\u003eres += markdownBasedTable\u003c/p\u003e\n return { ContentsFormat: formats.markdown, Type: entryTypes.note, Contents:\n res } ;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Results As Notes\u003c/strong\u003e\u003cbr\u003e\n \u003cp\u003eResults can be set as notes\u003c/p\u003e\n \u003cp\u003evar res = '## This is a note\\n';\u003c/p\u003e\n \u003cp\u003eres += 'It has important information\\n';\u003c/p\u003e\n return { ContentsFormat: formats.markdown, Type: entryTypes.note, Contents:\n res, Note: true } ;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eBase 64\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003ebtoa: encode string to base 64\u003c/p\u003e\n \u003cp\u003eatob: decode base 64 to string\u003c/p\u003e\n \u003cp\u003e\n entrytoa: gets a file entry ID and returns the file in base 64.\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAccess Investigation Metadata\u003c/strong\u003e\n \u003cp\u003e\n When you run a script in a War Room, whether manually or through a playbook,\n sometimes there is a need to access the investigation metadata, which\n is accessible through the `investigation` and `incidents` objects which\n are mapped into the script by the platform. Try the following example\n in a war room, and in the playground, to see the structure of the object\n in different investigations. Then you can extract the fields that interest\n your for your script's logic and purpose.\n \u003c/p\u003e\n \u003cp\u003eTo see the structure of the investigation metadata object:\u003c/p\u003e\n \u003cp\u003ereturn investigation;\u003c/p\u003e\n \u003cp\u003eTo see the structure of the incidents metadata object:\u003c/p\u003e\n \u003cp\u003ereturn incidents;\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003ePrinting to Log\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003eTo print to war room: log(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in INFO: logInfo(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in DEBUG: logDebug(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in ERROR: logError(...)\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Severity Levels\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003eUnknown: 0\u003c/li\u003e\n \u003cli\u003eInformational: .5\u003c/li\u003e\n \u003cli\u003eLow: 1\u003c/li\u003e\n \u003cli\u003eMedium: 2\u003c/li\u003e\n \u003cli\u003eHigh: 3\u003c/li\u003e\n \u003cli\u003eCritical: 4\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Statuses\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003ePending: 0\u003c/li\u003e\n \u003cli\u003eActive: 1\u003c/li\u003e\n \u003cli\u003eDone: 2\u003c/li\u003e\n \u003cli\u003eArchive: 3\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n\u003c/ol\u003e", "language": "javascript", - "editorType": "integrations" + "editorType": "integration" }, { - "body": "\u003col\u003e\n \u003cli\u003e\n \u003cstrong\u003etest\u003cbr\u003e\u003c/strong\u003etest 1\n \u003c/li\u003e\n\u003c/ol\u003e", + "body": "\u003col\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as simple text entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n $demisto.Results(\"Mission Accomplished\")\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as a complex entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n \u003ch3\u003eFields\u003c/h3\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Type\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e:\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003eThe value is the number that corresponds to the entry type: \"1 (note)\", \"3 (file)\", \"4 (error)\", \"7 (image)\". There are several additional entry types that Demisto uses internally.\u003c/span\u003e\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Specifies the type of entry. Default is \"note\".\u0026nbsp;\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Contents\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Raw data of the command or script. If no HumanReadable is provided, this also displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:88px\" width=\"433\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:429px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ContentsFormat\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\", \"text\", \"image\", \"html\"\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the Content field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: HumanReadable\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Content that displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ReadableContentsFormat\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\"\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the HumanReadable field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: EntryContext\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Data added to the investigation context (Output Context), which you can use in playbooks.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Tag\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Tags to apply to the War Room entry.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ch3\u003eExample\u003c/h3\u003e\n \u003cp\u003e\n entry = {'Type' : entryTypes.note,\u003cbr\u003e\n 'Contents': data,\u003cbr\u003e\n 'ContentsFormat' : formats.json,\u003cbr\u003e\n 'HumanReadable': md,\u003cbr\u003e\n 'ReadableContentsFormat' : formats.markdown,\u003cbr\u003e\n 'EntryContext' : context,\u003cbr\u003e\n 'Tag' : shiftSummary}\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn an error to War Room\u003cbr\u003e\u003c/strong\u003emyErrorText\u0026nbsp; = \"No matching\n sensors.\"\u003cbr\u003e\n $demisto.Results( @{\n Type = 1;\n ContentsFormat = \"json\";\n Contents = $contents;\n EntryContext = $context;\n ReadableContentsFormat = \"markdown\";\n HumanReadable = $contents\n } )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Context\u003c/strong\u003e\u003cbr\u003e\n $demisto.SetContext(demisto.Args().key, demisto.Args().'value')\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSave data in playbook\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003e\n Saves data into context for later task scripts within the currently executing\n playbook.\n \u003c/p\u003e\n \u003cp\u003e$demisto.SetContext('myIPs', '1.1.1.1','2.2.2.2');\u003c/p\u003e\n \u003cp\u003e$demisto.SetContext('sender', 'john@acme.com');\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAccess Investigation Metadata\u003c/strong\u003e\u003cbr\u003e\n \u003col\u003e\n \u003cli\u003e\n When you run a script in a War Room, whether manually or through\n a playbook, sometimes there is a need to access the investigation\n metadata, which is accessible through the `investigation` and `incidents`\n objects which are mapped into the script by the platform. Try the\n following example in a war room, and in the playground, to see the\n structure of the object in different investigations. Then you can\n extract the fields that interest your for your script\ufffds logic and\n purpose.\n \u003c/li\u003e\n \u003c/ol\u003e\n \u003cp\u003e\n \u0026nbsp;To see the structure of the investigation metadata object:\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;$demisto.Results( demisto.Investigation() )\u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;To see the structure of the incidents metadata object:\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;$demisto.Results( demisto.Incidents() )\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003ePrinting to Log\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003eTo print to war room: $demisto.Log(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in INFO: $demisto.Info(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in DEBUG: $demisto.Debug(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in ERROR: $demisto.Error(...)\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eClose the current investigation\u003cbr\u003e\u003c/strong\u003e$demisto.ExecuteCommand('closeInvestigation',\n @{ reason_What-happened : 'Automated malware playbook completed.' } )\u003cstrong\u003e\u003cbr\u003e\u003c/strong\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAdvanced How To\u003cbr\u003e\u003c/strong\u003eTo be added soon:\u003cbr\u003e\n 1. Access War Room entries from within a script - return entries matching\n a specific condition, aggregate content from entries, run a regex-based search\n against all text in the war room to collect a list of identifiers, and more.\u003cbr\u003e\n 2. Send files from war room as email attachments.\u003cbr\u003e\n 3. Access context data directly disregarding arguments.\u003cbr\u003e\n 4.More tips and use cases to come.\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Severity Levels\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003eUnknown: 0\u003c/li\u003e\n \u003cli\u003eInformational: .5\u003c/li\u003e\n \u003cli\u003eLow: 1\u003c/li\u003e\n \u003cli\u003eMedium: 2\u003c/li\u003e\n \u003cli\u003eHigh: 3\u003c/li\u003e\n \u003cli\u003eCritical: 4\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Statuses\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003ePending: 0\u003c/li\u003e\n \u003cli\u003eActive: 1\u003c/li\u003e\n \u003cli\u003eDone: 2\u003c/li\u003e\n \u003cli\u003eArchive: 3\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n\u003c/ol\u003e\n", "language": "powershell", - "editorType": "integrations" + "editorType": "integration" }, { "body": "\u003col\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as simple text entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n demisto.results(\"Mission Accomplished\")\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as a complex entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n \u003ch3\u003eFields\u003c/h3\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Type\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e:\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003eThe value is the number that corresponds to the entry type: \"1 (note)\", \"3 (file)\", \"4 (error)\", \"7 (image)\". There are several additional entry types that Demisto uses internally.\u003c/span\u003e\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Specifies the type of entry. Default is \"note\".\u0026nbsp;\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Contents\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Raw data of the command or script. If no HumanReadable is provided, this also displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:88px\" width=\"433\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:429px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ContentsFormat\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\", \"text\", \"image\", \"html\"\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the Content field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: HumanReadable\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Content that displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ReadableContentsFormat\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\"\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the HumanReadable field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: EntryContext\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Data added to the investigation context (Output Context), which you can use in playbooks.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Tag\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Tags to apply to the War Room entry.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ch3\u003eExample\u003c/h3\u003e\n \u003cp\u003e\n entry = {'Type' : entryTypes.note,\u003cbr\u003e\n 'Contents': data,\u003cbr\u003e\n 'ContentsFormat' : formats.json,\u003cbr\u003e\n 'HumanReadable': md,\u003cbr\u003e\n 'ReadableContentsFormat' : formats.markdown,\u003cbr\u003e\n 'EntryContext' : context,\u003cbr\u003e\n 'Tag' : shiftSummary}\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn data to the War Room as a file\u003c/strong\u003e\u003cbr\u003e\n demisto.results(fileResult('filename',data))\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn an error to War Room\u003cbr\u003e\u003c/strong\u003emyErrorText\u0026nbsp; = \"No matching\n sensors.\"\u003cbr\u003e\n demisto.results( { \"Type\" : entryTypes[\"error\"], \"ContentsFormat\" : formats[\"text\"],\n \"Contents\" : myErrorText } )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn multiple entries to War Room\u003cbr\u003e\u003c/strong\u003eoutput = []\u003cbr\u003e\n output.append( { \"Type\" : entryTypes[\"error\"], \"ContentsFormat\" : formats[\"text\"],\n \"Contents\" : \"First part of the script failed.\" } )\u003cbr\u003e\n output += [ { \"Type\" : entryTypes[\"note\"], \"ContentsFormat\" : formats[\"text\"],\n \"Contents\" : \"Second part of the script completed successfully.\" } ]\u003cbr\u003e\n demisto.results( output )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGetting time and other metadata for war room entries\u003cbr\u003e\u003c/strong\u003ee\n = demisto.executeCommand('getEntry', {'id': '270@4dfc3b65-9da2-46c5-8751-ebe959f31a7b'});\n demisto.results(demisto.get(e[0], 'Metadata.Created'));\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGetting metadata for war room entries in JSON\u003cbr\u003e\u003c/strong\u003ee = demisto.executeCommand('getEntry',\n {'id': '60@4751'}); demisto.results(json.dumps(e[0]['Metadata'], indent=2));\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eExecute Commands\u003c/strong\u003e\u003cbr\u003e\n arrResultEntries = demisto.executeCommand('ip', { \"ip\" : \"8.8.8.8\" } )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGet context value\u003c/strong\u003e\u003cbr\u003e\n Fetches the value from the context by it's key. demisto.get(demisto.context(),\n 'key')\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Context\u003c/strong\u003e\u003cbr\u003e\n demisto.setContext(demisto.args()['key'], demisto.args()['value'])\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet an Incident\u003c/strong\u003e\u003cbr\u003e\n demisto.executeCommand(\"setIncident\", {'mydate': '2018-02-02T22:58:21+02:00'})\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSend notifications (e.g. Email)\u003c/strong\u003e\u003cbr\u003e\n demisto.executeCommand(\"send-mail\", { \"to\" : \"\u003ca href=\"mailto:user@domain.com\"\u003euser@domain.com\u003c/a\u003e\",\n \"cc\" : \"\u003ca href=\"mailto:also@domain.com\"\u003ealso@domain.com\u003c/a\u003e\", \"subject\"\n : \"Update on Demisto investigation\", \"body\" : \"Contents of your message.\"\n } )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eHandle Errors\u003c/strong\u003e\u003cbr\u003e\n \u003col\u003e\n \u003cli\u003eoutput = []\u003c/li\u003e\n \u003c/ol\u003e\n \u003cp\u003e\n resultEntries = demisto.executeCommand( 'dummy-command', { 'arg' : 'value'\n } )\n \u003c/p\u003e\n \u003cp\u003etry:\u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; if isError( resultEntries[0] ):\u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp; # We have something special\n to say about this error\n \u003c/p\u003e\n \u003cp\u003e\n if 'failed with status 404 NOT FOUND' in resultEntries[0]['Contents']:\n \u003c/p\u003e\n \u003cp\u003e\n demisto.results( { 'Type' : entryTypes['error'], 'ContentsFormat' : formats['text'],\n 'Contents' : 'Received HTTP Error 404 from Session API. Please ensure\n that you do not already have an active session with that sensor, and\n if not - report to the sysadmin.' } )\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp; else:\u003c/p\u003e\n \u003cp\u003e\n # If it's not the error we recognize - send all entries returned from\n the command back to the war room as-is\n \u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp; demisto.results(resultEntries)\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; else:\u003c/p\u003e\n \u003cp\u003e\n demisto.results( { 'Type' : entryTypes['note'], 'ContentsFormat' : formats['text'],\n 'Contents': 'Success.' } )\n \u003c/p\u003e\n \u003cp\u003eexcept Exception as ex:\u003c/p\u003e\n demisto.results( { 'Type' : entryTypes['error'], 'Contentmat' : formats['text'],\n 'Contents' : 'Error occurred while parsing output from command. Exception\n info:\\n' + str(ex) + '\\n\\nInvalid output:\\n' + str( resultEntries ) } )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eExecute Another Script\u003cbr\u003e\u003c/strong\u003eYou can execute other scripts\n just as you execute commands, using `executeCommand`.\n \u003cp\u003e\n arrResultEntries = demisto.executeCommand( \"IPReputation\", { \"ip\" : \"8.8.8.8\"\n } )\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSave data in playbook\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003e\n Saves data into context for later task scripts within the currently executing\n playbook.\n \u003c/p\u003e\n \u003cp\u003edemisto.setContext('myIPs', ['1.1.1.1','2.2.2.2']);\u003c/p\u003e\n \u003cp\u003edemisto.setContext('sender', 'john@acme.com');\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReading file contents\u003c/strong\u003e\u003cbr\u003e\n demisto.executeCommand('getFilePath', {'id': demisto.args()['entryId'] })\n \u003cp\u003e\n filePath = resultEntries[0][\"Contents\"][\"path\"] with open(filePath ,\n 'rb') as file:\n \u003c/p\u003e\n \u003cp\u003edata = file.read()\u003c/p\u003e\n \u003cp\u003edemisto.log('Actual file path on disk was: ' + filePath)\u003c/p\u003e\n \u003cp\u003e\n demisto.results( { \"Type\" : entryTypes[\"note\"], \"ContentsFormat\" : formats[\"text\"],\n \"Contents\" : data } )\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eFormat Results as a table\u003cbr\u003e\u003c/strong\u003eIn addition to plain text,\n you can return results to the war room formatted as a table. Error entries\n can also be formatted as tables, by setting the `entryType` to `error`.\n \u003cp\u003eres = [ {\"col1\" : \"val1\", \"col2\" : 1} ]\u003c/p\u003e\n \u003cp\u003eres.append( {\"col1\" : \"val2\", \"col2\" : 2} )\u003c/p\u003e\n demisto.results( {'ContentsFormat': formats['table'], 'Type': entryTypes['note'],\n 'Contents': res} )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eFormat Results using Markdown\u003cbr\u003e\u003c/strong\u003eResults can also be formatted\n using\n \u003ca href=\"https://en.wikipedia.org/wiki/Markdown\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eMarkdown\u003c/a\u003e.\n \u003cp\u003eres = '## Exabeam global info'\u003c/p\u003e\n \u003cp\u003eentry = demisto.executeCommand('xb-users', {})[0]\u003c/p\u003e\n \u003cp\u003e\n if entry['Type'] != entryTypes['error'] and entry['ContentsFormat'] ==\n formats['json']:\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; res += '\\n### Users:'\u003c/p\u003e\n \u003cp\u003e\n res += '\\n- High Risk: ' + str(demisto.get(entry, 'Contents.highRisk'))\n \u003c/p\u003e\n \u003cp\u003e\n res += '\\n- Recent: ' + str(demisto.get(entry, 'Contents.recent'))\n \u003c/p\u003e\n \u003cp\u003e\n res += '\\n- Total: ' + str(demisto.get(entry, 'Contents.total'))\n \u003c/p\u003e\n demisto.results({'ContentsFormat': formats['markdown'], 'Type': entryTypes['note'],\n 'Contents': res})\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Results As Notes\u003cbr\u003e\u003c/strong\u003eResults can be tagged as Notes\n \u003cp\u003eres = '## This is a note\\n'\u003c/p\u003e\n \u003cp\u003eres += 'It has important information\\n'\u003c/p\u003e\n demisto.results({'ContentsFormat': formats['markdown'], 'Type': entryTypes['note'],\n 'Contents': res, 'Note': True})\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAccess Investigation Metadata\u003c/strong\u003e\u003cbr\u003e\n \u003col\u003e\n \u003cli\u003e\n When you run a script in a War Room, whether manually or through\n a playbook, sometimes there is a need to access the investigation\n metadata, which is accessible through the `investigation` and `incidents`\n objects which are mapped into the script by the platform. Try the\n following example in a war room, and in the playground, to see the\n structure of the object in different investigations. Then you can\n extract the fields that interest your for your script’s logic and\n purpose.\n \u003c/li\u003e\n \u003c/ol\u003e\n \u003cp\u003e\n \u0026nbsp;To see the structure of the investigation metadata object:\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;demisto.results( demisto.investigation() )\u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;To see the structure of the incidents metadata object:\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;demisto.results( demisto.incidents() )\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003ePrinting to Log\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003eTo print to war room: demisto.log(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in INFO: demisto.info(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in DEBUG: demisto.debug(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in ERROR: demisto.error(...)\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eClose the current investigation\u003cbr\u003e\u003c/strong\u003edemisto.executeCommand('closeInvestigation',\n { 'reason_What-happened' : 'Automated malware playbook completed.' } )\u003cstrong\u003e\u003cbr\u003e\u003c/strong\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAdvanced How To\u003cbr\u003e\u003c/strong\u003eTo be added soon:\u003cbr\u003e\n 1. Access War Room entries from within a script – return entries matching\n a specific condition, aggregate content from entries, run a regex-based search\n against all text in the war room to collect a list of identifiers, and more.\u003cbr\u003e\n 2. Send files from war room as email attachments.\u003cbr\u003e\n 3. Access context data directly disregarding arguments.\u003cbr\u003e\n 4.More tips and use cases to come.\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn a map to the War Room\u003c/strong\u003e\u003cbr\u003e\n demisto.results({\u003cbr\u003e\n 'Type': entryTypes['map'],\u003cbr\u003e\n 'ContentsFormat' : formats['json'],\u003cbr\u003e\n 'Contents': {\u003cbr\u003e\n 'lat': \u0026lt;latitude-coordinate\u0026gt;,\u003cbr\u003e\n 'lng': \u0026lt;longitude-coordinate\u0026gt;,\u003cbr\u003e\n }\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Severity Levels\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003eUnknown: 0\u003c/li\u003e\n \u003cli\u003eInformational: .5\u003c/li\u003e\n \u003cli\u003eLow: 1\u003c/li\u003e\n \u003cli\u003eMedium: 2\u003c/li\u003e\n \u003cli\u003eHigh: 3\u003c/li\u003e\n \u003cli\u003eCritical: 4\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Statuses\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003ePending: 0\u003c/li\u003e\n \u003cli\u003eActive: 1\u003c/li\u003e\n \u003cli\u003eDone: 2\u003c/li\u003e\n \u003cli\u003eArchive: 3\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n\u003c/ol\u003e", @@ -20,12 +20,12 @@ "editorType": "automation" }, { - "body": "\u003col\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as simple text entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n return \"Mission Accomplished\";\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as a complex entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n \u003ch3\u003eFields\u003c/h3\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Type\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e:\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003eThe value is the number that corresponds to the entry type: \"1 (note)\", \"3 (file)\", \"4 (error)\", \"7 (image)\". There are several additional entry types that Demisto uses internally. \u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Specifies the type of entry. Default is \"note\".\u0026nbsp;\u003c/span\u003e\u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExample\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Specifies the type of entry. Default is \"note\".\u0026nbsp;\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Contents\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Raw data of the command or script. If no HumanReadable is provided, this also displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:88px\" width=\"433\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:429px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ContentsFormat\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\", \"text\", \"image\", \"html\"\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the Content field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: HumanReadable\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Content that displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ReadableContentsFormat\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\"\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the HumanReadable field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: EntryContext\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Data added to the investigation context (Output Context), which you can use in playbooks.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Tag\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Tags to apply to the War Room entry.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ch3\u003eExample\u003c/h3\u003e\n \u003cp\u003e\n entry = {'Type' : entryTypes.note,\u003cbr\u003e\n 'Contents': data,\u003cbr\u003e\n 'ContentsFormat' : formats.json,\u003cbr\u003e\n 'HumanReadable': md,\u003cbr\u003e\n 'ReadableContentsFormat' : formats.markdown,\u003cbr\u003e\n 'EntryContext' : context,\u003cbr\u003e\n 'Tag' : shiftSummary}\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn data to the War Room as a file\u003c/strong\u003e\u003cbr\u003e\n return saveFile(res.Body);\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn an error to the War Room\u003c/strong\u003e\u003cbr\u003e\n return { ContentsFormat: formats.text, Type: entryTypes.error, Contents:\n 'First part of the script failed.' };\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn multiple entries to the War Room\u003cbr\u003e\u003c/strong\u003evar output =\n [];\u003cbr\u003e\n output.push( { ContentsFormat: formats.text, Type: entryTypes.error, Contents:\n 'First part of the script failed.' } );\u003cbr\u003e\n output.push( { ContentsFormat: formats.text, Type: entryTypes.note, Contents:\n 'Second part of the script completed successfully.' } );\u003cbr\u003e\n return output;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGetting time and other metadata for War Room entries\u003c/strong\u003e\u003cbr\u003e\n !js script=\"e = executeCommand('getEntry', {id: '270@4dfc3b65-9da2-46c5-8751-ebe959f31a7b'});\n return e[0].Metadata.Created;\"\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGetting metadata for War Room entries in JSON\u003c/strong\u003e\u003cbr\u003e\n !js script=\"e = executeCommand('getEntry', {id: '60@4751'}); return JSON.stringify(e[0].Metadata,\n null, 2);\"\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eExecute Commands\u003c/strong\u003e\u003cbr\u003e\n var arrResultEntries = executeCommand('ip', { ip: '8.8.8.8' } );\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGet Context value\u003c/strong\u003e\u003cbr\u003e\n Fetches the value from the context by it's key. dq(invContext,'key.path')\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Context\u003c/strong\u003e\u003cbr\u003e\n setContext(args.key, args.value);\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSend notifications (e.g. Email)\u003c/strong\u003e\u003cbr\u003e\n var arrResultEntries = executeCommand('send-mail', { to : 'user@domain.com',\n cc : 'also@domain.com', subject : 'Update on Demisto investigation', body\n : 'Contents of your message.'\u0026nbsp; });\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSending an HTTP request or file\u003c/strong\u003e\u003cbr\u003e\n http(url,{Method: method,Headers: headers,Body: body, Username: username,Password:\n password},params.insecure,params.proxy);\u003cbr\u003e\n httpMultipart(url,file_id,{Headers: headers, Username: username,Password:\n password},body,params.insecure,params.proxy,false,'uploadFile', file_name,true);\u003cbr\u003e\n \u003cstrong\u003ehttp\u003c/strong\u003e sends a request and receives a response and\u0026nbsp;\u003cstrong\u003ehttpMultipart\u003c/strong\u003e\n sends a file in HTTP protocol\u003cbr\u003e\n where:\u003cbr\u003e\n \u003cstrong\u003eURL\u003c/strong\u003e: the site url (mandatory)\u003cbr\u003e\n method is the http method such as 'GET', 'POST', 'PUT' (mandatory)\u003cbr\u003e\n fileID is the entry ID of the file in the War room\u003cbr\u003e\n headers is the HTTP request headers\u003cbr\u003e\n body is the http request body\u003cbr\u003e\n username and password are the authentication details if needed\u003cbr\u003e\n insecure is a Boolean parameter that is true if secure and false if not secure.\u003cbr\u003e\n proxy is a Boolean parameter that is true to use proxy and false if not use\n proxy.\u003cbr\u003e\n file_name is the name of the file that is sent. Can be different than the\n file ID.;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eHandle Errors\u003c/strong\u003e\u003cbr\u003e\n \u003ctable style=\"height:452px\" width=\"720\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:716px;background-color:#d3d3d3\"\u003e\n \u003col\u003e\n \u003cli\u003e\n \u003cp\u003eif (res[0].Type == entryTypes.error) {\u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;\u0026nbsp;\u0026nbsp; // Return the error to war\n room no results to parse.\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; return res[0];\u003c/p\u003e\n \u003cp\u003e} else {\u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; var usersOnCall = res[0].Contents;\u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; var selectedUser = usersOnCall[0];\u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; if (selectedUser === null) {\u003c/p\u003e\n \u003cp\u003e\n return { ContentsFormat: formats.text, Type:\n entryTypes.error, Contents: 'error : did not\n receive any users from PagerDutyGetUsersOnCallNow!'\n };\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; } else {\u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;return\n selectedUser.name;\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; }\u003c/p\u003e\n }var res = executeCommand('PagerDutyGetUsersOnCallNow',\n { });\n \u003c/li\u003e\n \u003c/ol\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eExecute Another Script\u003cbr\u003e\u003c/strong\u003eYou can execute other scripts\n just as you execute commands, using `executeCommand`.\n \u003cp\u003e\n var arrResultEntries = executeCommand('IPReputation', { ip: '8.8.8.8'\n } );\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSave data in playbook\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003e\n Saves data into context for later task scripts within the currently executing\n playbook.\n \u003c/p\u003e\n \u003cp\u003esetContext('myIPs', ['1.1.1.1','2.2.2.2']);\u003c/p\u003e\n \u003cp\u003esetContext('sender', 'john@acme.com');\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003e\n \u003cstrong\u003eFormat Results as a table\u003cbr\u003e\u003c/strong\u003eIn addition to plain text,\n you can return results to the war room formatted as a table. Error entries\n can also be formatted as tables, by setting the `entryType` to `error`.\n \u003c/p\u003e\n \u003cp\u003e\n rows = [ { col1 : 'val1', col2 : 1 } , { col1 : 'val2', col2 : 2 } ]\n \u003c/p\u003e\n \u003cp\u003e\n return {ContentsFormat: formats.table, Type: entryTypes.note, Contents:\n rows};\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eFormat Results using Markdown\u003c/strong\u003e\u003cbr\u003e\n \u003cp\u003e\n Results can also be formatted using\n \u003ca href=\"https://en.wikipedia.org/wiki/Markdown\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eMarkdown\u003c/a\u003e.\n \u003c/p\u003e\n \u003cp\u003evar res = '## My title\\n### My subsection\\n'\u003c/p\u003e\n \u003cp\u003e\n rows = [ { col1 : 'val1', col2 : 1 } , { col1 : 'val2', col2 : 2 } ]\n \u003c/p\u003e\n \u003cp\u003emarkdownBasedTable = 'num|col1|col2\\n'\u003c/p\u003e\n \u003cp\u003emarkdownBasedTable += '---|---|---\\n'\u003c/p\u003e\n \u003cp\u003efor (var i = 0; i \u0026lt; rows.length; i++)\u003c/p\u003e\n \u003cp\u003e\n markdownBasedTable += (i+1) + '|' + rows[i].col1 + '|' + rows[i].col2\n + '\\n'\n \u003c/p\u003e\n \u003cp\u003eres += markdownBasedTable\u003c/p\u003e\n return { ContentsFormat: formats.markdown, Type: entryTypes.note, Contents:\n res } ;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Results As Notes\u003c/strong\u003e\u003cbr\u003e\n \u003cp\u003eResults can be set as notes\u003c/p\u003e\n \u003cp\u003evar res = '## This is a note\\n';\u003c/p\u003e\n \u003cp\u003eres += 'It has important information\\n';\u003c/p\u003e\n return { ContentsFormat: formats.markdown, Type: entryTypes.note, Contents:\n res, Note: true } ;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eBase 64\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003ebtoa: encode string to base 64\u003c/p\u003e\n \u003cp\u003eatob: decode base 64 to string\u003c/p\u003e\n \u003cp\u003e\n entrytoa: gets a file entry ID and returns the file in base 64.\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAccess Investigation Metadata\u003c/strong\u003e\n \u003cp\u003e\n When you run a script in a War Room, whether manually or through a playbook,\n sometimes there is a need to access the investigation metadata, which\n is accessible through the `investigation` and `incidents` objects which\n are mapped into the script by the platform. Try the following example\n in a war room, and in the playground, to see the structure of the object\n in different investigations. Then you can extract the fields that interest\n your for your script’s logic and purpose.\n \u003c/p\u003e\n \u003cp\u003eTo see the structure of the investigation metadata object:\u003c/p\u003e\n \u003cp\u003ereturn investigation;\u003c/p\u003e\n \u003cp\u003eTo see the structure of the incidents metadata object:\u003c/p\u003e\n \u003cp\u003ereturn incidents;\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003ePrinting to Log\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003eTo print to war room: log(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in INFO: logInfo(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in DEBUG: logDebug(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in ERROR: logError(...)\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eClose the current investigation\u003cbr\u003e\u003c/strong\u003ecloseInvestigation({Reason:\n 'Automated malware playbook completed.'});\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAdvanced How To\u003cbr\u003e\u003c/strong\u003eTo be added soon:\u003cbr\u003e\n 1. Access War Room entries from within a script – return entries matching\n a specific condition, aggregate content from entries, run a regex-based search\n against all text in the war room to collect a list of identifiers, and more.\u003cbr\u003e\n 2. Send files from war room as email attachments.\u003cbr\u003e\n 3. Access context data directly disregarding arguments.\u003cbr\u003e\n 4.More tips and use cases to come.\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn a map to the War Room\u003c/strong\u003e\u003cbr\u003e\n return {\u003cbr\u003e\n Type: entryTypes.map,\u003cbr\u003e\n ContentsFormat: formats.json,\u003cbr\u003e\n Contents: {\u003cbr\u003e\n lat: \u0026lt;latitude-coordinate\u0026gt;,\u003cbr\u003e\n lng: \u0026lt;longitude-coordinate\u0026gt;,\u003cbr\u003e\n }\u003cbr\u003e\n };\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Severity Levels\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003eUnknown: 0\u003c/li\u003e\n \u003cli\u003eInformational: 0.5\u003c/li\u003e\n \u003cli\u003eLow: 1\u003c/li\u003e\n \u003cli\u003eMedium: 2\u003c/li\u003e\n \u003cli\u003eHigh: 3\u003c/li\u003e\n \u003cli\u003eCritical: 4\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Statuses\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003ePending: 0\u003c/li\u003e\n \u003cli\u003eActive: 1\u003c/li\u003e\n \u003cli\u003eDone: 2\u003c/li\u003e\n \u003cli\u003eArchive: 3\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n\u003c/ol\u003e", + "body": "\u003col\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as simple text entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n return \"Mission Accomplished\";\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as a complex entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n \u003ch3\u003eFields\u003c/h3\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Type\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e:\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003eThe value is the number that corresponds to the entry type: \"1 (note)\", \"3 (file)\", \"4 (error)\", \"7 (image)\". There are several additional entry types that Demisto uses internally. \u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Specifies the type of entry. Default is \"note\".\u0026nbsp;\u003c/span\u003e\u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExample\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Specifies the type of entry. Default is \"note\".\u0026nbsp;\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Contents\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Raw data of the command or script. If no HumanReadable is provided, this also displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:88px\" width=\"433\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:429px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ContentsFormat\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\", \"text\", \"image\", \"html\"\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the Content field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: HumanReadable\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Content that displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ReadableContentsFormat\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\"\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the HumanReadable field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: EntryContext\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Data added to the investigation context (Output Context), which you can use in playbooks.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Tag\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Tags to apply to the War Room entry.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ch3\u003eExample\u003c/h3\u003e\n \u003cp\u003e\n entry = {'Type' : entryTypes.note,\u003cbr\u003e\n 'Contents': data,\u003cbr\u003e\n 'ContentsFormat' : formats.json,\u003cbr\u003e\n 'HumanReadable': md,\u003cbr\u003e\n 'ReadableContentsFormat' : formats.markdown,\u003cbr\u003e\n 'EntryContext' : context,\u003cbr\u003e\n 'Tag' : shiftSummary}\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn data to the War Room as a file\u003c/strong\u003e\u003cbr\u003e\n return saveFile(res.Body);\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn an error to the War Room\u003c/strong\u003e\u003cbr\u003e\n return { ContentsFormat: formats.text, Type: entryTypes.error, Contents:\n 'First part of the script failed.' };\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn multiple entries to the War Room\u003cbr\u003e\u003c/strong\u003evar output =\n [];\u003cbr\u003e\n output.push( { ContentsFormat: formats.text, Type: entryTypes.error, Contents:\n 'First part of the script failed.' } );\u003cbr\u003e\n output.push( { ContentsFormat: formats.text, Type: entryTypes.note, Contents:\n 'Second part of the script completed successfully.' } );\u003cbr\u003e\n return output;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGetting time and other metadata for War Room entries\u003c/strong\u003e\u003cbr\u003e\n !js script=\"e = executeCommand('getEntry', {id: '270@4dfc3b65-9da2-46c5-8751-ebe959f31a7b'});\n return e[0].Metadata.Created;\"\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGetting metadata for War Room entries in JSON\u003c/strong\u003e\u003cbr\u003e\n !js script=\"e = executeCommand('getEntry', {id: '60@4751'}); return JSON.stringify(e[0].Metadata,\n null, 2);\"\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eExecute Commands\u003c/strong\u003e\u003cbr\u003e\n var arrResultEntries = executeCommand('ip', { ip: '8.8.8.8' } );\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eGet Context value\u003c/strong\u003e\u003cbr\u003e\n Fetches the value from the context by it's key. dq(invContext,'key.path')\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Context\u003c/strong\u003e\u003cbr\u003e\n setContext(args.key, args.value);\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSend notifications (e.g. Email)\u003c/strong\u003e\u003cbr\u003e\n var arrResultEntries = executeCommand('send-mail', { to : 'user@domain.com',\n cc : 'also@domain.com', subject : 'Update on Demisto investigation', body\n : 'Contents of your message.'\u0026nbsp; });\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSending an HTTP request or file\u003c/strong\u003e\u003cbr\u003e\n http(url,{Method: method,Headers: headers,Body: body, Username: username,Password:\n password},params.insecure,params.proxy);\u003cbr\u003e\n httpMultipart(url,file_id,{Headers: headers, Username: username,Password:\n password},body,params.insecure,params.proxy,false,'uploadFile', file_name,true);\u003cbr\u003e\n \u003cstrong\u003ehttp\u003c/strong\u003e sends a request and receives a response and\u0026nbsp;\u003cstrong\u003ehttpMultipart\u003c/strong\u003e\n sends a file in HTTP protocol\u003cbr\u003e\n where:\u003cbr\u003e\n \u003cstrong\u003eURL\u003c/strong\u003e: the site url (mandatory)\u003cbr\u003e\n method is the http method such as 'GET', 'POST', 'PUT' (mandatory)\u003cbr\u003e\n fileID is the entry ID of the file in the War room\u003cbr\u003e\n headers is the HTTP request headers\u003cbr\u003e\n body is the http request body\u003cbr\u003e\n username and password are the authentication details if needed\u003cbr\u003e\n insecure is a Boolean parameter that is true if secure and false if not secure.\u003cbr\u003e\n proxy is a Boolean parameter that is true to use proxy and false if not use\n proxy.\u003cbr\u003e\n file_name is the name of the file that is sent. Can be different than the\n file ID.;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eHandle Errors\u003c/strong\u003e\u003cbr\u003e\n \u003ctable style=\"height:452px\" width=\"720\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:716px;background-color:#d3d3d3\"\u003e\n \u003col\u003e\n \u003cli\u003e\n \u003cp\u003eif (res[0].Type == entryTypes.error) {\u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;\u0026nbsp;\u0026nbsp; // Return the error to war\n room no results to parse.\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; return res[0];\u003c/p\u003e\n \u003cp\u003e} else {\u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; var usersOnCall = res[0].Contents;\u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; var selectedUser = usersOnCall[0];\u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; if (selectedUser === null) {\u003c/p\u003e\n \u003cp\u003e\n return { ContentsFormat: formats.text, Type:\n entryTypes.error, Contents: 'error : did not\n receive any users from PagerDutyGetUsersOnCallNow!'\n };\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; } else {\u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;return\n selectedUser.name;\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;\u0026nbsp;\u0026nbsp; }\u003c/p\u003e\n }var res = executeCommand('PagerDutyGetUsersOnCallNow',\n { });\n \u003c/li\u003e\n \u003c/ol\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eExecute Another Script\u003cbr\u003e\u003c/strong\u003eYou can execute other scripts\n just as you execute commands, using `executeCommand`.\n \u003cp\u003e\n var arrResultEntries = executeCommand('IPReputation', { ip: '8.8.8.8'\n } );\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSave data in playbook\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003e\n Saves data into context for later task scripts within the currently executing\n playbook.\n \u003c/p\u003e\n \u003cp\u003esetContext('myIPs', ['1.1.1.1','2.2.2.2']);\u003c/p\u003e\n \u003cp\u003esetContext('sender', 'john@acme.com');\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cp\u003e\n \u003cstrong\u003eFormat Results as a table\u003cbr\u003e\u003c/strong\u003eIn addition to plain text,\n you can return results to the war room formatted as a table. Error entries\n can also be formatted as tables, by setting the `entryType` to `error`.\n \u003c/p\u003e\n \u003cp\u003e\n rows = [ { col1 : 'val1', col2 : 1 } , { col1 : 'val2', col2 : 2 } ]\n \u003c/p\u003e\n \u003cp\u003e\n return {ContentsFormat: formats.table, Type: entryTypes.note, Contents:\n rows};\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eFormat Results using Markdown\u003c/strong\u003e\u003cbr\u003e\n \u003cp\u003e\n Results can also be formatted using\n \u003ca href=\"https://en.wikipedia.org/wiki/Markdown\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eMarkdown\u003c/a\u003e.\n \u003c/p\u003e\n \u003cp\u003evar res = '## My title\\n### My subsection\\n'\u003c/p\u003e\n \u003cp\u003e\n rows = [ { col1 : 'val1', col2 : 1 } , { col1 : 'val2', col2 : 2 } ]\n \u003c/p\u003e\n \u003cp\u003emarkdownBasedTable = 'num|col1|col2\\n'\u003c/p\u003e\n \u003cp\u003emarkdownBasedTable += '---|---|---\\n'\u003c/p\u003e\n \u003cp\u003efor (var i = 0; i \u0026lt; rows.length; i++)\u003c/p\u003e\n \u003cp\u003e\n markdownBasedTable += (i+1) + '|' + rows[i].col1 + '|' + rows[i].col2\n + '\\n'\n \u003c/p\u003e\n \u003cp\u003eres += markdownBasedTable\u003c/p\u003e\n return { ContentsFormat: formats.markdown, Type: entryTypes.note, Contents:\n res } ;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Results As Notes\u003c/strong\u003e\u003cbr\u003e\n \u003cp\u003eResults can be set as notes\u003c/p\u003e\n \u003cp\u003evar res = '## This is a note\\n';\u003c/p\u003e\n \u003cp\u003eres += 'It has important information\\n';\u003c/p\u003e\n return { ContentsFormat: formats.markdown, Type: entryTypes.note, Contents:\n res, Note: true } ;\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eBase 64\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003ebtoa: encode string to base 64\u003c/p\u003e\n \u003cp\u003eatob: decode base 64 to string\u003c/p\u003e\n \u003cp\u003e\n entrytoa: gets a file entry ID and returns the file in base 64.\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAccess Investigation Metadata\u003c/strong\u003e\n \u003cp\u003e\n When you run a script in a War Room, whether manually or through a playbook,\n sometimes there is a need to access the investigation metadata, which\n is accessible through the `investigation` and `incidents` objects which\n are mapped into the script by the platform. Try the following example\n in a war room, and in the playground, to see the structure of the object\n in different investigations. Then you can extract the fields that interest\n your for your script's logic and purpose.\n \u003c/p\u003e\n \u003cp\u003eTo see the structure of the investigation metadata object:\u003c/p\u003e\n \u003cp\u003ereturn investigation;\u003c/p\u003e\n \u003cp\u003eTo see the structure of the incidents metadata object:\u003c/p\u003e\n \u003cp\u003ereturn incidents;\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003ePrinting to Log\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003eTo print to war room: log(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in INFO: logInfo(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in DEBUG: logDebug(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in ERROR: logError(...)\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eClose the current investigation\u003cbr\u003e\u003c/strong\u003ecloseInvestigation({Reason:\n 'Automated malware playbook completed.'});\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAdvanced How To\u003cbr\u003e\u003c/strong\u003eTo be added soon:\u003cbr\u003e\n 1. Access War Room entries from within a script – return entries matching\n a specific condition, aggregate content from entries, run a regex-based search\n against all text in the war room to collect a list of identifiers, and more.\u003cbr\u003e\n 2. Send files from war room as email attachments.\u003cbr\u003e\n 3. Access context data directly disregarding arguments.\u003cbr\u003e\n 4.More tips and use cases to come.\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn a map to the War Room\u003c/strong\u003e\u003cbr\u003e\n return {\u003cbr\u003e\n Type: entryTypes.map,\u003cbr\u003e\n ContentsFormat: formats.json,\u003cbr\u003e\n Contents: {\u003cbr\u003e\n lat: \u0026lt;latitude-coordinate\u0026gt;,\u003cbr\u003e\n lng: \u0026lt;longitude-coordinate\u0026gt;,\u003cbr\u003e\n }\u003cbr\u003e\n };\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Severity Levels\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003eUnknown: 0\u003c/li\u003e\n \u003cli\u003eInformational: 0.5\u003c/li\u003e\n \u003cli\u003eLow: 1\u003c/li\u003e\n \u003cli\u003eMedium: 2\u003c/li\u003e\n \u003cli\u003eHigh: 3\u003c/li\u003e\n \u003cli\u003eCritical: 4\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Statuses\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003ePending: 0\u003c/li\u003e\n \u003cli\u003eActive: 1\u003c/li\u003e\n \u003cli\u003eDone: 2\u003c/li\u003e\n \u003cli\u003eArchive: 3\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n\u003c/ol\u003e", "language": "javascript", "editorType": "automation" }, { - "body": "\u003col\u003e\n \u003cli\u003e\n \u003cstrong\u003eTest\u003cbr\u003e\u003c/strong\u003etest\n \u003c/li\u003e\n\u003c/ol\u003e", + "body": "\u003col\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as simple text entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n $demisto.Results(\"Mission Accomplished\")\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn result as a complex entry to the War Room\u003c/strong\u003e\u003cbr\u003e\n \u003ch3\u003eFields\u003c/h3\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Type\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003e:\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e\u003cspan style=\"font-size:13px\"\u003eThe value is the number that corresponds to the entry type: \"1 (note)\", \"3 (file)\", \"4 (error)\", \"7 (image)\". There are several additional entry types that Demisto uses internally.\u003c/span\u003e\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Specifies the type of entry. Default is \"note\".\u0026nbsp;\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Contents\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Raw data of the command or script. If no HumanReadable is provided, this also displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:88px\" width=\"433\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:429px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ContentsFormat\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\", \"text\", \"image\", \"html\"\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the Content field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: HumanReadable\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Content that displays in the War Room.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: ReadableContentsFormat\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: \"json\", \"markdown\"\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Format of the content from the HumanReadable field.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: EntryContext\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Data added to the investigation context (Output Context), which you can use in playbooks.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ctable style=\"height:26px\" width=\"409\"\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd style=\"width:405px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eField\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Tag\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eExpected Values\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: N/A\u0026nbsp;\u003c/span\u003e\u003cbr style=\"font-size:13px\"\u003e\n \u003cspan style=\"font-weight:bolder;font-size:13px\"\u003eDescription\u003c/span\u003e\u003cspan style=\"font-size:13px\"\u003e: Tags to apply to the War Room entry.\u003c/span\u003e\n \u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n \u003c/table\u003e\n \u003cbr\u003e\n \u003ch3\u003eExample\u003c/h3\u003e\n \u003cp\u003e\n entry = {'Type' : entryTypes.note,\u003cbr\u003e\n 'Contents': data,\u003cbr\u003e\n 'ContentsFormat' : formats.json,\u003cbr\u003e\n 'HumanReadable': md,\u003cbr\u003e\n 'ReadableContentsFormat' : formats.markdown,\u003cbr\u003e\n 'EntryContext' : context,\u003cbr\u003e\n 'Tag' : shiftSummary}\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReturn an error to War Room\u003cbr\u003e\u003c/strong\u003emyErrorText\u0026nbsp; = \"No matching\n sensors.\"\u003cbr\u003e\n $demisto.Results( @{\n Type = 1;\n ContentsFormat = \"json\";\n Contents = $contents;\n EntryContext = $context;\n ReadableContentsFormat = \"markdown\";\n HumanReadable = $contents\n } )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eExecute Commands\u003c/strong\u003e\u003cbr\u003e\n $arrResultEntries = demisto.ExecuteCommand('ip', @{ip = \"8.8.8.8\" } )\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet Context\u003c/strong\u003e\u003cbr\u003e\n $demisto.SetContext(demisto.Args().key, demisto.Args().'value')\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSet an Incident\u003c/strong\u003e\u003cbr\u003e\n $demisto.ExecuteCommand(\"setIncident\", @{mydate: '2018-02-02T22:58:21+02:00'})\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eExecute Another Script\u003cbr\u003e\u003c/strong\u003eYou can execute other scripts\n just as you execute commands, using `ExecuteCommand`.\n \u003cp\u003e\n $arrResultEntries = demisto.ExecuteCommand( \"IPReputation\", @{ ip : \"8.8.8.8\" } )\n \u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eSave data in playbook\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003e\n Saves data into context for later task scripts within the currently executing\n playbook.\n \u003c/p\u003e\n \u003cp\u003e$demisto.SetContext('myIPs', '1.1.1.1','2.2.2.2');\u003c/p\u003e\n \u003cp\u003e$demisto.SetContext('sender', 'john@acme.com');\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eReading file contents\u003c/strong\u003e\u003cbr\u003e\n demisto.ExecuteCommand('getFilePath', @{id: demisto.Args().entryId })\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAccess Investigation Metadata\u003c/strong\u003e\u003cbr\u003e\n \u003col\u003e\n \u003cli\u003e\n When you run a script in a War Room, whether manually or through\n a playbook, sometimes there is a need to access the investigation\n metadata, which is accessible through the `investigation` and `incidents`\n objects which are mapped into the script by the platform. Try the\n following example in a war room, and in the playground, to see the\n structure of the object in different investigations. Then you can\n extract the fields that interest your for your script\ufffds logic and\n purpose.\n \u003c/li\u003e\n \u003c/ol\u003e\n \u003cp\u003e\n \u0026nbsp;To see the structure of the investigation metadata object:\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;$demisto.Results( demisto.Investigation() )\u003c/p\u003e\n \u003cp\u003e\n \u0026nbsp;To see the structure of the incidents metadata object:\n \u003c/p\u003e\n \u003cp\u003e\u0026nbsp;$demisto.Results( demisto.Incidents() )\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003ePrinting to Log\u003cbr\u003e\u003c/strong\u003e\n \u003cp\u003eTo print to war room: $demisto.Log(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in INFO: $demisto.Info(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in DEBUG: $demisto.Debug(...)\u003c/p\u003e\n \u003cp\u003eTo print to demisto log in ERROR: $demisto.Error(...)\u003c/p\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eClose the current investigation\u003cbr\u003e\u003c/strong\u003e$demisto.ExecuteCommand('closeInvestigation',\n @{ reason_What-happened : 'Automated malware playbook completed.' } )\u003cstrong\u003e\u003cbr\u003e\u003c/strong\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eAdvanced How To\u003cbr\u003e\u003c/strong\u003eTo be added soon:\u003cbr\u003e\n 1. Access War Room entries from within a script - return entries matching\n a specific condition, aggregate content from entries, run a regex-based search\n against all text in the war room to collect a list of identifiers, and more.\u003cbr\u003e\n 2. Send files from war room as email attachments.\u003cbr\u003e\n 3. Access context data directly disregarding arguments.\u003cbr\u003e\n 4.More tips and use cases to come.\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Severity Levels\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003eUnknown: 0\u003c/li\u003e\n \u003cli\u003eInformational: .5\u003c/li\u003e\n \u003cli\u003eLow: 1\u003c/li\u003e\n \u003cli\u003eMedium: 2\u003c/li\u003e\n \u003cli\u003eHigh: 3\u003c/li\u003e\n \u003cli\u003eCritical: 4\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003cstrong\u003eIncident Statuses\u003c/strong\u003e\u003cbr\u003e\n \u003cul\u003e\n \u003cli\u003ePending: 0\u003c/li\u003e\n \u003cli\u003eActive: 1\u003c/li\u003e\n \u003cli\u003eDone: 2\u003c/li\u003e\n \u003cli\u003eArchive: 3\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/li\u003e\n\u003c/ol\u003e\n", "language": "powershell", "editorType": "automation" } diff --git a/Packs/APIVoid/pack_metadata.json b/Packs/APIVoid/pack_metadata.json index a1074bb6f8b..1a613e1abae 100644 --- a/Packs/APIVoid/pack_metadata.json +++ b/Packs/APIVoid/pack_metadata.json @@ -12,11 +12,6 @@ "tags": [ ], "created": "2020-04-01T22:23:20Z", - "updated": "2020-04-01T22:23:20Z", - "beta": false, - "deprecated": false, "useCases": [], - "keywords": [], - "dependencies": {}, - "displayedImages": [] + "keywords": [] } \ No newline at end of file diff --git a/Packs/IPWhitelisting/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group.yml b/Packs/AWS-EC2/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group.yml similarity index 67% rename from Packs/IPWhitelisting/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group.yml rename to Packs/AWS-EC2/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group.yml index 86573925be9..596b7ba99b2 100644 --- a/Packs/IPWhitelisting/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group.yml +++ b/Packs/AWS-EC2/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group.yml @@ -1,67 +1,80 @@ id: IP Whitelist - AWS Security Group version: -1 name: IP Whitelist - AWS Security Group -starttaskid: '0' +description: Sync a list of IP addresses to an AWS Security Group. +starttaskid: "0" tasks: - '0': - id: '0' - taskid: bf893f17-9227-4737-89ac-26ca8777b1aa + "0": + id: "0" + taskid: c85f856f-9810-4ab0-8729-ee1dfac7485c type: start task: - id: bf893f17-9227-4737-89ac-26ca8777b1aa + id: c85f856f-9810-4ab0-8729-ee1dfac7485c version: -1 - name: '' + name: "" iscommand: false - brand: '' + brand: "" description: '' nexttasks: '#none#': - - '4' + - "4" separatecontext: false - view: "{\n \"position\": {\n \"x\": 690,\n \"y\": -300\n }\n}" + view: |- + { + "position": { + "x": 690, + "y": -300 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '4': - id: '4' - taskid: e1e1c907-0baa-4a5d-8189-991dfd4ca36a + "4": + id: "4" + taskid: 84551e34-e39d-49af-8f9c-519daf296254 type: title task: - id: e1e1c907-0baa-4a5d-8189-991dfd4ca36a + id: 84551e34-e39d-49af-8f9c-519daf296254 version: -1 - name: Whitelist IPs on AWS (Sec Group Ingress) + name: Allow IPs on AWS (Sec Group Ingress) type: title iscommand: false - brand: '' + brand: "" description: '' nexttasks: '#none#': - - '28' + - "28" separatecontext: false - view: "{\n \"position\": {\n \"x\": 690,\n \"y\": -150\n }\n}" + view: |- + { + "position": { + "x": 690, + "y": -150 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '8': - id: '8' - taskid: 31451327-b459-4943-8fda-cee277f63b8a + "8": + id: "8" + taskid: 5ce745a5-3013-44aa-8f88-fd2c7ea0243e type: regular task: - id: 31451327-b459-4943-8fda-cee277f63b8a + id: 5ce745a5-3013-44aa-8f88-fd2c7ea0243e version: -1 - name: Add whitelisted Tag - description: commands.local.cmd.set.indicator + name: Add allowed Tag + description: Adds the tag defined in inputs.IndicatorTagName. script: Builtin|||setIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - - '13' + - "34" scriptarguments: a: {} actor: {} @@ -174,54 +187,26 @@ tasks: simple: / fields: value: - simple: '-1' + simple: "-1" separatecontext: false - view: "{\n \"position\": {\n \"x\": 1190,\n \"y\": 1525\n }\n}" + view: |- + { + "position": { + "x": 1190, + "y": 1575 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '13': - id: '13' - taskid: d60a3761-2f77-4c52-82d2-462e5bf640d8 + "14": + id: "14" + taskid: 3f3f330a-fab8-4067-8aff-95a1e6b0e813 type: regular task: - id: d60a3761-2f77-4c52-82d2-462e5bf640d8 - version: -1 - name: Close Incident - description: commands.local.cmd.close.inv - script: Builtin|||closeInvestigation - type: regular - iscommand: true - brand: Builtin - nexttasks: - '#none#': - - '34' - scriptarguments: - assetid: {} - closeNotes: {} - closeReason: {} - code42alerttype: {} - emailclassification: {} - id: - complex: - root: incident - accessor: id - phishingsubtype: {} - separatecontext: false - view: "{\n \"position\": {\n \"x\": 910,\n \"y\": 1740\n }\n}" - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - '14': - id: '14' - taskid: 74afad3e-db15-4400-8d75-5234dd389ab9 - type: regular - task: - id: 74afad3e-db15-4400-8d75-5234dd389ab9 + id: 3f3f330a-fab8-4067-8aff-95a1e6b0e813 version: -1 name: Describe Security Groups description: Describes one or more of your security groups. @@ -231,7 +216,7 @@ tasks: brand: AWS - EC2 nexttasks: '#none#': - - '35' + - "35" scriptarguments: filters: {} groupIds: {} @@ -242,28 +227,34 @@ tasks: roleSessionDuration: {} roleSessionName: {} separatecontext: false - view: "{\n \"position\": {\n \"x\": 1012.5,\n \"y\": 160\n }\n}" + view: |- + { + "position": { + "x": 1012.5, + "y": 160 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '19': - id: '19' - taskid: f26c62ee-c760-451e-837a-4ffc6364f43c + "19": + id: "19" + taskid: 59c54288-6d6a-4793-8777-9baaeae2af74 type: regular task: - id: f26c62ee-c760-451e-837a-4ffc6364f43c + id: 59c54288-6d6a-4793-8777-9baaeae2af74 version: -1 name: Add IPs to AWS Security Group description: Adds ingress rule to a security group. script: '|||aws-ec2-authorize-security-group-ingress-rule' type: regular iscommand: true - brand: '' + brand: "" nexttasks: '#none#': - - '8' + - "8" scriptarguments: IpPermissionsIpProtocol: {} IpPermissionsToPort: {} @@ -293,9 +284,9 @@ tasks: args: index: value: - simple: '0' + simple: "0" ipProtocol: - simple: '-1' + simple: "-1" region: {} roleArn: {} roleSessionDuration: {} @@ -303,32 +294,38 @@ tasks: sourceSecurityGroupName: {} toPort: {} separatecontext: false - view: "{\n \"position\": {\n \"x\": 1190,\n \"y\": 1350\n }\n}" + view: |- + { + "position": { + "x": 1190, + "y": 1400 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '20': - id: '20' - taskid: 4c12ee8d-be9d-434d-8cfd-75c8dc3dada9 + "20": + id: "20" + taskid: f239a3a3-482a-4e21-85ff-321537aa71e4 type: regular task: - id: 4c12ee8d-be9d-434d-8cfd-75c8dc3dada9 + id: f239a3a3-482a-4e21-85ff-321537aa71e4 version: -1 name: Map IPs as CIDR ranges description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '38' + - "38" scriptarguments: append: {} key: - simple: WhitelistCIDRs + simple: AllowedCIDRs stringify: {} value: complex: @@ -342,18 +339,24 @@ tasks: value: simple: /32 separatecontext: false - view: "{\n \"position\": {\n \"x\": 802.5,\n \"y\": 535\n }\n}" + view: |- + { + "position": { + "x": 802.5, + "y": 535 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '21': - id: '21' - taskid: f7ab4211-3f74-494f-83e6-76d12bc01bd3 + "21": + id: "21" + taskid: 8a1ec2e1-2f6c-4ab1-86dc-7f587b6fd52a type: regular task: - id: f7ab4211-3f74-494f-83e6-76d12bc01bd3 + id: 8a1ec2e1-2f6c-4ab1-86dc-7f587b6fd52a version: -1 name: Revoke IPs from AWS Security Group description: Removes egress rule from a security group. To remove a rule, the @@ -362,10 +365,10 @@ tasks: script: '|||aws-ec2-revoke-security-group-ingress-rule' type: regular iscommand: true - brand: '' + brand: "" nexttasks: '#none#': - - '25' + - "25" scriptarguments: cidrIp: simple: ${ListCompare.RightOnly} @@ -379,9 +382,9 @@ tasks: args: index: value: - simple: '0' + simple: "0" ipProtocol: - simple: '-1' + simple: "-1" region: {} roleArn: {} roleSessionDuration: {} @@ -389,28 +392,34 @@ tasks: sourceSecurityGroupName: {} toPort: {} separatecontext: false - view: "{\n \"position\": {\n \"x\": 570,\n \"y\": 1350\n }\n}" + view: |- + { + "position": { + "x": 640, + "y": 1400 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '25': - id: '25' - taskid: ba5d0ec8-8e7f-4d2a-84e9-d70beaf9f171 + "25": + id: "25" + taskid: 224e4558-67e0-4a68-828a-781414358c9b type: regular task: - id: ba5d0ec8-8e7f-4d2a-84e9-d70beaf9f171 + id: 224e4558-67e0-4a68-828a-781414358c9b version: -1 - name: Remove whitelisted Tag - description: commands.local.cmd.remove.values.to.indicator.multi.select.field + name: Remove allowed Tag + description: Removes the tag defined in inputs.IndicatorTagName. script: Builtin|||removeIndicatorField type: regular iscommand: true brand: Builtin nexttasks: '#none#': - - '13' + - "34" scriptarguments: field: simple: tags @@ -428,63 +437,75 @@ tasks: simple: / fields: value: - simple: '-1' + simple: "-1" separatecontext: false - view: "{\n \"position\": {\n \"x\": 570,\n \"y\": 1525\n }\n}" + view: |- + { + "position": { + "x": 640, + "y": 1575 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '26': - id: '26' - taskid: c0f43acd-8d5e-4f25-80fe-ff5eab5584eb + "26": + id: "26" + taskid: d7869678-c140-4948-8f5a-6daa317373a4 type: regular task: - id: c0f43acd-8d5e-4f25-80fe-ff5eab5584eb + id: d7869678-c140-4948-8f5a-6daa317373a4 version: -1 - name: Compare IP list with current AWS whitelist + name: Compare IP list with current AWS allow list scriptName: CompareLists type: regular iscommand: false - brand: '' + brand: "" description: '' nexttasks: '#none#': - - '33' - - '32' + - "33" + - "32" scriptarguments: left: - simple: ${WhitelistCIDRs} + simple: ${AllowedCIDRs} right: simple: ${AWS.EC2.SecurityGroups.IpPermissions.[0].IpRanges.CidrIp} separatecontext: false - view: "{\n \"position\": {\n \"x\": 810,\n \"y\": 900\n }\n}" + view: |- + { + "position": { + "x": 810, + "y": 900 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '28': - id: '28' - taskid: cc9df904-c013-4130-865a-61c8347af54b + "28": + id: "28" + taskid: 8846755b-df88-477e-8075-dfbe8349b807 type: condition task: - id: cc9df904-c013-4130-865a-61c8347af54b + id: 8846755b-df88-477e-8075-dfbe8349b807 version: -1 name: Is AWS EC2 integration enabled? type: condition iscommand: false - brand: '' + brand: "" description: '' nexttasks: '#default#': - - '34' - yes: - - '14' + - "34" + "yes": + - "14" separatecontext: false conditions: - - label: yes + - label: "yes" condition: - - operator: isEqualString left: @@ -513,243 +534,314 @@ tasks: right: value: simple: AWS - EC2 - view: "{\n \"position\": {\n \"x\": 690,\n \"y\": -25\n }\n}" + view: |- + { + "position": { + "x": 690, + "y": -25 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '32': - id: '32' - taskid: 1d931d79-f1ad-479c-8bc6-2cee307f8a40 + "32": + id: "32" + taskid: 63f88ed9-a184-4062-8ed7-de7c170a81d8 type: condition task: - id: 1d931d79-f1ad-479c-8bc6-2cee307f8a40 + id: 63f88ed9-a184-4062-8ed7-de7c170a81d8 version: -1 - name: Any IPs to whitelist that are not already in AWS? + name: Any IPs to allow which are not already in AWS? type: condition iscommand: false - brand: '' + brand: "" description: '' nexttasks: '#default#': - - '13' - yes: - - '19' + - "34" + "yes": + - "19" separatecontext: false conditions: - - label: yes + - label: "yes" condition: - - operator: isNotEmpty left: value: simple: ListCompare.LeftOnly iscontext: true - view: "{\n \"position\": {\n \"x\": 1190,\n \"y\": 1075\n }\n}" + view: |- + { + "position": { + "x": 1190, + "y": 1075 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '33': - id: '33' - taskid: 0097c3ae-1c7e-4872-88a6-31cdecbaa78d + "33": + id: "33" + taskid: ded851c7-5bc7-4f2e-8238-e57849966324 type: condition task: - id: 0097c3ae-1c7e-4872-88a6-31cdecbaa78d + id: ded851c7-5bc7-4f2e-8238-e57849966324 version: -1 - name: Any IPs in AWS whitelist that should be removed? + name: Any IPs in AWS allow list that should be removed? type: condition iscommand: false - brand: '' + brand: "" description: '' nexttasks: '#default#': - - '13' - yes: - - '21' + - "34" + "yes": + - "21" separatecontext: false conditions: - - label: yes + - label: "yes" condition: - - operator: isNotEmpty left: value: simple: ListCompare.RightOnly iscontext: true - view: "{\n \"position\": {\n \"x\": 650,\n \"y\": 1075\n }\n}" + view: |- + { + "position": { + "x": 650, + "y": 1075 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '34': - id: '34' - taskid: 71668d17-22c9-4c55-8270-bf2ab182a0b4 + "34": + id: "34" + taskid: 1e8d132f-c94a-4418-8056-64e102d4ed17 type: title task: - id: 71668d17-22c9-4c55-8270-bf2ab182a0b4 + id: 1e8d132f-c94a-4418-8056-64e102d4ed17 version: -1 name: Done type: title iscommand: false - brand: '' + brand: "" description: '' separatecontext: false - view: "{\n \"position\": {\n \"x\": 260,\n \"y\": 1910\n }\n}" + view: |- + { + "position": { + "x": 270, + "y": 1870 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '35': - id: '35' - taskid: b68f72b6-3761-4353-8caf-5b500943e114 + "35": + id: "35" + taskid: ea3c38a0-8354-492d-8c1d-8c9eec68cb4f type: condition task: - id: b68f72b6-3761-4353-8caf-5b500943e114 + id: ea3c38a0-8354-492d-8c1d-8c9eec68cb4f version: -1 name: Security Group retrieved successfully? type: condition iscommand: false - brand: '' + brand: "" description: '' nexttasks: '#default#': - - '36' - yes: - - '20' + - "36" + "yes": + - "20" separatecontext: false conditions: - - label: yes + - label: "yes" condition: - - operator: isExists left: value: simple: AWS.EC2.SecurityGroups.GroupName iscontext: true - view: "{\n \"position\": {\n \"x\": 1012.5,\n \"y\": 330\n }\n}" + view: |- + { + "position": { + "x": 1012.5, + "y": 330 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '36': - id: '36' - taskid: ab30585f-b61e-4726-8b98-9ec4bd0175e4 + "36": + id: "36" + taskid: 2a06ac93-6908-46b6-82d1-234ec106abf1 type: title task: - id: ab30585f-b61e-4726-8b98-9ec4bd0175e4 + id: 2a06ac93-6908-46b6-82d1-234ec106abf1 version: -1 name: Security Group not found type: title iscommand: false - brand: '' + brand: "" description: '' nexttasks: '#none#': - - '37' + - "37" separatecontext: false - view: "{\n \"position\": {\n \"x\": 1520,\n \"y\": 545\n }\n}" + view: |- + { + "position": { + "x": 1520, + "y": 545 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '37': - id: '37' - taskid: 2a05ad2e-dd91-4ff2-8ebb-7ac7deefbc16 + "37": + id: "37" + taskid: c28c2363-66e7-435c-826c-2d52dffecded type: regular task: - id: 2a05ad2e-dd91-4ff2-8ebb-7ac7deefbc16 + id: c28c2363-66e7-435c-826c-2d52dffecded version: -1 name: Engineer - Fix Security Group Name and rerun type: regular iscommand: false - brand: '' + brand: "" description: '' separatecontext: false - view: "{\n \"position\": {\n \"x\": 1520,\n \"y\": 700\n }\n}" + view: |- + { + "position": { + "x": 1520, + "y": 700 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '38': - id: '38' - taskid: ffbf768d-43f9-4a73-8d14-979500e553f1 + "38": + id: "38" + taskid: 810ac836-5ce8-4568-8f9b-6c3fda6ad566 type: condition task: - id: ffbf768d-43f9-4a73-8d14-979500e553f1 + id: 810ac836-5ce8-4568-8f9b-6c3fda6ad566 version: -1 - name: Is the Security Group Empty? + name: Is the Security Group empty? type: condition iscommand: false - brand: '' + brand: "" description: '' nexttasks: '#default#': - - '26' - yes: - - '39' + - "26" + "yes": + - "39" separatecontext: false conditions: - - label: yes + - label: "yes" condition: - - operator: isEmpty left: value: simple: AWS.EC2.SecurityGroups.IpPermissions.[0].IpRanges.CidrIp iscontext: true - view: "{\n \"position\": {\n \"x\": 802.5,\n \"y\": 690\n }\n}" + view: |- + { + "position": { + "x": 802.5, + "y": 690 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 - '39': - id: '39' - taskid: bc08353f-0a9d-4a27-88d9-4ca06b390681 + "39": + id: "39" + taskid: 51ed900a-7f88-46aa-8532-4237e6a7daad type: regular task: - id: bc08353f-0a9d-4a27-88d9-4ca06b390681 + id: 51ed900a-7f88-46aa-8532-4237e6a7daad version: -1 name: Set new list of IP addresses description: Sets a value into the context with the given context key scriptName: Set type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '32' + - "32" scriptarguments: append: {} key: simple: ListCompare.LeftOnly stringify: {} value: - simple: ${WhitelistCIDRs} + simple: ${AllowedCIDRs} separatecontext: false - view: "{\n \"position\": {\n \"x\": 1260,\n \"y\": 880\n }\n}" + view: |- + { + "position": { + "x": 1260, + "y": 900 + } + } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 -view: "{\n \"linkLabelsPosition\": {\n \"28_14_yes\": 0.54,\n \"35_20_yes\"\ - : 0.69,\n \"38_26_#default#\": 0.65\n },\n \"paper\": {\n \"dimensions\"\ - : {\n \"height\": 2275,\n \"width\": 1640,\n \"x\": 260,\n \"\ - y\": -300\n }\n }\n}" +system: true +view: |- + { + "linkLabelsPosition": { + "28_14_yes": 0.54, + "28_34_#default#": 0.58, + "32_34_#default#": 0.1, + "33_21_yes": 0.54, + "33_34_#default#": 0.11, + "35_20_yes": 0.69, + "38_26_#default#": 0.65 + }, + "paper": { + "dimensions": { + "height": 2235, + "width": 1630, + "x": 270, + "y": -300 + } + } + } inputs: -- key: '' +- key: "" value: {} required: false - description: '' + description: "" playbookInputQuery: query: "" queryEntity: indicators - results: null + results: daterange: fromdate: 0001-01-01T00:00:00Z todate: 0001-01-01T00:00:00Z @@ -757,16 +849,16 @@ inputs: by: "" byto: "" byfrom: "" - tovalue: null - fromvalue: null + tovalue: + fromvalue: field: "" fromdatelicenseval: 0001-01-01T00:00:00Z runFromLastJobTime: false - key: IP value: {} required: true - description: IP addresses to set in the whitelist playbookInputQuery: + description: IP addresses to set in the allow list - key: SecurityGroupName value: {} required: true @@ -776,12 +868,9 @@ inputs: value: simple: AWS_IP_Whitelist required: true - description: Name of the Indicator Tag to apply to any IPs whitelisted by this playbook. playbookInputQuery: + description: Name of the Indicator Tag to apply to any IPs allowed by this playbook. outputs: [] -sourceplaybookid: 6b4415d2-cf8e-4a22-8bb0-012e4b692b60 -quiet: true fromversion: 5.5.0 -description: 'Sync a list of IP addresses to an AWS Security Group.' tests: -- No tests \ No newline at end of file +- No tests (auto formatted) diff --git a/Packs/IPWhitelisting/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group_README.md b/Packs/AWS-EC2/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group_README.md similarity index 54% rename from Packs/IPWhitelisting/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group_README.md rename to Packs/AWS-EC2/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group_README.md index 81e0c7eb165..7a0e3a7de24 100644 --- a/Packs/IPWhitelisting/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group_README.md +++ b/Packs/AWS-EC2/Playbooks/playbook-IP_Whitelist_-_AWS_Security_Group_README.md @@ -7,33 +7,34 @@ This playbook uses the following sub-playbooks, integrations, and scripts. This playbook does not use any sub-playbooks. ### Integrations -* Builtin * AWS - EC2 +* AWS-EC2 ### Scripts * Set * CompareLists ### Commands -* aws-ec2-revoke-security-group-ingress-rule -* closeInvestigation * removeIndicatorField -* setIndicator * aws-ec2-describe-security-groups +* aws-ec2-revoke-security-group-ingress-rule +* setIndicator * aws-ec2-authorize-security-group-ingress-rule ## Playbook Inputs --- -| **Name** | **Description** | **Default Value** | **Source** | **Required** | -| --- | --- | --- | --- | --- | -| | | | | Optional | -| IP | IP addresses to set in the whitelist | | | Required | -| SecurityGroupName | Name of the AWS Security Group to update | | | Required | -| IndicatorTagName | Name of the Indicator Tag to apply to any IPs whitelisted by this playbook. | AWS_IP_Whitelist | | Required | +| **Name** | **Description** | **Default Value** | **Required** | +| --- | --- | --- | --- | +| Indicator Query | Indicators matching the indicator query will be used as playbook input | | Optional | +| IP | IP addresses to set in the allow list | | Required | +| SecurityGroupName | Name of the AWS Security Group to update | | Required | +| IndicatorTagName | Name of the Indicator Tag to apply to any IPs allowed by this playbook. | AWS_IP_Whitelist | Required | ## Playbook Outputs --- There are no outputs for this playbook. -![Playbook Image](https://raw.githubusercontent.com/demisto/content/c20427ed8dde64841a1249b5d7c44e8773df2b72/Packs/IPWhitelisting/doc_files/IP_Whitelist_-_AWS_Security_Group.png) \ No newline at end of file +## Playbook Image +--- +![IP Whitelist - AWS Security Group](https://raw.githubusercontent.com/demisto/content/859f073f59aabaef8e36ec39eed63778cd2b9856/Packs/AWS-EC2/doc_files/IP_Whitelist_-_AWS_Security_Group.png) \ No newline at end of file diff --git a/Packs/AWS-EC2/ReleaseNotes/1_1_0.md b/Packs/AWS-EC2/ReleaseNotes/1_1_0.md new file mode 100644 index 00000000000..81e1a8b41a5 --- /dev/null +++ b/Packs/AWS-EC2/ReleaseNotes/1_1_0.md @@ -0,0 +1,3 @@ +#### Scripts +##### AwsEC2GetPublicSGRules +- Added support for security groups with only one ingress rule. \ No newline at end of file diff --git a/Packs/AWS-EC2/ReleaseNotes/1_1_1.md b/Packs/AWS-EC2/ReleaseNotes/1_1_1.md new file mode 100644 index 00000000000..be835737721 --- /dev/null +++ b/Packs/AWS-EC2/ReleaseNotes/1_1_1.md @@ -0,0 +1,3 @@ +#### Playbooks +##### IP Whitelist - AWS Security Group +- Playbook to sync a list of IPs with an AWS Security Group. Moved from IPWhitelisting pack. diff --git a/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules.py b/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules.py index 49e663b1c31..f43e07dd2fd 100644 --- a/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules.py +++ b/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules.py @@ -21,6 +21,11 @@ def get_ec2_sg_public_rules(group_id, ip_permissions, checked_protocol=None, che which can be passed on to the following command: aws-ec2-revoke-security-group-ingress-rule """ + + # If the SG only has one rule, we have to convert the dict to a list with one element + if (isinstance(ip_permissions, dict)): + ip_permissions = [ip_permissions] + public_rules = [] for rule in ip_permissions: # Check protocol diff --git a/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules.yml b/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules.yml index 249007367e5..f6600b0f989 100644 --- a/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules.yml +++ b/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules.yml @@ -91,6 +91,6 @@ tags: timeout: '0' type: python subtype: python3 -dockerimage: demisto/python3:3.7.4.977 +dockerimage: demisto/python3:3.8.3.8715 runas: DBotWeakRole runonce: false diff --git a/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules_test.py b/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules_test.py index 3633074d147..55be4de48b5 100644 --- a/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules_test.py +++ b/Packs/AWS-EC2/Scripts/AwsEC2GetPublicSGRules/AwsEC2GetPublicSGRules_test.py @@ -9,6 +9,9 @@ {"FromPort": 55, "IpProtocol": "tcp", "IpRanges": [], "Ipv6Ranges": [{"CidrIpv6": "::/0"}], "PrefixListIds": [], "ToPort": 55, "UserIdGroupPairs": []}] +IPPERM2 = {"FromPort": 22, "IpProtocol": "tcp", "IpRanges": [{"CidrIp": "0.0.0.0/0"}], "Ipv6Ranges": [], + "PrefixListIds": [], "ToPort": 22, "UserIdGroupPairs": []} + def test_get_ec2_sg_public_rules(): expected1 = [{"groupId": "sg-12345", "ipProtocol": "tcp", "region": "us-east-1", "fromPort": 10, "toPort": 22, @@ -29,6 +32,9 @@ def test_get_ec2_sg_public_rules(): expected4 = [{"cidrIp": "::/0", "groupId": "sg-12345", "ipProtocol": "-1", "region": "us-east-1"}] + expected5 = [{"groupId": "sg-12345", "ipProtocol": "tcp", "region": "us-east-1", "fromPort": 22, "toPort": 22, + "cidrIp": "0.0.0.0/0"}] + result1 = get_ec2_sg_public_rules(group_id='sg-12345', ip_permissions=IPPERM, checked_protocol='tcp', checked_from_port=22, checked_to_port=22, region='us-east-1', include_ipv6='no' ) @@ -45,7 +51,12 @@ def test_get_ec2_sg_public_rules(): checked_from_port=55, checked_to_port=60, region='us-east-1', include_ipv6='yes' ) + result5 = get_ec2_sg_public_rules(group_id='sg-12345', ip_permissions=IPPERM2, checked_protocol='tcp', + checked_from_port=22, checked_to_port=22, region='us-east-1', include_ipv6='yes' + ) + assert expected1 == result1 assert expected2 == result2 assert expected3 == result3 assert expected4 == result4 + assert expected5 == result5 diff --git a/Packs/AWS-EC2/doc_files/IP_Whitelist_-_AWS_Security_Group.png b/Packs/AWS-EC2/doc_files/IP_Whitelist_-_AWS_Security_Group.png new file mode 100644 index 00000000000..cfdce5454ef Binary files /dev/null and b/Packs/AWS-EC2/doc_files/IP_Whitelist_-_AWS_Security_Group.png differ diff --git a/Packs/AWS-EC2/pack_metadata.json b/Packs/AWS-EC2/pack_metadata.json index b96a130e163..d2593f26ecb 100644 --- a/Packs/AWS-EC2/pack_metadata.json +++ b/Packs/AWS-EC2/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AWS - EC2", "description": "Amazon Web Services Elastic Compute Cloud (EC2)", "support": "xsoar", - "currentVersion": "1.0.0", + "currentVersion": "1.1.1", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AccessInvestigation/IncidentTypes/incidenttype-Access.json b/Packs/AccessInvestigation/IncidentTypes/incidenttype-Access.json new file mode 100644 index 00000000000..e71641feabc --- /dev/null +++ b/Packs/AccessInvestigation/IncidentTypes/incidenttype-Access.json @@ -0,0 +1,27 @@ +{ + "id": "Access", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Access", + "prevName": "", + "playbookId": "access_investigation_-_generic", + "color": "#B287FE", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/AccessInvestigation/ReleaseNotes/1_1_2.md b/Packs/AccessInvestigation/ReleaseNotes/1_1_2.md new file mode 100644 index 00000000000..8327a3b64eb --- /dev/null +++ b/Packs/AccessInvestigation/ReleaseNotes/1_1_2.md @@ -0,0 +1,5 @@ + \ No newline at end of file diff --git a/Packs/AccessInvestigation/pack_metadata.json b/Packs/AccessInvestigation/pack_metadata.json index a9b2d68d743..adfed798b3e 100644 --- a/Packs/AccessInvestigation/pack_metadata.json +++ b/Packs/AccessInvestigation/pack_metadata.json @@ -1,16 +1,16 @@ -{ - "name": "Access Investigation", - "description": "Investigates an access incident by gathering user and IP information and interacting with the user to confirm whether or not they initiated the access action.", - "support": "xsoar", - "currentVersion": "1.1.1", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-05-25T10:39:08Z", - "categories": [ - "Network Security" - ], - "tags": [], - "useCases": ["Access"], - "keywords": [] +{ + "name": "Access Investigation", + "description": "Investigates an access incident by gathering user and IP information and interacting with the user to confirm whether or not they initiated the access action.", + "support": "xsoar", + "currentVersion": "1.1.2", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-05-25T10:39:08Z", + "categories": [ + "Network Security" + ], + "tags": [], + "useCases": ["Access"], + "keywords": [] } \ No newline at end of file diff --git a/Packs/Accessdata/.pack-ignore b/Packs/Accessdata/.pack-ignore index e69de29bb2d..b2e114bca9c 100644 --- a/Packs/Accessdata/.pack-ignore +++ b/Packs/Accessdata/.pack-ignore @@ -0,0 +1,2 @@ +[file:playbook-Accessdata__Dump_memory_for_malicious_process.yml] +ignore=BA101 diff --git a/Packs/Accessdata/pack_metadata.json b/Packs/Accessdata/pack_metadata.json index 6dc42c35b55..69abc865e74 100644 --- a/Packs/Accessdata/pack_metadata.json +++ b/Packs/Accessdata/pack_metadata.json @@ -1,11 +1,11 @@ { "name": "Accessdata", "description": "Use the Accessdata integration to protect against and provide additional visibility into phishing and other malicious email attacks.", - "support": "xsoar", + "support": "partner", "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", + "author": "Accessdata", + "url": "https://support.accessdata.com/hc/en-us", + "email": "support@accessdata.com", "created": "2020-04-14T00:00:00Z", "categories": [ "Forensics & Malware Analysis" diff --git a/Packs/Active_Directory_Query/pack_metadata.json b/Packs/Active_Directory_Query/pack_metadata.json index 4eb49ccc188..7c134bbcd52 100644 --- a/Packs/Active_Directory_Query/pack_metadata.json +++ b/Packs/Active_Directory_Query/pack_metadata.json @@ -14,5 +14,35 @@ "useCases": [], "keywords": [ "Active Directory" - ] + ], + "dependencies": { + "EWSMailSender": { + "mandatory": false, + "display_name": "EWS Mail Sender" + }, + "Gmail": { + "mandatory": false, + "display_name": "Gmail" + }, + "CommonScripts": { + "mandatory": true, + "display_name": "Common Scripts" + }, + "MicrosoftGraphListener": { + "mandatory": false, + "display_name": "Microsoft Graph Mail Single User" + }, + "GmailSingleUser": { + "mandatory": false, + "display_name": "Gmail Single User (Beta)" + }, + "MailSenderNew": { + "mandatory": false, + "display_name": "Mail Sender (New)" + }, + "MicrosoftGraphMail": { + "mandatory": false, + "display_name": "Microsoft Graph Mail" + } + } } \ No newline at end of file diff --git a/Packs/Aella_StarLight/.pack-ignore b/Packs/Aella_StarLight/.pack-ignore index e69de29bb2d..5960bab48a9 100644 --- a/Packs/Aella_StarLight/.pack-ignore +++ b/Packs/Aella_StarLight/.pack-ignore @@ -0,0 +1,2 @@ +[file:pack_metadata.json] +ignore=PA113 \ No newline at end of file diff --git a/Packs/Aella_StarLight/pack_metadata.json b/Packs/Aella_StarLight/pack_metadata.json index dc1422af9ac..cacbe7abc93 100644 --- a/Packs/Aella_StarLight/pack_metadata.json +++ b/Packs/Aella_StarLight/pack_metadata.json @@ -1,10 +1,10 @@ { "name": "Aella Star Light", "description": "Aella Star Light Integration", - "support": "xsoar", + "support": "partner", "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", + "author": "Aella Star Light", + "url": "", "email": "", "created": "2020-04-14T00:00:00Z", "categories": [ diff --git a/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.py b/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.py index 6409a51015e..009b4efbec3 100644 --- a/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.py +++ b/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.py @@ -365,7 +365,7 @@ def main(): ) ) commands = { - f"test-module": test_module_command, + "test-module": test_module_command, f"{INTEGRATION_COMMAND_NAME}-get-events": get_events_command } command = demisto.command() diff --git a/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.yml b/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.yml index 74d3cedc779..156d2fb072e 100644 --- a/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.yml +++ b/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.yml @@ -176,7 +176,7 @@ script: - contextPath: IP.Geo.Country description: The country in which the IP address is located. type: String - dockerimage: demisto/akamai:1.0.0.5063 + dockerimage: demisto/akamai:1.0.0.8883 isfetch: true longRunning: false longRunningPort: false diff --git a/Packs/Akamai_SIEM/ReleaseNotes/1_0_1.md b/Packs/Akamai_SIEM/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..3faeffad162 --- /dev/null +++ b/Packs/Akamai_SIEM/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Akamai WAF SIEM +- Internal code improvements. \ No newline at end of file diff --git a/Packs/Akamai_SIEM/pack_metadata.json b/Packs/Akamai_SIEM/pack_metadata.json index 0253993da9c..5b543477f15 100644 --- a/Packs/Akamai_SIEM/pack_metadata.json +++ b/Packs/Akamai_SIEM/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "Akamai WAF SIEM", - "description": "Use the Akamai WAF SIEM integration to retrieve security events from Akamai Web Application Firewall (WAF) service.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Analytics & SIEM" - ], - "tags": [], - "useCases": [], - "keywords": [] -} + "name": "Akamai WAF SIEM", + "description": "Use the Akamai WAF SIEM integration to retrieve security events from Akamai Web Application Firewall (WAF) service.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Analytics & SIEM" + ], + "tags": [], + "useCases": [], + "keywords": [] +} \ No newline at end of file diff --git a/Packs/Akamai_WAF/Integrations/Akamai_WAF/Akamai_WAF.py b/Packs/Akamai_WAF/Integrations/Akamai_WAF/Akamai_WAF.py index d6422e3636a..58996610a55 100644 --- a/Packs/Akamai_WAF/Integrations/Akamai_WAF/Akamai_WAF.py +++ b/Packs/Akamai_WAF/Integrations/Akamai_WAF/Akamai_WAF.py @@ -98,7 +98,7 @@ def create_network_list(self, list_name: str, list_type: str, elements: Optional "list": elements if elements else [] } return self._http_request(method='POST', - url_suffix=f'/network-list/v2/network-lists', + url_suffix='/network-list/v2/network-lists', json_data=body) def delete_network_list(self, network_list_id: str) -> dict: diff --git a/Packs/Akamai_WAF/Integrations/Akamai_WAF/Akamai_WAF.yml b/Packs/Akamai_WAF/Integrations/Akamai_WAF/Akamai_WAF.yml index 95b97124fda..2c324a79a7e 100644 --- a/Packs/Akamai_WAF/Integrations/Akamai_WAF/Akamai_WAF.yml +++ b/Packs/Akamai_WAF/Integrations/Akamai_WAF/Akamai_WAF.yml @@ -320,7 +320,7 @@ script: - contextPath: Akamai.NetworkLists.ActivationStatus.ProductionStatus description: The network list environment activation status. type: String - dockerimage: demisto/akamai:1.0.0.5063 + dockerimage: demisto/akamai:1.0.0.8883 feed: false isfetch: false longRunning: false diff --git a/Packs/Akamai_WAF/ReleaseNotes/1_0_1.md b/Packs/Akamai_WAF/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..85005e04310 --- /dev/null +++ b/Packs/Akamai_WAF/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Akamai WAF +- Internal code improvements. diff --git a/Packs/Akamai_WAF/pack_metadata.json b/Packs/Akamai_WAF/pack_metadata.json index 8f1bc6de7ef..35cf458e59d 100644 --- a/Packs/Akamai_WAF/pack_metadata.json +++ b/Packs/Akamai_WAF/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "Akamai WAF", - "description": "Use the Akamai WAF integration to manage common sets of lists used by various Akamai security products and features.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Network Security" - ], - "tags": [], - "useCases": [], - "keywords": [] -} + "name": "Akamai WAF", + "description": "Use the Akamai WAF integration to manage common sets of lists used by various Akamai security products and features.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Network Security" + ], + "tags": [], + "useCases": [], + "keywords": [] +} \ No newline at end of file diff --git a/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.py b/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.py index 7eaed68513a..8f3cef5dbe6 100644 --- a/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.py +++ b/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.py @@ -207,7 +207,7 @@ def ip_command(client: Client, ip_address: str, ip_version: str) -> Tuple[str, D return f'{INTEGRATION_NAME} - Could not find any results for given query', {}, {} context_entry: dict = { outputPaths.get("ip"): ip_ec, - f'AlienVaultOTX.IP(val.IP && val.IP === obj.IP)': alienvault_ec, + 'AlienVaultOTX.IP(val.IP && val.IP === obj.IP)': alienvault_ec, outputPaths.get("dbotscore"): dbotscore_ec } human_readable = tableToMarkdown(t=context_entry.get(outputPaths.get("ip")), @@ -255,13 +255,13 @@ def domain_command(client: Client, domain: str) -> Tuple[str, Dict, Union[Dict, return f'{INTEGRATION_NAME} - Could not find any results for given query', {}, {} context_entry: dict = { outputPaths.get("domain"): domain_ec, - f'AlienVaultOTX.Domain(val.Alexa && val.Alexa === obj.Alexa &&' - f'val.Whois && val.Whois === obj.Whois)': alienvault_ec, + 'AlienVaultOTX.Domain(val.Alexa && val.Alexa === obj.Alexa &&' + 'val.Whois && val.Whois === obj.Whois)': alienvault_ec, outputPaths.get("dbotscore"): dbotscore_ec } human_readable = tableToMarkdown(t=context_entry.get( - f'AlienVaultOTX.Domain(val.Alexa && val.Alexa === obj.Alexa &&' - f'val.Whois && val.Whois === obj.Whois)'), + 'AlienVaultOTX.Domain(val.Alexa && val.Alexa === obj.Alexa &&' + 'val.Whois && val.Whois === obj.Whois)'), name=title) return human_readable, context_entry, raws @@ -363,10 +363,10 @@ def url_command(client: Client, url: str) -> Tuple[str, Dict, Union[Dict, list]] return f'{INTEGRATION_NAME} - Could not find any results for given query', {}, {} context_entry: dict = { outputPaths.get("url"): url_ec, - f'AlienVaultOTX.URL(val.Url && val.Url === obj.Url)': alienvault_ec, + 'AlienVaultOTX.URL(val.Url && val.Url === obj.Url)': alienvault_ec, outputPaths.get("dbotscore"): dbotscore_ec } - human_readable = tableToMarkdown(t=context_entry.get(f'AlienVaultOTX.URL(val.Url && val.Url === obj.Url)'), + human_readable = tableToMarkdown(t=context_entry.get('AlienVaultOTX.URL(val.Url && val.Url === obj.Url)'), name=title) return human_readable, context_entry, raws @@ -390,8 +390,8 @@ def alienvault_search_hostname_command(client: Client, hostname: str) -> Tuple[s 'Endpoint(val.Hostname && val.Hostname === obj.Hostname)': { 'Hostname': raw_response.get('indicator') }, - f'AlienVaultOTX.Endpoint(val.Alexa && val.Alexa === obj.Alexa &&' - f'val.Whois && val.Whois === obj.Whois)': { + 'AlienVaultOTX.Endpoint(val.Alexa && val.Alexa === obj.Alexa &&' + 'val.Whois && val.Whois === obj.Whois)': { 'Hostname': raw_response.get('indicator'), 'Alexa': raw_response.get('alexa'), 'Whois': raw_response.get('whois') @@ -405,8 +405,8 @@ def alienvault_search_hostname_command(client: Client, hostname: str) -> Tuple[s } human_readable = tableToMarkdown(name=title, t=context_entry.get( - f'AlienVaultOTX.Endpoint(val.Alexa && val.Alexa === obj.Alexa &&' - f'val.Whois && val.Whois === obj.Whois)')) + 'AlienVaultOTX.Endpoint(val.Alexa && val.Alexa === obj.Alexa &&' + 'val.Whois && val.Whois === obj.Whois)')) return human_readable, context_entry, raw_response else: @@ -471,7 +471,7 @@ def alienvault_get_related_urls_by_indicator_command(client: Client, indicator_t title = f'{INTEGRATION_NAME} - Related url list to queried indicator' context_entry: list = create_list_by_ec(list_entries=raw_response.get('url_list', {}), list_type='url_list') context: dict = { - f'AlienVaultOTX.URL(val.URL.Data && val.URL.Data == obj.URL.Data)': context_entry + 'AlienVaultOTX.URL(val.URL.Data && val.URL.Data == obj.URL.Data)': context_entry } human_readable = tableToMarkdown(t=context_entry, name=title) @@ -500,10 +500,10 @@ def alienvault_get_related_hashes_by_indicator_command(client: Client, indicator if raw_response: title = f'{INTEGRATION_NAME} - Related malware list to queried indicator' context_entry: dict = { - f'AlienVaultOTX.File(val.File.Hash && val.File.Hash == obj.File.Hash)': + 'AlienVaultOTX.File(val.File.Hash && val.File.Hash == obj.File.Hash)': create_list_by_ec(list_entries=raw_response.get('data', {}), list_type='hash_list') } - human_readable = tableToMarkdown(t=context_entry.get(f'AlienVaultOTX.File(val.File.Hash && val.File.Hash \ + human_readable = tableToMarkdown(t=context_entry.get('AlienVaultOTX.File(val.File.Hash && val.File.Hash \ == obj.File.Hash)'), name=title) @@ -531,15 +531,15 @@ def alienvault_get_passive_dns_data_by_indicator_command(client: Client, indicat if raw_response: title = f'{INTEGRATION_NAME} - Related passive dns list to queried indicator' context_entry: dict = { - f'AlienVaultOTX.PassiveDNS(val.PassiveDNS.Hostname && val.PassiveDNS.Hostname == obj.PassiveDNS.Hostname &&' - f'val.PassiveDNS.LastSeen && val.PassiveDNS.LastSeen == obj.PassiveDNS.LastSeen &&' - f'val.PassiveDNS.IP && val.PassiveDNS.IP == obj.PassiveDNS.IP)': + 'AlienVaultOTX.PassiveDNS(val.PassiveDNS.Hostname && val.PassiveDNS.Hostname == obj.PassiveDNS.Hostname &&' + 'val.PassiveDNS.LastSeen && val.PassiveDNS.LastSeen == obj.PassiveDNS.LastSeen &&' + 'val.PassiveDNS.IP && val.PassiveDNS.IP == obj.PassiveDNS.IP)': create_list_by_ec(list_entries=raw_response.get('passive_dns', {}), list_type='passive_dns') } human_readable = tableToMarkdown(t=context_entry.get( - f'AlienVaultOTX.PassiveDNS(val.PassiveDNS.Hostname && val.PassiveDNS.Hostname == obj.PassiveDNS.Hostname &&' - f'val.PassiveDNS.LastSeen && val.PassiveDNS.LastSeen == obj.PassiveDNS.LastSeen &&' - f'val.PassiveDNS.IP && val.PassiveDNS.IP == obj.PassiveDNS.IP)'), + 'AlienVaultOTX.PassiveDNS(val.PassiveDNS.Hostname && val.PassiveDNS.Hostname == obj.PassiveDNS.Hostname &&' + 'val.PassiveDNS.LastSeen && val.PassiveDNS.LastSeen == obj.PassiveDNS.LastSeen &&' + 'val.PassiveDNS.IP && val.PassiveDNS.IP == obj.PassiveDNS.IP)'), name=title) return human_readable, context_entry, raw_response else: @@ -563,13 +563,13 @@ def alienvault_search_pulses_command(client: Client, page: str) -> Tuple[str, Di if raw_response: title = f'{INTEGRATION_NAME} - pulse page {page}' context_entry: dict = { - f'AlienVaultOTX.Pulses(val.ID && val.ID == obj.ID && ' - f'val.Modified && val.Modified == obj.Modified)': + 'AlienVaultOTX.Pulses(val.ID && val.ID == obj.ID && ' + 'val.Modified && val.Modified == obj.Modified)': [create_pulse_by_ec(entry) for entry in raw_response.get('results', {})] } human_readable = tableToMarkdown(t=context_entry.get( - f'AlienVaultOTX.Pulses(val.ID && val.ID == obj.ID && ' - f'val.Modified && val.Modified == obj.Modified)'), + 'AlienVaultOTX.Pulses(val.ID && val.ID == obj.ID && ' + 'val.Modified && val.Modified == obj.Modified)'), name=title) return human_readable, context_entry, raw_response @@ -593,7 +593,7 @@ def alienvault_get_pulse_details_command(client: Client, pulse_id: str) -> Tuple if raw_response: title = f'{INTEGRATION_NAME} - pulse id details' context_entry: dict = { - f'AlienVaultOTX.Pulses(val.ID && val.ID == obj.ID)': { + 'AlienVaultOTX.Pulses(val.ID && val.ID == obj.ID)': { 'Description': raw_response.get('description'), 'Created': raw_response.get('created'), 'Author': { @@ -606,7 +606,7 @@ def alienvault_get_pulse_details_command(client: Client, pulse_id: str) -> Tuple } } human_readable = tableToMarkdown(t=context_entry.get( - f'AlienVaultOTX.Pulses(val.ID && val.ID == obj.ID)'), + 'AlienVaultOTX.Pulses(val.ID && val.ID == obj.ID)'), name=title) return human_readable, context_entry, raw_response diff --git a/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.yml b/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.yml index a204b3ff92a..b82b08fd985 100644 --- a/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.yml +++ b/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.yml @@ -534,7 +534,7 @@ script: - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - dockerimage: demisto/python3:3.7.4.1150 + dockerimage: demisto/python3:3.8.3.8715 isfetch: false longRunning: false longRunningPort: false diff --git a/Packs/AlienVault_OTX/ReleaseNotes/1_0_1.md b/Packs/AlienVault_OTX/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..4551a7ec62a --- /dev/null +++ b/Packs/AlienVault_OTX/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AlienVault OTX v2 +- Internal code improvements. diff --git a/Packs/AlienVault_OTX/pack_metadata.json b/Packs/AlienVault_OTX/pack_metadata.json index 3f7bbac66ab..335be133c6c 100644 --- a/Packs/AlienVault_OTX/pack_metadata.json +++ b/Packs/AlienVault_OTX/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "AlienVault OTX", - "description": "Query Indicators of Compromise in AlienVault OTX.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Data Enrichment & Threat Intelligence" - ], - "tags": [], - "useCases": [], - "keywords": [] -} + "name": "AlienVault OTX", + "description": "Query Indicators of Compromise in AlienVault OTX.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Data Enrichment & Threat Intelligence" + ], + "tags": [], + "useCases": [], + "keywords": [] +} \ No newline at end of file diff --git a/Packs/AlphaSOC_Network_Behavior_Analytics/pack_metadata.json b/Packs/AlphaSOC_Network_Behavior_Analytics/pack_metadata.json index 0f9b5482ce8..9df509d7ee4 100644 --- a/Packs/AlphaSOC_Network_Behavior_Analytics/pack_metadata.json +++ b/Packs/AlphaSOC_Network_Behavior_Analytics/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "AlphaSOC Network Behavior Analytics", - "description": "Retrieve alerts from the AlphaSOC Analytics Engine", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Analytics & SIEM" - ], - "tags": [], - "useCases": [], - "keywords": [] + "name": "AlphaSOC Network Behavior Analytics", + "description": "Retrieve alerts from the AlphaSOC Analytics Engine", + "support": "partner", + "currentVersion": "1.0.0", + "author": "AlphaSOC", + "url": "", + "email": "support@alphasoc.com", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Analytics & SIEM" + ], + "tags": [], + "useCases": [], + "keywords": [] } diff --git a/Packs/AlphaSOC_Wisdom/pack_metadata.json b/Packs/AlphaSOC_Wisdom/pack_metadata.json index 534a4994b5d..c39693feb24 100644 --- a/Packs/AlphaSOC_Wisdom/pack_metadata.json +++ b/Packs/AlphaSOC_Wisdom/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "AlphaSOC Wisdom", - "description": "DNS and IP threat intelligence via the AlphaSOC platform", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Data Enrichment & Threat Intelligence" - ], - "tags": [], - "useCases": [], - "keywords": [] + "name": "AlphaSOC Wisdom", + "description": "DNS and IP threat intelligence via the AlphaSOC platform", + "support": "partner", + "currentVersion": "1.0.0", + "author": "AlphaSOC", + "url": "", + "email": "support@alphasoc.com", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Data Enrichment & Threat Intelligence" + ], + "tags": [], + "useCases": [], + "keywords": [] } diff --git a/Packs/ApiModules/ReleaseNotes/1_0_2.md b/Packs/ApiModules/ReleaseNotes/1_0_2.md new file mode 100644 index 00000000000..87e46abc154 --- /dev/null +++ b/Packs/ApiModules/ReleaseNotes/1_0_2.md @@ -0,0 +1,8 @@ + +#### Scripts +##### __JSONFeedApiModule__ +- Added support for auto detection of indicator types. +##### __CSVFeedApiModule__ +- Added support for auto detection of indicator types. +##### __HTTPFeedApiModule__ +- Added support for auto detection of indicator types. diff --git a/Packs/ApiModules/Scripts/CSVFeedApiModule/CHANGELOG.md b/Packs/ApiModules/Scripts/CSVFeedApiModule/CHANGELOG.md index 9053f63c051..b8d7d9f4150 100644 --- a/Packs/ApiModules/Scripts/CSVFeedApiModule/CHANGELOG.md +++ b/Packs/ApiModules/Scripts/CSVFeedApiModule/CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +Added support for auto detection of indicator types. ## [20.4.1] - 2020-04-29 Fixed an issue where *firstseenbysource* and *lastseenbysource* fields were not formatted correctly. diff --git a/Packs/ApiModules/Scripts/CSVFeedApiModule/CSVFeedApiModule.py b/Packs/ApiModules/Scripts/CSVFeedApiModule/CSVFeedApiModule.py index e3fc23d83e8..f975248c7bb 100644 --- a/Packs/ApiModules/Scripts/CSVFeedApiModule/CSVFeedApiModule.py +++ b/Packs/ApiModules/Scripts/CSVFeedApiModule/CSVFeedApiModule.py @@ -181,21 +181,25 @@ def get_feed_content_divided_to_lines(self, url, raw_response): return response_content.decode(self.encoding).split('\n') -def determine_indicator_type(indicator_type, default_indicator_type, value): +def determine_indicator_type(indicator_type, default_indicator_type, auto_detect, value): + """ + Detect the indicator type of the given value. + Args: + indicator_type: (str) Indicator type given in the config. + default_indicator_type: Indicator type which was inserted as a param of the integration by user. + auto_detect: (bool) True whether auto detection of the indicator type is wanted. + value: (str) The value which we'd like to get indicator type of. + Returns: + Str which stands for the indicator type after detection. + """ + if auto_detect: + indicator_type = auto_detect_indicator_type(value) if not indicator_type: indicator_type = default_indicator_type - if indicator_type == FeedIndicatorType.Domain and '*' in value: - indicator_type = FeedIndicatorType.DomainGlob return indicator_type def module_test_command(client: Client, args): - if not client.feed_url_to_config: - indicator_type = args.get('indicator_type', demisto.params().get('indicator_type')) - if not FeedIndicatorType.is_valid_type(indicator_type): - supported_values = FeedIndicatorType.list_all_supported_indicators() - raise ValueError(f'Indicator type of {indicator_type} is not supported. Supported values are:' - f' {supported_values}') client.build_iterator() return 'ok', {}, {} @@ -240,7 +244,7 @@ def create_fields_mapping(raw_json: Dict[str, Any], mapping: Dict[str, Union[Tup return fields_mapping -def fetch_indicators_command(client: Client, default_indicator_type: str, **kwargs): +def fetch_indicators_command(client: Client, default_indicator_type: str, auto_detect: bool, **kwargs): iterator = client.build_iterator(**kwargs) indicators = [] config = client.feed_url_to_config or {} @@ -255,7 +259,8 @@ def fetch_indicators_command(client: Client, default_indicator_type: str, **kwar if value: raw_json['value'] = value conf_indicator_type = config.get(url, {}).get('indicator_type') - indicator_type = determine_indicator_type(conf_indicator_type, default_indicator_type, value) + indicator_type = determine_indicator_type(conf_indicator_type, default_indicator_type, auto_detect, + value) raw_json['type'] = indicator_type indicator = { 'value': value, @@ -264,14 +269,14 @@ def fetch_indicators_command(client: Client, default_indicator_type: str, **kwar 'fields': create_fields_mapping(raw_json, mapping) if mapping else {} } indicators.append(indicator) - return indicators def get_indicators_command(client, args): itype = args.get('indicator_type', demisto.params().get('indicator_type')) limit = int(args.get('limit')) - indicators_list = fetch_indicators_command(client, itype) + auto_detect = demisto.params().get('auto_detect_type') + indicators_list = fetch_indicators_command(client, itype, auto_detect) entry_result = indicators_list[:limit] hr = tableToMarkdown('Indicators', entry_result, headers=['value', 'type', 'fields']) return hr, {}, indicators_list @@ -294,7 +299,7 @@ def feed_main(feed_name, params=None, prefix=''): } try: if command == 'fetch-indicators': - indicators = fetch_indicators_command(client, params.get('indicator_type')) + indicators = fetch_indicators_command(client, params.get('indicator_type'), params.get('auto_detect_type')) # we submit the indicators in batches for b in batch(indicators, batch_size=2000): demisto.createIndicators(b) # type: ignore diff --git a/Packs/ApiModules/Scripts/CSVFeedApiModule/CSVFeedApiModule.yml b/Packs/ApiModules/Scripts/CSVFeedApiModule/CSVFeedApiModule.yml index 0f058f1089b..422487fb007 100644 --- a/Packs/ApiModules/Scripts/CSVFeedApiModule/CSVFeedApiModule.yml +++ b/Packs/ApiModules/Scripts/CSVFeedApiModule/CSVFeedApiModule.yml @@ -13,4 +13,4 @@ system: true scripttarget: 0 dependson: {} timeout: 0s -dockerimage: demisto/python3:3.7.5.5420 \ No newline at end of file +dockerimage: demisto/jmespath:1.0.0.6980 \ No newline at end of file diff --git a/Packs/ApiModules/Scripts/HTTPFeedApiModule/CHANGELOG.md b/Packs/ApiModules/Scripts/HTTPFeedApiModule/CHANGELOG.md index b7fad792a33..8d68ded81eb 100644 --- a/Packs/ApiModules/Scripts/HTTPFeedApiModule/CHANGELOG.md +++ b/Packs/ApiModules/Scripts/HTTPFeedApiModule/CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +Added support for auto detection of indicator types. ## [20.5.0] - 2020-05-12 Fixed an issue where tag parsing did not work as expected. diff --git a/Packs/ApiModules/Scripts/HTTPFeedApiModule/HTTPFeedApiModule.py b/Packs/ApiModules/Scripts/HTTPFeedApiModule/HTTPFeedApiModule.py index 5f088bbf9fe..d20e8354660 100644 --- a/Packs/ApiModules/Scripts/HTTPFeedApiModule/HTTPFeedApiModule.py +++ b/Packs/ApiModules/Scripts/HTTPFeedApiModule/HTTPFeedApiModule.py @@ -328,7 +328,7 @@ def get_indicator_fields(line, url, feed_tags: list, client: Client): return attributes, value -def fetch_indicators_command(client, feed_tags, itype, **kwargs): +def fetch_indicators_command(client, feed_tags, itype, auto_detect, **kwargs): iterators = client.build_iterator(**kwargs) indicators = [] for iterator in iterators: @@ -343,10 +343,11 @@ def fetch_indicators_command(client, feed_tags, itype, **kwargs): if 'firstseenbysource' in attributes.keys(): attributes['firstseenbysource'] = datestring_to_millisecond_timestamp( attributes['firstseenbysource']) - + indicator_type = determine_indicator_type( + client.feed_url_to_config.get(url, {}).get('indicator_type'), itype, auto_detect, value) indicator_data = { "value": value, - "type": client.feed_url_to_config.get(url, {}).get('indicator_type', itype), + "type": indicator_type, "rawJSON": attributes, } @@ -358,11 +359,30 @@ def fetch_indicators_command(client, feed_tags, itype, **kwargs): return indicators +def determine_indicator_type(indicator_type, default_indicator_type, auto_detect, value): + """ + Detect the indicator type of the given value. + Args: + indicator_type: (str) Indicator type given in the config. + default_indicator_type: Indicator type which was inserted as a param of the integration by user. + auto_detect: (bool) True whether auto detection of the indicator type is wanted. + value: (str) The value which we'd like to get indicator type of. + Returns: + Str which stands for the indicator type after detection. + """ + if auto_detect: + indicator_type = auto_detect_indicator_type(value) + if not indicator_type: + indicator_type = default_indicator_type + return indicator_type + + def get_indicators_command(client: Client, args): itype = args.get('indicator_type', client.indicator_type) limit = int(args.get('limit')) feed_tags = args.get('feedTags') - indicators_list = fetch_indicators_command(client, feed_tags, itype)[:limit] + auto_detect = demisto.params().get('auto_detect_type') + indicators_list = fetch_indicators_command(client, feed_tags, itype, auto_detect)[:limit] entry_result = camelize(indicators_list) hr = tableToMarkdown('Indicators', entry_result, headers=['Value', 'Type', 'Rawjson']) return hr, {}, indicators_list @@ -402,7 +422,8 @@ def feed_main(feed_name, params=None, prefix=''): } try: if command == 'fetch-indicators': - indicators = fetch_indicators_command(client, feed_tags, params.get('indicator_type')) + indicators = fetch_indicators_command(client, feed_tags, params.get('indicator_type'), + params.get('auto_detect_type')) # we submit the indicators in batches for b in batch(indicators, batch_size=2000): demisto.createIndicators(b) diff --git a/Packs/ApiModules/Scripts/HTTPFeedApiModule/HTTPFeedApiModule.yml b/Packs/ApiModules/Scripts/HTTPFeedApiModule/HTTPFeedApiModule.yml index f86bfecd4e3..41b263981af 100644 --- a/Packs/ApiModules/Scripts/HTTPFeedApiModule/HTTPFeedApiModule.yml +++ b/Packs/ApiModules/Scripts/HTTPFeedApiModule/HTTPFeedApiModule.yml @@ -13,4 +13,4 @@ system: true scripttarget: 0 dependson: {} timeout: 0s -dockerimage: demisto/python3:3.7.3.286 \ No newline at end of file +dockerimage: demisto/jmespath:1.0.0.6980 \ No newline at end of file diff --git a/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule.py b/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule.py index d4589f8d306..9986e81d7e0 100644 --- a/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule.py +++ b/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule.py @@ -100,7 +100,8 @@ def test_module(client, params) -> str: return 'ok' -def fetch_indicators_command(client: Client, indicator_type: str, feedTags: list, **kwargs) -> Union[Dict, List[Dict]]: +def fetch_indicators_command(client: Client, indicator_type: str, feedTags: list, auto_detect: bool, **kwargs)\ + -> Union[Dict, List[Dict]]: """ Fetches the indicators from client. :param client: Client of a JSON Feed @@ -120,7 +121,7 @@ def fetch_indicators_command(client: Client, indicator_type: str, feedTags: list item = {indicator_field: item} indicator_value = item.get(indicator_field) - current_indicator_type = indicator_type or auto_detect_indicator_type(indicator_value) + current_indicator_type = determine_indicator_type(indicator_type, auto_detect, indicator_value) if not current_indicator_type: continue @@ -143,6 +144,21 @@ def fetch_indicators_command(client: Client, indicator_type: str, feedTags: list return indicators +def determine_indicator_type(indicator_type, auto_detect, value): + """ + Detect the indicator type of the given value. + Args: + indicator_type: (str) Given indicator type. + auto_detect: (bool) True whether auto detection of the indicator type is wanted. + value: (str) The value which we'd like to get indicator type of. + Returns: + Str which stands for the indicator type after detection. + """ + if auto_detect: + indicator_type = auto_detect_indicator_type(value) + return indicator_type + + def extract_all_fields_from_indicator(indicator, indicator_key): """Flattens the JSON object to create one dictionary of values @@ -195,14 +211,16 @@ def feed_main(params, feed_name, prefix): return_outputs(test_module(client, params)) elif command == 'fetch-indicators': - indicators = fetch_indicators_command(client, indicator_type, feedTags) + indicators = fetch_indicators_command(client, params.get('indicator_type'), feedTags, + params.get('auto_detect_type')) for b in batch(indicators, batch_size=2000): demisto.createIndicators(b) elif command == f'{prefix}get-indicators': # dummy command for testing limit = int(demisto.args().get('limit', 10)) - indicators = fetch_indicators_command(client, indicator_type, feedTags)[:limit] + auto_detect = params.get('auto_detect_type') + indicators = fetch_indicators_command(client, indicator_type, feedTags, auto_detect)[:limit] hr = tableToMarkdown('Indicators', indicators, headers=['value', 'type', 'rawJSON']) return_outputs(hr, {}, indicators) diff --git a/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule_test.py b/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule_test.py index 5f1a8d10184..2329d199315 100644 --- a/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule_test.py +++ b/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule_test.py @@ -19,7 +19,8 @@ def test_json_feed_no_config(): insecure=True ) - indicators = fetch_indicators_command(client=client, indicator_type='CIDR', feedTags=['test']) + indicators = fetch_indicators_command(client=client, indicator_type='CIDR', feedTags=['test'], + auto_detect=False) assert len(jmespath.search(expression="[].rawJSON.service", data=indicators)) == 1117 @@ -47,7 +48,8 @@ def test_json_feed_with_config(): insecure=True ) - indicators = fetch_indicators_command(client=client, indicator_type='CIDR', feedTags=['test']) + indicators = fetch_indicators_command(client=client, indicator_type='CIDR', feedTags=['test'], + auto_detect=False) assert len(jmespath.search(expression="[].rawJSON.service", data=indicators)) == 1117 @@ -78,7 +80,8 @@ def test_json_feed_with_config_mapping(): insecure=True ) - indicators = fetch_indicators_command(client=client, indicator_type='CIDR', feedTags=['test']) + indicators = fetch_indicators_command(client=client, indicator_type='CIDR', feedTags=['test'], + auto_detect=False) assert len(jmespath.search(expression="[].rawJSON.service", data=indicators)) == 1117 indicator = indicators[0] custom_fields = indicator['fields'] @@ -113,7 +116,7 @@ def test_list_of_indicators_with_no_json_object(): insecure=True ) - indicators = fetch_indicators_command(client=client, indicator_type=None, feedTags=['test']) + indicators = fetch_indicators_command(client=client, indicator_type=None, feedTags=['test'], auto_detect=True) assert len(indicators) == 3 assert indicators[0].get('value') == '1.1.1.1' assert indicators[0].get('type') == 'IP' diff --git a/Packs/ApiModules/pack_metadata.json b/Packs/ApiModules/pack_metadata.json index 7ceea77dffc..b9816578183 100644 --- a/Packs/ApiModules/pack_metadata.json +++ b/Packs/ApiModules/pack_metadata.json @@ -2,7 +2,7 @@ "name": "ApiModules", "description": "API Modules", "support": "xsoar", - "currentVersion": "1.0.1", + "currentVersion": "1.0.2", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Exchange/README.md b/Packs/ArcSightXML/README.md similarity index 100% rename from Packs/Exchange/README.md rename to Packs/ArcSightXML/README.md diff --git a/Packs/AttackIQFireDrill/Integrations/AttackIQFireDrill/AttackIQFireDrill.py b/Packs/AttackIQFireDrill/Integrations/AttackIQFireDrill/AttackIQFireDrill.py index 6a29f61b8fd..1b4950f3e78 100644 --- a/Packs/AttackIQFireDrill/Integrations/AttackIQFireDrill/AttackIQFireDrill.py +++ b/Packs/AttackIQFireDrill/Integrations/AttackIQFireDrill/AttackIQFireDrill.py @@ -211,7 +211,7 @@ def create_invalid_id_err_msg(orig_err, error_codes): """ err_msg = API_ERR_MSG if any(err_code in orig_err for err_code in error_codes): - err_msg += f'This may be happen if you provided an invalid id.\n' + err_msg += 'This may be happen if you provided an invalid id.\n' err_msg += orig_err return err_msg @@ -480,7 +480,7 @@ def build_tests_hr(tests_res, ass_id, page_num, tot_pages): def list_tests_by_assessment(params): - return http_request('GET', f'/v1/tests', params=params) + return http_request('GET', '/v1/tests', params=params) def list_tests_by_assessment_command(): @@ -635,7 +635,7 @@ def add_assets_to_assessment(): data['asset_groups'] = asset_groups if data == {}: - raise ValueError(f"No asset or asset groups were specified.") + raise ValueError("No asset or asset groups were specified.") try: res = http_request('POST', f'/v1/assessments/{assessment_id}/update_defaults', data=json.dumps(data)) demisto.results(res.get('message', '')) diff --git a/Packs/AttackIQFireDrill/Integrations/AttackIQFireDrill/AttackIQFireDrill.yml b/Packs/AttackIQFireDrill/Integrations/AttackIQFireDrill/AttackIQFireDrill.yml index 62eae0ac6b6..c3d33a2b40d 100644 --- a/Packs/AttackIQFireDrill/Integrations/AttackIQFireDrill/AttackIQFireDrill.yml +++ b/Packs/AttackIQFireDrill/Integrations/AttackIQFireDrill/AttackIQFireDrill.yml @@ -688,7 +688,7 @@ script: description: Deletes an assessment. execution: false name: attackiq-delete-assessment - dockerimage: demisto/python3:3.7.4.1502 + dockerimage: demisto/python3:3.8.3.8715 isfetch: false runonce: false script: '-' diff --git a/Packs/AttackIQFireDrill/ReleaseNotes/1_0_1.md b/Packs/AttackIQFireDrill/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..9001c83ceae --- /dev/null +++ b/Packs/AttackIQFireDrill/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AttackIQFireDrill +- Internal code improvements. \ No newline at end of file diff --git a/Packs/AttackIQFireDrill/pack_metadata.json b/Packs/AttackIQFireDrill/pack_metadata.json index 94b91a9d59c..02c4e013e80 100644 --- a/Packs/AttackIQFireDrill/pack_metadata.json +++ b/Packs/AttackIQFireDrill/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "AttackIQ Platform", - "description": "An attack simulation platform that provides validations for security controls, responses, and remediation exercises.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Vulnerability Management" - ], - "tags": [], - "useCases": [], - "keywords": [] -} + "name": "AttackIQ Platform", + "description": "An attack simulation platform that provides validations for security controls, responses, and remediation exercises.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Vulnerability Management" + ], + "tags": [], + "useCases": [], + "keywords": [] +} \ No newline at end of file diff --git a/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.py b/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.py index 2ac0e9833e4..48672e7edf7 100644 --- a/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.py +++ b/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.py @@ -851,8 +851,8 @@ def validate_no_query_and_indicators(query, arg_list): if query: for arg in arg_list: if arg: - return_error(f'The search command can either run a search using a custom query ' - f'or use the builtin arguments, but not both') + return_error('The search command can either run a search using a custom query ' + 'or use the builtin arguments, but not both') def validate_no_multiple_indicators_for_search(arg_list): @@ -1103,7 +1103,7 @@ def search_samples_command(): info = search_samples(query=query, scope=scope, size=max_results, sort=sort, order=order, file_hash=file_hash, domain=domain, ip=ip, url=url, wildfire_verdict=wildfire_verdict, first_seen=first_seen, last_updated=last_updated, artifact_source=artifact_source) - md = tableToMarkdown(f'Search Samples Info:', info) + md = tableToMarkdown('Search Samples Info:', info) demisto.results({ 'Type': entryTypes['note'], 'ContentsFormat': formats['text'], @@ -1127,7 +1127,7 @@ def search_sessions_command(): order = args.get('order') info = search_sessions(query=query, size=max_results, sort=sort, order=order, file_hash=file_hash, domain=domain, ip=ip, url=url, from_time=from_time, to_time=to_time) - md = tableToMarkdown(f'Search Sessions Info:', info) + md = tableToMarkdown('Search Sessions Info:', info) demisto.results({ 'Type': entryTypes['note'], 'ContentsFormat': formats['text'], @@ -1161,7 +1161,7 @@ def samples_search_results_command(): return_outputs(readable_output=hr, outputs=context, raw_response=results) else: hr = tableToMarkdown(f'Search Samples Result is {status}', result) - hr += tableToMarkdown(f'Artifacts for Sample: ', []) + hr += tableToMarkdown('Artifacts for Sample: ', []) return_outputs(readable_output=hr, outputs=context, raw_response=results) @@ -1184,8 +1184,9 @@ def samples_search_result_hr(result: dict, status: str) -> str: rest = result hr = tableToMarkdown(f'Search Samples Result is {status}', rest) hr += '\n\n' - hr += tableToMarkdown(f'Artifacts for Sample: ', updated_artifact, headers=["b", "g", "m", "indicator_type", - "confidence", "indicator"]) + hr += tableToMarkdown( + 'Artifacts for Sample: ', updated_artifact, + headers=["b", "g", "m", "indicator_type", "confidence", "indicator"]) return hr @@ -1244,7 +1245,7 @@ def sample_analysis_command(): 'ContentsFormat': formats['text'], 'Contents': {'ID': sample_id, 'Analysis': analysis}, 'HumanReadable': f'### Sample Analysis results for {sample_id}:', - 'EntryContext': {f'AutoFocus.SampleAnalysis(val.ID == obj.ID)': {'ID': sample_id, 'Analysis': context}}, + 'EntryContext': {'AutoFocus.SampleAnalysis(val.ID == obj.ID)': {'ID': sample_id, 'Analysis': context}}, }) for category_name, category_data in analysis.items(): print_hr_by_category(category_name, category_data) @@ -1274,7 +1275,7 @@ def top_tags_search_command(): commodity = args.get('commodity') == 'True' unit42 = args.get('unit42') == 'True' info = autofocus_top_tags_search(scope, tag_class, private, public, commodity, unit42) - md = tableToMarkdown(f'Top tags search Info:', info) + md = tableToMarkdown('Top tags search Info:', info) demisto.results({ 'Type': entryTypes['note'], 'ContentsFormat': formats['text'], diff --git a/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.yml b/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.yml index 7c618e5fa1f..c7fd37045e5 100644 --- a/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.yml +++ b/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.yml @@ -1046,7 +1046,7 @@ script: description: The domain name. type: String dockerimage45: demisto/python3:3.7.2.214 - dockerimage: demisto/python3:3.8.2.6981 + dockerimage: demisto/python3:3.8.3.8715 isfetch: false longRunning: false longRunningPort: false diff --git a/Packs/AutoFocus/ReleaseNotes/1_0_1.md b/Packs/AutoFocus/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..2ea939072b0 --- /dev/null +++ b/Packs/AutoFocus/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AutoFocus V2 +- Internal code improvements. diff --git a/Packs/AutoFocus/pack_metadata.json b/Packs/AutoFocus/pack_metadata.json index faafdc8034e..3f296e39d83 100644 --- a/Packs/AutoFocus/pack_metadata.json +++ b/Packs/AutoFocus/pack_metadata.json @@ -1,16 +1,22 @@ { - "name": "AutoFocus", - "description": "Use the Palo Alto Networks AutoFocus integration to distinguish the most\n important threats from everyday commodity attacks.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-01T09:45:32Z", - "categories": [ - "Data Enrichment & Threat Intelligence" - ], - "tags": [], - "useCases": [], - "keywords": [] + "name": "AutoFocus", + "description": "Use the Palo Alto Networks AutoFocus integration to distinguish the most\n important threats from everyday commodity attacks.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-01T09:45:32Z", + "categories": [ + "Data Enrichment & Threat Intelligence" + ], + "tags": [], + "useCases": [], + "keywords": [], + "dependencies": { + "CommonScripts": { + "mandatory": true, + "display_name": "Common Scripts" + } + } } \ No newline at end of file diff --git a/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel.yml b/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel.yml index 7311f4dab48..3eac5792650 100644 --- a/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel.yml +++ b/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel.yml @@ -75,7 +75,7 @@ configuration: required: false type: 8 description: Use the Azure Sentinel integration to get and manage incidents and get related entity information for incidents. -display: Azure Sentinel +display: Azure Sentinel (Beta) name: Azure Sentinel script: commands: diff --git a/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel_description.md b/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel_description.md index ed7d7a287f8..53868748605 100644 --- a/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel_description.md +++ b/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel_description.md @@ -29,3 +29,5 @@ Follow these steps for a self-deployed configuration. ## Get the additional instance parameters To get the ***Subscription ID***, ***Workspace Name*** and ***Resource Group*** parameters, navigate in the Azure Portal to ***Azure Sentinel > YOUR-WORKSPACE > Settings*** and click on ***Workspace Settings*** tab. + +Note: This is a beta Integration, which lets you implement and test pre-release software. Since the integration is beta, it might contain bugs. Updates to the integration during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the integration to help us identify issues, fix them, and continually improve. diff --git a/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel_test.py b/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel_test.py index 1a859c029e5..6993800f72b 100644 --- a/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel_test.py +++ b/Packs/AzureSentinel/Integrations/AzureSentinel/AzureSentinel_test.py @@ -118,6 +118,7 @@ def test_list_incident_relations_command(args, client, mocker): assert next_link == 'https://test.com' assert len(result['value']) == 1 + @pytest.mark.parametrize('args,client', [ # disable-secrets-detection ({'incident_id': 'inc_id', 'message': 'test_message'}, mock_client(self_deployed=False))]) def test_incident_add_comment_command(args, client, mocker): diff --git a/Packs/AzureSentinel/Integrations/AzureSentinel/CHANGELOG.md b/Packs/AzureSentinel/Integrations/AzureSentinel/CHANGELOG.md index 8f82f3208ae..e2391458ab4 100644 --- a/Packs/AzureSentinel/Integrations/AzureSentinel/CHANGELOG.md +++ b/Packs/AzureSentinel/Integrations/AzureSentinel/CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +- ## [20.4.0] - 2020-04-14 - diff --git a/Packs/AzureSentinel/ReleaseNotes/1_0_1.md b/Packs/AzureSentinel/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..29459ad5820 --- /dev/null +++ b/Packs/AzureSentinel/ReleaseNotes/1_0_1.md @@ -0,0 +1,5 @@ + diff --git a/Packs/AzureSentinel/pack_metadata.json b/Packs/AzureSentinel/pack_metadata.json index 1c12129b15b..48908985543 100644 --- a/Packs/AzureSentinel/pack_metadata.json +++ b/Packs/AzureSentinel/pack_metadata.json @@ -1,18 +1,18 @@ { - "name": "AzureSentinel", - "description": "Azure Sentinel is a cloud-native security information and event manager (SIEM) platform that uses built-in AI to help analyze large volumes of data across an enterprise.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-03-28T12:58:02Z", - "categories": [ - "Analytics & SIEM" - ], - "tags": [], - "useCases": [], - "keywords": [ - "AzureSentinel" - ] -} + "name": "AzureSentinel", + "description": "Azure Sentinel is a cloud-native security information and event manager (SIEM) platform that uses built-in AI to help analyze large volumes of data across an enterprise.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-03-28T12:58:02Z", + "categories": [ + "Analytics & SIEM" + ], + "tags": [], + "useCases": [], + "keywords": [ + "AzureSentinel" + ] +} \ No newline at end of file diff --git a/Packs/BPA/Integrations/BPA/BPA.py b/Packs/BPA/Integrations/BPA/BPA.py index cbf1b6a3c0e..2fb25094349 100644 --- a/Packs/BPA/Integrations/BPA/BPA.py +++ b/Packs/BPA/Integrations/BPA/BPA.py @@ -177,6 +177,7 @@ def get_results_command(client: Client, args: Dict): raw: Dict = client.get_results_request(task_id) status = raw.get('status') results = raw.get('results', {}) + exclude_passed_checks = args.get('exclude_passed_checks') == "true" if not status: raise Exception("Invalid response from BPA") @@ -197,7 +198,10 @@ def get_results_command(client: Client, args: Dict): # Empty list, no checks continue checks = get_checks_from_feature(feature_contents[0], feature_name, category_name) - job_checks.extend(checks) + if exclude_passed_checks: + job_checks.extend([check for check in checks if not check.get('check_passed')]) + else: + job_checks.extend(checks) download_url = results.get('download_url') diff --git a/Packs/BPA/Integrations/BPA/BPA.yml b/Packs/BPA/Integrations/BPA/BPA.yml index fba123cb42f..d4fc71213d5 100644 --- a/Packs/BPA/Integrations/BPA/BPA.yml +++ b/Packs/BPA/Integrations/BPA/BPA.yml @@ -60,6 +60,14 @@ script: name: task_id required: true secret: false + - default: false + name: exclude_passed_checks + description: Whether to exclude passed checks. Can be "true" or "false". Default is "false". + auto: PREDEFINED + predefined: + - "true" + - "false" + defaultValue: "false" deprecated: false description: Returns results of BPA job. execution: false @@ -92,7 +100,7 @@ script: - contextPath: InfoFile.Extension description: File extension type: string - dockerimage: demisto/python3:3.8.2.6981 + dockerimage: demisto/python3:3.8.3.9324 feed: false isfetch: false longRunning: false diff --git a/Packs/BPA/Integrations/BPA/CHANGELOG.md b/Packs/BPA/Integrations/BPA/CHANGELOG.md index de184519a29..eb121899b51 100644 --- a/Packs/BPA/Integrations/BPA/CHANGELOG.md +++ b/Packs/BPA/Integrations/BPA/CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +Added the *exclude_passed_checks* argument to the ***pan-os-bpa-get-job-results*** command, which gives the option to exclude passed checks. ## [20.5.2] - 2020-05-26 - Added an argument which enables you to download a Panorama report. diff --git a/Packs/BPA/Integrations/BPA/README.md b/Packs/BPA/Integrations/BPA/README.md index 634e939bc3e..96f4359c9dd 100644 --- a/Packs/BPA/Integrations/BPA/README.md +++ b/Packs/BPA/Integrations/BPA/README.md @@ -263,6 +263,9 @@ Submitted BPA job ID: 2b0c40d6-73a8-4d23-9bd8-27548b28beb5 Required + + Default Value + @@ -270,6 +273,13 @@ Submitted BPA job ID: 2b0c40d6-73a8-4d23-9bd8-27548b28beb5 task_id The job id to get results from Required + - + + + exclude_passed_checks + Whether to exclude passed checks or not. + Not Required + false diff --git a/Packs/BPA/ReleaseNotes/1_1_0.md b/Packs/BPA/ReleaseNotes/1_1_0.md new file mode 100644 index 00000000000..27041df3b07 --- /dev/null +++ b/Packs/BPA/ReleaseNotes/1_1_0.md @@ -0,0 +1,4 @@ + +#### Integrations +##### BPA +- Added the option to exclude passed checks in ***pan-os-bpa-get-job-results*** command. diff --git a/Packs/BPA/TestPlaybooks/playbook-BPA-test.yml b/Packs/BPA/TestPlaybooks/playbook-BPA-test.yml index d155f1ca780..98c0c1d3c15 100644 --- a/Packs/BPA/TestPlaybooks/playbook-BPA-test.yml +++ b/Packs/BPA/TestPlaybooks/playbook-BPA-test.yml @@ -1,14 +1,14 @@ id: Test-BPA -version: -1 +version: 8 name: Test-BPA starttaskid: "0" tasks: "0": id: "0" - taskid: 33930745-eeda-4467-808f-b3109964dd33 + taskid: 06afda6f-3011-4b7d-81cd-d7d68376ef74 type: start task: - id: 33930745-eeda-4467-808f-b3109964dd33 + id: 06afda6f-3011-4b7d-81cd-d7d68376ef74 version: -1 name: "" iscommand: false @@ -31,10 +31,10 @@ tasks: quietmode: 0 "1": id: "1" - taskid: a584565d-45e0-48d6-8b3e-911de18654d2 + taskid: 7c822901-b728-43ea-87a5-20d0a5712cec type: regular task: - id: a584565d-45e0-48d6-8b3e-911de18654d2 + id: 7c822901-b728-43ea-87a5-20d0a5712cec version: -1 name: DeleteContext description: Delete field from context @@ -67,10 +67,10 @@ tasks: quietmode: 0 "2": id: "2" - taskid: 864913ea-71c9-49dd-88d4-1d93b5bdff93 + taskid: 1523fbb5-8f28-49f0-8562-ec01e9e8a2c4 type: regular task: - id: 864913ea-71c9-49dd-88d4-1d93b5bdff93 + id: 1523fbb5-8f28-49f0-8562-ec01e9e8a2c4 version: -1 name: pan-os-bpa-submit-job description: Submits a BPA job. @@ -99,10 +99,10 @@ tasks: quietmode: 0 "3": id: "3" - taskid: 333cfc71-49f5-4be0-8e02-bd8f2dac3835 + taskid: 25a4742a-99e5-457d-87fb-9c3bd103cc36 type: playbook task: - id: 333cfc71-49f5-4be0-8e02-bd8f2dac3835 + id: 25a4742a-99e5-457d-87fb-9c3bd103cc36 version: -1 name: GenericPolling description: |- @@ -155,10 +155,10 @@ tasks: quietmode: 0 "5": id: "5" - taskid: e3843b2a-b8e9-45ae-8820-2788455081eb + taskid: 9bc78e2e-5722-4e96-8a5a-1f503d1dd7a2 type: condition task: - id: e3843b2a-b8e9-45ae-8820-2788455081eb + id: 9bc78e2e-5722-4e96-8a5a-1f503d1dd7a2 version: -1 name: Test BPA Checks Are Returned type: condition @@ -166,7 +166,7 @@ tasks: brand: "" nexttasks: "yes": - - "7" + - "10" separatecontext: false conditions: - label: "yes" @@ -206,10 +206,10 @@ tasks: quietmode: 0 "7": id: "7" - taskid: 86e0b324-2b01-4958-8c27-78c66a293c83 + taskid: 86268dac-3b75-4713-8a92-13672c5a90d0 type: regular task: - id: 86e0b324-2b01-4958-8c27-78c66a293c83 + id: 86268dac-3b75-4713-8a92-13672c5a90d0 version: -1 name: closeInvestigation description: Close the current incident @@ -230,7 +230,7 @@ tasks: { "position": { "x": 50, - "y": 1245 + "y": 1770 } } note: false @@ -240,10 +240,10 @@ tasks: quietmode: 0 "8": id: "8" - taskid: 548b923e-b896-40bf-8d8f-42ac39c45874 + taskid: 0642547e-3930-45ed-8c6c-04f10290e6b1 type: regular task: - id: 548b923e-b896-40bf-8d8f-42ac39c45874 + id: 0642547e-3930-45ed-8c6c-04f10290e6b1 version: -1 name: pan-os-get-documentation description: Get documentaion @@ -269,10 +269,10 @@ tasks: quietmode: 0 "9": id: "9" - taskid: 4f8f98eb-d21f-4d4b-828a-eada7d92941a + taskid: 9da2cd68-133e-4adc-8526-e5b7cb3ef2ef type: regular task: - id: 4f8f98eb-d21f-4d4b-828a-eada7d92941a + id: 9da2cd68-133e-4adc-8526-e5b7cb3ef2ef version: -1 name: pan-os-bpa-get-job-results description: Returns results of BPA job. @@ -299,12 +299,126 @@ tasks: ignoreworker: false skipunavailable: false quietmode: 0 + "10": + id: "10" + taskid: 9f72939b-1058-45b6-88b1-6cc21b0bfa04 + type: regular + task: + id: 9f72939b-1058-45b6-88b1-6cc21b0bfa04 + version: -1 + name: DeleteContext + description: Delete field from context + scriptName: DeleteContext + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "11" + scriptarguments: + all: + simple: "yes" + index: {} + key: {} + keysToKeep: + simple: PAN-OS-BPA.SubmittedJob.JobID + subplaybook: {} + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 1245 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "11": + id: "11" + taskid: ec9101b0-65a8-49be-8794-304ab19e17f0 + type: regular + task: + id: ec9101b0-65a8-49be-8794-304ab19e17f0 + version: -1 + name: pan-os-bpa-get-job-results + description: Returns results of BPA job. + script: BPA|||pan-os-bpa-get-job-results + type: regular + iscommand: true + brand: BPA + nexttasks: + '#none#': + - "12" + scriptarguments: + exclude_passed_checks: + simple: "true" + task_id: + simple: ${PAN-OS-BPA.SubmittedJob.JobID} + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 1420 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "12": + id: "12" + taskid: 1a12b604-293a-4fdf-8b0b-1cf8e7b0d2a7 + type: condition + task: + id: 1a12b604-293a-4fdf-8b0b-1cf8e7b0d2a7 + version: -1 + name: Test BPA Checks Are Returned + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "7" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEmpty + left: + value: + complex: + root: PAN-OS-BPA + filters: + - - operator: isTrue + left: + value: + simple: PAN-OS-BPA.JobResults.Checks.check_passed + iscontext: true + accessor: JobResults.Checks + iscontext: true + view: |- + { + "position": { + "x": 50, + "y": 1595 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 1290, + "height": 1815, "width": 380, "x": 50, "y": 50 diff --git a/Packs/BPA/pack_metadata.json b/Packs/BPA/pack_metadata.json index fa0a665cd85..b58b6390b81 100644 --- a/Packs/BPA/pack_metadata.json +++ b/Packs/BPA/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "Palo Alto Networks BPA", - "description": "Palo Alto Networks Best Practice Assessment (BPA) analyzes NGFW and Panorama configurations and compares them to the best practices.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Utilities" - ], - "tags": [], - "useCases": [], - "keywords": [] + "name": "Palo Alto Networks BPA", + "description": "Palo Alto Networks Best Practice Assessment (BPA) analyzes NGFW and Panorama configurations and compares them to the best practices.", + "support": "xsoar", + "currentVersion": "1.1.0", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Utilities" + ], + "tags": [], + "useCases": [], + "keywords": [] } \ No newline at end of file diff --git a/Packs/Base/ReleaseNotes/1_0_10.md b/Packs/Base/ReleaseNotes/1_0_10.md new file mode 100644 index 00000000000..6d4fad919d8 --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_0_10.md @@ -0,0 +1,4 @@ + +#### Scripts +- __CommonServerPython__ +Fixed incorrect time zone parsing for **timestamp_to_datestring** diff --git a/Packs/Base/ReleaseNotes/1_0_11.md b/Packs/Base/ReleaseNotes/1_0_11.md new file mode 100644 index 00000000000..13ca42aa852 --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_0_11.md @@ -0,0 +1,4 @@ +#### Scripts +##### SaneDocReports +- Fixed SVG image rendering in doc reports. +- Added the ability to add customer logos to doc reports. diff --git a/Packs/Base/ReleaseNotes/1_0_12.md b/Packs/Base/ReleaseNotes/1_0_12.md new file mode 100644 index 00000000000..79db85bebd4 --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_0_12.md @@ -0,0 +1,4 @@ + +#### Scripts +##### SanePdfReports +- Fixes word overlapping in graphs. diff --git a/Packs/Base/ReleaseNotes/1_0_13.md b/Packs/Base/ReleaseNotes/1_0_13.md new file mode 100644 index 00000000000..c8d36bf3c7d --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_0_13.md @@ -0,0 +1,6 @@ +#### Scripts +##### SaneDocReports +- Reverted changes made in 1.0.12 + +##### SanePdfReports +- Rolled back the docker image to fix a conflict issue. \ No newline at end of file diff --git a/Packs/Base/ReleaseNotes/1_0_6.md b/Packs/Base/ReleaseNotes/1_0_6.md index 30f0c43c414..4e3ea4ef9d4 100644 --- a/Packs/Base/ReleaseNotes/1_0_6.md +++ b/Packs/Base/ReleaseNotes/1_0_6.md @@ -1,4 +1,4 @@ #### Scripts -- __CommonServerPython__ - - Added support for the CVE indicator class. +##### __CommonServerPython__ +- Added support for the CVE indicator class. diff --git a/Packs/Base/ReleaseNotes/1_0_7.md b/Packs/Base/ReleaseNotes/1_0_7.md new file mode 100644 index 00000000000..37b72573f64 --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_0_7.md @@ -0,0 +1,4 @@ + +#### Scripts +##### __CommonServerPython__ +- Add safeget from python dict function. diff --git a/Packs/Base/ReleaseNotes/1_0_8.md b/Packs/Base/ReleaseNotes/1_0_8.md new file mode 100644 index 00000000000..5fe6c57aded --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_0_8.md @@ -0,0 +1,4 @@ + +#### Scripts +##### CommonServerPowerShell +- Updated the **ReturnOutputs** function to support *object* types. diff --git a/Packs/Base/ReleaseNotes/1_0_9.md b/Packs/Base/ReleaseNotes/1_0_9.md new file mode 100644 index 00000000000..aca8a2d5ab5 --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_0_9.md @@ -0,0 +1,4 @@ + +#### Scripts +##### __CommonServerPython__ +- Fixed an issue where the **argToList** function did not behave as expected. This fix breaks backward compatibility. diff --git a/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.Tests.ps1 b/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.Tests.ps1 index 2c5bdb6640f..7bd873f43e5 100644 --- a/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.Tests.ps1 +++ b/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.Tests.ps1 @@ -1,4 +1,7 @@ -. $PSScriptRoot\CommonServerPowerShell.ps1 +BeforeAll { + . $PSScriptRoot\CommonServerPowerShell.ps1 +} + Describe 'Check-DemistoServerRequest' { It 'Check that a call to demisto DemistoServerRequest mock works. Should always return an empty response' { @@ -41,6 +44,20 @@ Describe 'Check-UtilityFunctions' { $r.Contents | Should -Be $msg } + It "ReturnOutputs PsCustomObject" { + $msg = "Human readable" + $output = [PsCustomObject]@{Test="test"} + $raw = [PSCustomObject]@{Raw="raw"} + $r = ReturnOutputs $msg $output $raw + $r.ContentsFormat | Should -Be "json" + $r.HumanReadable | Should -Be $msg + $r.EntryContext.Test | Should -Be "test" + $r.Contents.Raw | Should -Be "raw" + $r = ReturnOutputs $msg + $r.ContentsFormat | Should -Be "text" + $r.Contents | Should -Be $msg + } + It "ReturnError simple" { $msg = "this is an error" $r = ReturnError $msg @@ -50,8 +67,10 @@ Describe 'Check-UtilityFunctions' { $r.EntryContext | Should -BeNullOrEmpty } Context "Check log function" { - Mock DemistoServerLog {} - + BeforeAll { + Mock DemistoServerLog {} + } + It "ReturnError complex" { # simulate an error Test-JSON "{badjson}" -ErrorAction SilentlyContinue -ErrorVariable err @@ -59,8 +78,9 @@ Describe 'Check-UtilityFunctions' { $r = ReturnError $msg $err @{Failed = $true} $r.Contents | Should -Be $msg $r.EntryContext.Failed | Should -BeTrue + # ReturnError call demisto.Error() make sure it was called Assert-MockCalled -CommandName DemistoServerLog -Times 2 -ParameterFilter {$level -eq "error"} - Assert-MockCalled -CommandName DemistoServerLog -Times 1 -ParameterFilter {$msg.Contains("Test-JSON : Cannot parse the JSON")} + Assert-MockCalled -CommandName DemistoServerLog -Times 1 -ParameterFilter {$msg.Contains("Cannot parse the JSON")} } } } diff --git a/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.ps1 b/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.ps1 index c67a7dea7d0..69af1ec013d 100644 --- a/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.ps1 +++ b/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.ps1 @@ -367,7 +367,7 @@ raw response from the 3rd party service (optional) .OUTPUTS The entry object returned to the server #> -function ReturnOutputs([string]$ReadableOutput, [hashtable]$Outputs, [hashtable]$RawResponse) { +function ReturnOutputs([string]$ReadableOutput, [object]$Outputs, [object]$RawResponse) { $entry = @{ Type = [EntryTypes]::note; ContentsFormat = [EntryFormats]::json.ToString(); diff --git a/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.yml b/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.yml index 06ef8f2e1bc..697470d2d50 100644 --- a/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.yml +++ b/Packs/Base/Scripts/CommonServerPowerShell/CommonServerPowerShell.yml @@ -10,5 +10,8 @@ tags: comment: Common code that will be merged into each PowerShell script/integration when it runs system: true fromversion: 5.5.0 +dockerimage: demisto/powershell:6.2.4.6166 +alt_dockerimages: # used for unit testing + - demisto/powershell:7.0.1.9103 tests: - PowerShellCommon-Test diff --git a/Packs/Base/Scripts/CommonServerPython/CHANGELOG.md b/Packs/Base/Scripts/CommonServerPython/CHANGELOG.md index 61e84cd307d..ad52cf10bc8 100644 --- a/Packs/Base/Scripts/CommonServerPython/CHANGELOG.md +++ b/Packs/Base/Scripts/CommonServerPython/CHANGELOG.md @@ -1,6 +1,7 @@ ## [Unreleased] - Added **Endpoint** Common class. - Added a new function **auto_detect_indicator_type** which detects indicators. + - Fixed an issue where the **argToList** function did not behave as expected. This fix is breaking backward compatibility. ## [20.5.2] - 2020-05-26 - Fixed IPv4 regex to only catch IPv4 addresses, not CIDR ranges. diff --git a/Packs/Base/Scripts/CommonServerPython/CommonServerPython.py b/Packs/Base/Scripts/CommonServerPython/CommonServerPython.py index 27a3ee7ad2d..85d6d71cdda 100644 --- a/Packs/Base/Scripts/CommonServerPython/CommonServerPython.py +++ b/Packs/Base/Scripts/CommonServerPython/CommonServerPython.py @@ -1193,7 +1193,7 @@ def argToList(arg, separator=','): if arg[0] == '[' and arg[-1] == ']': return json.loads(arg) return [s.strip() for s in arg.split(separator)] - return arg + return [arg] def argToBoolean(value): @@ -3055,7 +3055,7 @@ def parse_date_range(date_range, date_format=None, to_timestamp=False, timezone= return start_time, end_time -def timestamp_to_datestring(timestamp, date_format="%Y-%m-%dT%H:%M:%S.000Z"): +def timestamp_to_datestring(timestamp, date_format="%Y-%m-%dT%H:%M:%S.000Z", is_utc=False): """ Parses timestamp (milliseconds) to a date string in the provided date format (by default: ISO 8601 format) Examples: (1541494441222, 1541495441000, etc.) @@ -3066,9 +3066,15 @@ def timestamp_to_datestring(timestamp, date_format="%Y-%m-%dT%H:%M:%S.000Z"): :type date_format: ``str`` :param date_format: The date format the timestamp should be parsed to. (optional) + :type is_utc: ``bool`` + :param is_utc: Should the string representation of the timestamp use UTC time or the local machine time + :return: The parsed timestamp in the date_format :rtype: ``str`` """ + use_utc_time = is_utc or date_format.endswith('Z') + if use_utc_time: + return datetime.utcfromtimestamp(int(timestamp) / 1000.0).strftime(date_format) return datetime.fromtimestamp(int(timestamp) / 1000.0).strftime(date_format) @@ -3785,6 +3791,29 @@ def batch(iterable, batch_size=1): current_batch = not_batched[:batch_size] not_batched = not_batched[batch_size:] +def dict_safe_get(dict_object, keys, default_return_value = None): + """Recursive safe get query, If keys found return value othewise return None or default value. + + :type dict_object: ``dict`` + :param dict_object: dictionary to query. + + :type keys: ``list`` + :param keys: keys for recursive get. + + :type default_return_value: ``object`` + :param default_return_value: Value to return when no key availble. + + :rtype: ``object`` + :return:: Value found. + """ + for key in keys: + try: + dict_object = dict_object[key] + except (KeyError, TypeError): + return default_return_value + + return dict_object + class DemistoException(Exception): pass diff --git a/Packs/Base/Scripts/CommonServerPython/CommonServerPython_test.py b/Packs/Base/Scripts/CommonServerPython/CommonServerPython_test.py index 5e1bd984996..aee1063f1a6 100644 --- a/Packs/Base/Scripts/CommonServerPython/CommonServerPython_test.py +++ b/Packs/Base/Scripts/CommonServerPython/CommonServerPython_test.py @@ -460,12 +460,19 @@ def test_argToList(): test2 = 'a,b,c' test3 = '["a","b","c"]' test4 = 'a;b;c' + test5 = 1 + test6 = '1' + test7 = True results = [argToList(test1), argToList(test2), argToList(test2, ','), argToList(test3), argToList(test4, ';')] for result in results: assert expected == result, 'argToList test failed, {} is not equal to {}'.format(str(result), str(expected)) + assert argToList(test5) == [1] + assert argToList(test6) == ['1'] + assert argToList(test7) == [True] + def test_remove_nulls(): temp_dictionary = {"a": "b", "c": 4, "e": [], "f": {}, "g": None, "h": "", "i": [1], "k": ()} @@ -1267,6 +1274,7 @@ class TestBaseClient: 'post' ] + @pytest.mark.skip(reason="Test - too long, only manual") @pytest.mark.parametrize('method', RETRIES_POSITIVE_TEST) def test_http_requests_with_retry_sanity(self, method): """ @@ -1291,9 +1299,9 @@ def test_http_requests_with_retry_sanity(self, method): ('get', 400), ('get', 401), ('get', 500), ('put', 400), ('put', 401), ('put', 500), ('post', 400), ('post', 401), ('post', 500), - ] + @pytest.mark.skip(reason="Test - too long, only manual") @pytest.mark.parametrize('method, status', RETRIES_NEGATIVE_TESTS_INPUT) def test_http_requests_with_retry_negative_sanity(self, method, status): """ @@ -1884,3 +1892,16 @@ def test_handle_proxy(mocker): mocker.patch.object(demisto, 'params', return_value={'unsecure': True}) handle_proxy() assert os.getenv('REQUESTS_CA_BUNDLE') is None + + +@pytest.mark.parametrize(argnames="dict_obj, keys, expected, default_return_value", + argvalues=[ + ({'a': '1'}, ['a'], '1', None), + ({'a': {'b': '2'}}, ['a', 'b'], '2', None), + ({'a': {'b': '2'}}, ['a', 'c'], 'test', 'test'), + ]) +def test_safe_get(dict_obj, keys, expected, default_return_value): + from CommonServerPython import dict_safe_get + assert expected == dict_safe_get(dict_object=dict_obj, + keys=keys, + default_return_value=default_return_value) diff --git a/Packs/Base/Scripts/DBotMLFetchData/DBotMLFetchData.py b/Packs/Base/Scripts/DBotMLFetchData/DBotMLFetchData.py new file mode 100644 index 00000000000..7d52b9d114e --- /dev/null +++ b/Packs/Base/Scripts/DBotMLFetchData/DBotMLFetchData.py @@ -0,0 +1,20 @@ +import demistomock as demisto +from CommonServerPython import * +from CommonServerUserPython import * + + +def return_json_entry(obj): + entry = { + "Type": entryTypes["note"], + "ContentsFormat": formats["json"], + "Contents": obj, + } + demisto.results(entry) + + +def main(): + return_json_entry({}) + + +if __name__ in ['__main__', '__builtin__', 'builtins']: + main() diff --git a/Packs/Base/Scripts/DBotMLFetchData/DBotMLFetchData.yml b/Packs/Base/Scripts/DBotMLFetchData/DBotMLFetchData.yml new file mode 100644 index 00000000000..f21afd379d0 --- /dev/null +++ b/Packs/Base/Scripts/DBotMLFetchData/DBotMLFetchData.yml @@ -0,0 +1,14 @@ +comment: Collect telemetry data from the environment +commonfields: + id: DBotMLFetchData + version: -1 +enabled: false +name: DBotMLFetchData +script: '-' +subtype: python3 +system: false +tags: + - ml +timeout: '0' +type: python +deprecated: true diff --git a/Packs/Base/Scripts/FindSimilarIncidentsByText/FindSimilarIncidentsByText.yml b/Packs/Base/Scripts/FindSimilarIncidentsByText/FindSimilarIncidentsByText.yml index 5e778bd1ce0..f8c33f75aed 100644 --- a/Packs/Base/Scripts/FindSimilarIncidentsByText/FindSimilarIncidentsByText.yml +++ b/Packs/Base/Scripts/FindSimilarIncidentsByText/FindSimilarIncidentsByText.yml @@ -110,4 +110,4 @@ type: python dockerimage: demisto/machine-learning runonce: false tests: -- dedup_-_generic_-_test +- Dedup - Generic v2 - Test diff --git a/Packs/Base/Scripts/SaneDocReportV2/CHANGELOG.md b/Packs/Base/Scripts/SaneDocReportV2/CHANGELOG.md index 6a7dd05397b..eef528a8e27 100644 --- a/Packs/Base/Scripts/SaneDocReportV2/CHANGELOG.md +++ b/Packs/Base/Scripts/SaneDocReportV2/CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +- ## [20.5.0] - 2020-05-12 - diff --git a/Packs/Base/Scripts/SaneDocReportV2/SaneDocReportV2.yml b/Packs/Base/Scripts/SaneDocReportV2/SaneDocReportV2.yml index 24ba05ed8ff..438f2992454 100644 --- a/Packs/Base/Scripts/SaneDocReportV2/SaneDocReportV2.yml +++ b/Packs/Base/Scripts/SaneDocReportV2/SaneDocReportV2.yml @@ -40,4 +40,4 @@ runonce: false tests: - No Test deprecated: true -fromversion: 5.5.0 +fromversion: 5.5.0 \ No newline at end of file diff --git a/Packs/Base/Scripts/SanePdfReport/CHANGELOG.md b/Packs/Base/Scripts/SanePdfReport/CHANGELOG.md index 789a8342d23..82c3c467bf4 100644 --- a/Packs/Base/Scripts/SanePdfReport/CHANGELOG.md +++ b/Packs/Base/Scripts/SanePdfReport/CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +- ## [20.5.0] - 2020-05-12 - Fixed logos usage and added failure verbose output. diff --git a/Packs/Base/pack_metadata.json b/Packs/Base/pack_metadata.json index ddd5833622f..23c3ccf1fb7 100644 --- a/Packs/Base/pack_metadata.json +++ b/Packs/Base/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Base", "description": "The base pack for Cortex XSOAR.", "support": "xsoar", - "currentVersion": "1.0.6", + "currentVersion": "1.0.13", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", @@ -15,5 +15,6 @@ "keywords": [ "base", "common" - ] -} \ No newline at end of file + ], + "dependencies": {} +} diff --git a/Packs/BastilleNetworks/pack_metadata.json b/Packs/BastilleNetworks/pack_metadata.json index 59b19684479..fe90181ee87 100644 --- a/Packs/BastilleNetworks/pack_metadata.json +++ b/Packs/BastilleNetworks/pack_metadata.json @@ -16,10 +16,6 @@ "wireless" ], "created": "2020-05-07T16:59:04Z", - "updated": "2020-05-07T16:59:04Z", - "beta": false, - "deprecated": false, "useCases": [], - "keywords": [], - "dependencies": {} + "keywords": [] } diff --git a/Packs/BigFix/Integrations/BigFix/BigFix.py b/Packs/BigFix/Integrations/BigFix/BigFix.py new file mode 100644 index 00000000000..7ff9594c504 --- /dev/null +++ b/Packs/BigFix/Integrations/BigFix/BigFix.py @@ -0,0 +1,797 @@ +import requests + +import demistomock as demisto +from CommonServerPython import * + +requests.packages.urllib3.disable_warnings() + +BASE_URL = demisto.params().get('url') +VERIFY_CERTIFICATE = not demisto.params().get('unsecure') + +USERNAME = demisto.params()['credentials']['identifier'] +PASSWORD = demisto.params()['credentials']['password'] + +if not demisto.params()['proxy']: + del os.environ['HTTP_PROXY'] + del os.environ['HTTPS_PROXY'] + del os.environ['http_proxy'] + del os.environ['https_proxy'] + + +def get_first(iterable, default=None): + if iterable: + for item in iterable: + return item + return default + + +def get_sites(): + fullurl = BASE_URL + '/api/sites' + res = requests.get( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE + ) + + if res.status_code < 200 or res.status_code >= 300: + return_error('Failed to get sites.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format( + fullurl, res.status_code, res.content)) + + raw_sites = json.loads(xml2json(res.content)) + + if not raw_sites or 'BESAPI' not in raw_sites: + return [] + + sites = [] + master_sites = demisto.get(raw_sites, 'BESAPI.ActionSite') + + if master_sites and not isinstance(master_sites, list): + master_sites = [master_sites] + if master_sites: + for idx, site in enumerate(master_sites): + master_sites[idx]['Type'] = 'master' + master_sites[idx]['Resource'] = master_sites[idx]['@Resource'] + del master_sites[idx]['@Resource'] + else: + master_sites = [] + + external_sites = demisto.get(raw_sites, 'BESAPI.ExternalSite') + if external_sites and not isinstance(external_sites, list): + external_sites = [external_sites] + if external_sites: + for idx, site in enumerate(external_sites): + external_sites[idx]['Type'] = 'external' + external_sites[idx]['Resource'] = external_sites[idx]['@Resource'] + del external_sites[idx]['@Resource'] + else: + external_sites = [] + + operator_sites = demisto.get(raw_sites, 'BESAPI.OperatorSite') + if operator_sites and not isinstance(operator_sites, list): + operator_sites = [operator_sites] + if operator_sites: + for idx, site in enumerate(operator_sites): + operator_sites[idx]['Type'] = 'operator' + operator_sites[idx]['Resource'] = operator_sites[idx]['@Resource'] + del operator_sites[idx]['@Resource'] + else: + operator_sites = [] + + custom_sites = demisto.get(raw_sites, 'BESAPI.CustomSite') + if custom_sites and not isinstance(custom_sites, list): + custom_sites = [custom_sites] + + if custom_sites: + for idx, site in enumerate(custom_sites): + custom_sites[idx]['Type'] = 'custom' + custom_sites[idx]['Resource'] = custom_sites[idx]['@Resource'] + del custom_sites[idx]['@Resource'] + else: + custom_sites = [] + + sites = master_sites + external_sites + operator_sites + custom_sites + for idx, site in enumerate(sites): + site_details = get_site(site['Type'], site['Name']) + sites[idx] = site_details + + return sites + + +def get_sites_command(): + sites = get_sites() + demisto.results({ + 'Type': entryTypes['note'], + 'ContentsFormat': formats['json'], + 'Contents': sites, + 'HumanReadable': tableToMarkdown( + 'BigFix Sites', + sites, + ['Name', 'Type', 'GatherURL', 'Description', 'GlobalReadPermissions', 'Subscription'] + ), + 'EntryContext': { + 'Bigfix.Site(val.Resource==obj.Resource)': sites + } + }) + + +def get_site(site_type, site_name): + fullurl = BASE_URL + '/api/site/' + site_type + if site_type != 'master': + # if site name is not empty the add to url + fullurl += '/' + site_name + + res = requests.get( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE + ) + + if res.status_code < 200 or res.status_code >= 300: + return_error('Failed to get site {}.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format( + site_name, fullurl, res.status_code, res.content)) + + raw_site = json.loads(xml2json(res.content)) + + if not raw_site or 'BES' not in raw_site: + return None + + site = None + if site_type == 'master': + site = demisto.get(raw_site, 'BES.ActionSite') + elif site_type == 'external': + site = demisto.get(raw_site, 'BES.ExternalSite') + elif site_type == 'custom': + site = demisto.get(raw_site, 'BES.CustomSite') + elif site_type == 'operator': + site = demisto.get(raw_site, 'BES.OperatorSite') + + if site is not None: + site['Type'] = site_type + site['Resource'] = BASE_URL + '/api/site/{}/{}'.format(site_type, site_name) + + return site + + +def get_site_command(): + site_name = demisto.args().get('site_name') + site_type = demisto.args().get('site_type') + site = get_site(site_type, site_name) + + if site is None: + demisto.results('No site found') + sys.exit(0) + + demisto.results({ + 'Type': entryTypes['note'], + 'ContentsFormat': formats['json'], + 'Contents': site, + 'HumanReadable': tableToMarkdown( + 'BigFix Site: {} - {}'.format(site_type, site_name), + [site], + ['Name', 'Type', 'GatherURL', 'Description', 'GlobalReadPermissions', 'Subscription'] + ), + 'EntryContext': { + 'Bigfix.Site(val.Resource==obj.Resource)': site + } + }) + + +def get_endpoints(should_get_endpoint_details): + fullurl = BASE_URL + '/api/computers' + + res = requests.get( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE + ) + + if res.status_code < 200 or res.status_code >= 300: + return_error('Failed to get endpoints.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format( + fullurl, res.status_code, res.content)) + + raw_endpoints = json.loads(xml2json(res.content)) + + if not raw_endpoints or 'BESAPI' not in raw_endpoints: + return None + + raw_endpoints = demisto.get(raw_endpoints, 'BESAPI.Computer') + if raw_endpoints and not isinstance(raw_endpoints, list): + raw_endpoints = [raw_endpoints] + + for idx, endpoint in enumerate(raw_endpoints): + raw_endpoints[idx]['Resource'] = raw_endpoints[idx]['@Resource'] + del raw_endpoints[idx]['@Resource'] + + if should_get_endpoint_details: + endpoints_with_details = [] + for raw_endpoint in raw_endpoints: + endpoint = get_endpoint_details(raw_endpoint.get('ID')) + endpoints_with_details.append(endpoint) + return endpoints_with_details + else: + return raw_endpoints + + +def get_endpoints_command(): + should_get_endpoint_details = demisto.args().get('get_endpoint_details') == 'true' + endpoints = get_endpoints(should_get_endpoint_details) + headers = ['ID', 'Resource', 'LastReportTime'] + if should_get_endpoint_details: + headers.extend([ + 'ActiveDirectoryPath', + 'AgentType', + 'AgentVersion', + 'BESRelaySelectionMethod', + 'BESRelayServiceInstalled', + 'BESRootServer', + 'BIOS', + 'CPU', + 'ClientSettings', + 'ComputerName', + 'ComputerType', + 'DNSName', + 'DeviceType', + 'DistancetoBESRelay', + 'FreeSpaceonSystemDrive', + 'IPAddress', + 'LicenseType', + 'Locked', + 'OS', + 'RAM', + 'Relay', + 'RelayNameOfClient', + 'SubnetAddress', + 'SubscribedSites', + 'TotalSizeofSystemDrive', + 'UserName' + ]) + demisto.results({ + 'Type': entryTypes['note'], + 'ContentsFormat': formats['json'], + 'Contents': endpoints, + 'HumanReadable': tableToMarkdown('BigFix Computers', endpoints, headers=headers), + 'EntryContext': { + 'Bigfix.Endpoint(val.ID==obj.ID)': endpoints + } + }) + + +def get_endpoint_details(computer_id): + fullurl = BASE_URL + '/api/computer/{}'.format(computer_id) + res = requests.get( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE + ) + + if res.status_code < 200 or res.status_code >= 300: + return_error( + 'Failed to get computer {}.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format( + computer_id, fullurl, res.status_code, res.content) + ) + + raw_endpoint = json.loads(xml2json(res.content)) + if not raw_endpoint or 'BESAPI' not in raw_endpoint: + return None + + raw_endpoint = demisto.get(raw_endpoint, 'BESAPI.Computer') + + endpoint = { + 'ID': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "ID")=val["#text"]')), + 'Resource': demisto.get(raw_endpoint, '@Resource'), + 'LastReportTime': get_first( + demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Last Report Time")=val["#text"]') + ), + 'ActiveDirectoryPath': get_first( + demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Active Directory Path")=val["#text"]') + ), + 'AgentType': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Agent Type")=val["#text"]')), + 'AgentVersion': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Agent Version")=val["#text"]')), + 'BESRelaySelectionMethod': get_first( + demisto.dt(raw_endpoint, 'Property(val["@Name"] == "BES Relay Selection Method")=val["#text"]') + ), + 'BESRelayServiceInstalled': get_first( + demisto.dt(raw_endpoint, 'Property(val["@Name"] == "BES Relay Selection Method")=val["#text"]') + ), + 'BESRootServer': get_first( + demisto.dt(raw_endpoint, 'Property(val["@Name"] == "BES Root Server")=val["#text"]') + ), + 'BIOS': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "BIOS")=val["#text"]')), + 'CPU': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "CPU")=val["#text"]')), + 'ClientSettings': demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Client Settings")=val["#text"]'), + 'ComputerName': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Computer Name")=val["#text"]')), + 'ComputerType': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Computer Type")=val["#text"]')), + 'DNSName': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "DNS Name")=val["#text"]')), + 'IPAddress': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "IP Address")=val["#text"]')), + 'DeviceType': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Device Type")=val["#text"]')), + 'DistancetoBESRelay': get_first( + demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Distance to BES Relay")=val["#text"]') + ), + 'FreeSpaceonSystemDrive': get_first( + demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Free Space on System Drive")=val["#text"]') + ), + 'LicenseType': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "License Type")=val["#text"]')), + 'Locked': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Locked")=val["#text"]')), + 'OS': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "OS")=val["#text"]')), + 'RAM': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "RAM")=val["#text"]')), + 'Relay': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Relay")=val["#text"]')), + 'RelayNameOfClient': get_first( + demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Relay Name of Client")=val["#text"]') + ), + 'SubnetAddress': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Subnet Address")=val["#text"]')), + 'SubscribedSites': get_first( + demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Subscribed Sites")=val["#text"]') + ), + 'TotalSizeofSystemDrive': get_first( + demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Total Size of System Drive")=val["#text"]') + ), + 'UserName': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "User Name")=val["#text"]')) + } + + return endpoint + + +def get_endpoint_details_command(): + computer_id = demisto.args().get('computer_id') + + endpoint = get_endpoint_details(computer_id) + if endpoint is None: + demisto.results('Endpoint with id {} was not found'.format(computer_id)) + sys.exit(0) + + markdown = tableToMarkdown('BigFix Endpoint {}'.format(computer_id), [endpoint], headers=[ + 'ID', + 'Resource', + 'LastReportTime', + 'ActiveDirectoryPath', + 'AgentType', + 'AgentVersion', + 'BESRelaySelectionMethod', + 'BESRelayServiceInstalled', + 'BESRootServer', + 'BIOS', + 'CPU', + 'ClientSettings', + 'ComputerName', + 'ComputerType', + 'DNSName', + 'DeviceType', + 'DistancetoBESRelay', + 'FreeSpaceonSystemDrive', + 'IPAddress', + 'LicenseType', + 'Locked', + 'OS', + 'RAM', + 'Relay', + 'RelayNameOfClient', + 'SubnetAddress', + 'SubscribedSites', + 'TotalSizeofSystemDrive', + 'UserName' + ]) + + demisto.results({ + 'Type': entryTypes['note'], + 'ContentsFormat': formats['json'], + 'Contents': endpoint, + 'HumanReadable': markdown, + 'EntryContext': { + 'Bigfix.Endpoint(val.ID==obj.ID)': endpoint + } + }) + + +def get_patches(site_type='', site_name=''): + fullurl = BASE_URL + '/api/fixlets/{}'.format(site_type) + if site_type != 'master': + # if site name is not empty the add to url + fullurl += '/' + site_name + + res = requests.get( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE + ) + + if res.status_code < 200 or res.status_code >= 300: + return_error( + 'Failed to get patches. Request URL: {}\nStatusCode: {}\nResponse Body: {}'.format( + fullurl, res.status_code, res.content) + ) + + raw_patches = json.loads(xml2json(res.content)) + if not raw_patches or 'BESAPI' not in raw_patches: + return None + + raw_patches = demisto.get(raw_patches, 'BESAPI.Fixlet') + if raw_patches and not isinstance(raw_patches, list): + raw_patches = [raw_patches] + + patches_with_details = [] + for raw_patch in raw_patches: + patch = get_patch_details(site_type, site_name, raw_patch.get('ID')) + patch['LastModified'] = raw_patch['@LastModified'] + patches_with_details.append(patch) + + return patches_with_details + + +def get_patches_command(): + site_name = demisto.args().get('site_name') + site_type = demisto.args().get('site_type') + patches = get_patches(site_type, site_name) + + markdown = tableToMarkdown('BigFix Patches', patches, headers=[ + 'ID', + 'Name', + 'Description', + 'LastModified', + 'Resource', + 'Relevance', + 'Category', + 'DownloadSize', + 'Source', + 'SourceID', + 'SourceReleaseDate', + 'SourceSeverity', + 'ActionID', + 'ActionScript' + ]) + + demisto.results({ + 'Type': entryTypes['note'], + 'ContentsFormat': formats['json'], + 'Contents': patches, + 'HumanReadable': markdown, + 'EntryContext': { + 'Bigfix.Patch(val.ID==obj.ID)': patches + } + }) + + +def get_patch_details(site_type, site_name, patch_id): + if site_type == 'master': + fullurl = BASE_URL + '/api/fixlet/master/{}'.format(patch_id) + else: + fullurl = BASE_URL + '/api/fixlet/{}/{}/{}'.format(site_type, site_name, patch_id) + + res = requests.get( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE + ) + + if res.status_code < 200 or res.status_code >= 300: + return_error('Failed to get patch/fixlet {}. Request URL: {}\nStatusCode: {}\nResponse Body: {}'.format( + patch_id, fullurl, res.status_code, res.content) + ) + + raw_patch = json.loads(xml2json(res.content)) + if not raw_patch or 'BES' not in raw_patch: + return None + + raw_patch = demisto.get(raw_patch, 'BES.Fixlet') + patch = { + 'ID': patch_id, + 'Name': demisto.get(raw_patch, 'Title'), + 'Resource': fullurl, + 'Description': demisto.get(raw_patch, 'Description'), + 'Relevance': demisto.get(raw_patch, 'Relevance'), + 'Category': demisto.get(raw_patch, 'Category'), + 'DownloadSize': demisto.get(raw_patch, 'DownloadSize'), + 'Source': demisto.get(raw_patch, 'Source'), + 'SourceID': demisto.get(raw_patch, 'SourceID'), + 'SourceReleaseDate': demisto.get(raw_patch, 'SourceReleaseDate'), + 'SourceSeverity': demisto.get(raw_patch, 'SourceSeverity'), + 'ActionID': demisto.get(raw_patch, 'DefaultAction.@ID'), + 'ActionScript': demisto.get(raw_patch, 'DefaultAction.ActionScript') + } + + return patch + + +def get_patch_details_command(): + site_type = demisto.args().get('site_type') + site_name = demisto.args().get('site_name') + patch_id = demisto.args().get('id') + + patch = get_patch_details(site_type, site_name, patch_id) + markdown = tableToMarkdown('BigFix Patch {}'.format(patch_id), [patch], headers=[ + 'ID', + 'Name', + 'Resource', + 'Description', + 'Relevance', + 'Category', + 'DownloadSize', + 'Source', + 'SourceID', + 'SourceReleaseDate', + 'SourceSeverity', + 'ActionID', + 'ActionScript' + ]) + + demisto.results({ + 'Type': entryTypes['note'], + 'ContentsFormat': formats['json'], + 'Contents': patch, + 'HumanReadable': markdown, + 'EntryContext': { + 'Bigfix.Patch(val.ID==obj.ID)': patch + } + }) + + +def deploy_patch(site_name, computer_ids, fixlet_id, action_id): + if 'all' in computer_ids: + target = 'true' + else: + target = '\n'.join(['{}'.format(computer_id) for computer_id in computer_ids]) + + request_body = """ + + + + {} + {} + {} + + + {} + + 1000 + + + """.format(site_name, fixlet_id, action_id, target) + LOG('deploy_patch - request: ' + request_body) + + fullurl = BASE_URL + '/api/actions' + res = requests.post( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE, + data=request_body + ) + + LOG('deploy_patch - raw response: ' + res.content) + if res.status_code < 200 or res.status_code >= 300: + return_error('Failed to deploy patch {}.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format( + fixlet_id, fullurl, res.status_code, res.content)) + + raw_action = json.loads(xml2json(res.content)) + if not raw_action or 'BESAPI' not in raw_action: + return None + + raw_action = demisto.get(raw_action, 'BESAPI.Action') + raw_action['FixletID'] = fixlet_id + raw_action['ComputerIDs'] = computer_ids + raw_action['SiteName'] = site_name + raw_action['Resource'] = raw_action['@Resource'] + del raw_action['@Resource'] + if 'all' in computer_ids: + raw_action['AllComputers'] = True + del raw_action['ComputerIDs'] + + return raw_action + + +def deploy_patch_command(): + site_name = demisto.args().get('site_name') + computer_ids = argToList(demisto.args().get('computer_ids')) + + fixlet_id = demisto.args().get('fixlet_id') + action_id = demisto.args().get('action_id') + + action = deploy_patch(site_name, computer_ids, fixlet_id, action_id) + + markdown = tableToMarkdown('BigFix Action {}'.format(action_id), [action], headers=[ + 'ID', + 'Name', + 'FixletID', + 'ComputerIDs', + 'SiteName', + 'Resource' + ]) + + demisto.results({ + 'Type': entryTypes['note'], + 'ContentsFormat': formats['json'], + 'Contents': action, + 'HumanReadable': markdown, + 'EntryContext': { + 'Bigfix.Action(val.ID==obj.ID)': action + } + }) + + +def action_delete(action_id): + fullurl = BASE_URL + '/api/action/' + action_id + res = requests.delete( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE + ) + + if res.status_code < 200 or res.status_code >= 300: + return_error('Failed to delete action {}.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format( + action_id, fullurl, res.status_code, res.content)) + + +def action_delete_command(): + action_id = demisto.args().get('action_id') + + action_delete(action_id) + + demisto.results('Action {} was deleted successfully'.format(action_id)) + + +def get_action_status(action_id): + fullurl = BASE_URL + '/api/action/' + action_id + '/status' + res = requests.get( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE + ) + + if res.status_code < 200 or res.status_code >= 300: + return_error('Failed to get action {} status.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format( + action_id, fullurl, res.status_code, res.content)) + + raw_action = json.loads(xml2json(res.content)) + if not raw_action or 'BESAPI' not in raw_action: + return None + + raw_action = demisto.get(raw_action, 'BESAPI.ActionResults') + return raw_action.get('Status') + + +def get_action_status_command(): + action_id = demisto.args().get('action_id') + + status = get_action_status(action_id) + + output = { + 'ID': action_id, + 'Status': status + } + demisto.results({ + 'Type': entryTypes['note'], + 'ContentsFormat': formats['json'], + 'Contents': output, + 'HumanReadable': 'Action {} status is {}'.format(action_id, status), + 'EntryContext': { + 'Bigfix.Action(val.ID==obj.ID)': output + } + }) + + +def action_stop(action_id): + fullurl = BASE_URL + '/api/action/' + action_id + '/stop' + res = requests.post( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE + ) + + if res.status_code < 200 or res.status_code >= 300: + return_error('Failed to stop action {}.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format( + action_id, fullurl, res.status_code, res.content)) + + +def action_stop_command(): + action_id = demisto.args().get('action_id') + + action_stop(action_id) + + demisto.results('Action {} was stopped successfully'.format(action_id)) + + +def query(relevance): + fullurl = BASE_URL + '/api/query' + params = { + 'relevance': relevance + } + res = requests.get( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE, + params=params + ) + + if res.status_code < 200 or res.status_code >= 300: + return_error('Query failed.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format( + fullurl, res.status_code, res.content)) + + raw_action = json.loads(xml2json(res.content)) + if not raw_action or 'BESAPI' not in raw_action: + demisto.info('BigFix query has incorrect response format. Response Body: {}'.format(res.content)) + return_error('The response has incorrect format. Check the logs') + + if demisto.get(raw_action, 'BESAPI.Query.Error'): + error = demisto.get(raw_action, 'BESAPI.Query.Error') + return_error(error) + + raw_query_results = demisto.get(raw_action, 'BESAPI.Query') + return raw_query_results + + +def query_command(): + relevance = demisto.args().get('relevance') + results = query(relevance) + + if results is None: + demisto.results('No results') + sys.exit(0) + + output = demisto.dt(results, 'Result.Answer.#text') + if not isinstance(output, list): + output = [output] + + demisto.results({ + 'Type': entryTypes['note'], + 'ContentsFormat': formats['json'], + 'Contents': results, + 'HumanReadable': tableToMarkdown('Query Results: {}'.format(relevance), output, ['Results']), + 'EntryContext': { + 'Bigfix.QueryResults': output + } + }) + + +try: + # do requets to /api/help + # should be good indicator for test connectivity + def test(): + fullurl = BASE_URL + '/api/help' + res = requests.get( + fullurl, + auth=(USERNAME, PASSWORD), + verify=VERIFY_CERTIFICATE + ) + res.raise_for_status() + + if demisto.command() == 'test-module': + # do requets to /api/help + # should be good indicator for test connectivity + test() + demisto.results('ok') + + elif demisto.command() == 'bigfix-get-sites': + get_sites_command() + + elif demisto.command() == 'bigfix-get-site': + get_site_command() + + elif demisto.command() == 'bigfix-get-endpoints': + get_endpoints_command() + + elif demisto.command() == 'bigfix-get-endpoint': + get_endpoint_details_command() + + elif demisto.command() == 'bigfix-get-patches': + get_patches_command() + + elif demisto.command() == 'bigfix-get-patch': + get_patch_details_command() + + elif demisto.command() == 'bigfix-deploy-patch': + deploy_patch_command() + + elif demisto.command() == 'bigfix-action-delete': + action_delete_command() + + elif demisto.command() == 'bigfix-action-status': + get_action_status_command() + + elif demisto.command() == 'bigfix-action-stop': + action_stop_command() + + elif demisto.command(): + query_command() + +except Exception, e: + LOG(e.message) + LOG.print_log() + return_error(e.message) diff --git a/Packs/BigFix/Integrations/BigFix/BigFix.yml b/Packs/BigFix/Integrations/BigFix/BigFix.yml new file mode 100644 index 00000000000..eb70bf549a4 --- /dev/null +++ b/Packs/BigFix/Integrations/BigFix/BigFix.yml @@ -0,0 +1,576 @@ +category: Vulnerability Management +commonfields: + id: BigFix + version: -1 +configuration: +- display: Server url (e.g https://192.168.10.1:52311) + name: url + required: true + type: 0 +- display: Username + name: credentials + required: true + type: 9 +- display: Trust any certificate (not secure) + name: unsecure + required: false + type: 8 +- display: Use system proxy settings + name: proxy + required: false + type: 8 +description: IBM BigFix Patch provides an automated, simplified patching process that + is administered from a single console. +display: BigFix +name: BigFix +script: + commands: + - deprecated: false + description: Retrieves all the sites + execution: false + name: bigfix-get-sites + outputs: + - contextPath: Bigfix.Site + description: Site + type: unknown + - contextPath: Bigfix.Site.Name + description: Name of the site + type: string + - contextPath: Bigfix.Site.Description + description: Description of the site + type: string + - contextPath: Bigfix.Site.Resource + description: Link to the endpoint resource. + type: string + - contextPath: Bigfix.Site.Type + description: Type of the site (master,custom,external,operator) + type: string + - contextPath: Bigfix.Site.Domain + description: Site domain + type: string + - contextPath: Bigfix.Site.GatherURL + description: Gather URL + type: string + - contextPath: Bigfix.Site.GlobalReadPermission + description: Global Read Permission available or not. + type: string + - arguments: + - default: false + description: Name of the site. If the site is external or operator then site + must be provided + isArray: false + name: site_name + required: false + secret: false + - auto: PREDEFINED + default: false + defaultValue: master + description: 'Type of the site. One of the following options: external,operator,master,custom' + isArray: false + name: site_type + predefined: + - external + - operator + - master + - custom + required: true + secret: false + deprecated: false + description: Retrieve single site by name and type + execution: false + name: bigfix-get-site + outputs: + - contextPath: Bigfix.Site + description: Site + type: unknown + - contextPath: Bigfix.Site.Name + description: Name of the site + type: string + - contextPath: Bigfix.Site.Description + description: Description of the site + type: string + - contextPath: Bigfix.Site.Resource + description: Link to the endpoint resource. + type: string + - contextPath: Bigfix.Site.Type + description: Type of the site (master,custom,external,operator) + type: string + - contextPath: Bigfix.Site.Domain + description: Site domain + type: string + - contextPath: Bigfix.Site.GatherURL + description: Gather URL + type: string + - contextPath: Bigfix.Site.GlobalReadPermission + description: Global Read Permission available or not. + type: string + - arguments: + - auto: PREDEFINED + default: false + defaultValue: master + description: 'Type of the site. One of the following options: external,operator,master,custom' + isArray: false + name: site_type + predefined: + - external + - operator + - master + - custom + required: true + secret: false + - default: false + description: Name of the site. If the site is external or operator then site + must be provided + isArray: false + name: site_name + required: false + secret: false + deprecated: false + description: Retrieve all the patches (fixlets) of site + execution: false + name: bigfix-get-patches + outputs: + - contextPath: Bigfix.Patch.ID + description: Patch (fixlet) ID + type: string + - contextPath: Bigfix.Patch.LastModified + description: Last modified Timestamp. + type: date + - contextPath: Bigfix.Patch.Name + description: Name of the Patch requested. + type: string + - contextPath: Bigfix.Patch.Resource + description: The link for the patch + type: string + - contextPath: Bigfix.Patch.Description + description: Description of the Patch requested. + type: string + - contextPath: Bigfix.Patch.Relevance + description: Relevance of the Patch requested. + type: string + - contextPath: Bigfix.Patch.Category + description: Category of the Patch requested. + type: string + - contextPath: Bigfix.Patch.DownloadSize + description: Download size. + type: string + - contextPath: Bigfix.Patch.Source + description: Source from where the patch is coming from. + type: string + - contextPath: Bigfix.Patch.SourceID + description: Source ID of the Patch requested. + type: string + - contextPath: Bigfix.Patch.SourceSeverity + description: Source Severity of the Patch requested. + type: string + - contextPath: Bigfix.Patch.SourceReleaseDate + description: Source Release Date of the Patch requested. + type: string + - contextPath: Bigfix.Patch.ActionID + description: Action ID of the Patch requested. + type: string + - contextPath: Bigfix.Patch.ActionScript + description: Action Script of the Patch requested. + type: string + - arguments: + - auto: PREDEFINED + default: false + defaultValue: 'true' + description: Whether to get endpoint full details of each endpoint or just basic + details, such as ID and last reported time. We recommend setting this to false + if there are many endpoints to retrieve. + isArray: false + name: get_endpoint_details + predefined: + - 'true' + - 'false' + required: false + secret: false + deprecated: false + description: Retrieve all the endpoints (computers) + execution: false + name: bigfix-get-endpoints + outputs: + - contextPath: Bigfix.Endpoint + description: Endpoint (computer) + type: Unknown + - contextPath: Bigfix.Endpoint.ID + description: The if of the endpoint (computer ID) + type: string + - contextPath: Bigfix.Endpoint.Resource + description: URL to the endpoint details + type: string + - contextPath: Bigfix.Endpoint.LastReportTime + description: Last report time of the endpoint + type: date + - contextPath: Bigfix.Endpoint.ActiveDirectoryPath + description: Active directory path of the endpoint device. + type: string + - contextPath: Bigfix.Endpoint.AgentType + description: Agent Type of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.AgentVersion + description: Agent Version of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.BESRelaySelectionMethod + description: Relay selection method of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.BESRelayServiceInstalled + description: Relay service installed of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.BESRootServer + description: Root server of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.BIOS + description: BIOS of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.CPU + description: CPU of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.ClientSettings + description: Client settings of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.ComputerName + description: Computer name of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.ComputerType + description: Computer Type of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.DNSName + description: DNS Name of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.DeviceType + description: Device Type of the endpoint device. + type: string + - contextPath: Bigfix.Endpoint.DistancetoBESRelay + description: Distance to BES Relay of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.FreeSpaceonSystemDrive + description: Free space on sytem drive of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.IPAddress + description: IP of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.LicenseType + description: License of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.Locked + description: Locked of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.OS + description: OS of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.RAM + description: RAM of the endpoint. + type: number + - contextPath: Bigfix.Endpoint.Relay + description: Relay of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.RelayNameOfClient + description: Relay Name of the client. + type: string + - contextPath: Bigfix.Endpoint.SubnetAddress + description: Subnet Address of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.SubscribedSites + description: Subscribed sites. + type: string + - contextPath: Bigfix.Endpoint.TotalSizeofSystemDrive + description: Total size of system drive. + type: number + - contextPath: Bigfix.Endpoint.UserName + description: User name. + type: string + - arguments: + - default: false + description: Computer ID + isArray: false + name: computer_id + required: true + secret: false + deprecated: false + description: Retrieve endpoint (computer) details + execution: false + name: bigfix-get-endpoint + outputs: + - contextPath: Bigfix.Endpoint + description: Endpoint (computer) + type: Unknown + - contextPath: Bigfix.Endpoint.ID + description: The if of the endpoint (computer ID) + type: string + - contextPath: Bigfix.Endpoint.Resource + description: URL to the endpoint details + type: string + - contextPath: Bigfix.Endpoint.LastReportTime + description: Last report time of the endpoint + type: date + - contextPath: Bigfix.Endpoint.ActiveDirectoryPath + description: Active directory path of the endpoint device. + type: string + - contextPath: Bigfix.Endpoint.AgentType + description: Agent Type of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.AgentVersion + description: Agent Version of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.BESRelaySelectionMethod + description: Relay selection method of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.BESRelayServiceInstalled + description: Relay service installed of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.BESRootServer + description: Root server of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.BIOS + description: BIOS of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.CPU + description: CPU of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.ClientSettings + description: Client settings of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.ComputerName + description: Computer name of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.ComputerType + description: Computer Type of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.DNSName + description: DNS Name of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.DeviceType + description: Device Type of the endpoint device. + type: string + - contextPath: Bigfix.Endpoint.DistancetoBESRelay + description: Distance to BES Relay of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.FreeSpaceonSystemDrive + description: Free space on sytem drive of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.IPAddress + description: IP of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.LicenseType + description: License of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.Locked + description: Locked of the endpoint. + type: Unknown + - contextPath: Bigfix.Endpoint.OS + description: OS of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.RAM + description: RAM of the endpoint. + type: number + - contextPath: Bigfix.Endpoint.Relay + description: Relay of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.RelayNameOfClient + description: Relay Name of the client. + type: string + - contextPath: Bigfix.Endpoint.SubnetAddress + description: Subnet Address of the endpoint. + type: string + - contextPath: Bigfix.Endpoint.SubscribedSites + description: Subscribed sites. + type: string + - contextPath: Bigfix.Endpoint.TotalSizeofSystemDrive + description: Total size of system drive. + type: number + - contextPath: Bigfix.Endpoint.UserName + description: User name. + type: string + - arguments: + - default: false + description: Name of the site. If the site is external or operator then site + must be provided + isArray: false + name: site_name + required: true + secret: false + - default: false + description: Provide ids of computers to deploy the patch. Pass 'all' to deploy + to all the computers + isArray: true + name: computer_ids + required: true + secret: false + - default: false + description: The Fixlet ID. To use the action script from the original Fixlet + or Task Message. + isArray: false + name: fixlet_id + required: true + secret: false + - default: false + description: The action ID. The specified action will run on target computers. + isArray: false + name: action_id + required: true + secret: false + deprecated: false + description: Create an action on BigFix that will run the given action from the + given fixlet on target computers. The computerID parameter takes a comma-separated + list of BigFix computer IDs. If no computers are given, the action will be run + on the default computers configured on BigFix. If the action should run on all + computers set the computerID parameter to all. + execution: false + name: bigfix-deploy-patch + outputs: + - contextPath: Bigfix.Action.ID + description: Action ID + type: number + - contextPath: Bigfix.Action.Name + description: Action Name + type: string + - contextPath: Bigfix.Action.SiteName + description: Site name + type: string + - contextPath: Bigfix.Action.ComputerIDs + description: Computers IDs to which the patch was applied to + type: Unknown + - contextPath: Bigfix.Action.AllComputers + description: true if patch was applied to all the computers + type: boolean + - contextPath: Bigfix.Action.Resource + description: Link to action in bigfix + type: string + - arguments: + - default: false + description: Fixlet id + isArray: false + name: id + required: true + secret: false + - auto: PREDEFINED + default: false + description: 'Type of the site. One of the following options: external,operator,master,custom' + isArray: false + name: site_type + predefined: + - external + - operator + - master + - custom + required: true + secret: false + - default: false + description: Name of the site. If the site is external or operator then site + must be provided + isArray: false + name: site_name + required: false + secret: false + deprecated: false + description: Retrieve patch (fixlet) by id + execution: false + name: bigfix-get-patch + outputs: + - contextPath: Bigfix.Patch.ID + description: Patch(fixlet) id + type: Unknown + - contextPath: Bigfix.Patch.Name + description: Patch name + type: Unknown + - contextPath: Bigfix.Patch.Resource + description: Link (URL) to the patch + type: Unknown + - contextPath: Bigfix.Patch.Description + description: Description + type: Unknown + - contextPath: Bigfix.Patch.Relevance + description: Relevance of the Patch requested. + type: Unknown + - contextPath: Bigfix.Patch.Category + description: Category of the Patch requested. + type: string + - contextPath: Bigfix.Patch.DownloadSize + description: Download size. + type: Unknown + - contextPath: Bigfix.Patch.Source + description: Source from where the patch is coming from. + type: Unknown + - contextPath: Bigfix.Patch.SourceID + description: Source ID of the Patch requested. + type: Unknown + - contextPath: Bigfix.Patch.SourceSeverity + description: Source Severity of the Patch requested. + type: Unknown + - contextPath: Bigfix.Patch.SourceReleaseDate + description: Source Release Date of the Patch requested. + type: Unknown + - contextPath: Bigfix.Patch.ActionID + description: Action ID of the Patch requested. + type: string + - contextPath: Bigfix.Patch.ActionScript + description: Action Script of the Patch requested. + type: string + - arguments: + - default: false + description: Action ID + isArray: false + name: action_id + required: true + secret: false + deprecated: false + description: 'Stops and deletes the specified action. Note: You cannot delete + actions that are members of a Multiple Action Group. This note applies to IBM + BigFix V9.2 and later.' + execution: false + name: bigfix-action-delete + - arguments: + - default: false + description: Action ID + isArray: false + name: action_id + required: true + secret: false + deprecated: false + description: Gets the status of an action against it's targets. + execution: false + name: bigfix-action-status + outputs: + - contextPath: Bigfix.Action.ID + description: Action ID + type: string + - contextPath: Bigfix.Action.Status + description: Action Status (e.g Open, Stopped) + type: string + - arguments: + - default: false + description: Action ID + isArray: false + name: action_id + required: true + secret: false + deprecated: false + description: Stops the specified action. + execution: false + name: bigfix-action-stop + - arguments: + - default: false + description: 'Relevance query (example: names of bes computers)' + isArray: false + name: relevance + required: true + secret: false + deprecated: false + description: Evaluate a relevance expression and get the result. This runs request + is processed through the server to WebReports. + execution: false + name: bigfix-query + outputs: + - contextPath: Bigfix.QueryResults + description: The results of the query + type: unknown + feed: false + isfetch: false + longRunning: false + longRunningPort: false + runonce: false + script: '-' + subtype: python2 + type: python diff --git a/Packs/BigFix/Integrations/BigFix/BigFix_image.png b/Packs/BigFix/Integrations/BigFix/BigFix_image.png new file mode 100644 index 00000000000..6e8a7360f02 Binary files /dev/null and b/Packs/BigFix/Integrations/BigFix/BigFix_image.png differ diff --git a/Packs/BigFix/Integrations/integration-BigFix_CHANGELOG.md b/Packs/BigFix/Integrations/BigFix/CHANGELOG.md similarity index 100% rename from Packs/BigFix/Integrations/integration-BigFix_CHANGELOG.md rename to Packs/BigFix/Integrations/BigFix/CHANGELOG.md diff --git a/Packs/BigFix/Integrations/BigFix/Pipfile b/Packs/BigFix/Integrations/BigFix/Pipfile new file mode 100644 index 00000000000..5b6d66dc82c --- /dev/null +++ b/Packs/BigFix/Integrations/BigFix/Pipfile @@ -0,0 +1,25 @@ +[[source]] +name = "pypi" +url = "https://pypi.org/simple" +verify_ssl = true + +[dev-packages] +pylint = "*" +pytest = "*" +pytest-mock = "*" +requests-mock = "*" +pytest-xdist = "*" +pytest-json = "*" +flake8 = "*" + +[packages] +certifi = "==2017.11.5" +chardet = "==3.0.4" +idna = "==2.6" +olefile = "==0.44" +requests = "==2.18.4" +urllib3 = "==1.22" +PyYAML = "==3.12" + +[requires] +python_version = "2.7" diff --git a/Packs/BigFix/Integrations/BigFix/Pipfile.lock b/Packs/BigFix/Integrations/BigFix/Pipfile.lock new file mode 100644 index 00000000000..9c6aa954ea0 --- /dev/null +++ b/Packs/BigFix/Integrations/BigFix/Pipfile.lock @@ -0,0 +1,347 @@ +{ + "_meta": { + "hash": { + "sha256": "17cd8f31f8b4bdfa7fedfae87e0eca4d9e1a602f54d991932f84ea3d2084e8f6" + }, + "pipfile-spec": 6, + "requires": { + "python_version": "2.7" + }, + "sources": [ + { + "name": "pypi", + "url": "https://pypi.org/simple", + "verify_ssl": true + } + ] + }, + "default": {}, + "develop": { + "apipkg": { + "hashes": [ + "sha256:37228cda29411948b422fae072f57e31d3396d2ee1c9783775980ee9c9990af6", + "sha256:58587dd4dc3daefad0487f6d9ae32b4542b185e1c36db6993290e7c41ca2b47c" + ], + "version": "==1.5" + }, + "astroid": { + "hashes": [ + "sha256:87de48a92e29cedf7210ffa853d11441e7ad94cb47bacd91b023499b51cbc756", + "sha256:d25869fc7f44f1d9fb7d24fd7ea0639656f5355fc3089cd1f3d18c6ec6b124c7" + ], + "version": "==1.6.6" + }, + "atomicwrites": { + "hashes": [ + "sha256:03472c30eb2c5d1ba9227e4c2ca66ab8287fbfbbda3888aa93dc2e28fc6811b4", + "sha256:75a9445bac02d8d058d5e1fe689654ba5a6556a1dfd8ce6ec55a0ed79866cfa6" + ], + "version": "==1.3.0" + }, + "attrs": { + "hashes": [ + "sha256:08a96c641c3a74e44eb59afb61a24f2cb9f4d7188748e76ba4bb5edfa3cb7d1c", + "sha256:f7b7ce16570fe9965acd6d30101a28f62fb4a7f9e926b3bbc9b61f8b04247e72" + ], + "version": "==19.3.0" + }, + "backports.functools-lru-cache": { + "hashes": [ + "sha256:0bada4c2f8a43d533e4ecb7a12214d9420e66eb206d54bf2d682581ca4b80848", + "sha256:8fde5f188da2d593bd5bc0be98d9abc46c95bb8a9dde93429570192ee6cc2d4a" + ], + "markers": "python_version < '3.2'", + "version": "==1.6.1" + }, + "certifi": { + "hashes": [ + "sha256:017c25db2a153ce562900032d5bc68e9f191e44e9a0f762f373977de9df1fbb3", + "sha256:25b64c7da4cd7479594d035c08c2d809eb4aab3a26e5a990ea98cc450c320f1f" + ], + "version": "==2019.11.28" + }, + "chardet": { + "hashes": [ + "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae", + "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691" + ], + "version": "==3.0.4" + }, + "configparser": { + "hashes": [ + "sha256:254c1d9c79f60c45dfde850850883d5aaa7f19a23f13561243a050d5a7c3fe4c", + "sha256:c7d282687a5308319bf3d2e7706e575c635b0a470342641c93bea0ea3b5331df" + ], + "markers": "python_version < '3'", + "version": "==4.0.2" + }, + "contextlib2": { + "hashes": [ + "sha256:01f490098c18b19d2bd5bb5dc445b2054d2fa97f09a4280ba2c5f3c394c8162e", + "sha256:3355078a159fbb44ee60ea80abd0d87b80b78c248643b49aa6d94673b413609b" + ], + "markers": "python_version < '3'", + "version": "==0.6.0.post1" + }, + "enum34": { + "hashes": [ + "sha256:13ef9a1c478203252107f66c25b99b45b1865693ca1284aab40dafa7e1e7ac17", + "sha256:708aabfb3d5898f99674c390d360d59efdd08547019763622365f19e84a7fef4", + "sha256:98df1f1937840b7d8012fea7f0b36392a3e6fd8a2f429c48a3ff4b1aad907f3f" + ], + "markers": "python_version < '3.4'", + "version": "==1.1.9" + }, + "execnet": { + "hashes": [ + "sha256:cacb9df31c9680ec5f95553976c4da484d407e85e41c83cb812aa014f0eddc50", + "sha256:d4efd397930c46415f62f8a31388d6be4f27a91d7550eb79bc64a756e0056547" + ], + "version": "==1.7.1" + }, + "funcsigs": { + "hashes": [ + "sha256:330cc27ccbf7f1e992e69fef78261dc7c6569012cf397db8d3de0234e6c937ca", + "sha256:a7bb0f2cf3a3fd1ab2732cb49eba4252c2af4240442415b4abce3b87022a8f50" + ], + "markers": "python_version < '3.0'", + "version": "==1.0.2" + }, + "futures": { + "hashes": [ + "sha256:49b3f5b064b6e3afc3316421a3f25f66c137ae88f068abbf72830170033c5e16", + "sha256:7e033af76a5e35f58e56da7a91e687706faf4e7bdfb2cbc3f2cca6b9bcda9794" + ], + "markers": "python_version < '3.2'", + "version": "==3.3.0" + }, + "idna": { + "hashes": [ + "sha256:7588d1c14ae4c77d74036e8c22ff447b26d0fde8f007354fd48a7814db15b7cb", + "sha256:a068a21ceac8a4d63dbfd964670474107f541babbd2250d61922f029858365fa" + ], + "version": "==2.9" + }, + "importlib-metadata": { + "hashes": [ + "sha256:06f5b3a99029c7134207dd882428a66992a9de2bef7c2b699b5641f9886c3302", + "sha256:b97607a1a18a5100839aec1dc26a1ea17ee0d93b20b0f008d80a5a050afb200b" + ], + "markers": "python_version < '3.8'", + "version": "==1.5.0" + }, + "isort": { + "hashes": [ + "sha256:54da7e92468955c4fceacd0c86bd0ec997b0e1ee80d97f67c35a78b719dccab1", + "sha256:6e811fcb295968434526407adb8796944f1988c5b65e8139058f2014cbe100fd" + ], + "version": "==4.3.21" + }, + "lazy-object-proxy": { + "hashes": [ + "sha256:0c4b206227a8097f05c4dbdd323c50edf81f15db3b8dc064d08c62d37e1a504d", + "sha256:194d092e6f246b906e8f70884e620e459fc54db3259e60cf69a4d66c3fda3449", + "sha256:1be7e4c9f96948003609aa6c974ae59830a6baecc5376c25c92d7d697e684c08", + "sha256:4677f594e474c91da97f489fea5b7daa17b5517190899cf213697e48d3902f5a", + "sha256:48dab84ebd4831077b150572aec802f303117c8cc5c871e182447281ebf3ac50", + "sha256:5541cada25cd173702dbd99f8e22434105456314462326f06dba3e180f203dfd", + "sha256:59f79fef100b09564bc2df42ea2d8d21a64fdcda64979c0fa3db7bdaabaf6239", + "sha256:8d859b89baf8ef7f8bc6b00aa20316483d67f0b1cbf422f5b4dc56701c8f2ffb", + "sha256:9254f4358b9b541e3441b007a0ea0764b9d056afdeafc1a5569eee1cc6c1b9ea", + "sha256:9651375199045a358eb6741df3e02a651e0330be090b3bc79f6d0de31a80ec3e", + "sha256:97bb5884f6f1cdce0099f86b907aa41c970c3c672ac8b9c8352789e103cf3156", + "sha256:9b15f3f4c0f35727d3a0fba4b770b3c4ebbb1fa907dbcc046a1d2799f3edd142", + "sha256:a2238e9d1bb71a56cd710611a1614d1194dc10a175c1e08d75e1a7bcc250d442", + "sha256:a6ae12d08c0bf9909ce12385803a543bfe99b95fe01e752536a60af2b7797c62", + "sha256:ca0a928a3ddbc5725be2dd1cf895ec0a254798915fb3a36af0964a0a4149e3db", + "sha256:cb2c7c57005a6804ab66f106ceb8482da55f5314b7fcb06551db1edae4ad1531", + "sha256:d74bb8693bf9cf75ac3b47a54d716bbb1a92648d5f781fc799347cfc95952383", + "sha256:d945239a5639b3ff35b70a88c5f2f491913eb94871780ebfabb2568bd58afc5a", + "sha256:eba7011090323c1dadf18b3b689845fd96a61ba0a1dfbd7f24b921398affc357", + "sha256:efa1909120ce98bbb3777e8b6f92237f5d5c8ea6758efea36a473e1d38f7d3e4", + "sha256:f3900e8a5de27447acbf900b4750b0ddfd7ec1ea7fbaf11dfa911141bc522af0" + ], + "version": "==1.4.3" + }, + "mccabe": { + "hashes": [ + "sha256:ab8a6258860da4b6677da4bd2fe5dc2c659cff31b3ee4f7f5d64e79735b80d42", + "sha256:dd8d182285a0fe56bace7f45b5e7d1a6ebcbf524e8f3bd87eb0f125271b8831f" + ], + "version": "==0.6.1" + }, + "mock": { + "hashes": [ + "sha256:83657d894c90d5681d62155c82bda9c1187827525880eda8ff5df4ec813437c3", + "sha256:d157e52d4e5b938c550f39eb2fd15610db062441a9c2747d3dbfa9298211d0f8" + ], + "markers": "python_version < '3.0'", + "version": "==3.0.5" + }, + "more-itertools": { + "hashes": [ + "sha256:38a936c0a6d98a38bcc2d03fdaaedaba9f412879461dd2ceff8d37564d6522e4", + "sha256:c0a5785b1109a6bd7fac76d6837fd1feca158e54e521ccd2ae8bfe393cc9d4fc", + "sha256:fe7a7cae1ccb57d33952113ff4fa1bc5f879963600ed74918f1236e212ee50b9" + ], + "markers": "python_version <= '2.7'", + "version": "==5.0.0" + }, + "packaging": { + "hashes": [ + "sha256:170748228214b70b672c581a3dd610ee51f733018650740e98c7df862a583f73", + "sha256:e665345f9eef0c621aa0bf2f8d78cf6d21904eef16a93f020240b704a57f1334" + ], + "version": "==20.1" + }, + "pathlib2": { + "hashes": [ + "sha256:0ec8205a157c80d7acc301c0b18fbd5d44fe655968f5d947b6ecef5290fc35db", + "sha256:6cd9a47b597b37cc57de1c05e56fb1a1c9cc9fab04fe78c29acd090418529868" + ], + "markers": "python_version < '3'", + "version": "==2.3.5" + }, + "pluggy": { + "hashes": [ + "sha256:15b2acde666561e1298d71b523007ed7364de07029219b604cf808bfa1c765b0", + "sha256:966c145cd83c96502c3c3868f50408687b38434af77734af1e9ca461a4081d2d" + ], + "version": "==0.13.1" + }, + "py": { + "hashes": [ + "sha256:5e27081401262157467ad6e7f851b7aa402c5852dbcb3dae06768434de5752aa", + "sha256:c20fdd83a5dbc0af9efd622bee9a5564e278f6380fffcacc43ba6f43db2813b0" + ], + "version": "==1.8.1" + }, + "pylint": { + "hashes": [ + "sha256:367e3d49813d349a905390ac27989eff82ab84958731c5ef0bef867452cfdc42", + "sha256:97a42df23d436c70132971d1dcb9efad2fe5c0c6add55b90161e773caf729300" + ], + "index": "pypi", + "version": "==1.9.5" + }, + "pyparsing": { + "hashes": [ + "sha256:4c830582a84fb022400b85429791bc551f1f4871c33f23e44f353119e92f969f", + "sha256:c342dccb5250c08d45fd6f8b4a559613ca603b57498511740e65cd11a2e7dcec" + ], + "version": "==2.4.6" + }, + "pytest": { + "hashes": [ + "sha256:19e8f75eac01dd3f211edd465b39efbcbdc8fc5f7866d7dd49fedb30d8adf339", + "sha256:c77a5f30a90e0ce24db9eaa14ddfd38d4afb5ea159309bdd2dae55b931bc9324" + ], + "index": "pypi", + "version": "==4.6.9" + }, + "pytest-forked": { + "hashes": [ + "sha256:1805699ed9c9e60cb7a8179b8d4fa2b8898098e82d229b0825d8095f0f261100", + "sha256:1ae25dba8ee2e56fb47311c9638f9e58552691da87e82d25b0ce0e4bf52b7d87" + ], + "version": "==1.1.3" + }, + "pytest-json": { + "hashes": [ + "sha256:8bf4e1be1691f4416bc12b14785b5ad9e842887b0b2b2d61b37dcb555b208630" + ], + "index": "pypi", + "version": "==0.4.0" + }, + "pytest-mock": { + "hashes": [ + "sha256:b35eb281e93aafed138db25c8772b95d3756108b601947f89af503f8c629413f", + "sha256:cb67402d87d5f53c579263d37971a164743dc33c159dfb4fb4a86f37c5552307" + ], + "index": "pypi", + "version": "==2.0.0" + }, + "pytest-xdist": { + "hashes": [ + "sha256:0f46020d3d9619e6d17a65b5b989c1ebbb58fc7b1da8fb126d70f4bac4dfeed1", + "sha256:7dc0d027d258cd0defc618fb97055fbd1002735ca7a6d17037018cf870e24011" + ], + "index": "pypi", + "version": "==1.31.0" + }, + "requests": { + "hashes": [ + "sha256:43999036bfa82904b6af1d99e4882b560e5e2c68e5c4b0aa03b655f3d7d73fee", + "sha256:b3f43d496c6daba4493e7c431722aeb7dbc6288f52a6e04e7b6023b0247817e6" + ], + "version": "==2.23.0" + }, + "requests-mock": { + "hashes": [ + "sha256:510df890afe08d36eca5bb16b4aa6308a6f85e3159ad3013bac8b9de7bd5a010", + "sha256:88d3402dd8b3c69a9e4f9d3a73ad11b15920c6efd36bc27bf1f701cf4a8e4646" + ], + "index": "pypi", + "version": "==1.7.0" + }, + "scandir": { + "hashes": [ + "sha256:2586c94e907d99617887daed6c1d102b5ca28f1085f90446554abf1faf73123e", + "sha256:2ae41f43797ca0c11591c0c35f2f5875fa99f8797cb1a1fd440497ec0ae4b022", + "sha256:2b8e3888b11abb2217a32af0766bc06b65cc4a928d8727828ee68af5a967fa6f", + "sha256:2c712840c2e2ee8dfaf36034080108d30060d759c7b73a01a52251cc8989f11f", + "sha256:4d4631f6062e658e9007ab3149a9b914f3548cb38bfb021c64f39a025ce578ae", + "sha256:67f15b6f83e6507fdc6fca22fedf6ef8b334b399ca27c6b568cbfaa82a364173", + "sha256:7d2d7a06a252764061a020407b997dd036f7bd6a175a5ba2b345f0a357f0b3f4", + "sha256:8c5922863e44ffc00c5c693190648daa6d15e7c1207ed02d6f46a8dcc2869d32", + "sha256:92c85ac42f41ffdc35b6da57ed991575bdbe69db895507af88b9f499b701c188", + "sha256:b24086f2375c4a094a6b51e78b4cf7ca16c721dcee2eddd7aa6494b42d6d519d", + "sha256:cb925555f43060a1745d0a321cca94bcea927c50114b623d73179189a4e100ac" + ], + "markers": "python_version < '3.5'", + "version": "==1.10.0" + }, + "singledispatch": { + "hashes": [ + "sha256:5b06af87df13818d14f08a028e42f566640aef80805c3b50c5056b086e3c2b9c", + "sha256:833b46966687b3de7f438c761ac475213e53b306740f1abfaa86e1d1aae56aa8" + ], + "markers": "python_version < '3.4'", + "version": "==3.4.0.3" + }, + "six": { + "hashes": [ + "sha256:236bdbdce46e6e6a3d61a337c0f8b763ca1e8717c03b369e87a7ec7ce1319c0a", + "sha256:8f3cd2e254d8f793e7f3d6d9df77b92252b52637291d0f0da013c76ea2724b6c" + ], + "version": "==1.14.0" + }, + "urllib3": { + "hashes": [ + "sha256:2f3db8b19923a873b3e5256dc9c2dedfa883e33d87c690d9c7913e1f40673cdc", + "sha256:87716c2d2a7121198ebcb7ce7cccf6ce5e9ba539041cfbaeecfb641dc0bf6acc" + ], + "version": "==1.25.8" + }, + "wcwidth": { + "hashes": [ + "sha256:8fd29383f539be45b20bd4df0dc29c20ba48654a41e661925e612311e9f3c603", + "sha256:f28b3e8a6483e5d49e7f8949ac1a78314e740333ae305b4ba5defd3e74fb37a8" + ], + "version": "==0.1.8" + }, + "wrapt": { + "hashes": [ + "sha256:0ec40d9fd4ec9f9e3ff9bdd12dbd3535f4085949f4db93025089d7a673ea94e8" + ], + "version": "==1.12.0" + }, + "zipp": { + "hashes": [ + "sha256:c70410551488251b0fee67b460fb9a536af8d6f9f008ad10ac51f615b6a521b1", + "sha256:e0d9e63797e483a30d27e09fffd308c59a700d365ec34e93cc100844168bf921" + ], + "version": "==1.2.0" + } + } +} diff --git a/Packs/BigFix/Integrations/integration-BigFix_README.md b/Packs/BigFix/Integrations/BigFix/README.md similarity index 98% rename from Packs/BigFix/Integrations/integration-BigFix_README.md rename to Packs/BigFix/Integrations/BigFix/README.md index 679f898881b..447cfec342c 100644 --- a/Packs/BigFix/Integrations/integration-BigFix_README.md +++ b/Packs/BigFix/Integrations/BigFix/README.md @@ -425,6 +425,24 @@

Retrieves all endpoints (computers).

Base Command
bigfix-get-endpoints
+
Input
+ + + + + + + + + + + + + + + +
Argument NameDescriptionRequired
get_endpoint_detailsWhether to get endpoint full details of each endpoint or just basic details, such as ID and last reported time. We recommend setting this to false if there are many endpoints to retrieve.Optional
+
 
Context Output
diff --git a/Packs/BigFix/Integrations/integration-BigFix.yml b/Packs/BigFix/Integrations/integration-BigFix.yml deleted file mode 100644 index d5f2f300d9b..00000000000 --- a/Packs/BigFix/Integrations/integration-BigFix.yml +++ /dev/null @@ -1,1205 +0,0 @@ -commonfields: - id: BigFix - version: -1 -name: BigFix -display: BigFix -category: Vulnerability Management -image: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAYQAAACCCAMAAABxTU9IAAAAw1BMVEX///9vmb0AAACrxFCRkZFqlrt5n8FYWFhUVFQgICCGhoZnlLpkkrmmvtRolbq1tbXU1NRnZ2cvLy9NTU15eXmcnJzj4+PNzc3y8vL3+fvs7OyNjY2OrsqlpaXG1eO1ydt/pMTr8PU3NzemwUK/v7/U3+qBgYEMDAzb29sVFRWurq5GRkbM2uZhYWHe5++qwdaUss3k7MzZ5LYyMjInJyfD1Yi0ymbz9+ivx1nf6MHT4KrK2phxcXHu89/k7Mv4+vG80HmFQn/9AAAKLUlEQVR4nO2da3vaOBCFcRJys6FpmoQADpcADSEE6L1N2m3//69aA5awrTNjyzbhaTrvh93WlWVbR5qRRhcqFUEQBEEQBEEQBEEQSqQ/6nRrC9/v+f5i3p3Omrt+oX+OTs/zXNetKoI/e1W/O9v1e/1T1FzHpFr3XL8jLeKlqFWBCCshXM+f7vrt/hFIEVY6OF1pDi8AJ0JA3a2JDFsnRQTHcevzXb/jqydVhEAGR3zDdskgguN4vtik8qiZV7KIELhoaQwlMXMc41o2EYLGYOon5KDjVQ+Ni1lFcOqHYpKKU/Mcp4AIgUnq7+CtXxeLZXyiiAiBSZKIUjH8VYyomAiON9rBm78eFus4XUERRIUihBoUFkEsUn7mKl5dWASnKt45Hx1PFWEJIjjSU83DTGtQgghO1d/BJ/z1NCMlWIIIjtfdwUf87fiRYi5DBHHO9mwcQlkigAiUwNKMakCIsFxisVpwsfpfugauBPPsWMQKFYgQFLvfHfXXfZ7+rFM7dNECjBhikKyYxRoCEmFhDIL7nV5Ke6j2XuLdXw2H8dIzRcDMFrwMnszxZGeasCxZRQiag+/h8rfNSDgsUHZTh2kMXmdr7/zaSDYEuwrc9BkPLU0hK71kXbYsujltklwJamdjZtRk2/rbIVXYVQip2bq6au3m0fkwR8PWRoRWweNj2sP2QZzLm+EZU3o3q0TtIZdno/2wF3J0MGYSHhBcGikn+LGt0/UN7Sv4UWY+NGVY8i6lQp2P473fQ9yTr/9unaBN53iZzGtCJr2DDw9uoR57kLx+FN5xG73YUvmwVSXOyCy/HO60VidU6LG3nRLlsNfA6Y+J0lAMQVafqdZwQjz7s5HyiHhsU91yYybe+8l+eRwQm8vTpzG8ewi/AoYUYQ9X4BQRLnBeRJUsLkLljbrnWl8ampfSSQ4ScorQJwySyw4VaBH2zlB6XoR3VF64XZUggnqhvbf6yn145Q333QlmoPBy9e67eLjA948YEc5RelaEIzozWCspEUyfQItwndRZfdER99lJusCY5xtigSa1gpttDl/5YXKz5rL9U9UkaEQ4EQ50KX66bLRaravJsb7yiG4IRXhsn8Yxc6dFqEzCJ9yt/3qlnmjVQV4AW55PhA5uCmxAOxThbfSaKkzk2BgRxurz7zbqnenKjpzzCS12AkaEiuoPn67+piziDUpKgupvzmADbgqsU0AiVB7D5gHSMyKowniItrzmeXj1AtwRipDBeHMi6Lq/HCwoR43enaaJ/Cktwq+PT09P//3G/4i9QpWbYIMiNNYXT0B6WoTwpqQr0Z12kFk5IuiRyW2ky3oFU1KMUMERIvx+2h+s+fMB/XsTi9BjHg9FGOuPMqBFeCTsTnt19d0FcM0liVC5DR890V1kchyDgYYci/BjMNhXDP6g1uDjsQLzeK4lWPkEVQeNm1rH7SFRL8sSQXsjNURAbZhjnlmE540EK76ZSbBr9pjuERQhrE9WvSP1/XB0QVCWCGFr22DzEktQ5wiK8JTQYH9gtgU8YONieEiE0LmZvfUKI8J75iaK0kSofI5pgDoBLNCCABE+JDXY3/9qpoL9I5fpo4YiHLWulozHZ42J6uTBniMpwu36H+B4gKI8Ec5iIti8wwoY8gEiGBIETeGjkQpKyu1WoEfMOJBKihDexYRXTUIRTs6jnCBN0kSIBa0sgqchPVR3TRF+mA0hwEgGF+px+2opEe6I6kmJoPyy1RgJhy1Q5DBVBB0xSvq3TEADYorwFWkwMDqqKAbCjtYoEajCpERQw4FNCV4/vIvyAAqwTBF07PTOJngakk2E37AhDJ6T6WD3KI8IlAwWIiTyA96yTBF+bl+EX1CE/T/JdFPUPconAg5DUiKoIt+VCJHJJKu+wZpsPgH0jZZ8T6YDs3SZfML97YpP5/eR0kAqpDnmjTvPLQJqgqkiRGdKbSYS1mTromYVwVjBtBIhvXcUdWbjA6Y40kTYDJizi3AwPouCYtBpIsRn9KwNEhysGYEGwhwZIwXoE7hYNhwxM0E3UoRwdLGJXmYXofg4oRF/lNV8zhLYqawmAw3YMe8bjhnGUW1HzJuAsDkrSYqgms+mFjbWnB1vX4SoEc2YYwxYbObkPO6i/pdMhscJtrEjZuhFitAgv//t1kVQ63butSG13LoKrbg5xv2ImsLAyC3j0G8DIcI5VXB0KDv8fHM2Zesi6JjFUAe1LXtIaJ7fcc0VW0CEwVMyURPkxc/0EyLc24twoUsiwdZFUNG7o2hQOz3PCHBmDZQbiFsYfSOsaJU7oRCLoDzzqZGeFkF/f7J387hlEXQc+zr5l+zA0ZrhmSuVL0kVBuaEAnYw1nPMevhpFg8zx6yWVpzEVVDFsi0RtPjrQZ5qFnYRJOhL0T6nhAqDX2YS6BLYJcFIhKbudZvViRFBT7hHS3WiOy7bEkGtJAidke6tWhkk2LWHdjw6rTP4CibWoDXitzOrdUc3l4pTdrEQt+5osxT48+VZ67p1NYyOobYkgu4QqSlUpgbRWMyGfXserKaZB4PvP1BWeMyx4J7OxI7gkgV2Bd4jl5npX8oQQTc/HS/RCy6sDBKeDSPWqXx4ev7y/BFYogq12CL3WlTO8BMddmYd5HuQvAQRbsPsIwttdCzPxiDNYeCCG2FRGWERcq7KxjUpZVU23u4QOGu4Iri4CNoCRhfa6AZpYZCwJWeXbEGwXUvZL0WLgMs5bX9CA0VGT4h9IoVF0MYoZut01MrGIOHVi9ZnIuBFR7w1IqvuBbFUKH2nzptPiaweif0mOv6cQQRip86tUjl+Wa0RtjFIcE7SekEqsW0NjDiiJPesBd2jmwm1WKuSbc/a+PIo7Jje3Z4OGZsQbjjLsEoIP3Z8SuSgPyc9ZwWxvaNuZZD6xO4Etm+0Pa6XK2j+qu2beE7Bbjv+IZGHHPSSEWKQZXO8KbEKVU7Cyw5RhNlVWBB7N+WU2uxQTYGdo4/gExrIgUc2UE0h05mOfcIfiEewg9r/GrSF1J9omZIHT+2qa/S3Qm7Id6r8cKu5oI944TYmCACyJIPG0CPda7Pr0UdOpQyWBQO4dk5X6R500P25RzYg8cp5wDFQLUO1Noobl36357G3yM+65IA6IURVbM/rLbrT0Ww2mnbmvuPV+fRyEmQe+umH/q7PCHY9t5qaVo4HzgfrFiyReEVe6EPUrDWQX1vLDXmImq0Gjjjl/DCHa1qJIBoUoQwVqqJBQYpbJPlNo+LAvX8WuL1df8FrYMadQJ6K/BZwObAnkPOkhFwFC7pZfjIH4PbEJZdHv5ejMVTBBh+hCB2HiVJDPF+aQdk05+k/HxWVgJ75EQrQrHFzNjFD5B1K4HpbNLsOM32pcD1fWsFWGS08tqvkeodd8QXbZ1Rz4DRO1XW9nijwYvQ7td6yzN36cmZt+Z/AXSy6M4kSvTTN2ajTXdGZzvpS/oIgCIIgCIIgCIIgCIIgCIIgCIIgCK+f/wFFC7Z9cbrtAAAAAABJRU5ErkJggg== -description: IBM BigFix Patch provides an automated, simplified patching process that - is administered from a single console. -configuration: -- display: Server url (e.g https://192.168.10.1:52311) - name: url - defaultvalue: "" - type: 0 - required: true -- display: Username - name: credentials - defaultvalue: "" - type: 9 - required: true -- display: Trust any certificate (not secure) - name: unsecure - defaultvalue: "" - type: 8 - required: false -- display: Use system proxy settings - name: proxy - defaultvalue: "" - type: 8 - required: false -script: - script: | - import requests - requests.packages.urllib3.disable_warnings() - - BASE_URL = demisto.params().get('url') - VERIFY_CERTIFICATE = not demisto.params().get('unsecure') - - USERNAME = demisto.params()['credentials']['identifier'] - PASSWORD = demisto.params()['credentials']['password'] - - if not demisto.params()['proxy']: - del os.environ['HTTP_PROXY'] - del os.environ['HTTPS_PROXY'] - del os.environ['http_proxy'] - del os.environ['https_proxy'] - - def get_first(iterable, default=None): - if iterable: - for item in iterable: - return item - return default - - def get_sites(): - fullurl = BASE_URL + '/api/sites' - res = requests.get( - fullurl, - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE - ) - - if res.status_code < 200 or res.status_code >= 300: - return_error('Failed to get sites.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format(fullurl, res.status_code, res.content)) - - raw_sites = json.loads(xml2json(res.content)) - - if (not raw_sites or not raw_sites.has_key('BESAPI')): - return [] - - sites = [] - master_sites = demisto.get(raw_sites, 'BESAPI.ActionSite') - - if master_sites and not isinstance(master_sites, list): - master_sites = [master_sites] - if master_sites: - for idx, site in enumerate(master_sites): - master_sites[idx]['Type'] = 'master' - master_sites[idx]['Resource'] = master_sites[idx]['@Resource'] - del master_sites[idx]['@Resource'] - else: - master_sites = [] - - - external_sites = demisto.get(raw_sites, 'BESAPI.ExternalSite') - if external_sites and not isinstance(external_sites, list): - external_sites = [external_sites] - if external_sites: - for idx, site in enumerate(external_sites): - external_sites[idx]['Type'] = 'external' - external_sites[idx]['Resource'] = external_sites[idx]['@Resource'] - del external_sites[idx]['@Resource'] - else: - external_sites = [] - - - operator_sites = demisto.get(raw_sites, 'BESAPI.OperatorSite') - if operator_sites and not isinstance(operator_sites, list): - operator_sites = [operator_sites] - if operator_sites: - for idx, site in enumerate(operator_sites): - operator_sites[idx]['Type'] = 'operator' - operator_sites[idx]['Resource'] = operator_sites[idx]['@Resource'] - del operator_sites[idx]['@Resource'] - else: - operator_sites = [] - - - custom_sites = demisto.get(raw_sites, 'BESAPI.CustomSite') - if custom_sites and not isinstance(custom_sites, list): - custom_sites = [custom_sites] - - if custom_sites: - for idx, site in enumerate(custom_sites): - custom_sites[idx]['Type'] = 'custom' - custom_sites[idx]['Resource'] = custom_sites[idx]['@Resource'] - del custom_sites[idx]['@Resource'] - else: - custom_sites = [] - - sites = master_sites + external_sites + operator_sites + custom_sites - for idx, site in enumerate(sites): - site_details = get_site(site['Type'], site['Name']) - sites[idx] = site_details - - return sites - - def get_sites_command(): - sites = get_sites() - demisto.results({ - 'Type': entryTypes['note'], - 'ContentsFormat': formats['json'], - 'Contents': sites, - 'HumanReadable': tableToMarkdown('BigFix Sites', sites, ['Name', 'Type', 'GatherURL', 'Description', 'GlobalReadPermissions', 'Subscription']), - 'EntryContext': { - 'Bigfix.Site(val.Resource==obj.Resource)': sites - } - }) - - - def get_site(site_type, site_name): - fullurl = BASE_URL + '/api/site/' + site_type - if site_type != 'master': - # if site name is not empty the add to url - fullurl += '/' + site_name - - res = requests.get( - fullurl, - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE - ) - - if res.status_code < 200 or res.status_code >= 300: - return_error('Failed to get site {}.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format(site_name, fullurl, res.status_code, res.content)) - - raw_site = json.loads(xml2json(res.content)) - - if (not raw_site or not raw_site.has_key('BES')): - return None - - site = None - if site_type == 'master': - site = demisto.get(raw_site, 'BES.ActionSite') - elif site_type == 'external': - site = demisto.get(raw_site, 'BES.ExternalSite') - elif site_type == 'custom': - site = demisto.get(raw_site, 'BES.CustomSite') - elif site_type == 'operator': - site = demisto.get(raw_site, 'BES.OperatorSite') - - if site is not None: - site['Type'] = site_type - site['Resource'] = BASE_URL + '/api/site/{}/{}'.format(site_type, site_name) - - return site - - def get_site_command(): - site_name = demisto.args().get('site_name') - site_type = demisto.args().get('site_type') - site = get_site(site_type, site_name) - - if site is None: - demisto.results('No site found') - sys.exit(0) - - demisto.results({ - 'Type': entryTypes['note'], - 'ContentsFormat': formats['json'], - 'Contents': site, - 'HumanReadable': tableToMarkdown('BigFix Site: {} - {}'.format(site_type, site_name) , [site], ['Name', 'Type', 'GatherURL', 'Description', 'GlobalReadPermissions', 'Subscription']), - 'EntryContext': { - 'Bigfix.Site(val.Resource==obj.Resource)': site - } - }) - - - def get_endpoints(): - fullurl = BASE_URL + '/api/computers' - - res = requests.get( - fullurl, - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE - ) - - if res.status_code < 200 or res.status_code >= 300: - return_error('Failed to get endpoints.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format(fullurl, res.status_code, res.content)) - - raw_endpoints = json.loads(xml2json(res.content)) - if (not raw_endpoints or not raw_endpoints.has_key('BESAPI')): - return None - - raw_endpoints = demisto.get(raw_endpoints, 'BESAPI.Computer') - if raw_endpoints and not isinstance(raw_endpoints, list): - raw_endpoints = [raw_endpoints] - - for idx, endpoint in enumerate(raw_endpoints): - raw_endpoints[idx]['Resource'] = raw_endpoints[idx]['@Resource'] - del raw_endpoints[idx]['@Resource'] - - endpoints_with_details = [] - for raw_endpoint in raw_endpoints: - endpoint = get_endpoint_details(raw_endpoint.get('ID')) - endpoints_with_details.append(endpoint) - - return endpoints_with_details - - def get_endpoints_command(): - endpoints = get_endpoints() - demisto.results({ - 'Type': entryTypes['note'], - 'ContentsFormat': formats['json'], - 'Contents': endpoints, - 'HumanReadable': tableToMarkdown('BigFix Computers' , endpoints, headers = [ - 'ID', - 'Resource', - 'LastReportTime', - 'ActiveDirectoryPath', - 'AgentType', - 'AgentVersion', - 'BESRelaySelectionMethod', - 'BESRelayServiceInstalled', - 'BESRootServer', - 'BIOS', - 'CPU', - 'ClientSettings', - 'ComputerName', - 'ComputerType', - 'DNSName', - 'DeviceType', - 'DistancetoBESRelay', - 'FreeSpaceonSystemDrive', - 'IPAddress', - 'LicenseType', - 'Locked', - 'OS', - 'RAM', - 'Relay', - 'RelayNameOfClient', - 'SubnetAddress', - 'SubscribedSites', - 'TotalSizeofSystemDrive', - 'UserName' - ]), - 'EntryContext': { - 'Bigfix.Endpoint(val.ID==obj.ID)': endpoints - } - }) - - def get_endpoint_details(computer_id): - fullurl = BASE_URL + '/api/computer/{}'.format(computer_id) - res = requests.get( - fullurl, - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE - ) - - if res.status_code < 200 or res.status_code >= 300: - return_error( - 'Failed to get computer {}.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format(computer_id, fullurl, res.status_code, res.content) - ) - - raw_endpoint = json.loads(xml2json(res.content)) - if (not raw_endpoint or not raw_endpoint.has_key('BESAPI')): - return None - - raw_endpoint = demisto.get(raw_endpoint, 'BESAPI.Computer') - - endpoint = { - 'ID': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "ID")=val["#text"]')), - 'Resource': demisto.get(raw_endpoint, '@Resource'), - 'LastReportTime': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Last Report Time")=val["#text"]')), - 'ActiveDirectoryPath': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Active Directory Path")=val["#text"]')), - 'AgentType': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Agent Type")=val["#text"]')), - 'AgentVersion': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Agent Version")=val["#text"]')), - 'BESRelaySelectionMethod': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "BES Relay Selection Method")=val["#text"]')), - 'BESRelayServiceInstalled': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "BES Relay Selection Method")=val["#text"]')), - 'BESRootServer': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "BES Root Server")=val["#text"]')), - 'BIOS': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "BIOS")=val["#text"]')), - 'CPU': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "CPU")=val["#text"]')), - 'ClientSettings': demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Client Settings")=val["#text"]'), - 'ComputerName': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Computer Name")=val["#text"]')), - 'ComputerType': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Computer Type")=val["#text"]')), - 'DNSName': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "DNS Name")=val["#text"]')), - 'IPAddress': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "IP Address")=val["#text"]')), - 'DeviceType': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Device Type")=val["#text"]')), - 'DistancetoBESRelay': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Distance to BES Relay")=val["#text"]')), - 'FreeSpaceonSystemDrive': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Free Space on System Drive")=val["#text"]')), - 'LicenseType': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "License Type")=val["#text"]')), - 'Locked': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Locked")=val["#text"]')), - 'OS': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "OS")=val["#text"]')), - 'RAM': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "RAM")=val["#text"]')), - 'Relay': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Relay")=val["#text"]')), - 'RelayNameOfClient': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Relay Name of Client")=val["#text"]')), - 'SubnetAddress': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Subnet Address")=val["#text"]')), - 'SubscribedSites': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Subscribed Sites")=val["#text"]')), - 'TotalSizeofSystemDrive': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "Total Size of System Drive")=val["#text"]')), - 'UserName': get_first(demisto.dt(raw_endpoint, 'Property(val["@Name"] == "User Name")=val["#text"]')) - } - - return endpoint - - def get_endpoint_details_command(): - computer_id = demisto.args().get('computer_id') - - endpoint = get_endpoint_details(computer_id) - if endpoint is None: - demisto.results('Endpoint with id {} was not found'.format(computer_id)) - sys.exit(0) - - markdown = tableToMarkdown('BigFix Endpoint {}'.format(computer_id) , [endpoint], headers = [ - 'ID', - 'Resource', - 'LastReportTime', - 'ActiveDirectoryPath', - 'AgentType', - 'AgentVersion', - 'BESRelaySelectionMethod', - 'BESRelayServiceInstalled', - 'BESRootServer', - 'BIOS', - 'CPU', - 'ClientSettings', - 'ComputerName', - 'ComputerType', - 'DNSName', - 'DeviceType', - 'DistancetoBESRelay', - 'FreeSpaceonSystemDrive', - 'IPAddress', - 'LicenseType', - 'Locked', - 'OS', - 'RAM', - 'Relay', - 'RelayNameOfClient', - 'SubnetAddress', - 'SubscribedSites', - 'TotalSizeofSystemDrive', - 'UserName' - ]) - - demisto.results({ - 'Type': entryTypes['note'], - 'ContentsFormat': formats['json'], - 'Contents': endpoint, - 'HumanReadable': markdown, - 'EntryContext': { - 'Bigfix.Endpoint(val.ID==obj.ID)': endpoint - } - }) - - - - def get_patches(site_type='', site_name=''): - fullurl = BASE_URL + '/api/fixlets/{}'.format(site_type) - if site_type != 'master': - # if site name is not empty the add to url - fullurl += '/' + site_name - - res = requests.get( - fullurl, - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE - ) - - if res.status_code < 200 or res.status_code >= 300: - return_error( - 'Failed to get patches. Request URL: {}\nStatusCode: {}\nResponse Body: {}'.format(fullurl, res.status_code, res.content) - ) - - raw_patches = json.loads(xml2json(res.content)) - if (not raw_patches or not raw_patches.has_key('BESAPI')): - return None - - raw_patches = demisto.get(raw_patches, 'BESAPI.Fixlet') - if raw_patches and not isinstance(raw_patches, list): - raw_patches = [raw_patches] - - patches_with_details = [] - for raw_patch in raw_patches: - patch = get_patch_details(site_type, site_name, raw_patch.get('ID')) - patch['LastModified'] = raw_patch['@LastModified'] - patches_with_details.append(patch) - - return patches_with_details - - - def get_patches_command(): - site_name = demisto.args().get('site_name') - site_type = demisto.args().get('site_type') - patches = get_patches(site_type, site_name) - - markdown = tableToMarkdown('BigFix Patches' , patches, headers = [ - 'ID', - 'Name', - 'Description', - 'LastModified', - 'Resource', - 'Relevance', - 'Category', - 'DownloadSize', - 'Source', - 'SourceID', - 'SourceReleaseDate', - 'SourceSeverity', - 'ActionID', - 'ActionScript' - ]) - - demisto.results({ - 'Type': entryTypes['note'], - 'ContentsFormat': formats['json'], - 'Contents': patches, - 'HumanReadable': markdown, - 'EntryContext': { - 'Bigfix.Patch(val.ID==obj.ID)': patches - } - }) - - - def get_patch_details(site_type, site_name, patch_id): - fullurl = '' - if site_type == 'master': - fullurl = BASE_URL + '/api/fixlet/master/{}'.format(patch_id) - else: - fullurl = BASE_URL + '/api/fixlet/{}/{}/{}'.format(site_type, site_name, patch_id) - - res = requests.get( - fullurl, - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE - ) - - if res.status_code < 200 or res.status_code >= 300: - return_error('Failed to get patch/fixlet {}. Request URL: {}\nStatusCode: {}\nResponse Body: {}'.format(patch_id, fullurl, res.status_code, res.content)) - - raw_patch = json.loads(xml2json(res.content)) - if (not raw_patch or not raw_patch.has_key('BES')): - return None - - raw_patch = demisto.get(raw_patch, 'BES.Fixlet') - patch = { - 'ID': patch_id, - 'Name': demisto.get(raw_patch, 'Title'), - 'Resource': fullurl, - 'Description': demisto.get(raw_patch, 'Description'), - 'Relevance': demisto.get(raw_patch, 'Relevance'), - 'Category': demisto.get(raw_patch, 'Category'), - 'DownloadSize': demisto.get(raw_patch, 'DownloadSize'), - 'Source': demisto.get(raw_patch, 'Source'), - 'SourceID': demisto.get(raw_patch, 'SourceID'), - 'SourceReleaseDate': demisto.get(raw_patch, 'SourceReleaseDate'), - 'SourceSeverity': demisto.get(raw_patch, 'SourceSeverity'), - 'ActionID': demisto.get(raw_patch, 'DefaultAction.@ID'), - 'ActionScript': demisto.get(raw_patch, 'DefaultAction.ActionScript') - } - - return patch - - def get_patch_details_command(): - site_type = demisto.args().get('site_type') - site_name = demisto.args().get('site_name') - patch_id = demisto.args().get('id') - - patch = get_patch_details(site_type, site_name, patch_id) - markdown = tableToMarkdown('BigFix Patch {}'.format(patch_id) , [patch], headers = [ - 'ID', - 'Name', - 'Resource', - 'Description', - 'Relevance', - 'Category', - 'DownloadSize', - 'Source', - 'SourceID', - 'SourceReleaseDate', - 'SourceSeverity', - 'ActionID', - 'ActionScript' - ]) - - demisto.results({ - 'Type': entryTypes['note'], - 'ContentsFormat': formats['json'], - 'Contents': patch, - 'HumanReadable': markdown, - 'EntryContext': { - 'Bigfix.Patch(val.ID==obj.ID)': patch - } - }) - - def deploy_patch(site_name, computer_ids, fixlet_id, action_id): - target = '' - if 'all' in computer_ids: - target = 'true' - else: - target = '\n'.join(['{}'.format(computer_id) for computer_id in computer_ids]) - - request_body = """ - - - - {} - {} - {} - - - {} - - 1000 - - - """.format(site_name, fixlet_id, action_id, target) - LOG('deploy_patch - request: ' + request_body) - - fullurl = BASE_URL + '/api/actions' - res = requests.post( - fullurl, - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE, - data=request_body - ) - - LOG('deploy_patch - raw response: ' + res.content) - if res.status_code < 200 or res.status_code >= 300: - return_error('Failed to deploy patch {}.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format(fixlet_id, fullurl, res.status_code, res.content)) - - raw_action = json.loads(xml2json(res.content)) - if (not raw_action or not raw_action.has_key('BESAPI')): - return None - - raw_action = demisto.get(raw_action, 'BESAPI.Action') - raw_action['FixletID'] = fixlet_id - raw_action['ComputerIDs'] = computer_ids - raw_action['SiteName'] = site_name - raw_action['Resource'] = raw_action['@Resource'] - del raw_action['@Resource'] - if 'all' in computer_ids: - raw_action['AllComputers'] = True - del raw_action['ComputerIDs'] - - return raw_action - - def deploy_patch_command(): - site_name = demisto.args().get('site_name') - all_computers = False - computer_ids = argToList(demisto.args().get('computer_ids')) - - fixlet_id = demisto.args().get('fixlet_id') - action_id = demisto.args().get('action_id') - - action = deploy_patch(site_name, computer_ids, fixlet_id, action_id) - - markdown = tableToMarkdown('BigFix Action {}'.format(action_id) , [action], headers = [ - 'ID', - 'Name', - 'FixletID', - 'ComputerIDs', - 'SiteName', - 'Resource' - ]) - - demisto.results({ - 'Type': entryTypes['note'], - 'ContentsFormat': formats['json'], - 'Contents': action, - 'HumanReadable': markdown, - 'EntryContext': { - 'Bigfix.Action(val.ID==obj.ID)': action - } - }) - - - def action_delete(action_id): - res = requests.delete( - BASE_URL + '/api/action/' + action_id, - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE - ) - - if res.status_code < 200 or res.status_code >= 300: - return_error('Failed to delete action {}.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format(action_id, fullurl, res.status_code, res.content)) - - - def action_delete_command(): - action_id = demisto.args().get('action_id') - - action_delete(action_id) - - demisto.results('Action {} was deleted successfully'.format(action_id)) - - - def get_action_status(action_id): - fullurl = BASE_URL + '/api/action/' + action_id + '/status' - res = requests.get( - fullurl, - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE - ) - - if res.status_code < 200 or res.status_code >= 300: - return_error('Failed to get action {} status.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format(action_id, fullurl, res.status_code, res.content)) - - raw_action = json.loads(xml2json(res.content)) - if (not raw_action or not raw_action.has_key('BESAPI')): - return None - - raw_action = demisto.get(raw_action, 'BESAPI.ActionResults') - return raw_action.get('Status') - - def get_action_status_command(): - action_id = demisto.args().get('action_id') - - status = get_action_status(action_id) - - output = { - 'ID': action_id, - 'Status': status - } - demisto.results({ - 'Type': entryTypes['note'], - 'ContentsFormat': formats['json'], - 'Contents': output, - 'HumanReadable': 'Action {} status is {}'.format(action_id, status), - 'EntryContext': { - 'Bigfix.Action(val.ID==obj.ID)': output - } - }) - - def action_stop(action_id): - res = requests.post( - BASE_URL + '/api/action/' + action_id + '/stop', - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE - ) - - if res.status_code < 200 or res.status_code >= 300: - return_error('Failed to stop action {}.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format(action_id, fullurl, res.status_code, res.content)) - - - def action_stop_command(): - action_id = demisto.args().get('action_id') - - action_stop(action_id) - - demisto.results('Action {} was stopped successfully'.format(action_id)) - - def query(relevance): - fullurl = BASE_URL + '/api/query' - params = { - 'relevance': relevance - } - res = requests.get( - fullurl, - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE, - params=params - ) - - if res.status_code < 200 or res.status_code >= 300: - return_error('Query failed.\nRequest URL: {}\nStatusCode: {}\nResponse Body: {}'.format(fullurl, res.status_code, res.content)) - - raw_action = json.loads(xml2json(res.content)) - if (not raw_action or not raw_action.has_key('BESAPI')): - demisto.info('BigFix query has incorrect response format. Response Body: {}'.format(res.content)) - return_error('The response has incorrect format. Check the logs') - - if demisto.get(raw_action, 'BESAPI.Query.Error'): - error = demisto.get(raw_action, 'BESAPI.Query.Error') - return_error(error) - - raw_query_results = demisto.get(raw_action, 'BESAPI.Query') - return raw_query_results - - def query_command(): - relevance = demisto.args().get('relevance') - results = query(relevance) - - if results == None: - demisto.results('No results') - sys.exit(0) - - output = demisto.dt(results, 'Result.Answer.#text') - if not isinstance(output, list): - output = [output] - - demisto.results({ - 'Type': entryTypes['note'], - 'ContentsFormat': formats['json'], - 'Contents': results, - 'HumanReadable': tableToMarkdown('Query Results: {}'.format(relevance), output, ['Results']), - 'EntryContext': { - 'Bigfix.QueryResults': output - } - }) - - try: - # do requets to /api/help - # should be good indicator for test connectivity - def test(): - fullurl = BASE_URL + '/api/help' - res = requests.get( - fullurl, - auth=(USERNAME, PASSWORD), - verify=VERIFY_CERTIFICATE - ) - res.raise_for_status() - - if demisto.command() == 'test-module': - # do requets to /api/help - # should be good indicator for test connectivity - test() - demisto.results('ok') - - elif demisto.command() == 'bigfix-get-sites': - get_sites_command() - - elif demisto.command() == 'bigfix-get-site': - get_site_command() - - elif demisto.command() == 'bigfix-get-endpoints': - get_endpoints_command() - - elif demisto.command() == 'bigfix-get-endpoint': - get_endpoint_details_command() - - elif demisto.command() == 'bigfix-get-patches': - get_patches_command() - - elif demisto.command() == 'bigfix-get-patch': - get_patch_details_command() - - elif demisto.command() == 'bigfix-deploy-patch': - deploy_patch_command() - - elif demisto.command() == 'bigfix-action-delete': - action_delete_command() - - elif demisto.command() == 'bigfix-action-status': - get_action_status_command() - - elif demisto.command() == 'bigfix-action-stop': - action_stop_command() - - elif demisto.command(): - query_command() - - except Exception, e: - LOG(e.message) - LOG.print_log() - return_error(e.message) - type: python - subtype: python2 - commands: - - name: bigfix-get-sites - arguments: [] - outputs: - - contextPath: Bigfix.Site - description: Site - type: unknown - - contextPath: Bigfix.Site.Name - description: Name of the site - type: string - - contextPath: Bigfix.Site.Description - description: Description of the site - type: string - - contextPath: Bigfix.Site.Resource - description: Link to the endpoint resource. - type: string - - contextPath: Bigfix.Site.Type - description: Type of the site (master,custom,external,operator) - type: string - - contextPath: Bigfix.Site.Domain - description: Site domain - type: string - - contextPath: Bigfix.Site.GatherURL - description: Gather URL - type: string - - contextPath: Bigfix.Site.GlobalReadPermission - description: Global Read Permission available or not. - type: string - description: Retrieves all the sites - - name: bigfix-get-site - arguments: - - name: site_name - description: Name of the site. If the site is external or operator then site - must be provided - - name: site_type - required: true - auto: PREDEFINED - predefined: - - external - - operator - - master - - custom - description: 'Type of the site. One of the following options: external,operator,master,custom' - defaultValue: master - outputs: - - contextPath: Bigfix.Site - description: Site - type: unknown - - contextPath: Bigfix.Site.Name - description: Name of the site - type: string - - contextPath: Bigfix.Site.Description - description: Description of the site - type: string - - contextPath: Bigfix.Site.Resource - description: Link to the endpoint resource. - type: string - - contextPath: Bigfix.Site.Type - description: Type of the site (master,custom,external,operator) - type: string - - contextPath: Bigfix.Site.Domain - description: Site domain - type: string - - contextPath: Bigfix.Site.GatherURL - description: Gather URL - type: string - - contextPath: Bigfix.Site.GlobalReadPermission - description: Global Read Permission available or not. - type: string - description: Retrieve single site by name and type - - name: bigfix-get-patches - arguments: - - name: site_type - required: true - auto: PREDEFINED - predefined: - - external - - operator - - master - - custom - description: 'Type of the site. One of the following options: external,operator,master,custom' - defaultValue: master - - name: site_name - description: Name of the site. If the site is external or operator then site - must be provided - outputs: - - contextPath: Bigfix.Patch.ID - description: Patch (fixlet) ID - type: string - - contextPath: Bigfix.Patch.LastModified - description: Last modified Timestamp. - type: date - - contextPath: Bigfix.Patch.Name - description: Name of the Patch requested. - type: string - - contextPath: Bigfix.Patch.Resource - description: The link for the patch - type: string - - contextPath: Bigfix.Patch.Description - description: Description of the Patch requested. - type: string - - contextPath: Bigfix.Patch.Relevance - description: Relevance of the Patch requested. - type: string - - contextPath: Bigfix.Patch.Category - description: Category of the Patch requested. - type: string - - contextPath: Bigfix.Patch.DownloadSize - description: Download size. - type: string - - contextPath: Bigfix.Patch.Source - description: Source from where the patch is coming from. - type: string - - contextPath: Bigfix.Patch.SourceID - description: Source ID of the Patch requested. - type: string - - contextPath: Bigfix.Patch.SourceSeverity - description: Source Severity of the Patch requested. - type: string - - contextPath: Bigfix.Patch.SourceReleaseDate - description: Source Release Date of the Patch requested. - type: string - - contextPath: Bigfix.Patch.ActionID - description: Action ID of the Patch requested. - type: string - - contextPath: Bigfix.Patch.ActionScript - description: Action Script of the Patch requested. - type: string - description: Retrieve all the patches (fixlets) of site - - name: bigfix-get-endpoints - arguments: [] - outputs: - - contextPath: Bigfix.Endpoint - description: Endpoint (computer) - - contextPath: Bigfix.Endpoint.ID - description: The if of the endpoint (computer ID) - type: string - - contextPath: Bigfix.Endpoint.Resource - description: URL to the endpoint details - type: string - - contextPath: Bigfix.Endpoint.LastReportTime - description: Last report time of the endpoint - type: date - - contextPath: Bigfix.Endpoint.ActiveDirectoryPath - description: Active directory path of the endpoint device. - type: string - - contextPath: Bigfix.Endpoint.AgentType - description: Agent Type of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.AgentVersion - description: Agent Version of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.BESRelaySelectionMethod - description: Relay selection method of the endpoint. - - contextPath: Bigfix.Endpoint.BESRelayServiceInstalled - description: Relay service installed of the endpoint. - - contextPath: Bigfix.Endpoint.BESRootServer - description: Root server of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.BIOS - description: BIOS of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.CPU - description: CPU of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.ClientSettings - description: Client settings of the endpoint. - - contextPath: Bigfix.Endpoint.ComputerName - description: Computer name of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.ComputerType - description: Computer Type of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.DNSName - description: DNS Name of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.DeviceType - description: Device Type of the endpoint device. - type: string - - contextPath: Bigfix.Endpoint.DistancetoBESRelay - description: Distance to BES Relay of the endpoint. - - contextPath: Bigfix.Endpoint.FreeSpaceonSystemDrive - description: Free space on sytem drive of the endpoint. - - contextPath: Bigfix.Endpoint.IPAddress - description: IP of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.LicenseType - description: License of the endpoint. - - contextPath: Bigfix.Endpoint.Locked - description: Locked of the endpoint. - - contextPath: Bigfix.Endpoint.OS - description: OS of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.RAM - description: RAM of the endpoint. - type: number - - contextPath: Bigfix.Endpoint.Relay - description: Relay of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.RelayNameOfClient - description: Relay Name of the client. - type: string - - contextPath: Bigfix.Endpoint.SubnetAddress - description: Subnet Address of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.SubscribedSites - description: Subscribed sites. - type: string - - contextPath: Bigfix.Endpoint.TotalSizeofSystemDrive - description: Total size of system drive. - type: number - - contextPath: Bigfix.Endpoint.UserName - description: User name. - type: string - description: Retrieve all the endpoints (computers) - - name: bigfix-get-endpoint - arguments: - - name: computer_id - required: true - description: Computer ID - outputs: - - contextPath: Bigfix.Endpoint - description: Endpoint (computer) - - contextPath: Bigfix.Endpoint.ID - description: The if of the endpoint (computer ID) - type: string - - contextPath: Bigfix.Endpoint.Resource - description: URL to the endpoint details - type: string - - contextPath: Bigfix.Endpoint.LastReportTime - description: Last report time of the endpoint - type: date - - contextPath: Bigfix.Endpoint.ActiveDirectoryPath - description: Active directory path of the endpoint device. - type: string - - contextPath: Bigfix.Endpoint.AgentType - description: Agent Type of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.AgentVersion - description: Agent Version of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.BESRelaySelectionMethod - description: Relay selection method of the endpoint. - - contextPath: Bigfix.Endpoint.BESRelayServiceInstalled - description: Relay service installed of the endpoint. - - contextPath: Bigfix.Endpoint.BESRootServer - description: Root server of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.BIOS - description: BIOS of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.CPU - description: CPU of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.ClientSettings - description: Client settings of the endpoint. - - contextPath: Bigfix.Endpoint.ComputerName - description: Computer name of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.ComputerType - description: Computer Type of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.DNSName - description: DNS Name of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.DeviceType - description: Device Type of the endpoint device. - type: string - - contextPath: Bigfix.Endpoint.DistancetoBESRelay - description: Distance to BES Relay of the endpoint. - - contextPath: Bigfix.Endpoint.FreeSpaceonSystemDrive - description: Free space on sytem drive of the endpoint. - - contextPath: Bigfix.Endpoint.IPAddress - description: IP of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.LicenseType - description: License of the endpoint. - - contextPath: Bigfix.Endpoint.Locked - description: Locked of the endpoint. - - contextPath: Bigfix.Endpoint.OS - description: OS of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.RAM - description: RAM of the endpoint. - type: number - - contextPath: Bigfix.Endpoint.Relay - description: Relay of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.RelayNameOfClient - description: Relay Name of the client. - type: string - - contextPath: Bigfix.Endpoint.SubnetAddress - description: Subnet Address of the endpoint. - type: string - - contextPath: Bigfix.Endpoint.SubscribedSites - description: Subscribed sites. - type: string - - contextPath: Bigfix.Endpoint.TotalSizeofSystemDrive - description: Total size of system drive. - type: number - - contextPath: Bigfix.Endpoint.UserName - description: User name. - type: string - description: Retrieve endpoint (computer) details - - name: bigfix-deploy-patch - arguments: - - name: site_name - required: true - description: Name of the site. If the site is external or operator then site - must be provided - - name: computer_ids - required: true - description: Provide ids of computers to deploy the patch. Pass 'all' to deploy - to all the computers - isArray: true - - name: fixlet_id - required: true - description: The Fixlet ID. To use the action script from the original Fixlet - or Task Message. - - name: action_id - required: true - description: The action ID. The specified action will run on target computers. - outputs: - - contextPath: Bigfix.Action.ID - description: Action ID - type: number - - contextPath: Bigfix.Action.Name - description: Action Name - type: string - - contextPath: Bigfix.Action.SiteName - description: Site name - type: string - - contextPath: Bigfix.Action.ComputerIDs - description: Computers IDs to which the patch was applied to - - contextPath: Bigfix.Action.AllComputers - description: true if patch was applied to all the computers - type: boolean - - contextPath: Bigfix.Action.Resource - description: Link to action in bigfix - type: string - description: Create an action on BigFix that will run the given action from the - given fixlet on target computers. The computerID parameter takes a comma-separated - list of BigFix computer IDs. If no computers are given, the action will be run - on the default computers configured on BigFix. If the action should run on all - computers set the computerID parameter to all. - - name: bigfix-get-patch - arguments: - - name: id - required: true - description: Fixlet id - - name: site_type - required: true - auto: PREDEFINED - predefined: - - external - - operator - - master - - custom - description: 'Type of the site. One of the following options: external,operator,master,custom' - - name: site_name - description: Name of the site. If the site is external or operator then site - must be provided - outputs: - - contextPath: Bigfix.Patch.ID - description: Patch(fixlet) id - - contextPath: Bigfix.Patch.Name - description: Patch name - - contextPath: Bigfix.Patch.Resource - description: Link (URL) to the patch - - contextPath: Bigfix.Patch.Description - description: Description - - contextPath: Bigfix.Patch.Relevance - description: Relevance of the Patch requested. - - contextPath: Bigfix.Patch.Category - description: Category of the Patch requested. - type: string - - contextPath: Bigfix.Patch.DownloadSize - description: Download size. - - contextPath: Bigfix.Patch.Source - description: Source from where the patch is coming from. - - contextPath: Bigfix.Patch.SourceID - description: Source ID of the Patch requested. - - contextPath: Bigfix.Patch.SourceSeverity - description: Source Severity of the Patch requested. - - contextPath: Bigfix.Patch.SourceReleaseDate - description: Source Release Date of the Patch requested. - - contextPath: Bigfix.Patch.ActionID - description: Action ID of the Patch requested. - type: string - - contextPath: Bigfix.Patch.ActionScript - description: Action Script of the Patch requested. - type: string - description: Retrieve patch (fixlet) by id - - name: bigfix-action-delete - arguments: - - name: action_id - required: true - description: Action ID - description: 'Stops and deletes the specified action. Note: You cannot delete - actions that are members of a Multiple Action Group. This note applies to IBM - BigFix V9.2 and later.' - - name: bigfix-action-status - arguments: - - name: action_id - required: true - description: Action ID - outputs: - - contextPath: Bigfix.Action.ID - description: Action ID - type: string - - contextPath: Bigfix.Action.Status - description: Action Status (e.g Open, Stopped) - type: string - description: Gets the status of an action against it's targets. - - name: bigfix-action-stop - arguments: - - name: action_id - required: true - description: Action ID - description: Stops the specified action. - - name: bigfix-query - arguments: - - name: relevance - required: true - description: 'Relevance query (example: names of bes computers)' - outputs: - - contextPath: Bigfix.QueryResults - description: The results of the query - type: unknown - description: Evaluate a relevance expression and get the result. This runs request - is processed through the server to WebReports. - runonce: false diff --git a/Packs/BigFix/ReleaseNotes/1_0_1.md b/Packs/BigFix/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..9c876bfe798 --- /dev/null +++ b/Packs/BigFix/ReleaseNotes/1_0_1.md @@ -0,0 +1,3 @@ +#### Integrations +##### __BigFix__ +- Added **get_endpoints_details** argument to the ***bigfix-get-endpoints*** command to set if details of endpoints should be retrieved or not. diff --git a/Packs/BigFix/TestPlaybooks/playbook-BigFixTest.yml b/Packs/BigFix/TestPlaybooks/playbook-BigFixTest.yml index 409b3b37046..040dbdcde60 100644 --- a/Packs/BigFix/TestPlaybooks/playbook-BigFixTest.yml +++ b/Packs/BigFix/TestPlaybooks/playbook-BigFixTest.yml @@ -1,31 +1,40 @@ id: BigFixTest version: -1 name: BigFixTest -starttaskid: '0' +starttaskid: "0" tasks: - '0': - id: '0' - taskid: 2c9d96a0-f815-4c0c-8088-29eae39ef7c9 + "0": + id: "0" + taskid: 67df1a23-4949-410d-8480-15cd8be6e6b5 type: start task: - id: 2c9d96a0-f815-4c0c-8088-29eae39ef7c9 + id: 67df1a23-4949-410d-8480-15cd8be6e6b5 version: -1 - name: '' + name: "" iscommand: false - brand: '' - description: '' + brand: "" nexttasks: '#none#': - - '7' + - "7" separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 50\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 50 + } + } note: false - '1': - id: '1' - taskid: fe4946dd-7be1-4cb8-8e7c-04d791c0e022 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "1": + id: "1" + taskid: 0d4dbaf8-58e2-490f-877f-c99f72591aa0 type: regular task: - id: fe4946dd-7be1-4cb8-8e7c-04d791c0e022 + id: 0d4dbaf8-58e2-490f-877f-c99f72591aa0 version: -1 name: bigfix-get-sites description: Retrieves all the sites @@ -35,18 +44,28 @@ tasks: brand: BigFix nexttasks: '#none#': - - '8' - - '9' - - '10' + - "8" + - "9" + - "10" separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 370\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 370 + } + } note: false - '2': - id: '2' - taskid: 047cd2f3-3b2d-46dc-8be9-3622e1addc02 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "2": + id: "2" + taskid: c678d099-ac20-41f0-8ec5-eaa8acce8bf2 type: regular task: - id: 047cd2f3-3b2d-46dc-8be9-3622e1addc02 + id: c678d099-ac20-41f0-8ec5-eaa8acce8bf2 version: -1 name: bigfix-get-site (default master) description: Retrieve single site by name and type @@ -56,21 +75,31 @@ tasks: brand: BigFix nexttasks: '#none#': - - '12' - - '13' - - '14' + - "12" + - "13" + - "14" scriptarguments: site_name: {} site_type: {} separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 1420\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 1420 + } + } note: false - '3': - id: '3' - taskid: 8a932779-f2b1-487a-8fce-c71ff0fe5a82 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "3": + id: "3" + taskid: 4e2ea098-248d-46bf-8c96-6680ef0aa9de type: regular task: - id: 8a932779-f2b1-487a-8fce-c71ff0fe5a82 + id: 4e2ea098-248d-46bf-8c96-6680ef0aa9de version: -1 name: bigfix-get-site (external BES Support) description: Retrieve single site by name and type @@ -80,23 +109,33 @@ tasks: brand: BigFix nexttasks: '#none#': - - '16' - - '17' - - '18' + - "16" + - "17" + - "18" scriptarguments: site_name: simple: BES Support site_type: simple: external separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 895\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 895 + } + } note: false - '4': - id: '4' - taskid: f738eb65-123b-4635-899e-0e99363c98ee + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "4": + id: "4" + taskid: ebf4a1a3-f3e1-4c1f-87f6-00c7ed4e07bf type: regular task: - id: f738eb65-123b-4635-899e-0e99363c98ee + id: ebf4a1a3-f3e1-4c1f-87f6-00c7ed4e07bf version: -1 name: bigfix-get-patches description: Retrieve all the patches (fixlets) of site @@ -106,21 +145,31 @@ tasks: brand: BigFix nexttasks: '#none#': - - '21' - - '22' + - "21" + - "22" scriptarguments: site_name: {} site_type: simple: master separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 2295\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 2295 + } + } note: false - '5': - id: '5' - taskid: 355ac42b-fc75-459e-8e96-2a21872c1fe0 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "5": + id: "5" + taskid: 25fde8e9-77f9-480d-8d1c-75ca6b555c52 type: regular task: - id: 355ac42b-fc75-459e-8e96-2a21872c1fe0 + id: 25fde8e9-77f9-480d-8d1c-75ca6b555c52 version: -1 name: bigfix-deploy-patch description: Deploy patch on site @@ -130,465 +179,643 @@ tasks: brand: BigFix nexttasks: '#none#': - - '24' + - "24" scriptarguments: action_id: simple: Action2 computer_ids: - simple: '3385267' + simple: "3385267" fixlet_id: - simple: '1759' + simple: "1759" site_name: simple: BES Support site_type: simple: master separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 2645\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 2645 + } + } note: false - '6': - id: '6' - taskid: 673663a6-79c0-4bd8-8695-643da5c57840 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "6": + id: "6" + taskid: 974a014a-b2b8-43fc-8b11-32b5877bf929 type: regular task: - id: 673663a6-79c0-4bd8-8695-643da5c57840 + id: 974a014a-b2b8-43fc-8b11-32b5877bf929 version: -1 name: bigfix-get-endpoints script: BigFix|||bigfix-get-endpoints type: regular iscommand: true brand: BigFix - description: '' nexttasks: '#none#': - - '23' + - "23" separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 1770\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 1770 + } + } note: false - '7': - id: '7' - taskid: 3d9ef20e-ae32-43a9-8084-5acedc2b1041 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "7": + id: "7" + taskid: 36465eb9-089c-46db-8427-b223072c8df0 type: regular task: - id: 3d9ef20e-ae32-43a9-8084-5acedc2b1041 + id: 36465eb9-089c-46db-8427-b223072c8df0 version: -1 name: DeleteContext description: Delete field from context scriptName: DeleteContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '1' + - "1" scriptarguments: all: - simple: yes + simple: "yes" key: {} separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 195\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 195 + } + } note: false - '8': - id: '8' - taskid: cb760a6b-80be-4a21-8bd9-5dd145aee5c5 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "8": + id: "8" + taskid: 58a142c0-72b6-4020-814d-7d2cbdaf4b06 type: regular task: - id: cb760a6b-80be-4a21-8bd9-5dd145aee5c5 + id: 58a142c0-72b6-4020-814d-7d2cbdaf4b06 version: -1 name: VerifyContext - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '11' + - "11" scriptarguments: expectedValue: {} fields: {} path: simple: Bigfix.Site.Name separatecontext: false - view: "{\n \"position\": {\n \"x\": 50,\n \"y\": 545\n }\n}" + view: |- + { + "position": { + "x": 50, + "y": 545 + } + } note: false - '9': - id: '9' - taskid: 7b25a9e5-2290-4102-8765-14f68c31291b + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "9": + id: "9" + taskid: f4e6e81d-3c60-48e1-8450-18cead4e751b type: regular task: - id: 7b25a9e5-2290-4102-8765-14f68c31291b + id: f4e6e81d-3c60-48e1-8450-18cead4e751b version: -1 name: VerifyContext - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '11' + - "11" scriptarguments: expectedValue: {} fields: {} path: simple: Bigfix.Site.Resource separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 545\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 545 + } + } note: false - '10': - id: '10' - taskid: 1a1e91bf-e6f7-421a-8497-87f307824559 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "10": + id: "10" + taskid: f78807ab-84f6-408b-8a3d-4d15ba7ac791 type: regular task: - id: 1a1e91bf-e6f7-421a-8497-87f307824559 + id: f78807ab-84f6-408b-8a3d-4d15ba7ac791 version: -1 name: VerifyContext - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '11' + - "11" scriptarguments: expectedValue: {} fields: {} path: simple: Bigfix.Site.Type separatecontext: false - view: "{\n \"position\": {\n \"x\": 910,\n \"y\": 545\n }\n}" + view: |- + { + "position": { + "x": 910, + "y": 545 + } + } note: false - '11': - id: '11' - taskid: 54c5763c-c5a9-4619-8076-c6c0771bfe39 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "11": + id: "11" + taskid: 9bbf977e-cc7d-4534-845c-1c0f9398231c type: regular task: - id: 54c5763c-c5a9-4619-8076-c6c0771bfe39 + id: 9bbf977e-cc7d-4534-845c-1c0f9398231c version: -1 name: Delete Context scriptName: DeleteContext type: regular iscommand: false - brand: '' - description: '' + brand: "" nexttasks: '#none#': - - '3' + - "3" scriptarguments: all: - simple: yes + simple: "yes" key: {} separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 720\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 720 + } + } note: false - '12': - id: '12' - taskid: 75be5e31-bc88-459c-83f4-76edf213ea58 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "12": + id: "12" + taskid: f932b88b-7547-4054-8bf0-7049bc12ce0d type: regular task: - id: 75be5e31-bc88-459c-83f4-76edf213ea58 + id: f932b88b-7547-4054-8bf0-7049bc12ce0d version: -1 name: VerifyContext - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '6' + - "6" scriptarguments: expectedValue: {} fields: {} path: simple: Bigfix.Site.Name separatecontext: false - view: "{\n \"position\": {\n \"x\": 50,\n \"y\": 1595\n }\n}" + view: |- + { + "position": { + "x": 50, + "y": 1595 + } + } note: false - '13': - id: '13' - taskid: ee4f72e4-8c06-4bd2-8cbc-4b14dcd257dc + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "13": + id: "13" + taskid: 7c221d99-daca-4c5c-848f-5cde42a83332 type: regular task: - id: ee4f72e4-8c06-4bd2-8cbc-4b14dcd257dc + id: 7c221d99-daca-4c5c-848f-5cde42a83332 version: -1 name: VerifyContext - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '6' + - "6" scriptarguments: expectedValue: {} fields: {} path: simple: Bigfix.Site.Resource separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 1595\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 1595 + } + } note: false - '14': - id: '14' - taskid: 691fe7b7-448d-478a-88fe-2c54ee12326c + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "14": + id: "14" + taskid: 221e5ca2-1b40-41e6-87d5-ffc63888ad9e type: regular task: - id: 691fe7b7-448d-478a-88fe-2c54ee12326c + id: 221e5ca2-1b40-41e6-87d5-ffc63888ad9e version: -1 name: VerifyContext - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '6' + - "6" scriptarguments: expectedValue: {} fields: {} path: simple: Bigfix.Site.Type separatecontext: false - view: "{\n \"position\": {\n \"x\": 910,\n \"y\": 1595\n }\n}" + view: |- + { + "position": { + "x": 910, + "y": 1595 + } + } note: false - '16': - id: '16' - taskid: 1eb56d17-07d5-464e-8d80-60cdfe905eab + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "16": + id: "16" + taskid: b8b68950-8566-48f7-8aa1-21fbd7888df7 type: regular task: - id: 1eb56d17-07d5-464e-8d80-60cdfe905eab + id: b8b68950-8566-48f7-8aa1-21fbd7888df7 version: -1 name: VerifyContext - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '19' + - "19" scriptarguments: expectedValue: {} fields: {} path: simple: Bigfix.Site.Name separatecontext: false - view: "{\n \"position\": {\n \"x\": 50,\n \"y\": 1070\n }\n}" + view: |- + { + "position": { + "x": 50, + "y": 1070 + } + } note: false - '17': - id: '17' - taskid: a7825e03-6121-454d-89a4-6bc4fd2bba71 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "17": + id: "17" + taskid: fcc0b6fa-dc54-4bc8-84e3-05e6804140d6 type: regular task: - id: a7825e03-6121-454d-89a4-6bc4fd2bba71 + id: fcc0b6fa-dc54-4bc8-84e3-05e6804140d6 version: -1 name: VerifyContext - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '19' + - "19" scriptarguments: expectedValue: {} fields: {} path: simple: Bigfix.Site.Resource separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 1070\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 1070 + } + } note: false - '18': - id: '18' - taskid: a9da70c1-243d-4ff5-8fd5-fa74981aea5f + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "18": + id: "18" + taskid: 7fd45f79-3e21-4e59-8342-5b01eaac954f type: regular task: - id: a9da70c1-243d-4ff5-8fd5-fa74981aea5f + id: 7fd45f79-3e21-4e59-8342-5b01eaac954f version: -1 name: VerifyContext - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '19' + - "19" scriptarguments: expectedValue: {} fields: {} path: simple: Bigfix.Site.Type separatecontext: false - view: "{\n \"position\": {\n \"x\": 910,\n \"y\": 1070\n }\n}" + view: |- + { + "position": { + "x": 910, + "y": 1070 + } + } note: false - '19': - id: '19' - taskid: 57f4cde6-d8ec-4cde-8b7e-b45d34012c16 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "19": + id: "19" + taskid: 007103d1-f242-4fea-8528-d74625ddef2c type: regular task: - id: 57f4cde6-d8ec-4cde-8b7e-b45d34012c16 + id: 007103d1-f242-4fea-8528-d74625ddef2c version: -1 name: Delete Context scriptName: DeleteContext type: regular iscommand: false - brand: '' - description: '' + brand: "" nexttasks: '#none#': - - '2' + - "2" scriptarguments: all: - simple: yes + simple: "yes" key: {} separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 1245\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 1245 + } + } note: false - '20': - id: '20' - taskid: 6981e34d-806b-4768-8cbd-ee21be93b5de + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "20": + id: "20" + taskid: 268bdfcd-194f-4679-83c8-1b110e7c9bf8 type: regular task: - id: 6981e34d-806b-4768-8cbd-ee21be93b5de + id: 268bdfcd-194f-4679-83c8-1b110e7c9bf8 version: -1 name: Fail test - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '4' + - "4" scriptarguments: expectedValue: {} fields: {} path: simple: ThereIsNoSuchPath separatecontext: false - view: "{\n \"position\": {\n \"x\": 367.5,\n \"y\": 2120\n }\n}" + view: |- + { + "position": { + "x": 367.5, + "y": 2120 + } + } note: false - '21': - id: '21' - taskid: 85e9f1bf-6dfd-43d7-8595-207b2002c0a5 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "21": + id: "21" + taskid: cce78046-3f5a-456f-8e95-5662ef41553e type: regular task: - id: 85e9f1bf-6dfd-43d7-8595-207b2002c0a5 + id: cce78046-3f5a-456f-8e95-5662ef41553e version: -1 name: VerifyContext - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '5' + - "5" scriptarguments: expectedValue: {} fields: {} path: simple: Bigfix.Patch.ID separatecontext: false - view: "{\n \"position\": {\n \"x\": 265,\n \"y\": 2470\n }\n}" + view: |- + { + "position": { + "x": 265, + "y": 2470 + } + } note: false - '22': - id: '22' - taskid: b08f8a3c-0c73-44a8-846e-cb0da44d0f7b + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "22": + id: "22" + taskid: 15c98843-da79-462a-803a-b6bafa37db5f type: regular task: - id: b08f8a3c-0c73-44a8-846e-cb0da44d0f7b + id: 15c98843-da79-462a-803a-b6bafa37db5f version: -1 name: VerifyContext - description: "Verifies path in context:\n- Verifies path existence\n- If matching\ - \ object is an array: verify fields exists in each of the objects in the array\n\ - - If matching object is not an array: verify fields exists in matching object\n\ - - if 'expectedValue' is given: ensure that the given value is equal to the\ - \ context path" + description: |- + Verifies path in context: + - Verifies path existence + - If matching object is an array: verify fields exists in each of the objects in the array + - If matching object is not an array: verify fields exists in matching object + - if 'expectedValue' is given: ensure that the given value is equal to the context path scriptName: VerifyContext type: regular iscommand: false - brand: '' + brand: "" nexttasks: '#none#': - - '5' + - "5" scriptarguments: expectedValue: {} fields: {} path: simple: Bigfix.Patch.Name separatecontext: false - view: "{\n \"position\": {\n \"x\": 695,\n \"y\": 2470\n }\n}" + view: |- + { + "position": { + "x": 695, + "y": 2470 + } + } note: false - '23': - id: '23' - taskid: bf6f1bac-3ccb-42c4-8554-d94227d2122a + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "23": + id: "23" + taskid: 4522953c-dc17-43a0-88a5-f6ee40c047ed type: condition task: - id: bf6f1bac-3ccb-42c4-8554-d94227d2122a + id: 4522953c-dc17-43a0-88a5-f6ee40c047ed version: -1 name: Verify endpoint type: condition iscommand: false - brand: '' - description: '' + brand: "" nexttasks: '#default#': - - '20' - yes: - - '4' + - "20" + "yes": + - "4" separatecontext: false conditions: - - label: yes + - label: "yes" condition: - - operator: isEqualString left: @@ -597,76 +824,254 @@ tasks: iscontext: true right: value: - simple: '3385267' - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 1945\n }\n}" + simple: "3385267" + view: |- + { + "position": { + "x": 480, + "y": 1945 + } + } note: false - '24': - id: '24' - taskid: c2a4f754-6742-4844-8fe2-83eef7b3f392 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "24": + id: "24" + taskid: 7e627aea-9bfb-45a8-81de-09c0b5d84290 type: regular task: - id: c2a4f754-6742-4844-8fe2-83eef7b3f392 + id: 7e627aea-9bfb-45a8-81de-09c0b5d84290 version: -1 name: Stop action script: '|||bigfix-action-stop' type: regular iscommand: true - brand: '' - description: '' + brand: "" nexttasks: '#none#': - - '25' + - "25" scriptarguments: action_id: simple: ${Bigfix.Action.ID} separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 2850\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 2820 + } + } note: false - '25': - id: '25' - taskid: 2bf85dd9-1ff3-4e4a-81dd-4dea22ad7620 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "25": + id: "25" + taskid: 33316be1-3176-4fd1-8a8d-9f12682c18a6 type: regular task: - id: 2bf85dd9-1ff3-4e4a-81dd-4dea22ad7620 + id: 33316be1-3176-4fd1-8a8d-9f12682c18a6 version: -1 name: Get action status script: '|||bigfix-action-status' type: regular iscommand: true - brand: '' - description: '' + brand: "" nexttasks: '#none#': - - '26' + - "26" scriptarguments: action_id: simple: ${Bigfix.Action.ID} separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 3050\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 2995 + } + } note: false - '26': - id: '26' - taskid: 4fb123eb-7745-4130-8067-b22c09ba4c10 + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "26": + id: "26" + taskid: 17435711-47c4-4e97-853c-d391854defb3 type: regular task: - id: 4fb123eb-7745-4130-8067-b22c09ba4c10 + id: 17435711-47c4-4e97-853c-d391854defb3 version: -1 name: Delete action script: '|||bigfix-action-delete' type: regular iscommand: true - brand: '' - description: '' + brand: "" + nexttasks: + '#none#': + - "28" scriptarguments: action_id: simple: ${Bigfix.Action.ID} separatecontext: false - view: "{\n \"position\": {\n \"x\": 480,\n \"y\": 3270\n }\n}" + view: |- + { + "position": { + "x": 480, + "y": 3170 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "27": + id: "27" + taskid: 4303c0bf-08ac-4bb6-8bf8-3df2d24d5b49 + type: regular + task: + id: 4303c0bf-08ac-4bb6-8bf8-3df2d24d5b49 + version: -1 + name: Get Endpoints without details + script: BigFix|||bigfix-get-endpoints + type: regular + iscommand: true + brand: BigFix + nexttasks: + '#none#': + - "29" + scriptarguments: + get_endpoint_details: + simple: "false" + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 3520 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "28": + id: "28" + taskid: f4b23c6d-c0e2-410b-86ee-99bc03753628 + type: regular + task: + id: f4b23c6d-c0e2-410b-86ee-99bc03753628 + version: -1 + name: Delete Context + description: Delete field from context + scriptName: DeleteContext + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "27" + scriptarguments: + all: + simple: "yes" + index: {} + key: {} + keysToKeep: {} + subplaybook: {} + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 3345 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "29": + id: "29" + taskid: 2fdf6266-de58-4335-8aec-34134d2e237e + type: condition + task: + id: 2fdf6266-de58-4335-8aec-34134d2e237e + version: -1 + name: Verify endpoints with details outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "30" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + simple: Bigfix.Endpoint.ID + iscontext: true + - - operator: isEmpty + left: + value: + simple: Bigfix.Endpoint.OS + iscontext: true + view: |- + { + "position": { + "x": 480, + "y": 3695 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "30": + id: "30" + taskid: 0085f81a-5a60-4dea-8cc8-bef087b50c9f + type: title + task: + id: 0085f81a-5a60-4dea-8cc8-bef087b50c9f + version: -1 + name: Success + type: title + iscommand: false + brand: "" + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 3870 + } + } note: false -view: "{\n \"linkLabelsPosition\": {},\n \"paper\": {\n \"dimensions\": {\n \ - \ \"height\": 3315,\n \"width\": 1240,\n \"x\": 50,\n \"y\":\ - \ 50\n }\n }\n}" + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 3885, + "width": 1240, + "x": 50, + "y": 50 + } + } + } inputs: [] outputs: [] -fromversion: 5.0.0 -description: '' diff --git a/Packs/BigFix/pack_metadata.json b/Packs/BigFix/pack_metadata.json index c5ad8d0734b..bb034d001df 100644 --- a/Packs/BigFix/pack_metadata.json +++ b/Packs/BigFix/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "BigFix", - "description": "IBM BigFix Patch provides an automated, simplified patching process that is administered from a single console.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Vulnerability Management" - ], - "tags": [], - "useCases": [], - "keywords": [] + "name": "BigFix", + "description": "IBM BigFix Patch provides an automated, simplified patching process that is administered from a single console.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Vulnerability Management" + ], + "tags": [], + "useCases": [], + "keywords": [] } diff --git a/Packs/BitDam/pack_metadata.json b/Packs/BitDam/pack_metadata.json index ba85fe025f8..10a0510cd1b 100644 --- a/Packs/BitDam/pack_metadata.json +++ b/Packs/BitDam/pack_metadata.json @@ -1,11 +1,11 @@ { "name": "BitDam", "description": "BitDam secure email gateway protects from advanced content-borne threats with the most accurate prevention of known and unknown threats, at their source.", - "support": "xsoar", + "support": "partner", "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", + "author": "BitDam", + "url": "", + "email": "info@bitdam.com", "created": "2020-04-14T00:00:00Z", "categories": [ "Email Gateway" diff --git a/Packs/BreachNotification-US/pack_metadata.json b/Packs/BreachNotification-US/pack_metadata.json index 7c1ddcffa3a..98f8b16aa67 100644 --- a/Packs/BreachNotification-US/pack_metadata.json +++ b/Packs/BreachNotification-US/pack_metadata.json @@ -4,19 +4,15 @@ "support": "xsoar", "currentVersion": "1.0.2", "author": "Cortex XSOAR", - "url": "", + "url": "https://www.paloaltonetworks.com/cortex", "email": "", "categories": [], "tags": [ - "Breach", "Breach Notification", "PII", "Compliance" ], "created": "2020-05-06T18:47:57Z", - "updated": "2020-05-06T18:47:57Z", - "beta": false, - "deprecated": false, "useCases": [ "Breach Notification" ], @@ -26,6 +22,5 @@ "PII", "Compliance", "Personal Information" - ], - "dependencies": {} + ] } \ No newline at end of file diff --git a/Packs/CarbonBlackEnterpriseEDR/Integrations/CarbonBlackEnterpriseEDR/CarbonBlackEnterpriseEDR.py b/Packs/CarbonBlackEnterpriseEDR/Integrations/CarbonBlackEnterpriseEDR/CarbonBlackEnterpriseEDR.py index 3a396892b6d..2af8b675482 100644 --- a/Packs/CarbonBlackEnterpriseEDR/Integrations/CarbonBlackEnterpriseEDR/CarbonBlackEnterpriseEDR.py +++ b/Packs/CarbonBlackEnterpriseEDR/Integrations/CarbonBlackEnterpriseEDR/CarbonBlackEnterpriseEDR.py @@ -911,8 +911,8 @@ def create_report_command(client: Client, args: Dict) -> CommandResults: 'Link': ioc.get('link') }) - readable_output = tableToMarkdown(f'The report was created successfully.', contents, headers, removeNull=True) - ioc_output = tableToMarkdown(f'The IOCs for the report', ioc_contents, removeNull=True) + readable_output = tableToMarkdown('The report was created successfully.', contents, headers, removeNull=True) + ioc_output = tableToMarkdown('The IOCs for the report', ioc_contents, removeNull=True) results = CommandResults( outputs_prefix='CarbonBlackEEDR.Report', outputs_key_field='ID', @@ -1016,7 +1016,7 @@ def update_report_command(client: Client, args: Dict) -> CommandResults: 'Link': ioc.get('link') }) - readable_output = tableToMarkdown(f'The report was updated successfully.', contents, headers, removeNull=True) + readable_output = tableToMarkdown('The report was updated successfully.', contents, headers, removeNull=True) ioc_output = tableToMarkdown('The IOCs for the report', ioc_contents, removeNull=True) results = CommandResults( outputs_prefix='CarbonBlackEEDR.Report', diff --git a/Packs/CarbonBlackEnterpriseEDR/Integrations/CarbonBlackEnterpriseEDR/CarbonBlackEnterpriseEDR.yml b/Packs/CarbonBlackEnterpriseEDR/Integrations/CarbonBlackEnterpriseEDR/CarbonBlackEnterpriseEDR.yml index 27c48a0c73b..ca2fd3d97f1 100644 --- a/Packs/CarbonBlackEnterpriseEDR/Integrations/CarbonBlackEnterpriseEDR/CarbonBlackEnterpriseEDR.yml +++ b/Packs/CarbonBlackEnterpriseEDR/Integrations/CarbonBlackEnterpriseEDR/CarbonBlackEnterpriseEDR.yml @@ -1553,7 +1553,7 @@ script: description: The total number of file paths that have been observed, by this organization, for this file. type: Number - dockerimage: demisto/python3:3.7.4.2245 + dockerimage: demisto/python3:3.8.3.8715 feed: false isfetch: true longRunning: false diff --git a/Packs/CarbonBlackEnterpriseEDR/ReleaseNotes/1_0_1.md b/Packs/CarbonBlackEnterpriseEDR/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..b780c7d950f --- /dev/null +++ b/Packs/CarbonBlackEnterpriseEDR/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Carbon Black Enterprise EDR +- Internal code improvements. diff --git a/Packs/CarbonBlackEnterpriseEDR/pack_metadata.json b/Packs/CarbonBlackEnterpriseEDR/pack_metadata.json index 80fc2ca7137..200493afa75 100644 --- a/Packs/CarbonBlackEnterpriseEDR/pack_metadata.json +++ b/Packs/CarbonBlackEnterpriseEDR/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Carbon Black Cloud Enterprise EDR", "description": "Advanced threat hunting and incident response solution.", "support": "xsoar", - "currentVersion": "1.0.0", + "currentVersion": "1.0.1", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CHANGELOG.md b/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CHANGELOG.md index e0053696846..1feea660775 100644 --- a/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CHANGELOG.md +++ b/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +Added documentation notes ## [20.4.1] - 2020-04-29 - diff --git a/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CarbonBlackProtect.yml b/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CarbonBlackProtect.yml index 0f59af7c492..242339e6ae3 100644 --- a/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CarbonBlackProtect.yml +++ b/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CarbonBlackProtect.yml @@ -45,6 +45,7 @@ configuration: description: Carbon Black Enterprise Protection is a next-generation endpoint threat prevention solution to deliver a portfolio of protection policies, real-time visibility across environments, and comprehensive compliance rule sets in a single platform. + This integration only supports Carbon Black on-premise APIs. display: Carbon Black Enterprise Protection v2 name: CarbonBlackProtectionV2 script: @@ -2520,7 +2521,7 @@ script: - contextPath: CBP.FileRule.ReportOnly description: Is this rule "reporting only" or is it also "enforcing". type: String - dockerimage: demisto/python3:3.7.3.221 + dockerimage: demisto/python3:3.8.3.8715 subtype: python3 isfetch: true runonce: false diff --git a/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CarbonBlackProtect_description.md b/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CarbonBlackProtect_description.md index 7650e80da5f..2f28fc323fa 100644 --- a/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CarbonBlackProtect_description.md +++ b/Packs/CarbonBlackProtect/Integrations/CarbonBlackProtect/CarbonBlackProtect_description.md @@ -1,2 +1,8 @@ -To find a API key corresponding with a particular Carbon Black user account, log into the console as that user, then click the username in the upper right -> Profile info. -Then, click the "API Token" button on the left hand side to reveal the API token for the logged-in user. If there is no API token displayed, click the "Reset" button to create a new one. \ No newline at end of file +## Retrieve Your API Key +Follow these instructions to find an API key that corresponds to a particular Carbon Black user account. +1. Log in to the Carbon Black console as the user for which you want to get the API key. +2. Click the username in the upper-right corner. +3. Click the **API Token** button on the left-hand side to reveal the API token for the logged-in user. +4. (Optional) If no API token is displayed, click the **Reset** button to create a new one. + +* This integration only supports Carbon Black Cloud on-premise APIs. diff --git a/Packs/CarbonBlackProtect/ReleaseNotes/1_0_1.md b/Packs/CarbonBlackProtect/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..406863dd8cd --- /dev/null +++ b/Packs/CarbonBlackProtect/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### __CarbonBlackProtectionV2__ +- Added documentation notes diff --git a/Packs/CarbonBlackProtect/pack_metadata.json b/Packs/CarbonBlackProtect/pack_metadata.json index 562e656f59f..26837cad4b0 100644 --- a/Packs/CarbonBlackProtect/pack_metadata.json +++ b/Packs/CarbonBlackProtect/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "Carbon Black Enterprise Protection", - "description": "Carbon Black Enterprise Protection is a next-generation endpoint threat prevention solution to deliver a portfolio of protection policies, real-time visibility across environments, and comprehensive compliance rule sets in a single platform.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Endpoint" - ], - "tags": [], - "useCases": [], - "keywords": [] -} + "name": "Carbon Black Enterprise Protection", + "description": "Carbon Black Enterprise Protection is a next-generation endpoint threat prevention solution to deliver a portfolio of protection policies, real-time visibility across environments, and comprehensive compliance rule sets in a single platform.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Endpoint" + ], + "tags": [], + "useCases": [], + "keywords": [] +} \ No newline at end of file diff --git a/Packs/Carbon_Black_Enterprise_Response/.pack-ignore b/Packs/Carbon_Black_Enterprise_Response/.pack-ignore index e69de29bb2d..2bc6dc0c23b 100644 --- a/Packs/Carbon_Black_Enterprise_Response/.pack-ignore +++ b/Packs/Carbon_Black_Enterprise_Response/.pack-ignore @@ -0,0 +1,11 @@ +[file:playbook-Block_Endpoint_-_Carbon_Black_Response.yml] +ignore=BA101 + +[file:playbook-Get_File_Sample_By_Hash_-_Carbon_Black_Enterprise_Response.yml] +ignore=BA101 + +[file:playbook-Get_File_Sample_From_Path_-_Carbon_Black_Enterprise_Response.yml] +ignore=BA101 + +[file:playbook-Block_File_-_Carbon_Black_Response.yml] +ignore=BA101 diff --git a/Packs/Carbon_Black_Enterprise_Response/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_V2.yml b/Packs/Carbon_Black_Enterprise_Response/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_V2.yml new file mode 100644 index 00000000000..c351d69d996 --- /dev/null +++ b/Packs/Carbon_Black_Enterprise_Response/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_V2.yml @@ -0,0 +1,278 @@ +id: Search Endpoints By Hash - Carbon Black Response V2 +version: -1 +name: Search Endpoints By Hash - Carbon Black Response V2 +description: Hunt for malicious indicators using Carbon Black +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: edc8b672-13e8-48fa-87c9-594118876ac4 + type: start + task: + id: edc8b672-13e8-48fa-87c9-594118876ac4 + version: -1 + name: "" + description: Playbook start point + iscommand: false + brand: "" + nexttasks: + '#none#': + - "2" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + "1": + id: "1" + taskid: 71c8642a-2af7-4af6-8015-5a2f89fd40d2 + type: regular + task: + id: 71c8642a-2af7-4af6-8015-5a2f89fd40d2 + version: -1 + name: Hunt MD5 Hash + description: Query processes based on given parameters + script: '|||cb-get-processes' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + facet: {} + group: {} + hostname: {} + md5: + complex: + root: inputs + accessor: Hash + name: {} + parent-process-name: {} + process-path: {} + query: {} + rows: {} + sort: {} + start: {} + separatecontext: false + view: |- + { + "position": { + "x": 500, + "y": 680 + } + } + note: false + timertriggers: [] + ignoreworker: false + "2": + id: "2" + taskid: a43ea7bf-d5e3-4c0b-8da7-5ce65cc1aae3 + type: condition + task: + id: a43ea7bf-d5e3-4c0b-8da7-5ce65cc1aae3 + version: -1 + name: Is Carbon Black enabled? + description: Is Carbon Black enabled? + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "7" + "yes": + - "5" + scriptarguments: + value: + simple: ${modules(val.brand == 'carbonblack' && val.state == 'active')} + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + complex: + root: modules + filters: + - - operator: isEqualString + left: + value: + simple: modules.brand + iscontext: true + right: + value: + simple: carbonblack-v2 + - - operator: isEqualString + left: + value: + simple: modules.state + iscontext: true + right: + value: + simple: active + accessor: brand + iscontext: true + view: |- + { + "position": { + "x": 50, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + "3": + id: "3" + taskid: 108ba97d-b9da-4162-808d-025b5f6b7986 + type: title + task: + id: 108ba97d-b9da-4162-808d-025b5f6b7986 + version: -1 + name: Done + description: Done + type: title + iscommand: false + brand: "" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 865 + } + } + note: false + timertriggers: [] + ignoreworker: false + "5": + id: "5" + taskid: 00c09fd8-6352-4b6c-8e7a-5a2459544fc7 + type: condition + task: + id: 00c09fd8-6352-4b6c-8e7a-5a2459544fc7 + version: -1 + name: Is there an MD5 hash to hunt? + description: Checks if there is an MD5 hash to hunt. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "7" + "yes": + - "6" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + complex: + root: inputs.Hash + iscontext: true + view: |- + { + "position": { + "x": 290, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + "6": + id: "6" + taskid: 4fd8eec7-f7ec-4f53-8473-932db46cc0ec + type: title + task: + id: 4fd8eec7-f7ec-4f53-8473-932db46cc0ec + version: -1 + name: Hunt MD5 + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "1" + separatecontext: false + view: |- + { + "position": { + "x": 500, + "y": 540 + } + } + note: false + timertriggers: [] + ignoreworker: false + "7": + id: "7" + taskid: 863da4aa-ab0b-416b-8072-1f36602773aa + type: title + task: + id: 863da4aa-ab0b-416b-8072-1f36602773aa + version: -1 + name: No Integration \ No Hash + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "3" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 540 + } + } + note: false + timertriggers: [] + ignoreworker: false +view: |- + { + "linkLabelsPosition": { + "2_5_yes": 0.41, + "2_7_#default#": 0.42, + "5_6_yes": 0.47, + "5_7_#default#": 0.41 + }, + "paper": { + "dimensions": { + "height": 880, + "width": 830, + "x": 50, + "y": 50 + } + } + } +inputs: +- key: Hash + value: + complex: + root: File + accessor: MD5 + required: false + description: MD5 Hash +outputs: +- contextPath: Endpoint.Hostname + description: The device hostname + type: string +- contextPath: Endpoint + description: The endpoint + type: unknown +fromversion: 4.5.0 +tests: +- No tests diff --git a/Packs/Carbon_Black_Enterprise_Response/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_V2_README.md b/Packs/Carbon_Black_Enterprise_Response/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_V2_README.md new file mode 100644 index 00000000000..17a15fc24db --- /dev/null +++ b/Packs/Carbon_Black_Enterprise_Response/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_V2_README.md @@ -0,0 +1,35 @@ +Hunt for malicious indicators using Carbon Black + +## Dependencies +This playbook uses the following sub-playbooks, integrations, and scripts. + +### Sub-playbooks +This playbook does not use any sub-playbooks. + +### Integrations +* integration-Carbon_Black_Enterprise_Response + +### Scripts +This playbook does not use any scripts. + +### Commands +* cb-get-processes + +## Playbook Inputs +--- + +| **Name** | **Description** | **Default Value** | **Required** | +| --- | --- | --- | --- | +| Hash | MD5 Hash | File.MD5 | Optional | + +## Playbook Outputs +--- + +| **Path** | **Description** | **Type** | +| --- | --- | --- | +| Endpoint.Hostname | The device hostname | string | +| Endpoint | The endpoint | unknown | + +## Playbook Image +--- +![Search Endpoints By Hash - Carbon Black Response V2](Insert the link to your image here) \ No newline at end of file diff --git a/Packs/Carbon_Black_Enterprise_Response/ReleaseNotes/1_0_2.md b/Packs/Carbon_Black_Enterprise_Response/ReleaseNotes/1_0_2.md index 49ea2d1f62c..51e32536679 100644 --- a/Packs/Carbon_Black_Enterprise_Response/ReleaseNotes/1_0_2.md +++ b/Packs/Carbon_Black_Enterprise_Response/ReleaseNotes/1_0_2.md @@ -5,3 +5,7 @@ - __CBEvents__ - --> + +#### Playbook +##### __Search Endpoints By Hash - Carbon Black Response V2__ +- Hunt for malicious indicators using Carbon Black diff --git a/Packs/Carbon_Black_Enterprise_Response/ReleaseNotes/1_0_3.md b/Packs/Carbon_Black_Enterprise_Response/ReleaseNotes/1_0_3.md index 33728ad8aaa..2649f99aa02 100644 --- a/Packs/Carbon_Black_Enterprise_Response/ReleaseNotes/1_0_3.md +++ b/Packs/Carbon_Black_Enterprise_Response/ReleaseNotes/1_0_3.md @@ -1,5 +1,9 @@ -### Integrations -- __carbonblack-v2_ - - Fixed an issue where the file context did not behave as expected in the ***cb-get-processes*** command. +#### Integrations +##### __carbonblack-v2_ +- Fixed an issue where the file context did not behave as expected in the ***cb-get-processes*** command. + +#### Playbook +##### __Search Endpoints By Hash - Carbon Black Response V2__ +- New playbook - Search Endpoints By Hash - Carbon Black Response V2 playbook with carbonblack-v2. diff --git a/Packs/Carbon_Black_Enterprise_Response/doc_files/Search_Endpoints_By_Hash_-_Carbon_Black_Response_V2.png b/Packs/Carbon_Black_Enterprise_Response/doc_files/Search_Endpoints_By_Hash_-_Carbon_Black_Response_V2.png new file mode 100644 index 00000000000..02849fb9c0c Binary files /dev/null and b/Packs/Carbon_Black_Enterprise_Response/doc_files/Search_Endpoints_By_Hash_-_Carbon_Black_Response_V2.png differ diff --git a/Packs/CheckpointFirewall/Integrations/integration-CheckpointFirewall.yml b/Packs/CheckpointFirewall/Integrations/integration-CheckpointFirewall.yml index 2b086038416..8c335a55992 100644 --- a/Packs/CheckpointFirewall/Integrations/integration-CheckpointFirewall.yml +++ b/Packs/CheckpointFirewall/Integrations/integration-CheckpointFirewall.yml @@ -835,8 +835,9 @@ script: description: Whether to block traffic "to" or "from" the IPs, or "both". Default is "both". - name: rulename - required: true + required: false description: Base name for added rules inside checkpoint db + deprecated: true - name: ipname required: true description: Base name for added ip/hosts inside checkpoint db diff --git a/Packs/CheckpointFirewall/Integrations/integration-CheckpointFirewall_README.md b/Packs/CheckpointFirewall/Integrations/integration-CheckpointFirewall_README.md index ef1a2cda497..ee023926bd1 100644 --- a/Packs/CheckpointFirewall/Integrations/integration-CheckpointFirewall_README.md +++ b/Packs/CheckpointFirewall/Integrations/integration-CheckpointFirewall_README.md @@ -787,11 +787,6 @@ - - - - -
The base name for added rules inside Check Point DB. Required
ipnameThe base name for added IP addresses/hosts inside Check Point DB.Required
diff --git a/Packs/CheckpointFirewall/ReleaseNotes/1_0_2.md b/Packs/CheckpointFirewall/ReleaseNotes/1_0_2.md new file mode 100644 index 00000000000..28617978ef6 --- /dev/null +++ b/Packs/CheckpointFirewall/ReleaseNotes/1_0_2.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Check Point +- Deprecated the *ipname* argument from the ***checkpoint-block-ip*** command. diff --git a/Packs/CheckpointFirewall/pack_metadata.json b/Packs/CheckpointFirewall/pack_metadata.json index 175eae917b3..eac97bc4ea9 100644 --- a/Packs/CheckpointFirewall/pack_metadata.json +++ b/Packs/CheckpointFirewall/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Check Point Firewall", "description": "Manage Check Point firewall via API", "support": "xsoar", - "currentVersion": "1.0.1", + "currentVersion": "1.0.2", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Cherwell/Integrations/Cherwell/Cherwell.py b/Packs/Cherwell/Integrations/Cherwell/Cherwell.py index fc078f69b89..2c75a9a014f 100644 --- a/Packs/Cherwell/Integrations/Cherwell/Cherwell.py +++ b/Packs/Cherwell/Integrations/Cherwell/Cherwell.py @@ -539,8 +539,8 @@ def validate_query_list(query_list, is_fetch): def validate_query_for_fetch_incidents(objects_names, query_string, real_fetch): if not objects_names: - no_objects_err_message = f'No business object name was given. \n In order to run advanced query, ' \ - f'fill the integration parameter-`Objects to fetch` with exactly one business object name.' + no_objects_err_message = 'No business object name was given. \n In order to run advanced query, ' \ + 'fill the integration parameter-`Objects to fetch` with exactly one business object name.' raise_or_return_error(no_objects_err_message, real_fetch) if len(objects_names) > 1: multiple_objects_error_message = f'Advanced query operation is supported for a single business object. ' \ @@ -584,8 +584,8 @@ def parse_string_query_to_list(query_string, is_fetch=False): try: query_list = json.loads(query_string) except (ValueError, TypeError): - err_message = f'Cannot parse query, should be of the form: `[["FieldName","Operator","Value"],' \ - f'["FieldName","Operator","Value"]]`.' + err_message = 'Cannot parse query, should be of the form: `[["FieldName","Operator","Value"],' \ + '["FieldName","Operator","Value"]]`.' raise_or_return_error(err_message, is_fetch) validate_query_list(query_list, is_fetch) return query_list @@ -596,7 +596,7 @@ def query_business_object_string(business_object_name, query_string, max_results try: int(max_results) except ValueError: - return return_error(f'`max_results` argument received is not a number') + return return_error('`max_results` argument received is not a number') business_object_id = resolve_business_object_id_by_name(business_object_name) query_filters_list = parse_string_query_to_list(query_string) return query_business_object(query_filters_list, business_object_id, max_results) @@ -846,7 +846,7 @@ def get_attachments_info_command(): } if attachments_info: entry['EntryContext'] = { - f'Cherwell.AttachmentsInfo': attachments_info} + 'Cherwell.AttachmentsInfo': attachments_info} demisto.results(entry) @@ -942,7 +942,7 @@ def cherwell_get_business_object_id_command(): args = demisto.args() business_object_name = args.get('business_object_name') result = cherwell_get_business_object_id(business_object_name) - md = tableToMarkdown(f'Business Object Info:', result, headerTransform=pascalToSpace) + md = tableToMarkdown('Business Object Info:', result, headerTransform=pascalToSpace) demisto.results({ 'Type': entryTypes['note'], 'ContentsFormat': formats['text'], diff --git a/Packs/Cherwell/Integrations/Cherwell/Cherwell.yml b/Packs/Cherwell/Integrations/Cherwell/Cherwell.yml index 4180f73bc95..f88c1ce5b6a 100644 --- a/Packs/Cherwell/Integrations/Cherwell/Cherwell.yml +++ b/Packs/Cherwell/Integrations/Cherwell/Cherwell.yml @@ -526,7 +526,7 @@ script: - contextPath: Cherwell.BusinessObjectInfo.BusinessObjectName description: Business object name. type: String - dockerimage: demisto/python3:3.7.2.214 + dockerimage: demisto/python3:3.8.3.8715 isfetch: true runonce: false script: '-' diff --git a/Packs/Cherwell/ReleaseNotes/1_0_1.md b/Packs/Cherwell/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..013d1633b94 --- /dev/null +++ b/Packs/Cherwell/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Cherwell +- Internal code improvements. diff --git a/Packs/Cherwell/pack_metadata.json b/Packs/Cherwell/pack_metadata.json index 55b96a97d33..2f492e0d1ea 100644 --- a/Packs/Cherwell/pack_metadata.json +++ b/Packs/Cherwell/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "Cherwell", - "description": "Cloud-based IT service management solution", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Case Management" - ], - "tags": [], - "useCases": [], - "keywords": [] -} + "name": "Cherwell", + "description": "Cloud-based IT service management solution", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Case Management" + ], + "tags": [], + "useCases": [], + "keywords": [] +} \ No newline at end of file diff --git a/Packs/Claroty/Integrations/Claroty/Claroty.py b/Packs/Claroty/Integrations/Claroty/Claroty.py index 52100645ef4..c0e6fced935 100644 --- a/Packs/Claroty/Integrations/Claroty/Claroty.py +++ b/Packs/Claroty/Integrations/Claroty/Claroty.py @@ -245,13 +245,13 @@ def resolve_alert_command(client: Client, args: dict) -> Tuple: "Claroty.Resolve_out": result } if result['success']: - readable_output = f"## Alert was resolved successfully" + readable_output = "## Alert was resolved successfully" else: - readable_output = f"## Alert was not resolved" + readable_output = "## Alert was not resolved" else: result = {} outputs = {} - readable_output = f"## Bad input" + readable_output = "## Bad input" return ( readable_output, diff --git a/Packs/Claroty/Integrations/Claroty/Claroty.yml b/Packs/Claroty/Integrations/Claroty/Claroty.yml index 83acf763289..a29f4b5b451 100644 --- a/Packs/Claroty/Integrations/Claroty/Claroty.yml +++ b/Packs/Claroty/Integrations/Claroty/Claroty.yml @@ -482,7 +482,7 @@ script: - contextPath: Claroty.Alert.Severity description: The alert severity. type: String - dockerimage: demisto/python3:3.8.1.5734 + dockerimage: demisto/python3:3.8.3.8715 feed: false isfetch: true longRunning: false diff --git a/Packs/Claroty/Integrations/Claroty/README.md b/Packs/Claroty/Integrations/Claroty/README.md index 051434fd572..ba2d6ae9c13 100644 --- a/Packs/Claroty/Integrations/Claroty/README.md +++ b/Packs/Claroty/Integrations/Claroty/README.md @@ -1,8 +1,6 @@ -## Overview ---- - Use the Claroty CTD integration to manage assets and alerts. This integration was integrated and tested with version 4.0.1 of Claroty + ## Claroty Playbook Playbook 1: OT Asset Discovery Maintaining an accurate enterprise asset database is extremely difficult, @@ -537,16 +535,3 @@ Admin user. |AlertType|AlertTypeID|Category|Description|Indicator|NetworkID|RelatedAssets|Resolved|ResourceID|Severity| |---|---|---|---|---|---|---|---|---|---| | PortScan | 28 | Integrity | UDP Port scan: Asset 192.168.1.10 sent probe packets to 192.168.1.25 IP address on different ports | Alert ID - 75
Description - This Event does not currently support Alert Indicators
Points - 100

| 1 | {'AssetID': 47, 'Name': '192.168.1.10', 'InsightName': None, 'Vendor': 'Hewlett Packard', 'Criticality': 'Low', 'AssetType': 'Endpoint', 'LastSeen': None, 'IP': None, 'MAC': ['00:1A:4B:6A:CE:FE'], 'VirtualZone': 'Endpoint: Other', 'ClassType': 'IT', 'SiteName': 'site-1', 'SiteID': 1, 'WasParsed': None, 'RiskLevel': 0, 'FirmwareVersion': None, 'ResourceID': '47-1'},
{'AssetID': 48, 'Name': '192.168.1.25', 'InsightName': None, 'Vendor': 'VMware', 'Criticality': 'Low', 'AssetType': 'Endpoint', 'LastSeen': None, 'IP': None, 'MAC': ['00:0C:29:86:C8:36'], 'VirtualZone': 'Endpoint: Other', 'ClassType': 'IT', 'SiteName': 'site-1', 'SiteID': 1, 'WasParsed': None, 'RiskLevel': 0, 'FirmwareVersion': None, 'ResourceID': '48-1'} | false | 75-1 | Critical | - - -## Additional Information ---- - -## Known Limitations ---- - -## Troubleshooting ---- - - -## Possible Errors (DO NOT PUBLISH ON ZENDESK): diff --git a/Packs/Claroty/ReleaseNotes/1_0_2.md b/Packs/Claroty/ReleaseNotes/1_0_2.md new file mode 100644 index 00000000000..6ac9701ce86 --- /dev/null +++ b/Packs/Claroty/ReleaseNotes/1_0_2.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Claroty +- Internal code improvements. \ No newline at end of file diff --git a/Packs/Claroty/pack_metadata.json b/Packs/Claroty/pack_metadata.json index 105ebdc889f..871b784b633 100644 --- a/Packs/Claroty/pack_metadata.json +++ b/Packs/Claroty/pack_metadata.json @@ -2,16 +2,14 @@ "name": "Claroty", "description": "Use the Claroty CTD to manage assets and alerts.", "support": "partner", - "currentVersion": "1.0.1", + "currentVersion": "1.0.2", "author": "Claroty", "url": "", - "email": "", + "email": "gil.k@claroty.com", "created": "2020-03-11T12:58:02Z", "categories": [], "tags": [], - "useCases": [ - "Manage assets and alerts" - ], + "useCases": [], "keywords": [ "Claroty" ] diff --git a/Packs/CloudShark/pack_metadata.json b/Packs/CloudShark/pack_metadata.json index f42ba061086..fe4f9d4701d 100644 --- a/Packs/CloudShark/pack_metadata.json +++ b/Packs/CloudShark/pack_metadata.json @@ -1,11 +1,11 @@ { "name": "CloudShark", "description": "Use the CloudShark integration to upload, share, and collaborate on network packet capture files using your on-premises CS Enterprise system.", - "support": "xsoar", + "support": "partner", "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", + "author": "CloudShark", + "url": "", + "email": "support@cloudshark.io", "created": "2020-04-14T00:00:00Z", "categories": [ "Data Enrichment & Threat Intelligence" diff --git a/Packs/Code42/Integrations/Code42/Code42.py b/Packs/Code42/Integrations/Code42/Code42.py index 8d83633fe33..9a63a4336cf 100644 --- a/Packs/Code42/Integrations/Code42/Code42.py +++ b/Packs/Code42/Integrations/Code42/Code42.py @@ -411,7 +411,8 @@ def _create_file_category_filters(self): """Determine if file categorization is significant""" observed_file_categories = self._observation_data["fileCategories"] categories = [c["category"].upper() for c in observed_file_categories if c["isSignificant"]] - return FileCategory.is_in(categories) + if categories: + return FileCategory.is_in(categories) def map_observation_to_security_query(observation, actor): @@ -695,7 +696,7 @@ def _fetch_remaining_incidents_from_last_run(self): if remaining_incidents: return ( self._last_run, - remaining_incidents[: self._fetch_limit], + remaining_incidents[:self._fetch_limit], remaining_incidents[self._fetch_limit:], ) diff --git a/Packs/Code42/Integrations/Code42/Code42.yml b/Packs/Code42/Integrations/Code42/Code42.yml index e914c2b7fea..416bfb241d7 100644 --- a/Packs/Code42/Integrations/Code42/Code42.yml +++ b/Packs/Code42/Integrations/Code42/Code42.yml @@ -11,7 +11,7 @@ configuration: defaultvalue: console.us.code42.com type: 0 required: true -- display: "" +- display: "Username" name: credentials defaultvalue: "" type: 9 diff --git a/Packs/Code42/Integrations/Code42/Code42_test.py b/Packs/Code42/Integrations/Code42/Code42_test.py index e2d7dba7ce5..e7671554d44 100644 --- a/Packs/Code42/Integrations/Code42/Code42_test.py +++ b/Packs/Code42/Integrations/Code42/Code42_test.py @@ -1239,6 +1239,25 @@ def test_fetch_incidents_handles_multi_severity(code42_fetch_incidents_mock): assert "LOW" in str(code42_fetch_incidents_mock.alerts.search.call_args[0][0]) +def test_fetch_when_no_significant_file_categories_ignores_filter(code42_fetch_incidents_mock, mocker): + response_text = MOCK_ALERT_DETAILS_RESPONSE.replace('"isSignificant": true', '"isSignificant": false') + alert_details_response = create_mock_code42_sdk_response(mocker, response_text) + code42_fetch_incidents_mock.alerts.get_details.return_value = alert_details_response + client = create_client(code42_fetch_incidents_mock) + _, _, _ = fetch_incidents( + client=client, + last_run={"last_fetch": None}, + first_fetch_time=MOCK_FETCH_TIME, + event_severity_filter=None, + fetch_limit=10, + include_files=True, + integration_context=None, + ) + actual_query = str(code42_fetch_incidents_mock.securitydata.search_file_events.call_args[0][0]) + assert "fileCategory" not in actual_query + assert "IMAGE" not in actual_query + + def test_fetch_incidents_first_run(code42_fetch_incidents_mock): client = create_client(code42_fetch_incidents_mock) next_run, incidents, remaining_incidents = fetch_incidents( diff --git a/Packs/Code42/Integrations/Code42/integration-Code42.yml b/Packs/Code42/Integrations/Code42/integration-Code42.yml index 1bf98b61977..d67becca52a 100644 --- a/Packs/Code42/Integrations/Code42/integration-Code42.yml +++ b/Packs/Code42/Integrations/Code42/integration-Code42.yml @@ -483,7 +483,8 @@ script: """Determine if file categorization is significant""" observed_file_categories = self._observation_data["fileCategories"] categories = [c["category"].upper() for c in observed_file_categories if c["isSignificant"]] - return FileCategory.is_in(categories) + if categories: + return FileCategory.is_in(categories) def map_observation_to_security_query(observation, actor): @@ -782,7 +783,7 @@ script: if remaining_incidents: return ( self._last_run, - remaining_incidents[: self._fetch_limit], + remaining_incidents[:self._fetch_limit], remaining_incidents[self._fetch_limit:], ) diff --git a/Packs/Code42/ReleaseNotes/1_0_1.md b/Packs/Code42/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..581c01e1f0d --- /dev/null +++ b/Packs/Code42/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Code42 +- Internal code improvements. diff --git a/Packs/Code42/pack_metadata.json b/Packs/Code42/pack_metadata.json index b8fd1670b13..56c22af3313 100644 --- a/Packs/Code42/pack_metadata.json +++ b/Packs/Code42/pack_metadata.json @@ -1,18 +1,18 @@ { - "name": "Code42", - "description": "Use the Code42 integration to identify potential data exfiltration from insider threats while speeding investigation and response by providing fast access to file events and metadata across physical and cloud environments.", - "support": "partner", - "currentVersion": "1.0.0", - "author": "Code42", - "url": "https://support.code42.com/Administrator/Cloud/Monitoring_and_managing", - "email": "", - "created": "2020-03-11T13:16:53Z", - "categories": [ - "Endpoint" - ], - "tags": [ - "Recommended by Cortex XSOAR" - ], - "useCases": [], - "keywords": [] + "name": "Code42", + "description": "Use the Code42 integration to identify potential data exfiltration from insider threats while speeding investigation and response by providing fast access to file events and metadata across physical and cloud environments.", + "support": "partner", + "currentVersion": "1.0.1", + "author": "Code42", + "url": "https://support.code42.com/Administrator/Cloud/Monitoring_and_managing", + "email": "", + "created": "2020-03-11T13:16:53Z", + "categories": [ + "Endpoint" + ], + "tags": [ + "Recommended by Cortex XSOAR" + ], + "useCases": [], + "keywords": [] } \ No newline at end of file diff --git a/Packs/Cofense-Intelligence/.secrets-ignore b/Packs/Cofense-Intelligence/.secrets-ignore index e69de29bb2d..ec1e2682e57 100644 --- a/Packs/Cofense-Intelligence/.secrets-ignore +++ b/Packs/Cofense-Intelligence/.secrets-ignore @@ -0,0 +1,2 @@ +earner@zoho.com +51.254.240.48 diff --git a/Packs/Cofense-Intelligence/TestPlaybooks/playbook-Cofense-Test.yml b/Packs/Cofense-Intelligence/TestPlaybooks/playbook-Cofense-Test.yml index 9c7f38bb3e1..aa11d041889 100644 --- a/Packs/Cofense-Intelligence/TestPlaybooks/playbook-Cofense-Test.yml +++ b/Packs/Cofense-Intelligence/TestPlaybooks/playbook-Cofense-Test.yml @@ -40,7 +40,7 @@ tasks: - '2' scriptarguments: ip: - simple: 212.126.107.130 + simple: 51.254.240.48 separatecontext: false view: "{\n \"position\": {\n \"x\": 50,\n \"y\": 370\n }\n}" note: false @@ -93,7 +93,7 @@ tasks: - '7' scriptarguments: url: - simple: heckwassleftran2.ru + simple: zsn5qtrgfpu4tmpg.onion.gq separatecontext: false view: "{\n \"position\": {\n \"x\": 50,\n \"y\": 895\n }\n}" note: false @@ -167,7 +167,7 @@ tasks: - '10' scriptarguments: file: - simple: 77d736dc280968d0af8c3f46e673f821 + simple: 6be4f92e2ae9a2a9d411f7be9ecd06495f847009 separatecontext: false view: "{\n \"position\": {\n \"x\": 50,\n \"y\": 1245\n }\n}" note: false @@ -216,7 +216,7 @@ tasks: - '13' scriptarguments: email: - simple: forme@kanhseai.com + simple: earner@zoho.com separatecontext: false view: "{\n \"position\": {\n \"x\": 50,\n \"y\": 1595\n }\n}" note: false diff --git a/Packs/CofenseTriage/Integrations/CofenseTriage/CofenseTriage.py b/Packs/CofenseTriage/Integrations/CofenseTriage/CofenseTriage.py index 55713f18604..85475056470 100644 --- a/Packs/CofenseTriage/Integrations/CofenseTriage/CofenseTriage.py +++ b/Packs/CofenseTriage/Integrations/CofenseTriage/CofenseTriage.py @@ -138,7 +138,7 @@ def test_function() -> None: except Exception as ex: demisto.debug(str(ex)) - return_error(f'API call to Cofense Triage failed, please check URL, or integration parameters.') + return_error('API call to Cofense Triage failed, please check URL, or integration parameters.') def fetch_reports() -> None: @@ -260,7 +260,7 @@ def search_reports(subject=None, url=None, file_hash=None, reported_at=None, cre def get_all_reporters(time_frame) -> list: - res = http_request(f'/reporters', params={'start_date': time_frame}) + res = http_request('/reporters', params={'start_date': time_frame}) if not isinstance(res, list): res = [res] reporters = [reporter.get('email') for reporter in res] diff --git a/Packs/CofenseTriage/ReleaseNotes/1_1_1.md b/Packs/CofenseTriage/ReleaseNotes/1_1_1.md new file mode 100644 index 00000000000..7a126c629e7 --- /dev/null +++ b/Packs/CofenseTriage/ReleaseNotes/1_1_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Cofense Triage +- Internal code improvements. diff --git a/Packs/CofenseTriage/pack_metadata.json b/Packs/CofenseTriage/pack_metadata.json index 3e3c30a63fe..ae3a937c08a 100644 --- a/Packs/CofenseTriage/pack_metadata.json +++ b/Packs/CofenseTriage/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Cofense Triage", "description": "Use the Cofense Triage integration to manage reports and attachments.", "support": "partner", - "currentVersion": "1.1.0", + "currentVersion": "1.1.1", "author": "Cofense", "url": "https://www.paloaltonetworks.com/cortex", "email": "", @@ -13,4 +13,4 @@ "tags": [], "useCases": [], "keywords": [] -} +} \ No newline at end of file diff --git a/Packs/CommonDashboards/pack_metadata.json b/Packs/CommonDashboards/pack_metadata.json index d7259a4b883..0caf1d25c2d 100644 --- a/Packs/CommonDashboards/pack_metadata.json +++ b/Packs/CommonDashboards/pack_metadata.json @@ -12,5 +12,6 @@ ], "tags": [], "useCases": [], - "keywords": [] + "keywords": [], + "dependencies": {} } \ No newline at end of file diff --git a/Packs/CommonPlaybooks/Playbooks/Entity_Enrichment_-_Generic_v3.yml b/Packs/CommonPlaybooks/Playbooks/Entity_Enrichment_-_Generic_v3.yml new file mode 100644 index 00000000000..05e223ba1e2 --- /dev/null +++ b/Packs/CommonPlaybooks/Playbooks/Entity_Enrichment_-_Generic_v3.yml @@ -0,0 +1,674 @@ +id: Entity Enrichment - Generic v3 +version: -1 +name: Entity Enrichment - Generic v3 +description: Enrich entities using one or more integrations. +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: cdd6228a-7feb-4386-8ab1-7dfdf77d99c2 + type: start + task: + id: cdd6228a-7feb-4386-8ab1-7dfdf77d99c2 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "16" + - "18" + - "19" + - "22" + - "23" + - "26" + separatecontext: false + view: |- + { + "position": { + "x": 280, + "y": 70 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "15": + id: "15" + taskid: 38007764-1687-47b1-8490-0f3cded9dc95 + type: title + task: + id: 38007764-1687-47b1-8490-0f3cded9dc95 + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 280, + "y": 871 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "16": + id: "16" + taskid: afe0c443-753d-4633-89e1-0d77dc533447 + type: playbook + task: + id: afe0c443-753d-4633-89e1-0d77dc533447 + version: -1 + name: IP Enrichment - Generic v2 + description: |- + Enrich IP using one or more integrations. + + IP enrichment includes: + * Resolve IP to Hostname (DNS) + * Threat information + * Separate internal and external addresses + * IP reputation + * For internal addresses, get host information + playbookName: IP Enrichment - Generic v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "15" + scriptarguments: + IP: + complex: + root: inputs.IP + transformers: + - operator: uniq + InternalRange: + complex: + root: inputs.InternalRange + transformers: + - operator: uniq + ResolveIP: + complex: + root: inputs.ResolveIP + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 490, + "y": 225 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "18": + id: "18" + taskid: 8189698a-475c-433b-8fbf-20275b3b2084 + type: playbook + task: + id: 8189698a-475c-433b-8fbf-20275b3b2084 + version: -1 + name: File Enrichment - Generic v2 + playbookName: File Enrichment - Generic v2 + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "15" + scriptarguments: + MD5: + complex: + root: inputs.MD5 + transformers: + - operator: uniq + SHA1: + complex: + root: inputs.SHA1 + transformers: + - operator: uniq + SHA256: + complex: + root: inputs.SHA256 + transformers: + - operator: uniq + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 70, + "y": 225 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "19": + id: "19" + taskid: b00cb02f-d44b-4e40-8c27-281d17a94723 + type: playbook + task: + id: b00cb02f-d44b-4e40-8c27-281d17a94723 + version: -1 + name: URL Enrichment - Generic v2 + playbookName: URL Enrichment - Generic v2 + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "15" + - "25" + scriptarguments: + Rasterize: + simple: "True" + URL: + complex: + root: inputs.URL + transformers: + - operator: uniq + VerifyURL: + simple: "False" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 490, + "y": 386 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "22": + id: "22" + taskid: 6245f7fc-b1cc-4120-81da-d3320f809b03 + type: playbook + task: + id: 6245f7fc-b1cc-4120-81da-d3320f809b03 + version: -1 + name: Domain Enrichment - Generic v2 + description: |- + Enrich domains using one or more integrations. + Domain enrichment includes: + * Threat information + playbookName: Domain Enrichment - Generic v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "15" + scriptarguments: + Domain: + complex: + root: inputs.Domain + transformers: + - operator: uniq + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 490, + "y": 700 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "23": + id: "23" + taskid: 0ba8dffe-9aac-40a7-8303-ff40de2d91f9 + type: playbook + task: + id: 0ba8dffe-9aac-40a7-8303-ff40de2d91f9 + version: -1 + name: Email Address Enrichment - Generic v2.1 + playbookName: Email Address Enrichment - Generic v2.1 + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "15" + - "24" + scriptarguments: + Domain: + complex: + root: inputs.Domain + transformers: + - operator: uniq + Email: + complex: + root: inputs.Email + transformers: + - operator: uniq + InternalDomains: + complex: + root: inputs.InternalDomains + transformers: + - operator: uniq + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 70, + "y": 386 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "24": + id: "24" + taskid: 7f313517-52cb-4653-8c77-08819d4910f3 + type: playbook + task: + id: 7f313517-52cb-4653-8c77-08819d4910f3 + version: -1 + name: Account Enrichment - Generic v2.1 + playbookName: Account Enrichment - Generic v2.1 + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "26" + - "15" + scriptarguments: + Username: + complex: + root: inputs.Username + transformers: + - operator: uniq + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 70, + "y": 545 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "25": + id: "25" + taskid: 473ab066-87e5-408d-8317-70e38ead40ca + type: playbook + task: + id: 473ab066-87e5-408d-8317-70e38ead40ca + version: -1 + name: Endpoint Enrichment - Generic v2.1 + playbookName: Endpoint Enrichment - Generic v2.1 + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "15" + scriptarguments: + Hostname: + complex: + root: inputs.Hostname + transformers: + - operator: uniq + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 490, + "y": 545 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "26": + id: "26" + taskid: a9201fe9-18e4-47dc-8b45-c2c5111eea6a + type: playbook + task: + id: a9201fe9-18e4-47dc-8b45-c2c5111eea6a + version: -1 + name: CVE Enrichment - Generic v2 + description: |- + This playbook performs CVE Enrichment using the following integrations: + - VulnDB + - CVE Search + - IBM X-Force Exchange + playbookName: CVE Enrichment - Generic v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "15" + scriptarguments: + cve_id: + complex: + root: inputs.CVE + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 70, + "y": 700 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 866, + "width": 800, + "x": 70, + "y": 70 + } + } + } +inputs: +- key: IP + value: + complex: + root: IP + accessor: Address + transformers: + - operator: uniq + required: false + description: The IP addresses to enrich + playbookInputQuery: +- key: InternalRange + value: {} + required: false + description: 'A list of internal IP ranges to check IP addresses against. The list + should be provided in CIDR notation, separated by commas. An example of a list + of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes). + If a list is not provided, will use default list provided in the IsIPInRanges + script (the known IPv4 private address ranges).' + playbookInputQuery: +- key: MD5 + value: + complex: + root: File + accessor: MD5 + transformers: + - operator: uniq + required: false + description: File MD5 to enrich + playbookInputQuery: +- key: SHA256 + value: + complex: + root: File + accessor: SHA256 + transformers: + - operator: uniq + required: false + description: File SHA256 to enrich + playbookInputQuery: +- key: SHA1 + value: + complex: + root: File + accessor: SHA1 + transformers: + - operator: uniq + required: false + description: File SHA1 to enrich + playbookInputQuery: +- key: URL + value: + complex: + root: URL + accessor: Data + transformers: + - operator: uniq + required: false + description: URL to enrich + playbookInputQuery: +- key: Email + value: + complex: + root: Account + accessor: Email.Address + transformers: + - operator: uniq + required: false + description: The email addresses to enrich + playbookInputQuery: +- key: Hostname + value: + complex: + root: Endpoint + accessor: Hostname + transformers: + - operator: uniq + required: false + description: The hostname to enrich + playbookInputQuery: +- key: Username + value: + complex: + root: Account + accessor: Username + transformers: + - operator: uniq + required: false + description: The username to enrich + playbookInputQuery: +- key: Domain + value: + complex: + root: Domain + accessor: Name + transformers: + - operator: uniq + required: false + description: The domain name to enrich + playbookInputQuery: +- key: ResolveIP + value: + simple: "False" + required: false + description: Determines whether the IP Enrichment - Generic playbook should convert + IP addresses to hostnames using a DNS query. + True - Resolves the IP addresses to hostnames. + False - Does not resolve the IP addresses to hostnames. + playbookInputQuery: +- key: InternalDomains + value: {} + required: false + description: A CSV list of internal domains. The list will be used to determine + whether an email address is internal or external. + playbookInputQuery: +- key: CVE + value: + complex: + root: CVE + accessor: ID + required: false + description: CVE ID to enrich. + playbookInputQuery: +outputs: +- contextPath: IP + description: The IP object. + type: unknown +- contextPath: Endpoint + description: The endpoint object. + type: unknown +- contextPath: Endpoint.Hostname + description: The hostname that was enriched. + type: string +- contextPath: Endpoint.OS + description: The endpoint's operating system. + type: string +- contextPath: Endpoint.IP + description: A list of endpoint IP addresses. +- contextPath: Endpoint.MAC + description: A list of endpoint MAC addresses. +- contextPath: Endpoint.Domain + description: The endpoint domain name. + type: string +- contextPath: DBotScore + description: The DBotScore object. + type: unknown +- contextPath: DBotScore.Indicator + description: The indicator that was tested. + type: string +- contextPath: DBotScore.Type + description: The indicator type. + type: string +- contextPath: DBotScore.Vendor + description: Vendor used to calculate the score. + type: string +- contextPath: DBotScore.Score + description: The actual score. + type: number +- contextPath: File + description: The file object. + type: unknown +- contextPath: File.SHA1 + description: SHA1 hash of the file. + type: string +- contextPath: File.SHA256 + description: SHA256 hash of the file. + type: string +- contextPath: File.MD5 + description: MD5 hash of the file. + type: string +- contextPath: File.Malicious + description: Whether the file is malicious. + type: unknown +- contextPath: File.Malicious.Vendor + description: For malicious files, the vendor that made the decision. + type: string +- contextPath: URL + description: The URL object. + type: uknown +- contextPath: URL.Data + description: The enriched URL. + type: string +- contextPath: URL.Malicious + description: Whether the detected URL was malicious. + type: unknown +- contextPath: URL.Vendor + description: Vendor that labeled the URL as malicious. + type: string +- contextPath: URL.Description + description: Additional information for the URL. + type: string +- contextPath: Domain + description: The domain object. + type: unknown +- contextPath: Account + description: The account object. + type: unknown +- contextPath: Account.Email + description: The email of the account. + type: unknown +- contextPath: Account.Email.NetworkType + description: The email account NetworkType (Internal/External). + type: string +- contextPath: Account.Email.Distance + description: 'The object that contains the distance between the email domain and + the compared domain. ' + type: unknown +- contextPath: Account.Email.Distance.Domain + description: The compared domain. + type: string +- contextPath: Account.Email.Distance.Value + description: 'The distance between the email domain and the compared domain. ' + type: number +- contextPath: ActiveDirectory.Users + description: An object containing information about the user from Active Directory. + type: unknown +- contextPath: ActiveDirectory.Users.sAMAccountName + description: The user's samAccountName. +- contextPath: ActiveDirectory.Users.userAccountControl + description: The user's account control flag. +- contextPath: ActiveDirectory.Users.mail + description: The user's email address. +- contextPath: ActiveDirectory.Users.memberOf + description: Groups the user is a member of. +- contextPath: CylanceProtectDevice + description: The device information about the hostname that was enriched using Cylance + Protect v2. + type: unknown +fromversion: 5.0.0 +tests: +- No tests (auto formatted) diff --git a/Packs/CommonPlaybooks/Playbooks/Entity_Enrichment_-_Generic_v3_README.md b/Packs/CommonPlaybooks/Playbooks/Entity_Enrichment_-_Generic_v3_README.md new file mode 100644 index 00000000000..c3446a9b6c6 --- /dev/null +++ b/Packs/CommonPlaybooks/Playbooks/Entity_Enrichment_-_Generic_v3_README.md @@ -0,0 +1,90 @@ +Enrich entities using one or more integrations. + +## Dependencies +This playbook uses the following sub-playbooks, integrations, and scripts. + +### Sub-playbooks +* Endpoint Enrichment - Generic v2.1 +* Account Enrichment - Generic v2.1 +* File Enrichment - Generic v2 +* CVE Enrichment - Generic v2 +* Email Address Enrichment - Generic v2.1 +* IP Enrichment - Generic v2 +* Domain Enrichment - Generic v2 +* URL Enrichment - Generic v2 + +### Integrations +This playbook does not use any integrations. + +### Scripts +This playbook does not use any scripts. + +### Commands +This playbook does not use any commands. + +## Playbook Inputs +--- + +| **Name** | **Description** | **Default Value** | **Required** | +| --- | --- | --- | --- | +| IP | The IP addresses to enrich | IP.Address | Optional | +| InternalRange | A list of internal IP ranges to check IP addresses against. The list should be provided in CIDR notation, separated by commas. An example of a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" \(without quotes\). If a list is not provided, will use default list provided in the IsIPInRanges script \(the known IPv4 private address ranges\). | | Optional | +| MD5 | File MD5 to enrich | File.MD5 | Optional | +| SHA256 | File SHA256 to enrich | File.SHA256 | Optional | +| SHA1 | File SHA1 to enrich | File.SHA1 | Optional | +| URL | URL to enrich | URL.Data | Optional | +| Email | The email addresses to enrich | Account.Email.Address | Optional | +| Hostname | The hostname to enrich | Endpoint.Hostname | Optional | +| Username | The username to enrich | Account.Username | Optional | +| Domain | The domain name to enrich | Domain.Name | Optional | +| ResolveIP | Determines whether the IP Enrichment \- Generic playbook should convert IP addresses to hostnames using a DNS query. True \- Resolves the IP addresses to hostnames. False \- Does not resolve the IP addresses to hostnames. | False | Optional | +| InternalDomains | A CSV list of internal domains. The list will be used to determine whether an email address is internal or external. | | Optional | +| CVE | CVE ID to enrich. | CVE.ID | Optional | + +## Playbook Outputs +--- + +| **Path** | **Description** | **Type** | +| --- | --- | --- | +| IP | The IP object. | unknown | +| Endpoint | The endpoint object. | unknown | +| Endpoint.Hostname | The hostname that was enriched. | string | +| Endpoint.OS | The endpoint's operating system. | string | +| Endpoint.IP | A list of endpoint IP addresses. | unknown | +| Endpoint.MAC | A list of endpoint MAC addresses. | unknown | +| Endpoint.Domain | The endpoint domain name. | string | +| DBotScore | The DBotScore object. | unknown | +| DBotScore.Indicator | The indicator that was tested. | string | +| DBotScore.Type | The indicator type. | string | +| DBotScore.Vendor | Vendor used to calculate the score. | string | +| DBotScore.Score | The actual score. | number | +| File | The file object. | unknown | +| File.SHA1 | SHA1 hash of the file. | string | +| File.SHA256 | SHA256 hash of the file. | string | +| File.MD5 | MD5 hash of the file. | string | +| File.Malicious | Whether the file is malicious. | unknown | +| File.Malicious.Vendor | For malicious files, the vendor that made the decision. | string | +| URL | The URL object. | uknown | +| URL.Data | The enriched URL. | string | +| URL.Malicious | Whether the detected URL was malicious. | unknown | +| URL.Vendor | Vendor that labeled the URL as malicious. | string | +| URL.Description | Additional information for the URL. | string | +| Domain | The domain object. | unknown | +| Account | The account object. | unknown | +| Account.Email | The email of the account. | unknown | +| Account.Email.NetworkType | The email account NetworkType \(Internal/External\). | string | +| Account.Email.Distance | The object that contains the distance between the email domain and the compared domain. | unknown | +| Account.Email.Distance.Domain | The compared domain. | string | +| Account.Email.Distance.Value | The distance between the email domain and the compared domain. | number | +| ActiveDirectory.Users | An object containing information about the user from Active Directory. | unknown | +| ActiveDirectory.Users.sAMAccountName | The user's samAccountName. | unknown | +| ActiveDirectory.Users.userAccountControl | The user's account control flag. | unknown | +| ActiveDirectory.Users.mail | The user's email address. | unknown | +| ActiveDirectory.Users.memberOf | Groups the user is a member of. | unknown | +| CylanceProtectDevice | The device information about the hostname that was enriched using Cylance Protect v2. | unknown | + +## Playbook Image +--- +![Entity Enrichment - Generic v3](https://github.com/demisto/content/raw/3fadebe9e16eb7c9fc28ce3bb600319ec875e3b5/Packs/CommonPlaybooks/doc_files/Entity_Enrichment_-_Generic_v3.png) + + diff --git a/Packs/CommonPlaybooks/Playbooks/Get_Original_Email_-_Generic.yml b/Packs/CommonPlaybooks/Playbooks/Get_Original_Email_-_Generic.yml index 9c8c39676ec..d0351568743 100644 --- a/Packs/CommonPlaybooks/Playbooks/Get_Original_Email_-_Generic.yml +++ b/Packs/CommonPlaybooks/Playbooks/Get_Original_Email_-_Generic.yml @@ -1,175 +1,165 @@ -id: get_original_email_-_generic -version: -1 -name: Get Original Email - Generic -fromversion: 4.0.0 -description: |- - Use this playbook to retrieve the original email in the thread, including headers and attahcments, when the reporting user forwarded the original email not as an attachment. - - You must have the necessary permissions in your email service to execute global search. - - - EWS: eDiscovery - - Gmail: Google Apps Domain-Wide Delegation of Authority -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: d7920fee-8ada-4d48-8197-2e08d19a54dc - type: start - task: - id: d7920fee-8ada-4d48-8197-2e08d19a54dc - version: -1 - name: "" - description: "" - iscommand: false - brand: "" - nexttasks: - '#none#': - - "6" - - "7" - separatecontext: false - view: |- - { - "position": { - "x": 265, - "y": 50 - } - } - note: false - "3": - id: "3" - taskid: b52aade3-aa90-4343-8417-d4aa26803d62 - type: title - task: - id: b52aade3-aa90-4343-8417-d4aa26803d62 - version: -1 - name: Done - description: "" - type: title - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 265, - "y": 370 - } - } - note: false - "6": - id: "6" - taskid: eaebbf2e-aa04-4581-8157-2f55adc08880 - type: playbook - task: - id: eaebbf2e-aa04-4581-8157-2f55adc08880 - version: -1 - name: Get Original Message - Gmail - description: "" - playbookName: Get Original Email - Gmail - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - separatecontext: true - view: |- - { - "position": { - "x": 480, - "y": 195 - } - } - note: false - "7": - id: "7" - taskid: 96353c64-dc04-4475-89a8-f0f90922090f - type: playbook - task: - id: 96353c64-dc04-4475-89a8-f0f90922090f - version: -1 - name: Get Original Email - EWS - description: |- - Use this playbook to retrieve the original email in the thread, including headers and attahcments, when the reporting user forwarded the original email not as an attachment. - - You must have the necessary permissions in the EWS integration to execute global search: eDiscovery - playbookName: Get Original Email - EWS - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - InReplyTo: - complex: - root: incident - accessor: labels.Email/Header/In-Reply-To - Mailbox: - complex: - root: incident - accessor: labels.Email/from - ThreadTopic: - complex: - root: incident - accessor: labels.Email/Header/Thread-Topic - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 40, - "y": 195 - } - } - note: false -view: |- - { - "linkLabelsPosition": {}, - "paper": { - "dimensions": { - "height": 385, - "width": 820, - "x": 40, - "y": 50 - } - } - } -inputs: [] -outputs: -- contextPath: Email - description: The email object - type: unknown -- contextPath: File - description: Original attachments - type: unknown -- contextPath: Email.To - description: The recipient of the email - type: string -- contextPath: Email.From - description: The sender of the email - type: string -- contextPath: Email.CC - description: The CC address of the email - type: string -- contextPath: Email.BCC - description: The BCC address of the email - type: string -- contextPath: Email.HTML - description: The email HTML - type: string -- contextPath: Email.Body - description: The email text body - type: string -- contextPath: Email.Headers - description: The email headers - type: unknown -- contextPath: Email.Subject - description: The email subject - type: string -tests: - - Phishing v2 Test - Attachment - - Phishing v2 Test - Inline +id: get_original_email_-_generic +version: -1 +name: Get Original Email - Generic +description: |- + Use this playbook to retrieve the original email in the thread, including headers and attahcments, when the reporting user forwarded the original email not as an attachment. + + You must have the necessary permissions in your email service to execute global search. + + - EWS: eDiscovery + - Gmail: Google Apps Domain-Wide Delegation of Authority +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: d7920fee-8ada-4d48-8197-2e08d19a54dc + type: start + task: + id: d7920fee-8ada-4d48-8197-2e08d19a54dc + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "6" + - "8" + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + "3": + id: "3" + taskid: b52aade3-aa90-4343-8417-d4aa26803d62 + type: title + task: + id: b52aade3-aa90-4343-8417-d4aa26803d62 + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + "6": + id: "6" + taskid: eaebbf2e-aa04-4581-8157-2f55adc08880 + type: playbook + task: + id: eaebbf2e-aa04-4581-8157-2f55adc08880 + version: -1 + name: Get Original Email - Gmail + playbookName: Get Original Email - Gmail + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "3" + separatecontext: true + view: |- + { + "position": { + "x": 480, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + "8": + id: "8" + taskid: 73a4ccfb-a535-4af3-8587-121339850a37 + type: playbook + task: + id: 73a4ccfb-a535-4af3-8587-121339850a37 + version: -1 + name: Get Original Email - EWS + playbookName: Get Original Email - EWS + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "3" + separatecontext: true + view: |- + { + "position": { + "x": 50, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 385, + "width": 810, + "x": 50, + "y": 50 + } + } + } +inputs: [] +outputs: +- contextPath: Email + description: The email object + type: unknown +- contextPath: File + description: Original attachments + type: unknown +- contextPath: Email.To + description: The recipient of the email + type: string +- contextPath: Email.From + description: The sender of the email + type: string +- contextPath: Email.CC + description: The CC address of the email + type: string +- contextPath: Email.BCC + description: The BCC address of the email + type: string +- contextPath: Email.HTML + description: The email HTML + type: string +- contextPath: Email.Body + description: The email text body + type: string +- contextPath: Email.Headers + description: The email headers + type: unknown +- contextPath: Email.Subject + description: The email subject + type: string +- contextPath: Email.HeadersMap + description: The headers of the email. +fromversion: 4.0.0 +tests: +- Phishing v2 Test - Attachment +- Phishing v2 Test - Inline diff --git a/Packs/CommonPlaybooks/Playbooks/Get_Original_Email_-_Generic_CHANGELOG.md b/Packs/CommonPlaybooks/Playbooks/Get_Original_Email_-_Generic_CHANGELOG.md index 9645ae6c726..8d03c5e10b5 100644 --- a/Packs/CommonPlaybooks/Playbooks/Get_Original_Email_-_Generic_CHANGELOG.md +++ b/Packs/CommonPlaybooks/Playbooks/Get_Original_Email_-_Generic_CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +Added an output of email headers. ## [20.5.2] - 2020-05-26 - \ No newline at end of file diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Block_File_-_Generic_v2.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Block_File_-_Generic_v2.yml index 26dfb54df03..b3aa152f8b2 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Block_File_-_Generic_v2.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Block_File_-_Generic_v2.yml @@ -1,382 +1,393 @@ -id: Block File - Generic v2 -version: -1 -fromversion: 4.5.0 -name: Block File - Generic v2 -description: "This playbook is used to block files from running on endpoints. \nThis - playbook supports the following integrations:\n- Palo Alto Networks Traps\n- Cybereason\n- - Carbon Black Enterprise Response\n- Cylance Protect v2\n" -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: 49ac9316-5f77-48f9-8d21-9f05c335c2e4 - type: start - task: - id: 49ac9316-5f77-48f9-8d21-9f05c335c2e4 - version: -1 - name: "" - description: "" - iscommand: false - brand: "" - nexttasks: - '#none#': - - "8" - - "9" - - "10" - - "11" - separatecontext: false - view: |- - { - "position": { - "x": 695, - "y": 50 - } - } - note: false - timertriggers: [] - ignoreworker: false - "2": - id: "2" - taskid: e3fbf02a-78a1-4329-837e-a6116bcf92af - type: playbook - task: - id: e3fbf02a-78a1-4329-837e-a6116bcf92af - version: -1 - name: Block File - Carbon Black Response - playbookName: Block File - Carbon Black Response - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - MD5: - complex: - root: inputs.MD5 - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 50, - "y": 340 - } - } - note: false - timertriggers: [] - ignoreworker: false - "3": - id: "3" - taskid: fceba42b-c11f-4521-8b0a-f86d410adc0e - type: title - task: - id: fceba42b-c11f-4521-8b0a-f86d410adc0e - version: -1 - name: Done - description: "" - type: title - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 910, - "y": 515 - } - } - note: false - timertriggers: [] - ignoreworker: false - "4": - id: "4" - taskid: 0b7eb74d-0e93-4850-8e16-2c0d4828e5b7 - type: playbook - task: - id: 0b7eb74d-0e93-4850-8e16-2c0d4828e5b7 - version: -1 - name: Block File - Cybereason - description: This playbook accepts an MD5 hash and blocks the file using the Cybereason - integration. - playbookName: Block File - Cybereason - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - MD5: - complex: - root: inputs.MD5 - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 480, - "y": 340 - } - } - note: false - timertriggers: [] - ignoreworker: false - "5": - id: "5" - taskid: e8748c4f-4281-472a-887f-177492c1f435 - type: playbook - task: - id: e8748c4f-4281-472a-887f-177492c1f435 - version: -1 - name: Block File - Cylance Protect v2 - description: This playbook accepts a SHA256 hash and adds the hash to the Global - Quarantine list using the Cylance Protect v2 integration. - playbookName: Block File - Cylance Protect v2 - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - SHA256: - complex: - root: inputs.SHA256 - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 910, - "y": 340 - } - } - note: false - timertriggers: [] - ignoreworker: false - "6": - id: "6" - taskid: 7b67cfd5-71a9-4ddb-81f0-efbf0fb72408 - type: playbook - task: - id: 7b67cfd5-71a9-4ddb-81f0-efbf0fb72408 - version: -1 - name: Traps Blacklist File - playbookName: Traps Blacklist File - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - SHA256: - complex: - root: inputs.SHA256 - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 1340, - "y": 340 - } - } - note: false - timertriggers: [] - ignoreworker: false - "7": - id: "7" - taskid: 599c8e61-1a9f-4860-8c2d-b9e31949f82e - type: playbook - task: - id: 599c8e61-1a9f-4860-8c2d-b9e31949f82e - version: -1 - name: Traps Quarantine Event - playbookName: Traps Quarantine Event - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - EventId: - complex: - root: inputs.EventId - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 1770, - "y": 340 - } - } - note: false - timertriggers: [] - ignoreworker: false - "8": - id: "8" - taskid: 5f8b3671-3dc9-49db-8a77-3416c2edf8e5 - type: title - task: - id: 5f8b3671-3dc9-49db-8a77-3416c2edf8e5 - version: -1 - name: Palo Alto Networks - Traps - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "6" - - "7" - separatecontext: false - view: |- - { - "position": { - "x": 1555, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "9": - id: "9" - taskid: 38f390ec-5a46-4954-8660-8f1e657c2ad3 - type: title - task: - id: 38f390ec-5a46-4954-8660-8f1e657c2ad3 - version: -1 - name: Cybereason - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "4" - separatecontext: false - view: |- - { - "position": { - "x": 480, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "10": - id: "10" - taskid: 944eb95d-f07b-4d1b-8c97-ae26d1d2d81b - type: title - task: - id: 944eb95d-f07b-4d1b-8c97-ae26d1d2d81b - version: -1 - name: Carbon Black Enterprise Response - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - separatecontext: false - view: |- - { - "position": { - "x": 50, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "11": - id: "11" - taskid: e65c3923-7562-4fba-805c-6b340d2a31e7 - type: title - task: - id: e65c3923-7562-4fba-805c-6b340d2a31e7 - version: -1 - name: Cylance Protect v2 - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "5" - separatecontext: false - view: |- - { - "position": { - "x": 910, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false -view: |- - { - "linkLabelsPosition": {}, - "paper": { - "dimensions": { - "height": 530, - "width": 2100, - "x": 50, - "y": 50 - } - } - } -inputs: -- key: MD5 - value: - complex: - root: File - accessor: MD5 - required: false - description: The MD5 hash of the file you want to block. -- key: SHA256 - value: - complex: - root: File - accessor: SHA256 - required: false - description: "" -- key: EventId - value: {} - required: false - description: Traps event ID that contains the malicious file to block. -outputs: -- contextPath: CbResponse.BlockedHashes.LastBlock.Time - description: Last block time -- contextPath: CbResponse.BlockedHashes.LastBlock.Hostname - description: Last block hostname -- contextPath: CbResponse.BlockedHashes.LastBlock.CbSensorID - description: Last block sensor ID -tests: - - block_indicators_-_generic_-_test +id: Block File - Generic v2 +version: -1 +name: Block File - Generic v2 +description: "This playbook is used to block files from running on endpoints. \nThis\ + \ playbook supports the following integrations:\n- Palo Alto Networks Traps\n- Cybereason\n\ + - Carbon Black Enterprise Response\n- Cylance Protect v2\n" +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 420a534c-a6e6-4cf5-8b86-ac7dd1a91441 + type: start + task: + id: 420a534c-a6e6-4cf5-8b86-ac7dd1a91441 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "8" + - "9" + - "10" + - "11" + separatecontext: false + view: |- + { + "position": { + "x": 695, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "2": + id: "2" + taskid: 24babe11-954f-4415-8d3d-a1100cdbb3df + type: playbook + task: + id: 24babe11-954f-4415-8d3d-a1100cdbb3df + version: -1 + name: Block File - Carbon Black Response + playbookName: Block File - Carbon Black Response + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 50, + "y": 340 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "3": + id: "3" + taskid: c8476a84-8d87-4ff2-8d6c-1dd1cccc503a + type: title + task: + id: c8476a84-8d87-4ff2-8d6c-1dd1cccc503a + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 910, + "y": 515 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "4": + id: "4" + taskid: 2efe2a1a-1d31-438c-828f-b6ae50f3899d + type: playbook + task: + id: 2efe2a1a-1d31-438c-828f-b6ae50f3899d + version: -1 + name: Block File - Cybereason + description: This playbook accepts an MD5 hash and blocks the file using the + Cybereason integration. + playbookName: Block File - Cybereason + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 480, + "y": 340 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "5": + id: "5" + taskid: a887370c-f94a-42f9-866f-2d80b7707f41 + type: playbook + task: + id: a887370c-f94a-42f9-866f-2d80b7707f41 + version: -1 + name: Block File - Cylance Protect v2 + description: This playbook accepts a SHA256 hash and adds the hash to the Global + Quarantine list using the Cylance Protect v2 integration. + playbookName: Block File - Cylance Protect v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 910, + "y": 340 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "6": + id: "6" + taskid: 4e936a4c-b781-40a1-831a-be0c62a727d6 + type: playbook + task: + id: 4e936a4c-b781-40a1-831a-be0c62a727d6 + version: -1 + name: Traps Blacklist File + playbookName: Traps Blacklist File + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 1340, + "y": 340 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "7": + id: "7" + taskid: ca09ee7f-ce03-43e9-8eed-0bfeef2b2ef3 + type: playbook + task: + id: ca09ee7f-ce03-43e9-8eed-0bfeef2b2ef3 + version: -1 + name: Traps Quarantine Event + playbookName: Traps Quarantine Event + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 1770, + "y": 340 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "8": + id: "8" + taskid: e46175f0-26fc-4f24-87f7-d531354ca0dd + type: title + task: + id: e46175f0-26fc-4f24-87f7-d531354ca0dd + version: -1 + name: Palo Alto Networks - Traps + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "6" + - "7" + separatecontext: false + view: |- + { + "position": { + "x": 1555, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "9": + id: "9" + taskid: 32d4b47a-e972-4e30-875b-b563130cc4ca + type: title + task: + id: 32d4b47a-e972-4e30-875b-b563130cc4ca + version: -1 + name: Cybereason + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "4" + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "10": + id: "10" + taskid: 0c07d0e1-59b1-436c-8e90-f2d0410df813 + type: title + task: + id: 0c07d0e1-59b1-436c-8e90-f2d0410df813 + version: -1 + name: Carbon Black Enterprise Response + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "11": + id: "11" + taskid: dcc8e191-213c-4ffd-8bc7-a8e1bc8894d7 + type: title + task: + id: dcc8e191-213c-4ffd-8bc7-a8e1bc8894d7 + version: -1 + name: Cylance Protect v2 + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "5" + separatecontext: false + view: |- + { + "position": { + "x": 910, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +system: true +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 530, + "width": 2100, + "x": 50, + "y": 50 + } + } + } +inputs: +- key: MD5 + value: + complex: + root: File + accessor: MD5 + required: false + description: The MD5 hash of the file you want to block. + playbookInputQuery: +- key: SHA256 + value: + complex: + root: File + accessor: SHA256 + required: false + description: "" + playbookInputQuery: +- key: EventId + value: {} + required: false + description: Traps event ID that contains the malicious file to block. + playbookInputQuery: +outputs: +- contextPath: CbResponse.BlockedHashes.LastBlock.Time + description: Last block time +- contextPath: CbResponse.BlockedHashes.LastBlock.Hostname + description: Last block hostname +- contextPath: CbResponse.BlockedHashes.LastBlock.CbSensorID + description: Last block sensor ID +fromversion: 4.5.0 +tests: +- block_indicators_-_generic_-_test diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Block_IP_-_Generic_v2.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Block_IP_-_Generic_v2.yml index 24a3b632baa..fcff663e1c9 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Block_IP_-_Generic_v2.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Block_IP_-_Generic_v2.yml @@ -1,948 +1,924 @@ -id: Block IP - Generic v2 -version: -1 -name: Block IP - Generic v2 -fromversion: 4.0.0 -description: |- - This playbook blocks malicious IPs using all integrations that are enabled. - - Supported integrations for this playbook: - * Check Point Firewall - * Palo Alto Networks Minemeld - * Palo Alto Networks PAN-OS - * Zscaler -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: b95110b7-ba18-42a5-87ad-c5d37915401c - type: start - task: - id: b95110b7-ba18-42a5-87ad-c5d37915401c - version: -1 - name: "" - description: "" - iscommand: false - brand: "" - nexttasks: - '#none#': - - "8" - separatecontext: false - view: |- - { - "position": { - "x": 500, - "y": 10 - } - } - note: false - timertriggers: [] - ignoreworker: false - "2": - id: "2" - taskid: 1808d949-f921-4957-8796-7bbedd822ad9 - type: title - task: - id: 1808d949-f921-4957-8796-7bbedd822ad9 - version: -1 - name: Done - description: "" - type: title - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 500, - "y": 1020 - } - } - note: false - timertriggers: [] - ignoreworker: false - "5": - id: "5" - taskid: cea4b9a9-d2a5-42c6-84e7-7eab6d6ab7a8 - type: title - task: - id: cea4b9a9-d2a5-42c6-84e7-7eab6d6ab7a8 - version: -1 - name: Block IPs - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "17" - - "18" - - "19" - - "20" - separatecontext: false - view: |- - { - "position": { - "x": 500, - "y": 370 - } - } - note: false - timertriggers: [] - ignoreworker: false - "6": - id: "6" - taskid: 077714b6-f53e-4ab4-8679-d2c172e67a59 - type: regular - task: - id: 077714b6-f53e-4ab4-8679-d2c172e67a59 - version: -1 - name: Block IP with Check Point Firewall - description: Block the IPs using Check Point Firewall - script: '|||checkpoint-block-ip' - type: regular - iscommand: true - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - direction: - simple: both - ip: - complex: - root: inputs.IP - ipname: - simple: IP-${inputs.IP} - rulename: - simple: Block-${inputs.IP} - separatecontext: false - view: |- - { - "position": { - "x": 980, - "y": 850 - } - } - note: false - timertriggers: [] - ignoreworker: false - "7": - id: "7" - taskid: cc26e2d3-b22c-4e90-819e-5a1dc485c2db - type: condition - task: - id: cc26e2d3-b22c-4e90-819e-5a1dc485c2db - version: -1 - name: Is Check Point Firewall enabled? - description: Verify that there is a valid instance of Check Point Firewall enabled. - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "2" - "yes": - - "6" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isExists - left: - value: - complex: - root: modules - filters: - - - operator: isEqualString - left: - value: - simple: modules.brand - iscontext: true - right: - value: - simple: Check Point - ignorecase: true - - - operator: isEqualString - left: - value: - simple: modules.state - iscontext: true - right: - value: - simple: Active - ignorecase: true - accessor: brand - iscontext: true - ignorecase: true - view: |- - { - "position": { - "x": 980, - "y": 660 - } - } - note: false - timertriggers: [] - ignoreworker: false - "8": - id: "8" - taskid: 3f8eeba3-99f9-484c-8f73-a0c6d9bd02bb - type: condition - task: - id: 3f8eeba3-99f9-484c-8f73-a0c6d9bd02bb - version: -1 - name: Is there an IP to block? - description: Verify that the playbook input includes at least one IP to block. - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "2" - "yes": - - "5" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isExists - left: - value: - simple: inputs.IP - iscontext: true - view: |- - { - "position": { - "x": 500, - "y": 155 - } - } - note: false - timertriggers: [] - ignoreworker: false - "11": - id: "11" - taskid: dbee1e60-454a-4043-8676-7f5bb3006b00 - type: playbook - task: - id: dbee1e60-454a-4043-8676-7f5bb3006b00 - version: -1 - name: Add Indicator to Miner - Minemeld - playbookName: Add Indicator to Miner - Palo Alto MineMeld - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - Indicator: - complex: - root: inputs.IP - MinerName: - complex: - root: inputs.IPBlacklistMiner - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 500, - "y": 660 - } - } - note: false - timertriggers: [] - ignoreworker: false - "12": - id: "12" - taskid: 43617e2e-a00d-4569-8d43-80b6e732798e - type: condition - task: - id: 43617e2e-a00d-4569-8d43-80b6e732798e - version: -1 - name: Is Zscaler enabled? - description: Verify that there is a valid instance of Zscaler enabled. - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "2" - "yes": - - "13" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isExists - left: - value: - complex: - root: modules - filters: - - - operator: isEqualString - left: - value: - simple: modules.brand - iscontext: true - right: - value: - simple: Zscaler - ignorecase: true - - - operator: isEqualString - left: - value: - simple: modules.state - iscontext: true - right: - value: - simple: active - ignorecase: true - accessor: brand - iscontext: true - ignorecase: true - view: |- - { - "position": { - "x": 1470, - "y": 660 - } - } - note: false - timertriggers: [] - ignoreworker: false - "13": - id: "13" - taskid: 6c6d1f99-8689-49d7-8c7c-f9ddcdd2a782 - type: regular - task: - id: 6c6d1f99-8689-49d7-8c7c-f9ddcdd2a782 - version: -1 - name: Block IP with Zscaler - description: Block the IPs using Zscaler. - script: Zscaler|||zscaler-blacklist-ip - type: regular - iscommand: true - brand: Zscaler - nexttasks: - '#none#': - - "2" - scriptarguments: - ip: - complex: - root: inputs.IP - separatecontext: false - view: |- - { - "position": { - "x": 1470, - "y": 850 - } - } - note: false - timertriggers: [] - ignoreworker: false - "14": - id: "14" - taskid: 161ff68a-c259-4e8c-8d24-965fe952c1d2 - type: playbook - task: - id: 161ff68a-c259-4e8c-8d24-965fe952c1d2 - version: -1 - name: PAN-OS - Block IP - Custom Block Rule - playbookName: PAN-OS - Block IP - Custom Block Rule - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - AutoCommit: - complex: - root: inputs.AutoCommit - IP: - complex: - root: inputs.IP - transformers: - - operator: uniq - LogForwarding: - complex: - root: inputs.LogForwarding - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 80, - "y": 850 - } - } - note: false - timertriggers: [] - ignoreworker: false - "15": - id: "15" - taskid: dcbbc272-0463-4e4c-81ba-ed176e92d04c - type: playbook - task: - id: dcbbc272-0463-4e4c-81ba-ed176e92d04c - version: -1 - name: PAN-OS - Block IP - Static Address Group - playbookName: PAN-OS - Block IP - Static Address Group - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - AddressGroupName: - complex: - root: inputs.StaticAddressGroup - AutoCommit: - complex: - root: inputs.AutoCommit - IP: - complex: - root: inputs.IP - transformers: - - operator: uniq - LogForwarding: - complex: - root: inputs.LogForwarding - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": -330, - "y": 850 - } - } - note: false - timertriggers: [] - ignoreworker: false - "16": - id: "16" - taskid: 6843cc6b-0460-4f91-8ad4-7925fb5f817a - type: playbook - task: - id: 6843cc6b-0460-4f91-8ad4-7925fb5f817a - version: -1 - name: PAN-OS - Block IP and URL - External Dynamic List - playbookName: PAN-OS - Block IP and URL - External Dynamic List - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - AutoCommit: - complex: - root: inputs.AutoCommit - EDLServerIP: - complex: - root: inputs.EDLServerIP - IP: - complex: - root: inputs.IP - transformers: - - operator: uniq - IPListName: - complex: - root: inputs.IPListName - LogForwarding: - complex: - root: inputs.LogForwarding - URL: {} - URLListName: {} - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": -760, - "y": 850 - } - } - note: false - timertriggers: [] - ignoreworker: false - "17": - id: "17" - taskid: 901eaceb-8b70-4afa-81b8-cb26eb624fd2 - type: title - task: - id: 901eaceb-8b70-4afa-81b8-cb26eb624fd2 - version: -1 - name: PAN-OS - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "22" - - "23" - - "24" - - "25" - separatecontext: false - view: |- - { - "position": { - "x": -550, - "y": 510 - } - } - note: false - timertriggers: [] - ignoreworker: false - "18": - id: "18" - taskid: eaa34a69-51d5-4309-851e-cec547062d7e - type: title - task: - id: eaa34a69-51d5-4309-851e-cec547062d7e - version: -1 - name: CheckPoint FW - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "7" - separatecontext: false - view: |- - { - "position": { - "x": 980, - "y": 515 - } - } - note: false - timertriggers: [] - ignoreworker: false - "19": - id: "19" - taskid: 5ef9b8f5-62a4-415c-896d-a739062d19ad - type: title - task: - id: 5ef9b8f5-62a4-415c-896d-a739062d19ad - version: -1 - name: MineMeld - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "11" - separatecontext: false - view: |- - { - "position": { - "x": 500, - "y": 515 - } - } - note: false - timertriggers: [] - ignoreworker: false - "20": - id: "20" - taskid: c35db5b5-164d-466d-825c-144a961f4f9c - type: title - task: - id: c35db5b5-164d-466d-825c-144a961f4f9c - version: -1 - name: Zscaler - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "12" - separatecontext: false - view: |- - { - "position": { - "x": 1470, - "y": 515 - } - } - note: false - timertriggers: [] - ignoreworker: false - "21": - id: "21" - taskid: be4682fc-8d29-42a2-8de6-6f31f277e4d9 - type: playbook - task: - id: be4682fc-8d29-42a2-8de6-6f31f277e4d9 - version: -1 - name: PAN-OS DAG Configuration - playbookName: PAN-OS DAG Configuration - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - action-type: - simple: drop - address_group_name: - simple: Demisto - Remediation IP Address Group - auto_commit: - complex: - root: inputs.AutoCommit - device-group: {} - inbound-or-outbound-rule: - simple: outbound - ip_list: - complex: - root: inputs.IP - log-forwarding-object-name: - complex: - root: inputs.LogForwarding - pre-post-rulebase: - simple: pre-rulebase - relative-rule-name: {} - rule-position: - simple: before - rule_name: - simple: Demisto Block Rule - ${incident.id} - tag_name: - complex: - root: inputs.DAG - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": -1180, - "y": 850 - } - } - note: false - timertriggers: [] - ignoreworker: false - "22": - id: "22" - taskid: c3a30091-7a2f-405a-808c-c1553a264cb4 - type: condition - task: - id: c3a30091-7a2f-405a-808c-c1553a264cb4 - version: -1 - name: Use Custom Block Rules? - description: "" - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "2" - "yes": - - "14" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isEqualString - left: - value: - complex: - root: inputs.CustomBlockRule - transformers: - - operator: toLowerCase - iscontext: true - right: - value: - simple: "true" - view: |- - { - "position": { - "x": 80, - "y": 650 - } - } - note: false - timertriggers: [] - ignoreworker: false - "23": - id: "23" - taskid: f62443fb-69ea-4a5d-8c10-f3dd19a1cdc8 - type: condition - task: - id: f62443fb-69ea-4a5d-8c10-f3dd19a1cdc8 - version: -1 - name: Use Static Address Group? - description: "" - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "2" - "yes": - - "15" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isNotEmpty - left: - value: - complex: - root: inputs.StaticAddressGroup - iscontext: true - view: |- - { - "position": { - "x": -330, - "y": 650 - } - } - note: false - timertriggers: [] - ignoreworker: false - "24": - id: "24" - taskid: 5358db30-716f-46d9-86d5-bd22d496c93c - type: condition - task: - id: 5358db30-716f-46d9-86d5-bd22d496c93c - version: -1 - name: Use External Dynamic List? - description: "" - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "2" - "yes": - - "16" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isNotEmpty - left: - value: - complex: - root: inputs.IPListName - iscontext: true - - - operator: isNotEmpty - left: - value: - complex: - root: inputs.EDLServerIP - iscontext: true - view: |- - { - "position": { - "x": -760, - "y": 650 - } - } - note: false - timertriggers: [] - ignoreworker: false - "25": - id: "25" - taskid: 07323c54-1759-454b-89c5-09ae35d4e86d - type: condition - task: - id: 07323c54-1759-454b-89c5-09ae35d4e86d - version: -1 - name: Use Dynamic Address Group? - description: "" - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "2" - "yes": - - "21" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isNotEmpty - left: - value: - complex: - root: inputs.DAG - iscontext: true - view: |- - { - "position": { - "x": -1180, - "y": 650 - } - } - note: false - timertriggers: [] - ignoreworker: false -view: |- - { - "linkLabelsPosition": { - "12_2_#default#": 0.23, - "22_2_#default#": 0.22, - "23_2_#default#": 0.11, - "24_2_#default#": 0.1, - "25_2_#default#": 0.1, - "7_2_#default#": 0.39, - "8_2_#default#": 0.48 - }, - "paper": { - "dimensions": { - "height": 1075, - "width": 3030, - "x": -1180, - "y": 10 - } - } - } -inputs: -- key: IPBlacklistMiner - value: {} - required: false - description: The name of the IP blacklist Miner in Minemeld. -- key: IP - value: {} - required: false - description: Array of malicious IPs to block. -- key: CustomBlockRule - value: - simple: "True" - required: false - description: |- - This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. - Specify True to use Custom Block Rules. -- key: LogForwarding - value: {} - required: false - description: Panorama log forwarding object name. -- key: AutoCommit - value: - simple: "No" - required: false - description: |- - This input determines whether to commit the configuration automatically. - Yes - Commit automatically. - No - Commit manually. -- key: StaticAddressGroup - value: {} - required: false - description: |- - This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. - Specify the Static Address Group name for IP handling. -- key: IPListName - value: {} - required: false - description: |- - This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used for blocking IPs. - Specify the EDL name for IP handling. -- key: EDLServerIP - value: {} - required: false - description: |- - This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used: - * The IP address of the web server on which the files are stored. - * The web server IP address is configured in the integration instance. -- key: DAG - value: {} - required: false - description: |- - This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. - Specify the Dynamic Address Group tag name for IP handling. -outputs: -- contextPath: CheckpointFWRule.Destination - description: Rule Destination. -- contextPath: CheckpointFWRule.DestinationNegate - description: Rule destination negate status (True/False). -- contextPath: PanoramaRule.Direction - description: Direction of the Panorama rule. Can be 'to','from', 'both' - type: string -- contextPath: PanoramaRule.IP - description: The IP the Panorama rule blocks - type: string -- contextPath: CheckpointFWRule.Name - description: Rule name. -- contextPath: PanoramaRule.Name - description: Name of the Panorama rule - type: string -- contextPath: CheckpointFWRule.UID - description: Rule UID. -- contextPath: PanoramaRule - description: List of Panorama rules -- contextPath: CheckpointFWRule.Type - description: Rule Type. -- contextPath: CheckpointFWRule.Action - description: 'Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).' -- contextPath: CheckpointFWRule.ActionSetting - description: Rule action settings. -- contextPath: CheckpointFWRule.CustomFields - description: Rule custom fields. -- contextPath: CheckpointFWRule.Data - description: Rule data. -- contextPath: CheckpointFWRule.DataDirection - description: Rule data direction. -- contextPath: CheckpointFWRule.DataNegate - description: Rule data negate status (True/False). -- contextPath: CheckpointFWRule.Domain - description: Rule domain. -- contextPath: CheckpointFWRule.Enabled - description: Rule status. -- contextPath: CheckpointFWRule.Hits - description: Rule hits count. -- contextPath: CheckpointFWRule.Data.Name - description: Rule data object name. -- contextPath: CheckpointFWRule.Data.Domain - description: Information about the domain the data object belongs to. -- contextPath: CheckpointFWRule.Domain.Name - description: Rule domain name. -- contextPath: CheckpointFWRule.Domain.UID - description: Rule domain UID. -- contextPath: CheckpointFWRule.Domain.Type - description: Rule domain type. -- contextPath: CheckpointFWRule.Hits.FirstDate - description: The date of the first hit for the rule. -- contextPath: CheckpointFWRule.Hits.LastDate - description: The date of the last hit for the rule. -- contextPath: CheckpointFWRule.Hits.Level - description: Level of rule hits. -- contextPath: CheckpointFWRule.Hits.Percentage - description: Percentage of rule hits. -- contextPath: CheckpointFWRule.Hits.Value - description: Value of rule hits. -tests: - - block_indicators_-_generic_-_test +id: Block IP - Generic v2 +version: -1 +name: Block IP - Generic v2 +description: |- + This playbook blocks malicious IPs using all integrations that are enabled. + + Supported integrations for this playbook: + * Check Point Firewall + * Palo Alto Networks Minemeld + * Palo Alto Networks PAN-OS + * Zscaler +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 650804b8-1cd4-4c33-8d83-8f72c789f860 + type: start + task: + id: 650804b8-1cd4-4c33-8d83-8f72c789f860 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "8" + separatecontext: false + view: |- + { + "position": { + "x": 500, + "y": 10 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "2": + id: "2" + taskid: cbdf2261-0bd1-4856-86f8-c5082a16f3ee + type: title + task: + id: cbdf2261-0bd1-4856-86f8-c5082a16f3ee + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 500, + "y": 1020 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "5": + id: "5" + taskid: 47c2b776-5038-453b-8115-48141dbad596 + type: title + task: + id: 47c2b776-5038-453b-8115-48141dbad596 + version: -1 + name: Block IPs + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "17" + - "18" + - "19" + - "20" + separatecontext: false + view: |- + { + "position": { + "x": 500, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "6": + id: "6" + taskid: 9dd50dac-37af-45ff-8c50-d02eadc60b93 + type: regular + task: + id: 9dd50dac-37af-45ff-8c50-d02eadc60b93 + version: -1 + name: Block IP with Check Point Firewall + description: Block the IPs using Check Point Firewall + script: '|||checkpoint-block-ip' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "2" + scriptarguments: + direction: + simple: both + ip: + complex: + root: inputs.IP + ipname: + simple: IP-${inputs.IP} + rulename: + simple: Block-${inputs.IP} + separatecontext: false + view: |- + { + "position": { + "x": 980, + "y": 850 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "7": + id: "7" + taskid: f5912507-b8b7-4a1e-8cbc-43d6ed014158 + type: condition + task: + id: f5912507-b8b7-4a1e-8cbc-43d6ed014158 + version: -1 + name: Is Check Point Firewall enabled? + description: Verify that there is a valid instance of Check Point Firewall enabled. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "6" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + complex: + root: modules + filters: + - - operator: isEqualString + left: + value: + simple: modules.brand + iscontext: true + right: + value: + simple: Check Point + ignorecase: true + - - operator: isEqualString + left: + value: + simple: modules.state + iscontext: true + right: + value: + simple: Active + ignorecase: true + accessor: brand + iscontext: true + ignorecase: true + view: |- + { + "position": { + "x": 980, + "y": 660 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "8": + id: "8" + taskid: 39db44de-9bb1-460e-8b42-023c12aa4778 + type: condition + task: + id: 39db44de-9bb1-460e-8b42-023c12aa4778 + version: -1 + name: Is there an IP to block? + description: Verify that the playbook input includes at least one IP to block. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "5" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + simple: inputs.IP + iscontext: true + view: |- + { + "position": { + "x": 500, + "y": 155 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "11": + id: "11" + taskid: d8d7576b-c4e9-48a6-8046-68f589b27e2e + type: playbook + task: + id: d8d7576b-c4e9-48a6-8046-68f589b27e2e + version: -1 + name: Add Indicator to Miner - Palo Alto MineMeld + playbookName: Add Indicator to Miner - Palo Alto MineMeld + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 500, + "y": 660 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "12": + id: "12" + taskid: 1bed0b61-b979-45c7-8628-f337dc0912ed + type: condition + task: + id: 1bed0b61-b979-45c7-8628-f337dc0912ed + version: -1 + name: Is Zscaler enabled? + description: Verify that there is a valid instance of Zscaler enabled. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "13" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + complex: + root: modules + filters: + - - operator: isEqualString + left: + value: + simple: modules.brand + iscontext: true + right: + value: + simple: Zscaler + ignorecase: true + - - operator: isEqualString + left: + value: + simple: modules.state + iscontext: true + right: + value: + simple: active + ignorecase: true + accessor: brand + iscontext: true + ignorecase: true + view: |- + { + "position": { + "x": 1470, + "y": 660 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "13": + id: "13" + taskid: 5e4a94dc-b93a-43e9-8a81-176b36b3fc57 + type: regular + task: + id: 5e4a94dc-b93a-43e9-8a81-176b36b3fc57 + version: -1 + name: Block IP with Zscaler + description: Block the IPs using Zscaler. + script: Zscaler|||zscaler-blacklist-ip + type: regular + iscommand: true + brand: Zscaler + nexttasks: + '#none#': + - "2" + scriptarguments: + ip: + complex: + root: inputs.IP + separatecontext: false + view: |- + { + "position": { + "x": 1470, + "y": 850 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "14": + id: "14" + taskid: b8398534-32b9-4455-84d6-2dd09bd2a592 + type: playbook + task: + id: b8398534-32b9-4455-84d6-2dd09bd2a592 + version: -1 + name: PAN-OS - Block IP - Custom Block Rule + playbookName: PAN-OS - Block IP - Custom Block Rule + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 80, + "y": 850 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "15": + id: "15" + taskid: 9828866a-b42c-4155-8681-d7b183b80fe2 + type: playbook + task: + id: 9828866a-b42c-4155-8681-d7b183b80fe2 + version: -1 + name: PAN-OS - Block IP - Static Address Group + playbookName: PAN-OS - Block IP - Static Address Group + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": -330, + "y": 850 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "16": + id: "16" + taskid: 9620e528-42f8-4c0d-8706-b46a73d188be + type: playbook + task: + id: 9620e528-42f8-4c0d-8706-b46a73d188be + version: -1 + name: PAN-OS - Block IP and URL - External Dynamic List + playbookName: PAN-OS - Block IP and URL - External Dynamic List + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": -760, + "y": 850 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "17": + id: "17" + taskid: 9d73fbe9-6b72-4cd3-8a23-235fb61bc197 + type: title + task: + id: 9d73fbe9-6b72-4cd3-8a23-235fb61bc197 + version: -1 + name: PAN-OS + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "22" + - "23" + - "24" + - "25" + separatecontext: false + view: |- + { + "position": { + "x": -550, + "y": 510 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "18": + id: "18" + taskid: fa041b26-6524-4e1f-8aeb-6d6e77e75c5c + type: title + task: + id: fa041b26-6524-4e1f-8aeb-6d6e77e75c5c + version: -1 + name: CheckPoint FW + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "7" + separatecontext: false + view: |- + { + "position": { + "x": 980, + "y": 515 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "19": + id: "19" + taskid: 3c8ee2b0-16ec-4e9e-8e66-b86781a7144e + type: title + task: + id: 3c8ee2b0-16ec-4e9e-8e66-b86781a7144e + version: -1 + name: MineMeld + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "11" + separatecontext: false + view: |- + { + "position": { + "x": 500, + "y": 515 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "20": + id: "20" + taskid: ffef1804-3251-47ce-83d5-f398b82b8fa6 + type: title + task: + id: ffef1804-3251-47ce-83d5-f398b82b8fa6 + version: -1 + name: Zscaler + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "12" + separatecontext: false + view: |- + { + "position": { + "x": 1470, + "y": 515 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "21": + id: "21" + taskid: 6c3dfdb9-9ac3-4a32-831b-67fc7bec6fd1 + type: playbook + task: + id: 6c3dfdb9-9ac3-4a32-831b-67fc7bec6fd1 + version: -1 + name: PAN-OS DAG Configuration + playbookName: PAN-OS DAG Configuration + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": -1180, + "y": 850 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "22": + id: "22" + taskid: 4f95fd93-d93e-432b-891b-da70b95207d9 + type: condition + task: + id: 4f95fd93-d93e-432b-891b-da70b95207d9 + version: -1 + name: Use Custom Block Rules? + description: "" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "14" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + complex: + root: inputs.CustomBlockRule + transformers: + - operator: toLowerCase + iscontext: true + right: + value: + simple: "true" + view: |- + { + "position": { + "x": 80, + "y": 650 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "23": + id: "23" + taskid: c4e83fd9-f8b6-45da-833e-94db3447c312 + type: condition + task: + id: c4e83fd9-f8b6-45da-833e-94db3447c312 + version: -1 + name: Use Static Address Group? + description: "" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "15" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + complex: + root: inputs.StaticAddressGroup + iscontext: true + view: |- + { + "position": { + "x": -330, + "y": 650 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "24": + id: "24" + taskid: 5ac3d7c2-8b78-45e9-8095-184b2a82a919 + type: condition + task: + id: 5ac3d7c2-8b78-45e9-8095-184b2a82a919 + version: -1 + name: Use External Dynamic List? + description: "" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "16" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + complex: + root: inputs.IPListName + iscontext: true + - - operator: isNotEmpty + left: + value: + complex: + root: inputs.EDLServerIP + iscontext: true + view: |- + { + "position": { + "x": -760, + "y": 650 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "25": + id: "25" + taskid: 5387aea9-c64b-4b9d-848f-c9269f644889 + type: condition + task: + id: 5387aea9-c64b-4b9d-848f-c9269f644889 + version: -1 + name: Use Dynamic Address Group? + description: "" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "21" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + complex: + root: inputs.DAG + iscontext: true + view: |- + { + "position": { + "x": -1180, + "y": 650 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +system: true +view: |- + { + "linkLabelsPosition": { + "12_2_#default#": 0.23, + "22_2_#default#": 0.22, + "23_2_#default#": 0.11, + "24_2_#default#": 0.1, + "25_2_#default#": 0.1, + "7_2_#default#": 0.39, + "8_2_#default#": 0.48 + }, + "paper": { + "dimensions": { + "height": 1075, + "width": 3030, + "x": -1180, + "y": 10 + } + } + } +inputs: +- key: IPBlacklistMiner + value: {} + required: false + description: The name of the IP blacklist Miner in Minemeld. + playbookInputQuery: +- key: IP + value: {} + required: false + description: Array of malicious IPs to block. + playbookInputQuery: +- key: CustomBlockRule + value: + simple: "True" + required: false + description: |- + This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. + Specify True to use Custom Block Rules. + playbookInputQuery: +- key: LogForwarding + value: {} + required: false + description: Panorama log forwarding object name. + playbookInputQuery: +- key: AutoCommit + value: + simple: "No" + required: false + description: |- + This input determines whether to commit the configuration automatically. + Yes - Commit automatically. + No - Commit manually. + playbookInputQuery: +- key: StaticAddressGroup + value: {} + required: false + description: |- + This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. + Specify the Static Address Group name for IP handling. + playbookInputQuery: +- key: IPListName + value: {} + required: false + description: |- + This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used for blocking IPs. + Specify the EDL name for IP handling. + playbookInputQuery: +- key: EDLServerIP + value: {} + required: false + description: |- + This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used: + * The IP address of the web server on which the files are stored. + * The web server IP address is configured in the integration instance. + playbookInputQuery: +- key: DAG + value: {} + required: false + description: |- + This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. + Specify the Dynamic Address Group tag name for IP handling. + playbookInputQuery: +outputs: +- contextPath: CheckpointFWRule.Destination + description: Rule Destination. +- contextPath: CheckpointFWRule.DestinationNegate + description: Rule destination negate status (True/False). +- contextPath: PanoramaRule.Direction + description: Direction of the Panorama rule. Can be 'to','from', 'both' + type: string +- contextPath: PanoramaRule.IP + description: The IP the Panorama rule blocks + type: string +- contextPath: CheckpointFWRule.Name + description: Rule name. +- contextPath: PanoramaRule.Name + description: Name of the Panorama rule + type: string +- contextPath: CheckpointFWRule.UID + description: Rule UID. +- contextPath: PanoramaRule + description: List of Panorama rules +- contextPath: CheckpointFWRule.Type + description: Rule Type. +- contextPath: CheckpointFWRule.Action + description: 'Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).' +- contextPath: CheckpointFWRule.ActionSetting + description: Rule action settings. +- contextPath: CheckpointFWRule.CustomFields + description: Rule custom fields. +- contextPath: CheckpointFWRule.Data + description: Rule data. +- contextPath: CheckpointFWRule.DataDirection + description: Rule data direction. +- contextPath: CheckpointFWRule.DataNegate + description: Rule data negate status (True/False). +- contextPath: CheckpointFWRule.Domain + description: Rule domain. +- contextPath: CheckpointFWRule.Enabled + description: Rule status. +- contextPath: CheckpointFWRule.Hits + description: Rule hits count. +- contextPath: CheckpointFWRule.Data.Name + description: Rule data object name. +- contextPath: CheckpointFWRule.Data.Domain + description: Information about the domain the data object belongs to. +- contextPath: CheckpointFWRule.Domain.Name + description: Rule domain name. +- contextPath: CheckpointFWRule.Domain.UID + description: Rule domain UID. +- contextPath: CheckpointFWRule.Domain.Type + description: Rule domain type. +- contextPath: CheckpointFWRule.Hits.FirstDate + description: The date of the first hit for the rule. +- contextPath: CheckpointFWRule.Hits.LastDate + description: The date of the last hit for the rule. +- contextPath: CheckpointFWRule.Hits.Level + description: Level of rule hits. +- contextPath: CheckpointFWRule.Hits.Percentage + description: Percentage of rule hits. +- contextPath: CheckpointFWRule.Hits.Value + description: Value of rule hits. +fromversion: 4.0.0 +tests: +- block_indicators_-_generic_-_test diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Block_Indicators_-_Generic_v2.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Block_Indicators_-_Generic_v2.yml index c6c61a7abdd..7a254cb81e1 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Block_Indicators_-_Generic_v2.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Block_Indicators_-_Generic_v2.yml @@ -1,570 +1,634 @@ -id: Block Indicators - Generic v2 -version: -1 -name: Block Indicators - Generic v2 -fromversion: 4.5.0 -description: |+ - This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks: - - - Block URL - Generic - - Block Account - Generic - - Block IP - Generic v2 - - Block File - Generic v2 - -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: b95110b7-ba18-42a5-87ad-c5d37915401c - type: start - task: - id: b95110b7-ba18-42a5-87ad-c5d37915401c - version: -1 - name: "" - description: "" - iscommand: false - brand: "" - nexttasks: - '#none#': - - "7" - separatecontext: false - view: |- - { - "position": { - "x": 695, - "y": 50 - } - } - note: false - timertriggers: [] - ignoreworker: false - "2": - id: "2" - taskid: 1808d949-f921-4957-8796-7bbedd822ad9 - type: title - task: - id: 1808d949-f921-4957-8796-7bbedd822ad9 - version: -1 - name: Done - description: "" - type: title - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 695, - "y": 515 - } - } - note: false - timertriggers: [] - ignoreworker: false - "4": - id: "4" - taskid: 0b19553d-6281-43ac-8bfc-583b1bfd6171 - type: playbook - task: - id: 0b19553d-6281-43ac-8bfc-583b1bfd6171 - version: -1 - name: Block URL - Generic - playbookName: Block URL - Generic - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - URL: - complex: - root: inputs.URL - URLBlacklistMiner: - complex: - root: inputs.URLBlacklistMiner - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 50, - "y": 340 - } - } - note: false - timertriggers: [] - ignoreworker: false - "5": - id: "5" - taskid: ba10aaed-dffd-4eae-8dcd-16807997f52f - type: playbook - task: - id: ba10aaed-dffd-4eae-8dcd-16807997f52f - version: -1 - name: Block Account - Generic - description: |- - This playbook blocks malicious usernames using all integrations that are enabled. - - Supported integrations for this playbook: - * Active Directory - * PAN-OS - This requires PAN-OS 9.1 or higher. - playbookName: Block Account - Generic - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - Username: - complex: - root: inputs.Username - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 480, - "y": 340 - } - } - note: false - timertriggers: [] - ignoreworker: false - "7": - id: "7" - taskid: 903a8a58-46c8-4ab0-8b6e-d83e35f442fb - type: title - task: - id: 903a8a58-46c8-4ab0-8b6e-d83e35f442fb - version: -1 - name: Block indicators - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "4" - - "5" - - "9" - - "10" - - "11" - separatecontext: false - view: |- - { - "position": { - "x": 695, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "9": - id: "9" - taskid: 81f60e8f-e1a0-48c0-8a65-9b34796e267e - type: playbook - task: - id: 81f60e8f-e1a0-48c0-8a65-9b34796e267e - version: -1 - name: Block IP - Generic v2 - playbookName: Block IP - Generic v2 - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - AutoCommit: - complex: - root: inputs.AutoCommit - CustomBlockRule: - complex: - root: inputs.CustomBlockRule - DAG: - complex: - root: inputs.DAG - EDLServerIP: - complex: - root: inputs.EDLServerIP - IP: - complex: - root: inputs.IP - IPBlacklistMiner: - complex: - root: inputs.IPBlacklistMiner - IPListName: - complex: - root: inputs.IPListName - LogForwarding: - complex: - root: inputs.LogForwarding - StaticAddressGroup: - complex: - root: inputs.StaticAddressGroup - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 910, - "y": 340 - } - } - note: false - timertriggers: [] - ignoreworker: false - "10": - id: "10" - taskid: b04799c6-781a-45e1-8205-3ae9ce2f725f - type: playbook - task: - id: b04799c6-781a-45e1-8205-3ae9ce2f725f - version: -1 - name: Block File - Generic v2 - playbookName: Block File - Generic v2 - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - EventId: {} - MD5: - complex: - root: inputs.MD5 - SHA256: - complex: - root: inputs.SHA256 - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 1340, - "y": 340 - } - } - note: false - timertriggers: [] - ignoreworker: false - "11": - id: "11" - taskid: 9d722317-88ec-40da-8d3f-f56b841f0039 - type: playbook - task: - id: 9d722317-88ec-40da-8d3f-f56b841f0039 - version: -1 - name: Block URL - Generic - playbookName: Block URL - Generic - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - AutoCommit: - complex: - root: inputs.AutoCommit - CustomURLCategory: - complex: - root: inputs.CustomURLCategory - EDLServerIP: - complex: - root: inputs.EDLServerIP - LogForwarding: - complex: - root: inputs.LogForwarding - URL: - complex: - root: inputs.URL - URLBlacklistMiner: - complex: - root: inputs.URLBlacklistMiner - URLListName: - complex: - root: inputs.URLListName - categories: - complex: - root: inputs.categories - device-group: - complex: - root: inputs.device-group - type: - complex: - root: inputs.type - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 50, - "y": 340 - } - } - note: false - timertriggers: [] - ignoreworker: false -view: |- - { - "linkLabelsPosition": {}, - "paper": { - "dimensions": { - "height": 530, - "width": 1670, - "x": 50, - "y": 50 - } - } - } -inputs: -- key: IPBlacklistMiner - value: {} - required: false - description: The name of the IP blacklist Miner in Minemeld. -- key: URLBlacklistMiner - value: {} - required: false - description: The name of the URL blacklist Miner in Minemeld. -- key: IP - value: - complex: - root: DBotScore - filters: - - - operator: isEqualString - left: - value: - simple: DBotScore.Type - iscontext: true - right: - value: - simple: ip - ignorecase: true - - - operator: greaterThanOrEqual - left: - value: - simple: DBotScore.Score - iscontext: true - right: - value: - simple: "3" - accessor: Indicator - transformers: - - operator: uniq - required: false - description: Array of malicious IPs to block. -- key: URL - value: - complex: - root: DBotScore - filters: - - - operator: isEqualString - left: - value: - simple: DBotScore.Type - iscontext: true - right: - value: - simple: url - ignorecase: true - - - operator: greaterThanOrEqual - left: - value: - simple: DBotScore.Score - iscontext: true - right: - value: - simple: "3" - accessor: Indicator - transformers: - - operator: uniq - required: false - description: Array of malicious URLs to block. -- key: Username - value: - complex: - root: DBotScore - filters: - - - operator: isEqualString - left: - value: - simple: DBotScore.Type - iscontext: true - right: - value: - simple: username - ignorecase: true - - - operator: greaterThanOrEqual - left: - value: - simple: DBotScore.Score - iscontext: true - right: - value: - simple: "3" - accessor: Indicator - required: false - description: Array of malicious usernames to block. -- key: MD5 - value: - complex: - root: File - accessor: MD5 - required: false - description: The MD5 hash of the file you want to block. -- key: SHA256 - value: - complex: - root: File - accessor: SHA256 - required: false - description: The SHA256 hash of the file you want to block. -- key: CustomBlockRule - value: - simple: "True" - required: false - description: |- - This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. - Specify True to use Custom Block Rules. -- key: LogForwarding - value: {} - required: false - description: Panorama log forwarding object name. -- key: AutoCommit - value: - simple: "No" - required: false - description: |- - This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. - Specify the Static Address Group name for IP handling. -- key: IPListName - value: {} - required: false - description: |- - This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used for blocking IPs. - Specify the EDL name for IP handling. -- key: EDLServerIP - value: {} - required: false - description: |- - This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used: - * The IP address of the web server on which the files are stored. - * The web server IP address is configured in the integration instance. -- key: DAG - value: {} - required: false - description: |- - This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. - Specify the Dynamic Address Group tag name for IP handling. -- key: StaticAddressGroup - value: {} - required: false - description: |- - This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. - Specify the Static Address Group name for IP handling. -- key: URLListName - value: - simple: Demisto Remediation - URL EDL - required: false - description: URL list from the instance context with which to override the remote - file. -- key: CustomURLCategory - value: - simple: Demisto Remediation - Malicious URLs - required: false - description: Custom URL Category name. -- key: type - value: {} - required: false - description: Custom URL category type. Insert "URL List"/ "Category Match". -- key: device-group - value: {} - required: false - description: Device group for the Custom URL Category (Panorama instances). -- key: categories - value: {} - required: false - description: The list of categories. Relevant from PAN-OS v9.x. -outputs: -- contextPath: CheckpointFWRule.Domain - description: Rule domain. -- contextPath: CheckpointFWRule.Enabled - description: Rule status. -- contextPath: CheckpointFWRule.Name - description: Rule name. -- contextPath: CheckpointFWRule.UID - description: Rule UID. -- contextPath: CheckpointFWRule.Type - description: Rule Type. -- contextPath: CheckpointFWRule.DestinationNegate - description: Rule destination negate status (True/False). -- contextPath: CheckpointFWRule.Action - description: 'Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).' -- contextPath: CheckpointFWRule.Destination - description: Rule Destination. -- contextPath: CheckpointFWRule.ActionSetting - description: Rule action settings. -- contextPath: CheckpointFWRule.CustomFields - description: Rule custom fields. -- contextPath: CheckpointFWRule.Data - description: Rule data. -- contextPath: CheckpointFWRule.DataDirection - description: Rule data direction. -- contextPath: CheckpointFWRule.DataNegate - description: Rule data negate status (True/False). -- contextPath: CheckpointFWRule.Hits - description: Rule hits count. -- contextPath: PanoramaRule.Direction - description: Direction of the Panorama rule. Can be 'to','from', 'both' - type: string -- contextPath: PanoramaRule.IP - description: The IP the Panorama rule blocks - type: string -- contextPath: PanoramaRule.Name - description: Name of the Panorama rule - type: string -- contextPath: CheckpointFWRule.Data.Name - description: Rule data object name. -- contextPath: CheckpointFWRule.Data.Domain - description: Information about the domain the data object belongs to. -- contextPath: CheckpointFWRule.Domain.Name - description: Rule domain name. -- contextPath: CheckpointFWRule.Domain.UID - description: Rule domain UID. -- contextPath: CheckpointFWRule.Domain.Type - description: Rule domain type. -- contextPath: CheckpointFWRule.Hits.FirstDate - description: The date of the first hit for the rule. -- contextPath: CheckpointFWRule.Hits.LastDate - description: The date of the last hit for the rule. -- contextPath: CheckpointFWRule.Hits.Level - description: Level of rule hits. -- contextPath: CheckpointFWRule.Hits.Percentage - description: Percentage of rule hits -- contextPath: CheckpointFWRule.Hits.Value - description: Value of rule hits. -tests: - - No Test +id: Block Indicators - Generic v2 +version: -1 +name: Block Indicators - Generic v2 +description: |+ + This playbook blocks malicious Indicators using all integrations that are enabled, using the following sub-playbooks: + + - Block URL - Generic + - Block Account - Generic + - Block IP - Generic v2 + - Block File - Generic v2 + +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: d3ee8477-b8eb-4b83-88e8-1a3f5e4f26ca + type: start + task: + id: d3ee8477-b8eb-4b83-88e8-1a3f5e4f26ca + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "7" + separatecontext: false + view: |- + { + "position": { + "x": 695, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "2": + id: "2" + taskid: 3ce0d3d2-cd32-467f-801d-8b6b43f5ce2a + type: title + task: + id: 3ce0d3d2-cd32-467f-801d-8b6b43f5ce2a + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 695, + "y": 515 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "4": + id: "4" + taskid: 4cfbb153-ee02-4ec5-85e0-a56993f6b1fa + type: playbook + task: + id: 4cfbb153-ee02-4ec5-85e0-a56993f6b1fa + version: -1 + name: Block URL - Generic + description: |- + This playbook blocks malicious URLs using all integrations that are enabled. + + Supported integrations for this playbook: + * Palo Alto Networks Minemeld + * Palo Alto Networks PAN-OS + * Zscaler + playbookName: Block URL - Generic + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "2" + scriptarguments: + URL: + complex: + root: inputs.URL + URLBlacklistMiner: + complex: + root: inputs.URLBlacklistMiner + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 50, + "y": 340 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "5": + id: "5" + taskid: bd1529d5-9110-4c59-8757-77ec2be78cb7 + type: playbook + task: + id: bd1529d5-9110-4c59-8757-77ec2be78cb7 + version: -1 + name: Block Account - Generic + description: |- + This playbook blocks malicious usernames using all integrations that you have enabled. + + Supported integrations for this playbook: + * Active Directory + * PAN-OS - This requires PAN-OS 9.1 or higher. + playbookName: Block Account - Generic + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "2" + scriptarguments: + Tag: {} + Username: + complex: + root: inputs.Username + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 480, + "y": 340 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "7": + id: "7" + taskid: 76aa6efb-02f5-48ef-8136-ce462c1488e4 + type: title + task: + id: 76aa6efb-02f5-48ef-8136-ce462c1488e4 + version: -1 + name: Block indicators + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "4" + - "5" + - "9" + - "10" + - "11" + separatecontext: false + view: |- + { + "position": { + "x": 695, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "9": + id: "9" + taskid: 4c576d9c-c844-4005-8cbc-a48d4d7317b0 + type: playbook + task: + id: 4c576d9c-c844-4005-8cbc-a48d4d7317b0 + version: -1 + name: Block IP - Generic v2 + description: |- + This playbook blocks malicious IPs using all integrations that are enabled. + + Supported integrations for this playbook: + * Check Point Firewall + * Palo Alto Networks Minemeld + * Palo Alto Networks PAN-OS + * Zscaler + playbookName: Block IP - Generic v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "2" + scriptarguments: + AutoCommit: + complex: + root: inputs.AutoCommit + CustomBlockRule: + complex: + root: inputs.CustomBlockRule + DAG: + complex: + root: inputs.DAG + EDLServerIP: + complex: + root: inputs.EDLServerIP + IP: + complex: + root: inputs.IP + IPBlacklistMiner: + complex: + root: inputs.IPBlacklistMiner + IPListName: + complex: + root: inputs.IPListName + LogForwarding: + complex: + root: inputs.LogForwarding + StaticAddressGroup: + complex: + root: inputs.StaticAddressGroup + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 910, + "y": 340 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "10": + id: "10" + taskid: 97c787e9-d72a-4c27-861e-f09f6c63723e + type: playbook + task: + id: 97c787e9-d72a-4c27-861e-f09f6c63723e + version: -1 + name: Block File - Generic v2 + description: "This playbook is used to block files from running on endpoints.\ + \ \nThis playbook supports the following integrations:\n- Palo Alto Networks\ + \ Traps\n- Cybereason\n- Carbon Black Enterprise Response\n- Cylance Protect\ + \ v2\n" + playbookName: Block File - Generic v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "2" + scriptarguments: + EventId: {} + MD5: + complex: + root: inputs.MD5 + SHA256: + complex: + root: inputs.SHA256 + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 1340, + "y": 340 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "11": + id: "11" + taskid: f982443c-3d26-4bd7-80b6-29f073994f76 + type: playbook + task: + id: f982443c-3d26-4bd7-80b6-29f073994f76 + version: -1 + name: Block URL - Generic + description: |- + This playbook blocks malicious URLs using all integrations that are enabled. + + Supported integrations for this playbook: + * Palo Alto Networks Minemeld + * Palo Alto Networks PAN-OS + * Zscaler + playbookName: Block URL - Generic + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "2" + scriptarguments: + AutoCommit: + complex: + root: inputs.AutoCommit + CustomURLCategory: + complex: + root: inputs.CustomURLCategory + EDLServerIP: + complex: + root: inputs.EDLServerIP + LogForwarding: + complex: + root: inputs.LogForwarding + URL: + complex: + root: inputs.URL + URLBlacklistMiner: + complex: + root: inputs.URLBlacklistMiner + URLListName: + complex: + root: inputs.URLListName + categories: + complex: + root: inputs.categories + device-group: + complex: + root: inputs.device-group + type: + complex: + root: inputs.type + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 50, + "y": 340 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 +system: true +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 530, + "width": 1670, + "x": 50, + "y": 50 + } + } + } +inputs: +- key: IPBlacklistMiner + value: {} + required: false + description: The name of the IP blacklist Miner in Minemeld. + playbookInputQuery: +- key: URLBlacklistMiner + value: {} + required: false + description: The name of the URL blacklist Miner in Minemeld. + playbookInputQuery: +- key: IP + value: + complex: + root: DBotScore + filters: + - - operator: isEqualString + left: + value: + simple: DBotScore.Type + iscontext: true + right: + value: + simple: ip + ignorecase: true + - - operator: greaterThanOrEqual + left: + value: + simple: DBotScore.Score + iscontext: true + right: + value: + simple: "3" + accessor: Indicator + transformers: + - operator: uniq + required: false + description: Array of malicious IPs to block. + playbookInputQuery: +- key: URL + value: + complex: + root: DBotScore + filters: + - - operator: isEqualString + left: + value: + simple: DBotScore.Type + iscontext: true + right: + value: + simple: url + ignorecase: true + - - operator: greaterThanOrEqual + left: + value: + simple: DBotScore.Score + iscontext: true + right: + value: + simple: "3" + accessor: Indicator + transformers: + - operator: uniq + required: false + description: Array of malicious URLs to block. + playbookInputQuery: +- key: Username + value: + complex: + root: DBotScore + filters: + - - operator: isEqualString + left: + value: + simple: DBotScore.Type + iscontext: true + right: + value: + simple: username + ignorecase: true + - - operator: greaterThanOrEqual + left: + value: + simple: DBotScore.Score + iscontext: true + right: + value: + simple: "3" + accessor: Indicator + required: false + description: Array of malicious usernames to block. + playbookInputQuery: +- key: MD5 + value: + complex: + root: File + accessor: MD5 + required: false + description: The MD5 hash of the file you want to block. + playbookInputQuery: +- key: SHA256 + value: + complex: + root: File + accessor: SHA256 + required: false + description: The SHA256 hash of the file you want to block. + playbookInputQuery: +- key: CustomBlockRule + value: + simple: "True" + required: false + description: |- + This input determines whether Palo Alto Networks Panorama or Firewall Custom Block Rules are used. + Specify True to use Custom Block Rules. + playbookInputQuery: +- key: LogForwarding + value: {} + required: false + description: Panorama log forwarding object name. + playbookInputQuery: +- key: AutoCommit + value: + simple: "No" + required: false + description: |- + This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. + Specify the Static Address Group name for IP handling. + playbookInputQuery: +- key: IPListName + value: {} + required: false + description: |- + This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used for blocking IPs. + Specify the EDL name for IP handling. + playbookInputQuery: +- key: EDLServerIP + value: {} + required: false + description: |- + This input determines whether Palo Alto Networks Panorama or Firewall External Dynamic Lists are used: + * The IP address of the web server on which the files are stored. + * The web server IP address is configured in the integration instance. + playbookInputQuery: +- key: DAG + value: {} + required: false + description: |- + This input determines whether Palo Alto Networks Panorama or Firewall Dynamic Address Groups are used. + Specify the Dynamic Address Group tag name for IP handling. + playbookInputQuery: +- key: StaticAddressGroup + value: {} + required: false + description: |- + This input determines whether Palo Alto Networks Panorama or Firewall Static Address Groups are used. + Specify the Static Address Group name for IP handling. + playbookInputQuery: +- key: URLListName + value: + simple: Demisto Remediation - URL EDL + required: false + description: URL list from the instance context with which to override the remote + file. + playbookInputQuery: +- key: CustomURLCategory + value: + simple: Demisto Remediation - Malicious URLs + required: false + description: Custom URL Category name. + playbookInputQuery: +- key: type + value: {} + required: false + description: Custom URL category type. Insert "URL List"/ "Category Match". + playbookInputQuery: +- key: device-group + value: {} + required: false + description: Device group for the Custom URL Category (Panorama instances). + playbookInputQuery: +- key: categories + value: {} + required: false + description: The list of categories. Relevant from PAN-OS v9.x. + playbookInputQuery: +outputs: +- contextPath: CheckpointFWRule.Domain + description: Rule domain. +- contextPath: CheckpointFWRule.Enabled + description: Rule status. +- contextPath: CheckpointFWRule.Name + description: Rule name. +- contextPath: CheckpointFWRule.UID + description: Rule UID. +- contextPath: CheckpointFWRule.Type + description: Rule Type. +- contextPath: CheckpointFWRule.DestinationNegate + description: Rule destination negate status (True/False). +- contextPath: CheckpointFWRule.Action + description: 'Rule action (Valid values are: Accept, Drop, Apply Layer, Ask, Info).' +- contextPath: CheckpointFWRule.Destination + description: Rule Destination. +- contextPath: CheckpointFWRule.ActionSetting + description: Rule action settings. +- contextPath: CheckpointFWRule.CustomFields + description: Rule custom fields. +- contextPath: CheckpointFWRule.Data + description: Rule data. +- contextPath: CheckpointFWRule.DataDirection + description: Rule data direction. +- contextPath: CheckpointFWRule.DataNegate + description: Rule data negate status (True/False). +- contextPath: CheckpointFWRule.Hits + description: Rule hits count. +- contextPath: PanoramaRule.Direction + description: Direction of the Panorama rule. Can be 'to','from', 'both' + type: string +- contextPath: PanoramaRule.IP + description: The IP the Panorama rule blocks + type: string +- contextPath: PanoramaRule.Name + description: Name of the Panorama rule + type: string +- contextPath: CheckpointFWRule.Data.Name + description: Rule data object name. +- contextPath: CheckpointFWRule.Data.Domain + description: Information about the domain the data object belongs to. +- contextPath: CheckpointFWRule.Domain.Name + description: Rule domain name. +- contextPath: CheckpointFWRule.Domain.UID + description: Rule domain UID. +- contextPath: CheckpointFWRule.Domain.Type + description: Rule domain type. +- contextPath: CheckpointFWRule.Hits.FirstDate + description: The date of the first hit for the rule. +- contextPath: CheckpointFWRule.Hits.LastDate + description: The date of the last hit for the rule. +- contextPath: CheckpointFWRule.Hits.Level + description: Level of rule hits. +- contextPath: CheckpointFWRule.Hits.Percentage + description: Percentage of rule hits +- contextPath: CheckpointFWRule.Hits.Value + description: Value of rule hits. +fromversion: 4.5.0 +tests: +- No Test diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Block_URL_-_Generic.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Block_URL_-_Generic.yml index 76b180e2f78..213e1e9d5cd 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Block_URL_-_Generic.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Block_URL_-_Generic.yml @@ -1,588 +1,566 @@ -id: block_url_-_generic -version: -1 -name: Block URL - Generic -fromversion: 4.0.0 -description: |- - This playbook blocks malicious URLs using all integrations that are enabled. - - Supported integrations for this playbook: - * Palo Alto Networks Minemeld - * Palo Alto Networks PAN-OS - * Zscaler -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: b95110b7-ba18-42a5-87ad-c5d37915401c - type: start - task: - id: b95110b7-ba18-42a5-87ad-c5d37915401c - version: -1 - name: "" - description: "" - iscommand: false - brand: "" - nexttasks: - '#none#': - - "8" - separatecontext: false - view: |- - { - "position": { - "x": 377.5, - "y": 40 - } - } - note: false - timertriggers: [] - ignoreworker: false - "2": - id: "2" - taskid: 1808d949-f921-4957-8796-7bbedd822ad9 - type: title - task: - id: 1808d949-f921-4957-8796-7bbedd822ad9 - version: -1 - name: Done - description: "" - type: title - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 377.5, - "y": 1150 - } - } - note: false - timertriggers: [] - ignoreworker: false - "5": - id: "5" - taskid: f414f4c2-03f8-4219-8428-048557b1758b - type: title - task: - id: f414f4c2-03f8-4219-8428-048557b1758b - version: -1 - name: Block URLs - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "16" - - "17" - - "18" - separatecontext: false - view: |- - { - "position": { - "x": 377.5, - "y": 425 - } - } - note: false - timertriggers: [] - ignoreworker: false - "8": - id: "8" - taskid: ad6bb4b2-ea87-4c6e-893c-a31e27e82e55 - type: condition - task: - id: ad6bb4b2-ea87-4c6e-893c-a31e27e82e55 - version: -1 - name: Is there a URL to block? - description: Verify that the playbook input includes at least one URL to block. - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "2" - "yes": - - "5" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isExists - left: - value: - simple: inputs.URL - iscontext: true - view: |- - { - "position": { - "x": 377.5, - "y": 175 - } - } - note: false - timertriggers: [] - ignoreworker: false - "11": - id: "11" - taskid: 2d0fc7d4-b827-43c9-8b7a-bf592e7a1c1f - type: playbook - task: - id: 2d0fc7d4-b827-43c9-8b7a-bf592e7a1c1f - version: -1 - name: Add Indicator to Miner - Minemeld - description: "" - playbookName: Add Indicator to Miner - Palo Alto MineMeld - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - Indicator: - complex: - root: inputs.URL - MinerName: - complex: - root: inputs.URLBlacklistMiner - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 110, - "y": 710 - } - } - note: false - timertriggers: [] - ignoreworker: false - "12": - id: "12" - taskid: a2108a1a-7365-45e7-8c07-a5a6fcdd8b95 - type: condition - task: - id: a2108a1a-7365-45e7-8c07-a5a6fcdd8b95 - version: -1 - name: Is Zscaler enabled? - description: Verify that there is a valid instance of Zscaler enabled. - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "2" - "yes": - - "13" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isExists - left: - value: - complex: - root: modules - filters: - - - operator: isEqualString - left: - value: - simple: modules.brand - iscontext: true - right: - value: - simple: Zscaler - ignorecase: true - - - operator: isEqualString - left: - value: - simple: modules.state - iscontext: true - right: - value: - simple: active - ignorecase: true - accessor: brand - iscontext: true - ignorecase: true - view: |- - { - "position": { - "x": 810, - "y": 730 - } - } - note: false - timertriggers: [] - ignoreworker: false - "13": - id: "13" - taskid: adb7b441-33c8-4fe9-8883-7af9a776e0d3 - type: regular - task: - id: adb7b441-33c8-4fe9-8883-7af9a776e0d3 - version: -1 - name: Block URL with Zscaler - description: Block the URLS using Zscaler. - script: '|||zscaler-blacklist-url' - type: regular - iscommand: true - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - url: - complex: - root: inputs.URL - separatecontext: false - view: |- - { - "position": { - "x": 810, - "y": 980 - } - } - note: false - timertriggers: [] - ignoreworker: false - "14": - id: "14" - taskid: 2b812a9e-5f84-40cb-8cb9-67bcc0537ee7 - type: playbook - task: - id: 2b812a9e-5f84-40cb-8cb9-67bcc0537ee7 - version: -1 - name: PAN-OS - Block URL - Custom URL Category - playbookName: PAN-OS - Block URL - Custom URL Category - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - AutoCommit: - complex: - root: inputs.AutoCommit - CustomURLCategory: - complex: - root: inputs.CustomURLCategory - LogForwarding: - complex: - root: inputs.LogForwarding - URL: - complex: - root: inputs.URL - transformers: - - operator: uniq - categories: - complex: - root: inputs.categories - device-group: - complex: - root: inputs.device-group - pre-post: - simple: pre-rulebase - type: - complex: - root: inputs.type - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": -800, - "y": 980 - } - } - note: false - timertriggers: [] - ignoreworker: false - "15": - id: "15" - taskid: bc52f173-2761-41cc-8342-6c5b462c3011 - type: playbook - task: - id: bc52f173-2761-41cc-8342-6c5b462c3011 - version: -1 - name: PAN-OS - Block IP and URL - External Dynamic List - playbookName: PAN-OS - Block IP and URL - External Dynamic List - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - AutoCommit: - complex: - root: inputs.AutoCommit - EDLServerIP: - complex: - root: inputs.EDLServerIP - IP: {} - IPListName: {} - LogForwarding: - complex: - root: inputs.LogForwarding - URL: - complex: - root: inputs.URL - transformers: - - operator: uniq - URLListName: - complex: - root: inputs.URLListName - device-group: - complex: - root: inputs.device-group - inbound-or-outbound-rule: - simple: outbound - ip-pre-post-rulebase: - simple: pre-rulebase - ip-rule-position: {} - url-pre-post-rulebase: - simple: pre-rulebase - url-rule-position: {} - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": -310, - "y": 980 - } - } - note: false - timertriggers: [] - ignoreworker: false - "16": - id: "16" - taskid: 864f7b0f-798c-40d8-862d-c1b41fce36f0 - type: title - task: - id: 864f7b0f-798c-40d8-862d-c1b41fce36f0 - version: -1 - name: MineMeld - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "11" - separatecontext: false - view: |- - { - "position": { - "x": 110, - "y": 570 - } - } - note: false - timertriggers: [] - ignoreworker: false - "17": - id: "17" - taskid: 59c2b2cb-4d8f-4e00-8140-751aec8dc2aa - type: title - task: - id: 59c2b2cb-4d8f-4e00-8140-751aec8dc2aa - version: -1 - name: PAN-OS - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "19" - - "20" - separatecontext: false - view: |- - { - "position": { - "x": -560, - "y": 570 - } - } - note: false - timertriggers: [] - ignoreworker: false - "18": - id: "18" - taskid: 99eec4e5-301a-4b0a-83e3-d7c2f973eeea - type: title - task: - id: 99eec4e5-301a-4b0a-83e3-d7c2f973eeea - version: -1 - name: Zscaler - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "12" - separatecontext: false - view: |- - { - "position": { - "x": 810, - "y": 570 - } - } - note: false - timertriggers: [] - ignoreworker: false - "19": - id: "19" - taskid: 8764a204-c1b6-454f-8b27-8d453cfcbb52 - type: condition - task: - id: 8764a204-c1b6-454f-8b27-8d453cfcbb52 - version: -1 - name: Use EDL? - description: "" - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "2" - "yes": - - "15" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isNotEmpty - left: - value: - simple: inputs.EDLServerIP - iscontext: true - view: |- - { - "position": { - "x": -310, - "y": 710 - } - } - note: false - timertriggers: [] - ignoreworker: false - "20": - id: "20" - taskid: 32ad589a-8395-4895-89fe-ee33d1a2b96c - type: condition - task: - id: 32ad589a-8395-4895-89fe-ee33d1a2b96c - version: -1 - name: Use Custom URL Category? - description: "" - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "2" - "yes": - - "14" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isNotEmpty - left: - value: - simple: inputs.type - iscontext: true - view: |- - { - "position": { - "x": -800, - "y": 710 - } - } - note: false - timertriggers: [] - ignoreworker: false -view: |- - { - "linkLabelsPosition": { - "12_2_#default#": 0.48, - "8_2_#default#": 0.43 - }, - "paper": { - "dimensions": { - "height": 1175, - "width": 1990, - "x": -800, - "y": 40 - } - } - } -inputs: -- key: URLBlacklistMiner - value: {} - required: false - description: The name of the URL blacklist Miner in Minemeld. -- key: URL - value: {} - required: false - description: Array of malicious URLs to block. -- key: URLListName - value: - simple: Demisto Remediation - URL EDL - required: false - description: URL list from the instance context with which to override the remote - file. -- key: LogForwarding - value: {} - required: false - description: Log Forwarding object name. -- key: EDLServerIP - value: {} - required: false - description: EDL server IP address. -- key: AutoCommit - value: - simple: "No" - required: false - description: |- - This input establishes whether to commit the configuration automatically. - Yes - Commit automatically. - No - Commit manually. -- key: CustomURLCategory - value: - simple: Demisto Remediation - Malicious URLs - required: false - description: Custom URL Category name. -- key: type - value: {} - required: false - description: Custom URL category type. Insert "URL List"/ "Category Match". -- key: device-group - value: {} - required: false - description: Device group for the Custom URL Category (Panorama instances). -- key: categories - value: {} - required: false - description: The list of categories. Relevant from PAN-OS v9.x. -outputs: [] -tests: - - block_indicators_-_generic_-_test \ No newline at end of file +id: block_url_-_generic +version: -1 +name: Block URL - Generic +description: |- + This playbook blocks malicious URLs using all integrations that are enabled. + + Supported integrations for this playbook: + * Palo Alto Networks Minemeld + * Palo Alto Networks PAN-OS + * Zscaler +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 59b1a1c8-41a6-4b2f-8bb4-24e4bd1036d8 + type: start + task: + id: 59b1a1c8-41a6-4b2f-8bb4-24e4bd1036d8 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "8" + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 40 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "2": + id: "2" + taskid: 5ba81cb8-30c1-4d31-8af6-45f937d1d58b + type: title + task: + id: 5ba81cb8-30c1-4d31-8af6-45f937d1d58b + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 1150 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "5": + id: "5" + taskid: 21e74ef4-5adb-44a4-874b-2bedbd59a051 + type: title + task: + id: 21e74ef4-5adb-44a4-874b-2bedbd59a051 + version: -1 + name: Block URLs + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "16" + - "17" + - "18" + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 425 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "8": + id: "8" + taskid: 6685a431-51a7-4bf8-8679-5d079a8dca85 + type: condition + task: + id: 6685a431-51a7-4bf8-8679-5d079a8dca85 + version: -1 + name: Is there a URL to block? + description: Verify that the playbook input includes at least one URL to block. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "5" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + simple: inputs.URL + iscontext: true + view: |- + { + "position": { + "x": 377.5, + "y": 175 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "11": + id: "11" + taskid: 4576e191-0508-4140-8ed3-0503e6232d9b + type: playbook + task: + id: 4576e191-0508-4140-8ed3-0503e6232d9b + version: -1 + name: Add Indicator to Miner - Palo Alto MineMeld + playbookName: Add Indicator to Miner - Palo Alto MineMeld + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 110, + "y": 710 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "12": + id: "12" + taskid: 4270c78b-8b35-44c8-832a-11b82fbbd9c4 + type: condition + task: + id: 4270c78b-8b35-44c8-832a-11b82fbbd9c4 + version: -1 + name: Is Zscaler enabled? + description: Verify that there is a valid instance of Zscaler enabled. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "13" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + complex: + root: modules + filters: + - - operator: isEqualString + left: + value: + simple: modules.brand + iscontext: true + right: + value: + simple: Zscaler + ignorecase: true + - - operator: isEqualString + left: + value: + simple: modules.state + iscontext: true + right: + value: + simple: active + ignorecase: true + accessor: brand + iscontext: true + ignorecase: true + view: |- + { + "position": { + "x": 810, + "y": 730 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "13": + id: "13" + taskid: 6c17067d-ac81-454b-8c4b-77e38811443e + type: regular + task: + id: 6c17067d-ac81-454b-8c4b-77e38811443e + version: -1 + name: Block URL with Zscaler + description: Block the URLS using Zscaler. + script: '|||zscaler-blacklist-url' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "2" + scriptarguments: + url: + complex: + root: inputs.URL + separatecontext: false + view: |- + { + "position": { + "x": 810, + "y": 980 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "14": + id: "14" + taskid: fa3391b8-020e-4f53-8576-7445bf741452 + type: playbook + task: + id: fa3391b8-020e-4f53-8576-7445bf741452 + version: -1 + name: PAN-OS - Block URL - Custom URL Category + playbookName: PAN-OS - Block URL - Custom URL Category + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": -800, + "y": 980 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "15": + id: "15" + taskid: 7cc51964-5d19-48ce-8bc3-7403438e6dfe + type: playbook + task: + id: 7cc51964-5d19-48ce-8bc3-7403438e6dfe + version: -1 + name: PAN-OS - Block IP and URL - External Dynamic List + playbookName: PAN-OS - Block IP and URL - External Dynamic List + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": -310, + "y": 980 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "16": + id: "16" + taskid: 258ee49c-7ea8-4d92-8054-dd0844396174 + type: title + task: + id: 258ee49c-7ea8-4d92-8054-dd0844396174 + version: -1 + name: MineMeld + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "11" + separatecontext: false + view: |- + { + "position": { + "x": 110, + "y": 570 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "17": + id: "17" + taskid: e92be57f-773d-496a-80f0-b1bc292b5355 + type: title + task: + id: e92be57f-773d-496a-80f0-b1bc292b5355 + version: -1 + name: PAN-OS + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "19" + - "20" + separatecontext: false + view: |- + { + "position": { + "x": -560, + "y": 570 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "18": + id: "18" + taskid: 18d080a9-f73c-4394-8f59-8cb602fd1604 + type: title + task: + id: 18d080a9-f73c-4394-8f59-8cb602fd1604 + version: -1 + name: Zscaler + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "12" + separatecontext: false + view: |- + { + "position": { + "x": 810, + "y": 570 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "19": + id: "19" + taskid: 663d099d-dde1-4521-8ff2-18fabf06d99e + type: condition + task: + id: 663d099d-dde1-4521-8ff2-18fabf06d99e + version: -1 + name: Use EDL? + description: "" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "15" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: inputs.EDLServerIP + iscontext: true + view: |- + { + "position": { + "x": -310, + "y": 710 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "20": + id: "20" + taskid: 61ddf243-2502-4c31-8ae3-9333c488d492 + type: condition + task: + id: 61ddf243-2502-4c31-8ae3-9333c488d492 + version: -1 + name: Use Custom URL Category? + description: "" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "14" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: inputs.type + iscontext: true + view: |- + { + "position": { + "x": -800, + "y": 710 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +system: true +view: |- + { + "linkLabelsPosition": { + "12_2_#default#": 0.48, + "8_2_#default#": 0.43 + }, + "paper": { + "dimensions": { + "height": 1175, + "width": 1990, + "x": -800, + "y": 40 + } + } + } +inputs: +- key: URLBlacklistMiner + value: {} + required: false + description: The name of the URL blacklist Miner in Minemeld. + playbookInputQuery: +- key: URL + value: {} + required: false + description: Array of malicious URLs to block. + playbookInputQuery: +- key: URLListName + value: + simple: Demisto Remediation - URL EDL + required: false + description: URL list from the instance context with which to override the remote + file. + playbookInputQuery: +- key: LogForwarding + value: {} + required: false + description: Log Forwarding object name. + playbookInputQuery: +- key: EDLServerIP + value: {} + required: false + description: EDL server IP address. + playbookInputQuery: +- key: AutoCommit + value: + simple: "No" + required: false + description: |- + This input establishes whether to commit the configuration automatically. + Yes - Commit automatically. + No - Commit manually. + playbookInputQuery: +- key: CustomURLCategory + value: + simple: Demisto Remediation - Malicious URLs + required: false + description: Custom URL Category name. + playbookInputQuery: +- key: type + value: {} + required: false + description: Custom URL category type. Insert "URL List"/ "Category Match". + playbookInputQuery: +- key: device-group + value: {} + required: false + description: Device group for the Custom URL Category (Panorama instances). + playbookInputQuery: +- key: categories + value: {} + required: false + description: The list of categories. Relevant from PAN-OS v9.x. + playbookInputQuery: +outputs: [] +fromversion: 4.0.0 +tests: +- block_indicators_-_generic_-_test diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Calculate_Severity_-_Generic_v2.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Calculate_Severity_-_Generic_v2.yml index 43bc9e3d61e..721d624e0c7 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Calculate_Severity_-_Generic_v2.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Calculate_Severity_-_Generic_v2.yml @@ -1,1418 +1,1452 @@ -id: Calculate Severity - Generic v2 -version: -1 -fromversion: 4.5.0 -name: Calculate Severity - Generic v2 -description: |- - Calculate and assign the incident severity based on the highest returned severity level from the following calculations: - - - DBotScores of indicators - - Critical assets - - Email authenticity - - Current incident severity -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: 3eded69b-617e-4212-86b7-2537474285f3 - type: start - task: - id: 3eded69b-617e-4212-86b7-2537474285f3 - version: -1 - name: "" - description: "" - iscommand: false - brand: "" - nexttasks: - '#none#': - - "16" - - "19" - - "18" - - "24" - separatecontext: false - view: |- - { - "position": { - "x": 910, - "y": 30 - } - } - note: false - timertriggers: [] - ignoreworker: false - "4": - id: "4" - taskid: 016add21-2f55-4108-8a61-18fc346d5bfd - type: regular - task: - id: 016add21-2f55-4108-8a61-18fc346d5bfd - version: -1 - name: Set incident severity to "Low" - description: Sets the incident severity to "Low". - script: Builtin|||setIncident - type: regular - iscommand: true - brand: Builtin - nexttasks: - '#none#': - - "10" - scriptarguments: - addLabels: {} - affecteddata: {} - affecteddatatype: {} - affectedhosts: {} - affectedindividualscontactinformation: {} - affectedips: {} - app: {} - approximatenumberofaffecteddatasubjects: {} - arcsightcaseid: {} - assetid: {} - attachmentcount: {} - attachmentextension: {} - attachmenthash: {} - attachmentid: {} - attachmentitem: {} - attachmentname: {} - attachmentsize: {} - attachmenttype: {} - backupowner: {} - blah: {} - booltest: {} - bugtraq: {} - city: {} - closeNotes: {} - closeReason: {} - companyaddress: {} - companycity: {} - companycountry: {} - companyhasinsuranceforthebreach: {} - companyname: {} - companypostalcode: {} - contactaddress: {} - contactname: {} - country: {} - countrywherebusinesshasitsmainestablishment: {} - countrywherethebreachtookplace: {} - criticalassets: {} - customFields: {} - cve: {} - cvss: {} - dataencryptionstatus: {} - datetimeofthebreach: {} - daysbetweenreportcreation: {} - deleteEmptyField: {} - dest: {} - destinationip: {} - destntdomain: {} - details: {} - detectedusers: {} - dpoemailaddress: {} - duration: {} - emailaddress: {} - emailauthenticitycheck: {} - emailbcc: {} - emailbody: {} - emailbodyformat: {} - emailbodyhtml: {} - emailbodyhtmlraw: {} - emailcc: {} - emailclassification: {} - emailclientname: {} - emailfrom: {} - emailfromdisplayname: {} - emailhtml: {} - emailinreplyto: {} - emailkeywords: {} - emailmessageid: {} - emailreceived: {} - emailreplyto: {} - emailreturnpath: {} - emailsenderdomain: {} - emailsenderip: {} - emailsize: {} - emailsource: {} - emailsubject: {} - emailsubjectlanguage: {} - emailto: {} - emailtocount: {} - emailurlclicked: {} - eventid: {} - falses: {} - fetchid: {} - fetchtype: {} - filehash: {} - filename: {} - filepath: {} - hostid: {} - hostname: {} - htmlimage: {} - htmlrenderedimage: {} - id: {} - important: {} - importantfield: {} - isthedatasubjecttodpia: {} - killchain: {} - labels: {} - likelyimpact: {} - lob: {} - maliciouscauseifthecauseisamaliciousattack: {} - malwarefamily: {} - mdtest: {} - measurestomitigate: {} - myfield: {} - name: {} - occurred: {} - owner: {} - phase: {} - phishingsubtype: {} - possiblecauseofthebreach: {} - postalcode: {} - queues: {} - relateddomain: {} - replacePlaybook: {} - reporteduser: {} - reportinguser: {} - roles: {} - screenshot: {} - screenshot2: {} - sectorofaffectedparty: {} - selector: {} - severity: - simple: low - signature: {} - single: {} - single2: {} - sizenumberofemployees: {} - sizeturnover: {} - sla: {} - slaField: {} - source: {} - src: {} - srcntdomain: {} - srcuser: {} - systems: {} - team: {} - telephoneno: {} - test: {} - test2: {} - testfield: {} - timeassignedtolevel2: {} - timefield1: {} - timelevel1: {} - type: {} - user: {} - username: {} - vendorid: {} - vendorproduct: {} - vulnerabilitycategory: {} - whereisdatahosted: {} - xdr: {} - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 62, - "y": 770 - } - } - note: false - timertriggers: [] - ignoreworker: false - "5": - id: "5" - taskid: 7c197cbc-c107-49e4-8744-4907a39ee6c5 - type: regular - task: - id: 7c197cbc-c107-49e4-8744-4907a39ee6c5 - version: -1 - name: Set incident severity to "Medium" - description: Sets the incident severity to "Medium". - script: Builtin|||setIncident - type: regular - iscommand: true - brand: Builtin - nexttasks: - '#none#': - - "10" - scriptarguments: - addLabels: {} - affecteddata: {} - affecteddatatype: {} - affectedhosts: {} - affectedindividualscontactinformation: {} - affectedips: {} - app: {} - approximatenumberofaffecteddatasubjects: {} - arcsightcaseid: {} - assetid: {} - attachmentcount: {} - attachmentextension: {} - attachmenthash: {} - attachmentid: {} - attachmentitem: {} - attachmentname: {} - attachmentsize: {} - attachmenttype: {} - backupowner: {} - blah: {} - booltest: {} - bugtraq: {} - campaigntargetcount: {} - campaigntargets: {} - city: {} - closeNotes: {} - closeReason: {} - companyaddress: {} - companycity: {} - companycountry: {} - companyhasinsuranceforthebreach: {} - companyname: {} - companypostalcode: {} - contactaddress: {} - contactname: {} - country: {} - countrywherebusinesshasitsmainestablishment: {} - countrywherethebreachtookplace: {} - criticalassets: {} - customFields: {} - cve: {} - cvss: {} - dataencryptionstatus: {} - datetimeofthebreach: {} - daysbetweenreportcreation: {} - deleteEmptyField: {} - dest: {} - destinationip: {} - destntdomain: {} - details: {} - detectedusers: {} - dpoemailaddress: {} - duration: {} - emailaddress: {} - emailauthenticitycheck: {} - emailbcc: {} - emailbody: {} - emailbodyformat: {} - emailbodyhtml: {} - emailbodyhtmlraw: {} - emailcc: {} - emailclassification: {} - emailclientname: {} - emailfrom: {} - emailfromdisplayname: {} - emailhtml: {} - emailinreplyto: {} - emailkeywords: {} - emailmessageid: {} - emailreceived: {} - emailreplyto: {} - emailreturnpath: {} - emailsenderdomain: {} - emailsenderip: {} - emailsize: {} - emailsource: {} - emailsubject: {} - emailsubjectlanguage: {} - emailto: {} - emailtocount: {} - emailurlclicked: {} - eventid: {} - falses: {} - fetchid: {} - fetchtype: {} - filehash: {} - filename: {} - filepath: {} - hostid: {} - hostname: {} - htmlimage: {} - htmlrenderedimage: {} - id: {} - important: {} - importantfield: {} - isthedatasubjecttodpia: {} - killchain: {} - labels: {} - likelyimpact: {} - lob: {} - maliciouscauseifthecauseisamaliciousattack: {} - malwarefamily: {} - mdtest: {} - measurestomitigate: {} - myfield: {} - name: {} - occurred: {} - owner: {} - phase: {} - phishingsubtype: {} - possiblecauseofthebreach: {} - postalcode: {} - queues: {} - relateddomain: {} - replacePlaybook: {} - reporteduser: {} - reportinguser: {} - roles: {} - screenshot: {} - screenshot2: {} - sectorofaffectedparty: {} - selector: {} - severity: - simple: medium - signature: {} - single: {} - single2: {} - sizenumberofemployees: {} - sizeturnover: {} - sla: {} - slaField: {} - source: {} - src: {} - srcntdomain: {} - srcuser: {} - systems: {} - team: {} - telephoneno: {} - test: {} - test2: {} - testfield: {} - timeassignedtolevel2: {} - timefield1: {} - timelevel1: {} - type: {} - user: {} - username: {} - vendorid: {} - vendorproduct: {} - vulnerabilitycategory: {} - whereisdatahosted: {} - xdr: {} - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 483, - "y": 770 - } - } - note: false - timertriggers: [] - ignoreworker: false - "6": - id: "6" - taskid: 9bca9c1e-ea09-4015-8e64-f40b4c3e2fa2 - type: regular - task: - id: 9bca9c1e-ea09-4015-8e64-f40b4c3e2fa2 - version: -1 - name: Set incident severity to "High" - description: Sets the incident severity to "High". - script: Builtin|||setIncident - type: regular - iscommand: true - brand: Builtin - nexttasks: - '#none#': - - "10" - scriptarguments: - addLabels: {} - affecteddata: {} - affecteddatatype: {} - affectedhosts: {} - affectedindividualscontactinformation: {} - affectedips: {} - app: {} - approximatenumberofaffecteddatasubjects: {} - arcsightcaseid: {} - assetid: {} - attachmentcount: {} - attachmentextension: {} - attachmenthash: {} - attachmentid: {} - attachmentitem: {} - attachmentname: {} - attachmentsize: {} - attachmenttype: {} - backupowner: {} - blah: {} - booltest: {} - bugtraq: {} - city: {} - closeNotes: {} - closeReason: {} - companyaddress: {} - companycity: {} - companycountry: {} - companyhasinsuranceforthebreach: {} - companyname: {} - companypostalcode: {} - contactaddress: {} - contactname: {} - country: {} - countrywherebusinesshasitsmainestablishment: {} - countrywherethebreachtookplace: {} - customFields: {} - cve: {} - cvss: {} - dataencryptionstatus: {} - datetimeofthebreach: {} - daysbetweenreportcreation: {} - deleteEmptyField: {} - dest: {} - destinationip: {} - destntdomain: {} - details: {} - detectedusers: {} - dpoemailaddress: {} - duration: {} - emailaddress: {} - emailbcc: {} - emailbody: {} - emailbodyformat: {} - emailbodyhtml: {} - emailbodyhtmlraw: {} - emailcc: {} - emailclassification: {} - emailclientname: {} - emailfrom: {} - emailfromdisplayname: {} - emailhtml: {} - emailinreplyto: {} - emailkeywords: {} - emailmessageid: {} - emailreceived: {} - emailreplyto: {} - emailreturnpath: {} - emailsenderdomain: {} - emailsenderip: {} - emailsize: {} - emailsource: {} - emailsubject: {} - emailsubjectlanguage: {} - emailto: {} - emailtocount: {} - emailurlclicked: {} - eventid: {} - falses: {} - fetchid: {} - fetchtype: {} - filehash: {} - filename: {} - filepath: {} - hostid: {} - hostname: {} - htmlimage: {} - htmlrenderedimage: {} - id: {} - important: {} - importantfield: {} - isthedatasubjecttodpia: {} - killchain: {} - labels: {} - likelyimpact: {} - lob: {} - maliciouscauseifthecauseisamaliciousattack: {} - malwarefamily: {} - mdtest: {} - measurestomitigate: {} - myfield: {} - name: {} - occurred: {} - owner: {} - phase: {} - phishingsubtype: {} - possiblecauseofthebreach: {} - postalcode: {} - queues: {} - relateddomain: {} - replacePlaybook: {} - reporteduser: {} - reportinguser: {} - roles: {} - screenshot: {} - screenshot2: {} - sectorofaffectedparty: {} - selector: {} - severity: - simple: high - signature: {} - single: {} - single2: {} - sizenumberofemployees: {} - sizeturnover: {} - sla: {} - slaField: {} - source: {} - src: {} - srcntdomain: {} - srcuser: {} - systems: {} - team: {} - telephoneno: {} - test: {} - test2: {} - testfield: {} - timeassignedtolevel2: {} - timefield1: {} - timelevel1: {} - type: {} - user: {} - username: {} - vendorid: {} - vendorproduct: {} - vulnerabilitycategory: {} - whereisdatahosted: {} - xdr: {} - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 1333, - "y": 770 - } - } - note: false - timertriggers: [] - ignoreworker: false - "10": - id: "10" - taskid: 483350d5-ab17-44cd-87b3-0e2360ce3577 - type: title - task: - id: 483350d5-ab17-44cd-87b3-0e2360ce3577 - version: -1 - name: Done - description: "" - type: title - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 910, - "y": 1050 - } - } - note: false - timertriggers: [] - ignoreworker: false - "11": - id: "11" - taskid: 8a3a57a3-6b38-44e5-8d33-3b4dfc0965ab - type: regular - task: - id: 8a3a57a3-6b38-44e5-8d33-3b4dfc0965ab - version: -1 - name: Set incident severity to "Critical" - description: Sets the incident severity to "Critical". - script: Builtin|||setIncident - type: regular - iscommand: true - brand: Builtin - nexttasks: - '#none#': - - "10" - scriptarguments: - addLabels: {} - affecteddata: {} - affecteddatatype: {} - affectedhosts: {} - affectedindividualscontactinformation: {} - affectedips: {} - app: {} - approximatenumberofaffecteddatasubjects: {} - arcsightcaseid: {} - assetid: {} - attachmentcount: {} - attachmentextension: {} - attachmenthash: {} - attachmentid: {} - attachmentitem: {} - attachmentname: {} - attachmentsize: {} - attachmenttype: {} - backupowner: {} - blah: {} - booltest: {} - bugtraq: {} - city: {} - closeNotes: {} - closeReason: {} - companyaddress: {} - companycity: {} - companycountry: {} - companyhasinsuranceforthebreach: {} - companyname: {} - companypostalcode: {} - contactaddress: {} - contactname: {} - country: {} - countrywherebusinesshasitsmainestablishment: {} - countrywherethebreachtookplace: {} - customFields: {} - cve: {} - cvss: {} - dataencryptionstatus: {} - datetimeofthebreach: {} - daysbetweenreportcreation: {} - deleteEmptyField: {} - dest: {} - destinationip: {} - destntdomain: {} - details: {} - detectedusers: {} - dpoemailaddress: {} - duration: {} - emailaddress: {} - emailbcc: {} - emailbody: {} - emailbodyformat: {} - emailbodyhtml: {} - emailbodyhtmlraw: {} - emailcc: {} - emailclassification: {} - emailclientname: {} - emailfrom: {} - emailfromdisplayname: {} - emailhtml: {} - emailinreplyto: {} - emailkeywords: {} - emailmessageid: {} - emailreceived: {} - emailreplyto: {} - emailreturnpath: {} - emailsenderdomain: {} - emailsenderip: {} - emailsize: {} - emailsource: {} - emailsubject: {} - emailsubjectlanguage: {} - emailto: {} - emailtocount: {} - emailurlclicked: {} - eventid: {} - falses: {} - fetchid: {} - fetchtype: {} - filehash: {} - filename: {} - filepath: {} - hostid: {} - hostname: {} - htmlimage: {} - htmlrenderedimage: {} - id: {} - important: {} - importantfield: {} - isthedatasubjecttodpia: {} - labels: {} - likelyimpact: {} - maliciouscauseifthecauseisamaliciousattack: {} - malwarefamily: {} - mdtest: {} - measurestomitigate: {} - myfield: {} - name: {} - occurred: {} - owner: {} - phase: {} - phishingsubtype: {} - possiblecauseofthebreach: {} - postalcode: {} - relateddomain: {} - replacePlaybook: {} - reporteduser: {} - reportinguser: {} - roles: {} - screenshot: {} - screenshot2: {} - sectorofaffectedparty: {} - selector: {} - severity: - simple: critical - signature: {} - single: {} - single2: {} - sizenumberofemployees: {} - sizeturnover: {} - sla: {} - slaField: {} - source: {} - src: {} - srcntdomain: {} - srcuser: {} - systems: {} - team: {} - telephoneno: {} - test: {} - test2: {} - testfield: {} - timeassignedtolevel2: {} - timefield1: {} - timelevel1: {} - type: {} - user: {} - username: {} - vendorid: {} - vendorproduct: {} - vulnerabilitycategory: {} - whereisdatahosted: {} - xdr: {} - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 1750, - "y": 770 - } - } - note: false - timertriggers: [] - ignoreworker: false - "15": - id: "15" - taskid: f0d6dc7b-0638-4a10-82eb-8e81360a0062 - type: condition - task: - id: f0d6dc7b-0638-4a10-82eb-8e81360a0062 - version: -1 - name: Determine incident severity - description: Determines the severity level based on the highest result of all - severity calculations. - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "25" - Critical: - - "11" - High: - - "6" - Low: - - "4" - Medium: - - "5" - separatecontext: false - conditions: - - label: Critical - condition: - - - operator: isExists - left: - value: - complex: - root: Severities - filters: - - - operator: containsGeneral - left: - value: - simple: Severities.DBotScoreSeverity - iscontext: true - right: - value: - simple: Critical - ignorecase: true - - operator: containsGeneral - left: - value: - simple: Severities.CriticalAssetsSeverity - iscontext: true - right: - value: - simple: Critical - ignorecase: true - - operator: containsGeneral - left: - value: - simple: Severities.EmailAuthenticitySeverity - iscontext: true - right: - value: - simple: Critical - ignorecase: true - - operator: isEqualString - left: - value: - simple: Severities.IncidentSeverity - iscontext: true - right: - value: - simple: "4" - ignorecase: true - iscontext: true - - label: High - condition: - - - operator: isExists - left: - value: - complex: - root: Severities - filters: - - - operator: containsGeneral - left: - value: - simple: Severities.DBotScoreSeverity - iscontext: true - right: - value: - simple: High - ignorecase: true - - operator: containsGeneral - left: - value: - simple: Severities.CriticalAssetsSeverity - iscontext: true - right: - value: - simple: High - ignorecase: true - - operator: containsGeneral - left: - value: - simple: Severities.EmailAuthenticitySeverity - iscontext: true - right: - value: - simple: High - ignorecase: true - - operator: isEqualString - left: - value: - simple: Severities.IncidentSeverity - iscontext: true - right: - value: - simple: "3" - ignorecase: true - iscontext: true - - label: Medium - condition: - - - operator: isExists - left: - value: - complex: - root: Severities - filters: - - - operator: containsGeneral - left: - value: - simple: Severities.DBotScoreSeverity - iscontext: true - right: - value: - simple: Medium - ignorecase: true - - operator: containsGeneral - left: - value: - simple: Severities.CriticalAssetsSeverity - iscontext: true - right: - value: - simple: Medium - ignorecase: true - - operator: containsGeneral - left: - value: - simple: Severities.EmailAuthenticitySeverity - iscontext: true - right: - value: - simple: Medium - - operator: isEqualString - left: - value: - simple: Severities.IncidentSeverity - iscontext: true - right: - value: - simple: "2" - ignorecase: true - iscontext: true - ignorecase: true - - label: Low - condition: - - - operator: isExists - left: - value: - complex: - root: Severities - filters: - - - operator: containsGeneral - left: - value: - simple: Severities.DBotScoreSeverity - iscontext: true - right: - value: - simple: Low - ignorecase: true - - operator: containsGeneral - left: - value: - simple: Severities.CriticalAssetsSeverity - iscontext: true - right: - value: - simple: Low - ignorecase: true - - operator: containsGeneral - left: - value: - simple: Severities.EmailAuthenticitySeverity - iscontext: true - right: - value: - simple: Low - ignorecase: true - - operator: isEqualString - left: - value: - simple: Severities.IncidentSeverity - iscontext: true - right: - value: - simple: "1" - ignorecase: true - iscontext: true - view: |- - { - "position": { - "x": 910, - "y": 570 - } - } - note: false - timertriggers: [] - ignoreworker: false - "16": - id: "16" - taskid: 69f21366-2cbf-4803-8090-ec97bc904a2f - type: regular - task: - id: 69f21366-2cbf-4803-8090-ec97bc904a2f - version: -1 - name: Get current incident severity - description: Sets the current severity of the incident in the context. - scriptName: Set - type: regular - iscommand: false - brand: "" - nexttasks: - '#none#': - - "15" - scriptarguments: - append: - simple: "true" - key: - simple: Severities.IncidentSeverity - value: - complex: - root: incident - accessor: severity - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 1120, - "y": 185 - } - } - note: false - timertriggers: [] - ignoreworker: false - "18": - id: "18" - taskid: 774bb421-1d10-4c1e-8228-8e1d33544fd2 - type: playbook - task: - id: 774bb421-1d10-4c1e-8228-8e1d33544fd2 - version: -1 - name: Calculate Severity - Critical Assets v2 - description: "Determines if a critical assest is associated with the invesigation. - The playbook returns a severity level of \"Critical\" if a critical asset - is associated with the investigation.\n\nThis playbook verifies if a user - account or an endpoint is part of a critical list or a critical AD group. " - playbookName: Calculate Severity - Critical Assets v2 - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "15" - scriptarguments: - Account: - complex: - root: inputs.Account - transformers: - - operator: uniq - CriticalEndpoints: - complex: - root: inputs.CriticalEndpoints - transformers: - - operator: uniq - CriticalGroups: - complex: - root: inputs.CriticalGroups - transformers: - - operator: uniq - CriticalUsers: - complex: - root: inputs.CriticalUsers - transformers: - - operator: uniq - Endpoint: - complex: - root: inputs.Endpoint - transformers: - - operator: uniq - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 700, - "y": 185 - } - } - note: false - timertriggers: [] - ignoreworker: false - "19": - id: "19" - taskid: d1938384-3c5b-4620-88a2-f559f1e720f4 - type: playbook - task: - id: d1938384-3c5b-4620-88a2-f559f1e720f4 - version: -1 - name: Calculate Severity - DBotScore v2 - description: Calculates the incident severity level according to the highest - indicator DBotScore. - playbookName: Calculate Severity By Highest DBotScore - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "15" - scriptarguments: - DBotScore: - complex: - root: inputs.DBotScore - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 1533, - "y": 185 - } - } - note: false - timertriggers: [] - ignoreworker: false - "24": - id: "24" - taskid: f5cdef97-77e2-438b-898e-a4f0a22e343b - type: playbook - task: - id: f5cdef97-77e2-438b-898e-a4f0a22e343b - version: -1 - name: Calculate Severity - Email Authenticity - description: Calculates a severity score according to the verdict coming from - the CheckEmailAuthenticity script. - playbookName: Calculate Severity By Email Authenticity - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "15" - scriptarguments: - EmailAuthenticityCheck: - complex: - root: inputs.EmailAuthenticityCheck - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 280, - "y": 185 - } - } - note: false - timertriggers: [] - ignoreworker: false - "25": - id: "25" - taskid: 429d77e2-31e3-4796-8b53-655951abeedf - type: regular - task: - id: 429d77e2-31e3-4796-8b53-655951abeedf - version: -1 - name: Set incident severity level to "Unknown" - description: Sets the incident severity to "Unknown". - script: Builtin|||setIncident - type: regular - iscommand: true - brand: Builtin - nexttasks: - '#none#': - - "10" - scriptarguments: - addLabels: {} - affecteddata: {} - affecteddatatype: {} - affectedhosts: {} - affectedindividualscontactinformation: {} - affectedips: {} - app: {} - approximatenumberofaffecteddatasubjects: {} - assetid: {} - attachmentcount: {} - attachmentextension: {} - attachmenthash: {} - attachmentid: {} - attachmentitem: {} - attachmentname: {} - attachmentsize: {} - attachmenttype: {} - backupowner: {} - bugtraq: {} - campaigntargetcount: {} - campaigntargets: {} - city: {} - closeNotes: {} - closeReason: {} - companyaddress: {} - companycity: {} - companycountry: {} - companyhasinsuranceforthebreach: {} - companyname: {} - companypostalcode: {} - contactaddress: {} - contactname: {} - country: {} - countrywherebusinesshasitsmainestablishment: {} - countrywherethebreachtookplace: {} - criticalassets: {} - customFields: {} - cve: {} - cvss: {} - dataencryptionstatus: {} - datetimeofthebreach: {} - daysbetweenreportcreation: {} - deleteEmptyField: {} - dest: {} - destinationip: {} - destntdomain: {} - details: {} - detectedusers: {} - dpoemailaddress: {} - duration: {} - emailaddress: {} - emailauthenticitycheck: {} - emailbcc: {} - emailbody: {} - emailbodyformat: {} - emailbodyhtml: {} - emailbodyhtmlraw: {} - emailcc: {} - emailclassification: {} - emailclientname: {} - emailfrom: {} - emailfromdisplayname: {} - emailhtml: {} - emailinreplyto: {} - emailkeywords: {} - emailmessageid: {} - emailreceived: {} - emailreplyto: {} - emailreturnpath: {} - emailsenderdomain: {} - emailsenderip: {} - emailsize: {} - emailsource: {} - emailsubject: {} - emailsubjectlanguage: {} - emailto: {} - emailtocount: {} - emailurlclicked: {} - eventid: {} - falses: {} - fetchid: {} - fetchtype: {} - filehash: {} - filename: {} - filepath: {} - hostid: {} - hostname: {} - htmlimage: {} - htmlrenderedimage: {} - id: {} - important: {} - importantfield: {} - isthedatasubjecttodpia: {} - labels: {} - likelyimpact: {} - maliciouscauseifthecauseisamaliciousattack: {} - malwarefamily: {} - mdtest: {} - measurestomitigate: {} - myfield: {} - name: {} - occurred: {} - owner: {} - phase: {} - phishingsubtype: {} - possiblecauseofthebreach: {} - postalcode: {} - relateddomain: {} - replacePlaybook: {} - reporteduser: {} - reportinguser: {} - roles: {} - screenshot: {} - screenshot2: {} - sectorofaffectedparty: {} - selector: {} - severity: - simple: unknown - signature: {} - single: {} - single2: {} - sizenumberofemployees: {} - sizeturnover: {} - sla: {} - slaField: {} - source: {} - src: {} - srcntdomain: {} - srcuser: {} - systems: {} - telephoneno: {} - test: {} - test2: {} - testfield: {} - timeassignedtolevel2: {} - timefield1: {} - timelevel1: {} - type: {} - user: {} - username: {} - vendorid: {} - vendorproduct: {} - vulnerabilitycategory: {} - whereisdatahosted: {} - xdr: {} - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 910, - "y": 865 - } - } - note: false - timertriggers: [] - ignoreworker: false -view: |- - { - "linkLabelsPosition": { - "15_11_Critical": 0.9, - "15_25_#default#": 0.59, - "15_4_Low": 0.9, - "15_5_Medium": 0.81, - "15_6_High": 0.82 - }, - "paper": { - "dimensions": { - "height": 1085, - "width": 2068, - "x": 62, - "y": 30 - } - } - } -inputs: -- key: DBotScore - value: - complex: - root: DBotScore - required: false - description: 'Array of all indicators associated with the incident. ' -- key: CriticalUsers - value: - simple: admin,administrator - required: false - description: CSV of usernames of critical users. -- key: CriticalEndpoints - value: - simple: admin - required: false - description: CSV of hostnames of critical endpoints. -- key: CriticalGroups - value: - simple: admins,administrators - required: false - description: CSV of DN names of critical AD groups. -- key: Account - value: - complex: - root: Account - transformers: - - operator: uniq - required: false - description: User accounts to check against the critical lists. -- key: Endpoint - value: - complex: - root: Endpoint - transformers: - - operator: uniq - required: false - description: Endpoints to check against the CriticalEndpoints list. -- key: EmailAuthenticityCheck - value: - complex: - root: Email - accessor: AuthenticityCheck - transformers: - - operator: uniq - required: false - description: 'Indicates the email authenticity resulting from the EmailAuthenticityCheck - script. Possible values are: Pass, Fail, Suspicious, and Undetermined.' -outputs: -- contextPath: CriticalAssets - description: All critical assets involved in the incident. - type: unknown -- contextPath: CriticalAssets.CriticalEndpoints - description: Critical endpoints involved in the incident. - type: unknown -- contextPath: CriticalAssets.CriticalEndpointGroups - description: Critical endpoint-groups involved in the incident. - type: unknown -- contextPath: CriticalAssets.CriticalUsers - description: Critical users involved in the incident. - type: unknown -- contextPath: CriticalAssets.CriticalUserGroups - description: Critical user-groups involved in the incident. - type: unknown -tests: - - Calculate Severity - Generic v2 - Test +id: Calculate Severity - Generic v2 +version: -1 +name: Calculate Severity - Generic v2 +description: |- + Calculate and assign the incident severity based on the highest returned severity level from the following calculations: + + - DBotScores of indicators + - Critical assets + - Email authenticity + - Current incident severity +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: d3a3d290-90e0-4101-8f6c-aaa23bcc3e1c + type: start + task: + id: d3a3d290-90e0-4101-8f6c-aaa23bcc3e1c + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "16" + - "19" + - "18" + - "24" + separatecontext: false + view: |- + { + "position": { + "x": 910, + "y": 30 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "4": + id: "4" + taskid: cf430274-2565-4433-8dfe-a25a621b0a7c + type: regular + task: + id: cf430274-2565-4433-8dfe-a25a621b0a7c + version: -1 + name: Set incident severity to "Low" + description: Sets the incident severity to "Low". + script: Builtin|||setIncident + type: regular + iscommand: true + brand: Builtin + nexttasks: + '#none#': + - "10" + scriptarguments: + addLabels: {} + affecteddata: {} + affecteddatatype: {} + affectedhosts: {} + affectedindividualscontactinformation: {} + affectedips: {} + app: {} + approximatenumberofaffecteddatasubjects: {} + arcsightcaseid: {} + assetid: {} + attachmentcount: {} + attachmentextension: {} + attachmenthash: {} + attachmentid: {} + attachmentitem: {} + attachmentname: {} + attachmentsize: {} + attachmenttype: {} + backupowner: {} + blah: {} + booltest: {} + bugtraq: {} + city: {} + closeNotes: {} + closeReason: {} + companyaddress: {} + companycity: {} + companycountry: {} + companyhasinsuranceforthebreach: {} + companyname: {} + companypostalcode: {} + contactaddress: {} + contactname: {} + country: {} + countrywherebusinesshasitsmainestablishment: {} + countrywherethebreachtookplace: {} + criticalassets: {} + customFields: {} + cve: {} + cvss: {} + dataencryptionstatus: {} + datetimeofthebreach: {} + daysbetweenreportcreation: {} + deleteEmptyField: {} + dest: {} + destinationip: {} + destntdomain: {} + details: {} + detectedusers: {} + dpoemailaddress: {} + duration: {} + emailaddress: {} + emailauthenticitycheck: {} + emailbcc: {} + emailbody: {} + emailbodyformat: {} + emailbodyhtml: {} + emailbodyhtmlraw: {} + emailcc: {} + emailclassification: {} + emailclientname: {} + emailfrom: {} + emailfromdisplayname: {} + emailhtml: {} + emailinreplyto: {} + emailkeywords: {} + emailmessageid: {} + emailreceived: {} + emailreplyto: {} + emailreturnpath: {} + emailsenderdomain: {} + emailsenderip: {} + emailsize: {} + emailsource: {} + emailsubject: {} + emailsubjectlanguage: {} + emailto: {} + emailtocount: {} + emailurlclicked: {} + eventid: {} + falses: {} + fetchid: {} + fetchtype: {} + filehash: {} + filename: {} + filepath: {} + hostid: {} + hostname: {} + htmlimage: {} + htmlrenderedimage: {} + id: {} + important: {} + importantfield: {} + isthedatasubjecttodpia: {} + killchain: {} + labels: {} + likelyimpact: {} + lob: {} + maliciouscauseifthecauseisamaliciousattack: {} + malwarefamily: {} + mdtest: {} + measurestomitigate: {} + myfield: {} + name: {} + occurred: {} + owner: {} + phase: {} + phishingsubtype: {} + possiblecauseofthebreach: {} + postalcode: {} + queues: {} + relateddomain: {} + replacePlaybook: {} + reporteduser: {} + reportinguser: {} + roles: {} + screenshot: {} + screenshot2: {} + sectorofaffectedparty: {} + selector: {} + severity: + simple: low + signature: {} + single: {} + single2: {} + sizenumberofemployees: {} + sizeturnover: {} + sla: {} + slaField: {} + source: {} + src: {} + srcntdomain: {} + srcuser: {} + systems: {} + team: {} + telephoneno: {} + test: {} + test2: {} + testfield: {} + timeassignedtolevel2: {} + timefield1: {} + timelevel1: {} + type: {} + user: {} + username: {} + vendorid: {} + vendorproduct: {} + vulnerabilitycategory: {} + whereisdatahosted: {} + xdr: {} + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 62, + "y": 770 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "5": + id: "5" + taskid: 4def42ba-2984-40f3-83c0-ec484edc3b97 + type: regular + task: + id: 4def42ba-2984-40f3-83c0-ec484edc3b97 + version: -1 + name: Set incident severity to "Medium" + description: Sets the incident severity to "Medium". + script: Builtin|||setIncident + type: regular + iscommand: true + brand: Builtin + nexttasks: + '#none#': + - "10" + scriptarguments: + addLabels: {} + affecteddata: {} + affecteddatatype: {} + affectedhosts: {} + affectedindividualscontactinformation: {} + affectedips: {} + app: {} + approximatenumberofaffecteddatasubjects: {} + arcsightcaseid: {} + assetid: {} + attachmentcount: {} + attachmentextension: {} + attachmenthash: {} + attachmentid: {} + attachmentitem: {} + attachmentname: {} + attachmentsize: {} + attachmenttype: {} + backupowner: {} + blah: {} + booltest: {} + bugtraq: {} + campaigntargetcount: {} + campaigntargets: {} + city: {} + closeNotes: {} + closeReason: {} + companyaddress: {} + companycity: {} + companycountry: {} + companyhasinsuranceforthebreach: {} + companyname: {} + companypostalcode: {} + contactaddress: {} + contactname: {} + country: {} + countrywherebusinesshasitsmainestablishment: {} + countrywherethebreachtookplace: {} + criticalassets: {} + customFields: {} + cve: {} + cvss: {} + dataencryptionstatus: {} + datetimeofthebreach: {} + daysbetweenreportcreation: {} + deleteEmptyField: {} + dest: {} + destinationip: {} + destntdomain: {} + details: {} + detectedusers: {} + dpoemailaddress: {} + duration: {} + emailaddress: {} + emailauthenticitycheck: {} + emailbcc: {} + emailbody: {} + emailbodyformat: {} + emailbodyhtml: {} + emailbodyhtmlraw: {} + emailcc: {} + emailclassification: {} + emailclientname: {} + emailfrom: {} + emailfromdisplayname: {} + emailhtml: {} + emailinreplyto: {} + emailkeywords: {} + emailmessageid: {} + emailreceived: {} + emailreplyto: {} + emailreturnpath: {} + emailsenderdomain: {} + emailsenderip: {} + emailsize: {} + emailsource: {} + emailsubject: {} + emailsubjectlanguage: {} + emailto: {} + emailtocount: {} + emailurlclicked: {} + eventid: {} + falses: {} + fetchid: {} + fetchtype: {} + filehash: {} + filename: {} + filepath: {} + hostid: {} + hostname: {} + htmlimage: {} + htmlrenderedimage: {} + id: {} + important: {} + importantfield: {} + isthedatasubjecttodpia: {} + killchain: {} + labels: {} + likelyimpact: {} + lob: {} + maliciouscauseifthecauseisamaliciousattack: {} + malwarefamily: {} + mdtest: {} + measurestomitigate: {} + myfield: {} + name: {} + occurred: {} + owner: {} + phase: {} + phishingsubtype: {} + possiblecauseofthebreach: {} + postalcode: {} + queues: {} + relateddomain: {} + replacePlaybook: {} + reporteduser: {} + reportinguser: {} + roles: {} + screenshot: {} + screenshot2: {} + sectorofaffectedparty: {} + selector: {} + severity: + simple: medium + signature: {} + single: {} + single2: {} + sizenumberofemployees: {} + sizeturnover: {} + sla: {} + slaField: {} + source: {} + src: {} + srcntdomain: {} + srcuser: {} + systems: {} + team: {} + telephoneno: {} + test: {} + test2: {} + testfield: {} + timeassignedtolevel2: {} + timefield1: {} + timelevel1: {} + type: {} + user: {} + username: {} + vendorid: {} + vendorproduct: {} + vulnerabilitycategory: {} + whereisdatahosted: {} + xdr: {} + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 483, + "y": 770 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "6": + id: "6" + taskid: 132c16ae-fb69-4752-8f79-77923b14ca8c + type: regular + task: + id: 132c16ae-fb69-4752-8f79-77923b14ca8c + version: -1 + name: Set incident severity to "High" + description: Sets the incident severity to "High". + script: Builtin|||setIncident + type: regular + iscommand: true + brand: Builtin + nexttasks: + '#none#': + - "10" + scriptarguments: + addLabels: {} + affecteddata: {} + affecteddatatype: {} + affectedhosts: {} + affectedindividualscontactinformation: {} + affectedips: {} + app: {} + approximatenumberofaffecteddatasubjects: {} + arcsightcaseid: {} + assetid: {} + attachmentcount: {} + attachmentextension: {} + attachmenthash: {} + attachmentid: {} + attachmentitem: {} + attachmentname: {} + attachmentsize: {} + attachmenttype: {} + backupowner: {} + blah: {} + booltest: {} + bugtraq: {} + city: {} + closeNotes: {} + closeReason: {} + companyaddress: {} + companycity: {} + companycountry: {} + companyhasinsuranceforthebreach: {} + companyname: {} + companypostalcode: {} + contactaddress: {} + contactname: {} + country: {} + countrywherebusinesshasitsmainestablishment: {} + countrywherethebreachtookplace: {} + customFields: {} + cve: {} + cvss: {} + dataencryptionstatus: {} + datetimeofthebreach: {} + daysbetweenreportcreation: {} + deleteEmptyField: {} + dest: {} + destinationip: {} + destntdomain: {} + details: {} + detectedusers: {} + dpoemailaddress: {} + duration: {} + emailaddress: {} + emailbcc: {} + emailbody: {} + emailbodyformat: {} + emailbodyhtml: {} + emailbodyhtmlraw: {} + emailcc: {} + emailclassification: {} + emailclientname: {} + emailfrom: {} + emailfromdisplayname: {} + emailhtml: {} + emailinreplyto: {} + emailkeywords: {} + emailmessageid: {} + emailreceived: {} + emailreplyto: {} + emailreturnpath: {} + emailsenderdomain: {} + emailsenderip: {} + emailsize: {} + emailsource: {} + emailsubject: {} + emailsubjectlanguage: {} + emailto: {} + emailtocount: {} + emailurlclicked: {} + eventid: {} + falses: {} + fetchid: {} + fetchtype: {} + filehash: {} + filename: {} + filepath: {} + hostid: {} + hostname: {} + htmlimage: {} + htmlrenderedimage: {} + id: {} + important: {} + importantfield: {} + isthedatasubjecttodpia: {} + killchain: {} + labels: {} + likelyimpact: {} + lob: {} + maliciouscauseifthecauseisamaliciousattack: {} + malwarefamily: {} + mdtest: {} + measurestomitigate: {} + myfield: {} + name: {} + occurred: {} + owner: {} + phase: {} + phishingsubtype: {} + possiblecauseofthebreach: {} + postalcode: {} + queues: {} + relateddomain: {} + replacePlaybook: {} + reporteduser: {} + reportinguser: {} + roles: {} + screenshot: {} + screenshot2: {} + sectorofaffectedparty: {} + selector: {} + severity: + simple: high + signature: {} + single: {} + single2: {} + sizenumberofemployees: {} + sizeturnover: {} + sla: {} + slaField: {} + source: {} + src: {} + srcntdomain: {} + srcuser: {} + systems: {} + team: {} + telephoneno: {} + test: {} + test2: {} + testfield: {} + timeassignedtolevel2: {} + timefield1: {} + timelevel1: {} + type: {} + user: {} + username: {} + vendorid: {} + vendorproduct: {} + vulnerabilitycategory: {} + whereisdatahosted: {} + xdr: {} + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 1333, + "y": 770 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "10": + id: "10" + taskid: 8ee3e05c-0da8-405d-8bb8-a2d7bbf7789f + type: title + task: + id: 8ee3e05c-0da8-405d-8bb8-a2d7bbf7789f + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 910, + "y": 1050 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "11": + id: "11" + taskid: c7b36df3-1ae7-4b18-819f-9b85d96c4858 + type: regular + task: + id: c7b36df3-1ae7-4b18-819f-9b85d96c4858 + version: -1 + name: Set incident severity to "Critical" + description: Sets the incident severity to "Critical". + script: Builtin|||setIncident + type: regular + iscommand: true + brand: Builtin + nexttasks: + '#none#': + - "10" + scriptarguments: + addLabels: {} + affecteddata: {} + affecteddatatype: {} + affectedhosts: {} + affectedindividualscontactinformation: {} + affectedips: {} + app: {} + approximatenumberofaffecteddatasubjects: {} + arcsightcaseid: {} + assetid: {} + attachmentcount: {} + attachmentextension: {} + attachmenthash: {} + attachmentid: {} + attachmentitem: {} + attachmentname: {} + attachmentsize: {} + attachmenttype: {} + backupowner: {} + blah: {} + booltest: {} + bugtraq: {} + city: {} + closeNotes: {} + closeReason: {} + companyaddress: {} + companycity: {} + companycountry: {} + companyhasinsuranceforthebreach: {} + companyname: {} + companypostalcode: {} + contactaddress: {} + contactname: {} + country: {} + countrywherebusinesshasitsmainestablishment: {} + countrywherethebreachtookplace: {} + customFields: {} + cve: {} + cvss: {} + dataencryptionstatus: {} + datetimeofthebreach: {} + daysbetweenreportcreation: {} + deleteEmptyField: {} + dest: {} + destinationip: {} + destntdomain: {} + details: {} + detectedusers: {} + dpoemailaddress: {} + duration: {} + emailaddress: {} + emailbcc: {} + emailbody: {} + emailbodyformat: {} + emailbodyhtml: {} + emailbodyhtmlraw: {} + emailcc: {} + emailclassification: {} + emailclientname: {} + emailfrom: {} + emailfromdisplayname: {} + emailhtml: {} + emailinreplyto: {} + emailkeywords: {} + emailmessageid: {} + emailreceived: {} + emailreplyto: {} + emailreturnpath: {} + emailsenderdomain: {} + emailsenderip: {} + emailsize: {} + emailsource: {} + emailsubject: {} + emailsubjectlanguage: {} + emailto: {} + emailtocount: {} + emailurlclicked: {} + eventid: {} + falses: {} + fetchid: {} + fetchtype: {} + filehash: {} + filename: {} + filepath: {} + hostid: {} + hostname: {} + htmlimage: {} + htmlrenderedimage: {} + id: {} + important: {} + importantfield: {} + isthedatasubjecttodpia: {} + labels: {} + likelyimpact: {} + maliciouscauseifthecauseisamaliciousattack: {} + malwarefamily: {} + mdtest: {} + measurestomitigate: {} + myfield: {} + name: {} + occurred: {} + owner: {} + phase: {} + phishingsubtype: {} + possiblecauseofthebreach: {} + postalcode: {} + relateddomain: {} + replacePlaybook: {} + reporteduser: {} + reportinguser: {} + roles: {} + screenshot: {} + screenshot2: {} + sectorofaffectedparty: {} + selector: {} + severity: + simple: critical + signature: {} + single: {} + single2: {} + sizenumberofemployees: {} + sizeturnover: {} + sla: {} + slaField: {} + source: {} + src: {} + srcntdomain: {} + srcuser: {} + systems: {} + team: {} + telephoneno: {} + test: {} + test2: {} + testfield: {} + timeassignedtolevel2: {} + timefield1: {} + timelevel1: {} + type: {} + user: {} + username: {} + vendorid: {} + vendorproduct: {} + vulnerabilitycategory: {} + whereisdatahosted: {} + xdr: {} + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 1750, + "y": 770 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "15": + id: "15" + taskid: bbfdfe72-13f4-48a2-8cbb-79fd7952704b + type: condition + task: + id: bbfdfe72-13f4-48a2-8cbb-79fd7952704b + version: -1 + name: Determine incident severity + description: Determines the severity level based on the highest result of all + severity calculations. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "25" + Critical: + - "11" + High: + - "6" + Low: + - "4" + Medium: + - "5" + separatecontext: false + conditions: + - label: Critical + condition: + - - operator: isExists + left: + value: + complex: + root: Severities + filters: + - - operator: containsGeneral + left: + value: + simple: Severities.DBotScoreSeverity + iscontext: true + right: + value: + simple: Critical + ignorecase: true + - operator: containsGeneral + left: + value: + simple: Severities.CriticalAssetsSeverity + iscontext: true + right: + value: + simple: Critical + ignorecase: true + - operator: containsGeneral + left: + value: + simple: Severities.EmailAuthenticitySeverity + iscontext: true + right: + value: + simple: Critical + ignorecase: true + - operator: isEqualString + left: + value: + simple: Severities.IncidentSeverity + iscontext: true + right: + value: + simple: "4" + ignorecase: true + iscontext: true + - label: High + condition: + - - operator: isExists + left: + value: + complex: + root: Severities + filters: + - - operator: containsGeneral + left: + value: + simple: Severities.DBotScoreSeverity + iscontext: true + right: + value: + simple: High + ignorecase: true + - operator: containsGeneral + left: + value: + simple: Severities.CriticalAssetsSeverity + iscontext: true + right: + value: + simple: High + ignorecase: true + - operator: containsGeneral + left: + value: + simple: Severities.EmailAuthenticitySeverity + iscontext: true + right: + value: + simple: High + ignorecase: true + - operator: isEqualString + left: + value: + simple: Severities.IncidentSeverity + iscontext: true + right: + value: + simple: "3" + ignorecase: true + iscontext: true + - label: Medium + condition: + - - operator: isExists + left: + value: + complex: + root: Severities + filters: + - - operator: containsGeneral + left: + value: + simple: Severities.DBotScoreSeverity + iscontext: true + right: + value: + simple: Medium + ignorecase: true + - operator: containsGeneral + left: + value: + simple: Severities.CriticalAssetsSeverity + iscontext: true + right: + value: + simple: Medium + ignorecase: true + - operator: containsGeneral + left: + value: + simple: Severities.EmailAuthenticitySeverity + iscontext: true + right: + value: + simple: Medium + - operator: isEqualString + left: + value: + simple: Severities.IncidentSeverity + iscontext: true + right: + value: + simple: "2" + ignorecase: true + iscontext: true + ignorecase: true + - label: Low + condition: + - - operator: isExists + left: + value: + complex: + root: Severities + filters: + - - operator: containsGeneral + left: + value: + simple: Severities.DBotScoreSeverity + iscontext: true + right: + value: + simple: Low + ignorecase: true + - operator: containsGeneral + left: + value: + simple: Severities.CriticalAssetsSeverity + iscontext: true + right: + value: + simple: Low + ignorecase: true + - operator: containsGeneral + left: + value: + simple: Severities.EmailAuthenticitySeverity + iscontext: true + right: + value: + simple: Low + ignorecase: true + - operator: isEqualString + left: + value: + simple: Severities.IncidentSeverity + iscontext: true + right: + value: + simple: "1" + ignorecase: true + iscontext: true + view: |- + { + "position": { + "x": 910, + "y": 570 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "16": + id: "16" + taskid: 740266f8-5732-4285-81a1-d19dbea15988 + type: regular + task: + id: 740266f8-5732-4285-81a1-d19dbea15988 + version: -1 + name: Get current incident severity + description: Sets the current severity of the incident in the context. + scriptName: Set + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "15" + scriptarguments: + append: + simple: "true" + key: + simple: Severities.IncidentSeverity + value: + complex: + root: incident + accessor: severity + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 1120, + "y": 185 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "18": + id: "18" + taskid: 29bad58f-8797-49ff-8681-68363fc8e9a5 + type: playbook + task: + id: 29bad58f-8797-49ff-8681-68363fc8e9a5 + version: -1 + name: Calculate Severity - Critical Assets v2 + description: |- + Determines if a critical assest is associated with the invesigation. The playbook returns a severity level of "Critical" if at least one critical asset is associated with the investigation. + Critical assets refer to: users, user groups, endpoints and endpoint groups. + playbookName: Calculate Severity - Critical Assets v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "15" + scriptarguments: + Account: + complex: + root: inputs.Account + transformers: + - operator: uniq + CriticalEndpoints: + complex: + root: inputs.CriticalEndpoints + transformers: + - operator: uniq + CriticalGroups: + complex: + root: inputs.CriticalGroups + transformers: + - operator: uniq + CriticalUsers: + complex: + root: inputs.CriticalUsers + transformers: + - operator: uniq + Endpoint: + complex: + root: inputs.Endpoint + transformers: + - operator: uniq + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 700, + "y": 185 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "19": + id: "19" + taskid: b20ff842-f44e-4314-8d7a-ce51e1d69c16 + type: playbook + task: + id: b20ff842-f44e-4314-8d7a-ce51e1d69c16 + version: -1 + name: Calculate Severity By Highest DBotScore + description: Calculates the incident severity level according to the highest + indicator DBotScore. + playbookName: Calculate Severity By Highest DBotScore + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "15" + scriptarguments: + DBotScore: + complex: + root: inputs.DBotScore + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 1533, + "y": 185 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "24": + id: "24" + taskid: 1a13e3e0-18fb-4c0f-8866-9d56b0df1017 + type: playbook + task: + id: 1a13e3e0-18fb-4c0f-8866-9d56b0df1017 + version: -1 + name: Calculate Severity By Email Authenticity + description: Calculates a severity according to the verdict coming from the + CheckEmailAuthenticity script. + playbookName: Calculate Severity By Email Authenticity + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "15" + scriptarguments: + EmailAuthenticityCheck: + complex: + root: inputs.EmailAuthenticityCheck + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 280, + "y": 185 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "25": + id: "25" + taskid: e042ddb9-d13d-492a-8ac4-95edfbf9a927 + type: regular + task: + id: e042ddb9-d13d-492a-8ac4-95edfbf9a927 + version: -1 + name: Set incident severity level to "Unknown" + description: Sets the incident severity to "Unknown". + script: Builtin|||setIncident + type: regular + iscommand: true + brand: Builtin + nexttasks: + '#none#': + - "10" + scriptarguments: + addLabels: {} + affecteddata: {} + affecteddatatype: {} + affectedhosts: {} + affectedindividualscontactinformation: {} + affectedips: {} + app: {} + approximatenumberofaffecteddatasubjects: {} + assetid: {} + attachmentcount: {} + attachmentextension: {} + attachmenthash: {} + attachmentid: {} + attachmentitem: {} + attachmentname: {} + attachmentsize: {} + attachmenttype: {} + backupowner: {} + bugtraq: {} + campaigntargetcount: {} + campaigntargets: {} + city: {} + closeNotes: {} + closeReason: {} + companyaddress: {} + companycity: {} + companycountry: {} + companyhasinsuranceforthebreach: {} + companyname: {} + companypostalcode: {} + contactaddress: {} + contactname: {} + country: {} + countrywherebusinesshasitsmainestablishment: {} + countrywherethebreachtookplace: {} + criticalassets: {} + customFields: {} + cve: {} + cvss: {} + dataencryptionstatus: {} + datetimeofthebreach: {} + daysbetweenreportcreation: {} + deleteEmptyField: {} + dest: {} + destinationip: {} + destntdomain: {} + details: {} + detectedusers: {} + dpoemailaddress: {} + duration: {} + emailaddress: {} + emailauthenticitycheck: {} + emailbcc: {} + emailbody: {} + emailbodyformat: {} + emailbodyhtml: {} + emailbodyhtmlraw: {} + emailcc: {} + emailclassification: {} + emailclientname: {} + emailfrom: {} + emailfromdisplayname: {} + emailhtml: {} + emailinreplyto: {} + emailkeywords: {} + emailmessageid: {} + emailreceived: {} + emailreplyto: {} + emailreturnpath: {} + emailsenderdomain: {} + emailsenderip: {} + emailsize: {} + emailsource: {} + emailsubject: {} + emailsubjectlanguage: {} + emailto: {} + emailtocount: {} + emailurlclicked: {} + eventid: {} + falses: {} + fetchid: {} + fetchtype: {} + filehash: {} + filename: {} + filepath: {} + hostid: {} + hostname: {} + htmlimage: {} + htmlrenderedimage: {} + id: {} + important: {} + importantfield: {} + isthedatasubjecttodpia: {} + labels: {} + likelyimpact: {} + maliciouscauseifthecauseisamaliciousattack: {} + malwarefamily: {} + mdtest: {} + measurestomitigate: {} + myfield: {} + name: {} + occurred: {} + owner: {} + phase: {} + phishingsubtype: {} + possiblecauseofthebreach: {} + postalcode: {} + relateddomain: {} + replacePlaybook: {} + reporteduser: {} + reportinguser: {} + roles: {} + screenshot: {} + screenshot2: {} + sectorofaffectedparty: {} + selector: {} + severity: + simple: unknown + signature: {} + single: {} + single2: {} + sizenumberofemployees: {} + sizeturnover: {} + sla: {} + slaField: {} + source: {} + src: {} + srcntdomain: {} + srcuser: {} + systems: {} + telephoneno: {} + test: {} + test2: {} + testfield: {} + timeassignedtolevel2: {} + timefield1: {} + timelevel1: {} + type: {} + user: {} + username: {} + vendorid: {} + vendorproduct: {} + vulnerabilitycategory: {} + whereisdatahosted: {} + xdr: {} + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 910, + "y": 865 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +system: true +view: |- + { + "linkLabelsPosition": { + "15_11_Critical": 0.9, + "15_25_#default#": 0.59, + "15_4_Low": 0.9, + "15_5_Medium": 0.81, + "15_6_High": 0.82 + }, + "paper": { + "dimensions": { + "height": 1085, + "width": 2068, + "x": 62, + "y": 30 + } + } + } +inputs: +- key: DBotScore + value: + complex: + root: DBotScore + required: false + description: 'Array of all indicators associated with the incident. ' + playbookInputQuery: +- key: CriticalUsers + value: + simple: admin,administrator + required: false + description: CSV of usernames of critical users. + playbookInputQuery: +- key: CriticalEndpoints + value: + simple: admin + required: false + description: CSV of hostnames of critical endpoints. + playbookInputQuery: +- key: CriticalGroups + value: + simple: admins,administrators + required: false + description: CSV of DN names of critical AD groups. + playbookInputQuery: +- key: Account + value: + complex: + root: Account + transformers: + - operator: uniq + required: false + description: User accounts to check against the critical lists. + playbookInputQuery: +- key: Endpoint + value: + complex: + root: Endpoint + transformers: + - operator: uniq + required: false + description: Endpoints to check against the CriticalEndpoints list. + playbookInputQuery: +- key: EmailAuthenticityCheck + value: + complex: + root: Email + accessor: AuthenticityCheck + transformers: + - operator: uniq + required: false + description: 'Indicates the email authenticity resulting from the EmailAuthenticityCheck + script. Possible values are: Pass, Fail, Suspicious, and Undetermined.' + playbookInputQuery: +outputs: +- contextPath: CriticalAssets + description: All critical assets involved in the incident. + type: unknown +- contextPath: CriticalAssets.CriticalEndpoints + description: Critical endpoints involved in the incident. + type: unknown +- contextPath: CriticalAssets.CriticalEndpointGroups + description: Critical endpoint-groups involved in the incident. + type: unknown +- contextPath: CriticalAssets.CriticalUsers + description: Critical users involved in the incident. + type: unknown +- contextPath: CriticalAssets.CriticalUserGroups + description: Critical user-groups involved in the incident. + type: unknown +fromversion: 4.5.0 +tests: +- Calculate Severity - Generic v2 - Test diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Detonate_File_-_Generic.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Detonate_File_-_Generic.yml index 1f412ca5010..580d458676d 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Detonate_File_-_Generic.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Detonate_File_-_Generic.yml @@ -1,1022 +1,1099 @@ -id: Detonate File - Generic -version: -1 -name: Detonate File - Generic -fromversion: 4.0.0 -description: Detonate file through active integrations that support file detonation -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: 454650df-c42f-4915-84cf-9a908e1bff04 - type: start - task: - id: 454650df-c42f-4915-84cf-9a908e1bff04 - version: -1 - name: "" - description: Playbook start point - iscommand: false - brand: "" - nexttasks: - '#none#': - - "8" - - "10" - - "9" - - "11" - - "13" - - "14" - - "15" - - "16" - - "17" - - "18" - - "19" - - "20" - separatecontext: false - view: |- - { - "position": { - "x": 2200, - "y": 50 - } - } - note: false - timertriggers: [] - ignoreworker: false - "3": - id: "3" - taskid: 2a8f5bbb-7692-4ece-8abe-9801c7b05c3c - type: title - task: - id: 2a8f5bbb-7692-4ece-8abe-9801c7b05c3c - version: -1 - name: Done - description: Done - type: title - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 2200, - "y": 370 - } - } - note: false - timertriggers: [] - ignoreworker: false - "8": - id: "8" - taskid: f6627718-5952-4240-8fba-104c1350e79b - type: playbook - task: - id: f6627718-5952-4240-8fba-104c1350e79b - version: -1 - name: Detonate File - JoeSecurity - description: |- - Detonates one or more files using the Joe Security - Joe Sandbox integration. - Returns relevant reports to the War Room and file reputations to the context data. - All file types are supported. - playbookName: Detonate File - JoeSecurity - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - File: - complex: - root: inputs.File - comments: {} - internet-access: - simple: "True" - interval: - simple: "1" - report-file-type: {} - systems: {} - timeout: - simple: "15" - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 50, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "9": - id: "9" - taskid: c04567fa-641d-4b51-8c94-561516554b3d - type: playbook - task: - id: c04567fa-641d-4b51-8c94-561516554b3d - version: -1 - name: ATD - Detonate File - description: |- - Detonates a File using the McAfee Advanced Threat Defense sandbox. - Advanced Threat Defense supports the following File Types: - 32-bit Portable Executables (PE)files; 64-bit PE+files - exe, sys, dll, com, scr, cpl, ocx, cgi - Microsoft Office Suite documents - doc,dotm, docx, dotx, xls, ppam, xlsx, pps, xlsb, ppsx, xlsm, ppsm, ppt, ppt, pptx, pptm, rtf, shs, xltm, sldm, xltx, sldx, xlam, thmx, docm, xar - Just Systems Ichitaro documents - jtd, jtdc - Adobe - pdf, swf - Compressed files - gz, 7z, tgz, msi, zip, lzh, cab, lzma, rar - Android application package - apk, Java, JAR, CLASS, Java Script, Java bin files - Image files - jpeg, png, gif - Other file types - cmd, ace, bat, arj, vbs, chm, xml, lnk, url, mof, htm, ocx, html, potm, eml, potx, msg, ps1, vb, reg, vba, wsc, vbe, wsf, vbs, wsh - playbookName: ATD - Detonate File - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - File: - complex: - root: inputs.File - interval: - simple: "1" - playbook: - simple: default - private: {} - source: {} - tags: {} - timeout: - simple: "15" - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 480, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "10": - id: "10" - taskid: e82f2557-2a9d-4e13-81b1-ad3f4d685f3d - type: playbook - task: - id: e82f2557-2a9d-4e13-81b1-ad3f4d685f3d - version: -1 - name: Detonate File - ThreatGrid - description: Detonate one or more URLs using the Threat Grid integration. This - playbook returns relevant reports to the War Room and URL reputations to the - context data. - playbookName: Detonate File - ThreatGrid - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - File: - complex: - root: inputs.File - FileName: - simple: file-detonated-via-demisto - interval: - simple: "1" - playbook: - simple: default - private: {} - source: {} - tags: {} - timeout: - simple: "15" - vm: {} - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 910, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "11": - id: "11" - taskid: f1c56438-d1b6-4848-8608-c6292f3905b9 - type: playbook - task: - id: f1c56438-d1b6-4848-8608-c6292f3905b9 - version: -1 - name: CrowdStrike Falcon Sandbox - Detonate file - description: Detonate one or more files using the CrowdStrike integration. This - playbook returns relevant reports to the War Room and file reputations to - the context data. The detonation supports the following file types - EXE, - DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, - GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, - BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM - playbookName: CrowdStrike Falcon Sandbox - Detonate file - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - EnvironmentID: - simple: "100" - File: - complex: - root: inputs.File - Interval: - simple: "5" - Timeout: - simple: "30" - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 1340, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "13": - id: "13" - taskid: 0a805640-8d5e-46d4-87f2-04a0781a6ca5 - type: playbook - task: - id: 0a805640-8d5e-46d4-87f2-04a0781a6ca5 - version: -1 - name: WildFire - Detonate file - description: |- - Detonate one or more files using the Wildfire integration. This playbook returns relevant reports to the War Room and file reputations to the context data. - The detonation supports the following file types - - APK, JAR, DOC, DOCX, RTF, XLS, XLSX, PPT, PPTX, XML, PE32, PDF, DMG, PKG, RAR, 7Z - playbookName: WildFire - Detonate file - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - File: - complex: - root: inputs.File - Interval: - simple: "1" - Timeout: - simple: "15" - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 1770, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "14": - id: "14" - taskid: d8093197-7aa9-4b18-8774-563225e8c72b - type: playbook - task: - id: d8093197-7aa9-4b18-8774-563225e8c72b - version: -1 - name: Detonate File - Lastline v2 - description: |- - Detonates a file using the Lastline sandbox. - Lastline supports the following file types: - EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH - playbookName: Detonate File - Lastline v2 - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - File: - complex: - root: inputs.File - Interval: - simple: "1" - Timeout: - simple: "15" - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 2200, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "15": - id: "15" - taskid: 0e879eba-0377-44bf-81c4-83468555fec4 - type: playbook - task: - id: 0e879eba-0377-44bf-81c4-83468555fec4 - version: -1 - name: Detonate File - Cuckoo - description: Detonates a file using Cuckoo sandbox - playbookName: Detonate File - Cuckoo - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - File: - simple: ${inputs.File} - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 2630, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "16": - id: "16" - taskid: e69051d8-12bd-440c-85de-3f3c713d1556 - type: playbook - task: - id: e69051d8-12bd-440c-85de-3f3c713d1556 - version: -1 - name: Detonate File - SNDBOX - description: Detonates a file using SNDBOX - playbookName: Detonate File - SNDBOX - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - File: - complex: - root: File - Interval: - simple: "1" - Timeout: - simple: "15" - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 3060, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "17": - id: "17" - taskid: 8bcf20e7-7f82-434b-8b21-200f3423a0ce - type: playbook - task: - id: 8bcf20e7-7f82-434b-8b21-200f3423a0ce - version: -1 - name: Detonate File - HybridAnalysis - description: Detonates a file using HybridAnalysis - playbookName: Detonate File - HybridAnalysis - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - separatecontext: true - view: |- - { - "position": { - "x": 3490, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "18": - id: "18" - taskid: 11d549c4-31e9-4cd9-8983-9e1a1c7c4baf - type: playbook - task: - id: 11d549c4-31e9-4cd9-8983-9e1a1c7c4baf - version: -1 - name: Detonate File - ANYRUN - description: Detonates a file using ANYRUN - playbookName: Detonate File - ANYRUN - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - separatecontext: true - view: |- - { - "position": { - "x": 3920, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "19": - id: "19" - taskid: 3727eda2-2c84-4730-8739-b54bc07a36c3 - type: playbook - task: - id: 3727eda2-2c84-4730-8739-b54bc07a36c3 - version: -1 - name: Detonate File - FireEye AX - description: Detonates a file using FireEye AX - playbookName: Detonate File - FireEye AX - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - File: - complex: - root: inputs.File - Interval: - simple: "1" - Timeout: - simple: "30" - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 4350, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "20": - id: "20" - taskid: 77b7e144-a6a2-4e93-8e69-1160f9921573 - type: playbook - task: - id: 77b7e144-a6a2-4e93-8e69-1160f9921573 - version: -1 - name: Detonate File - VMRay - description: Detonates a file using VMRay - playbookName: Detonate File - VMRay - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - File: - complex: - root: File - transformers: - - operator: uniq - archive_password: {} - document_password: {} - interval: - simple: "1" - max_jobs: {} - reanalyze: {} - sample_type: {} - shareable: {} - tags: {} - timeout: - simple: "10" - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 4350, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false -view: |- - { - "linkLabelsPosition": {}, - "paper": { - "dimensions": { - "height": 385, - "width": 4680, - "x": 50, - "y": 50 - } - } - } -inputs: -- key: EntryID - value: - complex: - root: File - accessor: EntryID - required: false - description: Entry ID of file to be detonated -- key: File - value: - complex: - root: File - required: false - description: File object of file to be detonated -outputs: -- contextPath: Joe.Analysis.Status - description: Analysis Status - type: string -- contextPath: Joe.Analysis.WebID - description: Web ID - type: string -- contextPath: File.Name - description: Filename (only in case of report type=json) - type: string -- contextPath: File.SHA1 - description: SHA1 of the file - type: string -- contextPath: File.SHA256 - description: SHA256 of the file - type: string -- contextPath: File.Size - description: File size (only in case of report type=json) - type: number -- contextPath: File.Type - description: File type e.g. "PE" (only in case of report type=json) - type: string -- contextPath: File.Malicious - description: The File malicious description - type: unknown -- contextPath: File.Malicious.Description - description: For malicious files, the reason for the vendor to make the decision - type: string -- contextPath: File.Malicious.Vendor - description: For malicious files, the vendor that made the decision - type: string -- contextPath: DBotScore - description: The Indicator's object - type: unknown -- contextPath: DBotScore.Indicator - description: The indicator that was tested - type: string -- contextPath: DBotScore.Score - description: The actual score - type: number -- contextPath: DBotScore.Type - description: The type of the indicator - type: string -- contextPath: DBotScore.Vendor - description: Vendor used to calculate the score - type: string -- contextPath: IP.Address - description: IP's relevant to the sample - type: string -- contextPath: DBotScore.Malicious.Vendor - description: Vendor used to calculate the score - type: string -- contextPath: DBotScore.Malicious.Detections - description: The sub analysis detection statuses - type: string -- contextPath: DBotScore.Malicious.SHA1 - description: The SHA1 of the file - type: string -- contextPath: Sample.State - description: The sample state -- contextPath: Sample.ID - description: The sample ID -- contextPath: File - description: The File's object - type: unknown -- contextPath: File.MD5 - description: MD5 of the file - type: string -- contextPath: Joe.Analysis.SampleName - description: Sample Data, could be a file name or URL - type: string -- contextPath: Joe.Analysis.Comments - description: Analysis Comments - type: string -- contextPath: Joe.Analysis.Time - description: Submitted Time - type: date -- contextPath: Joe.Analysis.Runs - description: Sub-Analysis Information - type: unknown -- contextPath: Joe.Analysis.Result - description: Analysis Results - type: string -- contextPath: Joe.Analysis.Errors - description: Raised errors during sampling - type: unknown -- contextPath: Joe.Analysis.Systems - description: Analysis OS - type: unknown -- contextPath: Joe.Analysis.MD5 - description: MD5 of analysis sample - type: string -- contextPath: Joe.Analysis.SHA1 - description: SHA1 of analysis sample - type: string -- contextPath: Joe.Analysis.SHA256 - description: SHA256 of analysis sample - type: string -- contextPath: InfoFile.Name - description: FileName of the report file - type: string -- contextPath: InfoFile.EntryID - description: The EntryID of the report file - type: string -- contextPath: InfoFile.Size - description: File Size - type: number -- contextPath: InfoFile.Type - description: File type e.g. "PE" - type: string -- contextPath: InfoFile.Info - description: Basic information of the file - type: string -- contextPath: File.Extension - description: File Extension - type: string -- contextPath: InfoFile - description: The report file's object - type: unknown -- contextPath: WildFire.Report - description: The submission object - type: unknown -- contextPath: WildFire.Report.Status - description: The status of the submission - type: string -- contextPath: WildFire.Report.SHA256 - description: SHA256 of the submission - type: string -- contextPath: WildFire.Report.MD5 - description: MD5 of the submission - type: string -- contextPath: WildFire.Report.FileType - description: The type of the submission - type: string -- contextPath: WildFire.Report.Size - description: The size of the submission - type: number -- contextPath: Joe.Analysis - description: Thee Analysis object - type: unknown -- contextPath: Cuckoo.Task.Category - description: Category of task -- contextPath: Cuckoo.Task.Machine - description: Machine of task -- contextPath: Cuckoo.Task.Errors - description: Errors of task -- contextPath: Cuckoo.Task.Target - description: Target of task -- contextPath: Cuckoo.Task.Package - description: Package of task -- contextPath: Cuckoo.Task.SampleID - description: Sample ID of task -- contextPath: Cuckoo.Task.Guest - description: Task guest -- contextPath: Cuckoo.Task.Custom - description: Custom values of task -- contextPath: Cuckoo.Task.Owner - description: Task owner -- contextPath: Cuckoo.Task.Priority - description: Priority of task -- contextPath: Cuckoo.Task.Platform - description: Platform of task -- contextPath: Cuckoo.Task.Options - description: Task options -- contextPath: Cuckoo.Task.Status - description: Task status -- contextPath: Cuckoo.Task.EnforceTimeout - description: Is timeout of task enforced -- contextPath: Cuckoo.Task.Timeout - description: Task timeout -- contextPath: Cuckoo.Task.Memory - description: Task memory -- contextPath: Cuckoo.Task.Tags - description: Task tags -- contextPath: Cuckoo.Task.ID - description: ID of task -- contextPath: Cuckoo.Task.AddedOn - description: Date on which the task was added -- contextPath: Cuckoo.Task.CompletedOn - description: Date on which the task was completed -- contextPath: Cuckoo.Task.Score - description: Reported score of the the task -- contextPath: Cuckoo.Task.Monitor - description: Monitor of the reported task -- contextPath: SNDBOX.Analysis.ID - description: Analysis ID - type: string -- contextPath: SNDBOX.Analysis.SampleName - description: Sample Data, could be a file name or URL - type: string -- contextPath: SNDBOX.Analysis.Status - description: Analysis Status - type: string -- contextPath: SNDBOX.Analysis.Time - description: Submitted Time - type: date -- contextPath: SNDBOX.Analysis.Result - description: Analysis Results - type: string -- contextPath: SNDBOX.Analysis.Errors - description: Raised errors during sampling -- contextPath: SNDBOX.Analysis.Link - description: Analysis Link - type: string -- contextPath: SNDBOX.Analysis.MD5 - description: MD5 of analysis sample - type: string -- contextPath: SNDBOX.Analysis.SHA1 - description: SHA1 of analysis sample - type: string -- contextPath: SNDBOX.Analysis.SHA256 - description: SHA256 of analysis sample - type: string -- contextPath: SNDBOX.Analysis - description: SNDBOX analysis - type: unknown -- contextPath: HybridAnalysis.Submit.State - description: The state of the process - type: string -- contextPath: HybridAnalysis.Submit.SHA256 - description: The submission SHA256 - type: string -- contextPath: HybridAnalysis.Submit.JobID - description: The JobID of the submission - type: string -- contextPath: HybridAnalysis.Submit.EnvironmentID - description: The environmentID of the submission - type: string -- contextPath: HybridAnalysis.Submit - description: The HybridAnalysis object - type: unknown -- contextPath: ANYRUN.Task.AnalysisDate - description: Date and time the analysis was executed. - type: String -- contextPath: ANYRUN.Task.Behavior.Category - description: Category of a process behavior. - type: String -- contextPath: ANYRUN.Task.Behavior.Action - description: Actions performed by a process. - type: String -- contextPath: ANYRUN.Task.Behavior.ThreatLevel - description: Threat score associated with a process behavior. - type: Number -- contextPath: ANYRUN.Task.Behavior.ProcessUUID - description: Unique ID of the process whose behaviors are being profiled. - type: String -- contextPath: ANYRUN.Task.Connection.Reputation - description: Connection reputation. - type: String -- contextPath: ANYRUN.Task.Connection.ProcessUUID - description: ID of the process that created the connection. - type: String -- contextPath: ANYRUN.Task.Connection.ASN - description: Connection autonomous system network. - type: String -- contextPath: ANYRUN.Task.Connection.Country - description: Connection country. - type: String -- contextPath: ANYRUN.Task.Connection.Protocol - description: Connection protocol. - type: String -- contextPath: ANYRUN.Task.Connection.Port - description: Connection port number. - type: Number -- contextPath: ANYRUN.Task.Connection.IP - description: Connection IP number. - type: String -- contextPath: ANYRUN.Task.DnsRequest.Reputation - description: Reputation of the DNS request. - type: String -- contextPath: ANYRUN.Task.DnsRequest.IP - description: IP addresses associated with a DNS request. - type: Unknown -- contextPath: ANYRUN.Task.DnsRequest.Domain - description: Domain resolution of a DNS request. - type: String -- contextPath: ANYRUN.Task.Threat.ProcessUUID - description: Unique process ID from where the threat originated. - type: String -- contextPath: ANYRUN.Task.Threat.Msg - description: Threat message. - type: String -- contextPath: ANYRUN.Task.Threat.Class - description: Class of the threat. - type: String -- contextPath: ANYRUN.Task.Threat.SrcPort - description: Port on which the threat originated. - type: Number -- contextPath: ANYRUN.Task.Threat.DstPort - description: Destination port of the threat. - type: Number -- contextPath: ANYRUN.Task.Threat.SrcIP - description: Source IP address where the threat originated. - type: String -- contextPath: ANYRUN.Task.Threat.DstIP - description: Destination IP address of the threat. - type: String -- contextPath: ANYRUN.Task.HttpRequest.Reputation - description: Reputation of the HTTP request. - type: String -- contextPath: ANYRUN.Task.HttpRequest.Country - description: HTTP request country. - type: String -- contextPath: ANYRUN.Task.HttpRequest.ProcessUUID - description: ID of the process making the HTTP request. - type: String -- contextPath: ANYRUN.Task.HttpRequest.Body - description: HTTP request body parameters and details. - type: Unknown -- contextPath: ANYRUN.Task.HttpRequest.HttpCode - description: HTTP request response code. - type: Number -- contextPath: ANYRUN.Task.HttpRequest.Status - description: Status of the HTTP request. - type: String -- contextPath: ANYRUN.Task.HttpRequest.ProxyDetected - description: Whether the HTTP request was made through a proxy. - type: Boolean -- contextPath: ANYRUN.Task.HttpRequest.Port - description: HTTP request port. - type: Number -- contextPath: ANYRUN.Task.HttpRequest.IP - description: HTTP request IP address. - type: String -- contextPath: ANYRUN.Task.HttpRequest.URL - description: HTTP request URL. - type: String -- contextPath: ANYRUN.Task.HttpRequest.Host - description: HTTP request host. - type: String -- contextPath: ANYRUN.Task.HttpRequest.Method - description: HTTP request method type. - type: String -- contextPath: ANYRUN.Task.FileInfo - description: Details of the submitted file. - type: String -- contextPath: ANYRUN.Task.OS - description: OS of the sandbox in which the file was analyzed. - type: String -- contextPath: ANYRUN.Task.ID - description: The unique ID of the task. - type: String -- contextPath: ANYRUN.Task.MIME - description: The MIME of the file submitted for analysis. - type: String -- contextPath: ANYRUN.Task.MD5 - description: The MD5 hash of the file submitted for analysis. - type: String -- contextPath: ANYRUN.Task.SHA1 - description: The SHA1 hash of the file submitted for analysis. - type: String -- contextPath: ANYRUN.Task.SHA256 - description: The SHA256 hash of the file submitted for analysis. - type: String -- contextPath: ANYRUN.Task.SSDeep - description: SSDeep hash of the file submitted for analysis. - type: String -- contextPath: ANYRUN.Task.Verdict - description: ANY.RUN verdict for the maliciousness of the submitted file or URL. - type: String -- contextPath: ANYRUN.Task.Process.FileName - description: File name of the process. - type: String -- contextPath: ANYRUN.Task.Process.PID - description: Process identification number. - type: Number -- contextPath: ANYRUN.Task.Process.PPID - description: Parent process identification number. - type: Number -- contextPath: ANYRUN.Task.Process.ProcessUUID - description: Unique process ID (used by ANY.RUN). - type: String -- contextPath: ANYRUN.Task.Process.CMD - description: Process command. - type: String -- contextPath: ANYRUN.Task.Process.Path - description: Path of the executed command. - type: String -- contextPath: ANYRUN.Task.Process.User - description: User who executed the command. - type: String -- contextPath: ANYRUN.Task.Process.IntegrityLevel - description: The process integrity level. - type: String -- contextPath: ANYRUN.Task.Process.ExitCode - description: Process exit code. - type: Number -- contextPath: ANYRUN.Task.Process.MainProcess - description: Whether the process is the main process. - type: Boolean -- contextPath: ANYRUN.Task.Process.Version.Company - description: Company responsible for the program executed. - type: String -- contextPath: ANYRUN.Task.Process.Version.Description - description: Description of the type of program. - type: String -- contextPath: ANYRUN.Task.Process.Version.Version - description: Version of the program executed. - type: String -- contextPath: File.Extension - description: Extension of the file submitted for analysis. - type: String -- contextPath: File.Name - description: The name of the file submitted for analysis. - type: String -- contextPath: File.MD5 - description: MD5 hash of the file submitted for analysis. - type: String -- contextPath: File.SHA1 - description: SHA1 hash of the file submitted for analysis. - type: String -- contextPath: File.SHA256 - description: SHA256 hash of the file submitted for analysis. - type: String -- contextPath: File.SSDeep - description: SSDeep hash of the file submitted for analysis. - type: String -- contextPath: File.Malicious.Vendor - description: For malicious files, the vendor that made the decision. - type: String -- contextPath: File.Malicious.Description - description: For malicious files, the reason that the vendor made the decision. - type: String -- contextPath: ANYRUN.Task.Status - description: Task analysis status. - type: String -tests: -- Detonate File - Generic Test +id: Detonate File - Generic +version: -1 +name: Detonate File - Generic +description: Detonate file through active integrations that support file detonation +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 2ac07fca-26e2-4263-8b08-c3944731d448 + type: start + task: + id: 2ac07fca-26e2-4263-8b08-c3944731d448 + version: -1 + name: "" + description: Playbook start point + iscommand: false + brand: "" + nexttasks: + '#none#': + - "8" + - "10" + - "9" + - "11" + - "13" + - "14" + - "15" + - "16" + - "17" + - "18" + - "19" + - "20" + separatecontext: false + view: |- + { + "position": { + "x": 2200, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "3": + id: "3" + taskid: 0fb13cc0-f182-49f6-8ced-38ddfe5c5d6e + type: title + task: + id: 0fb13cc0-f182-49f6-8ced-38ddfe5c5d6e + version: -1 + name: Done + description: Done + type: title + iscommand: false + brand: "" + separatecontext: false + view: |- + { + "position": { + "x": 2200, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "8": + id: "8" + taskid: eb680898-4271-4270-8249-7de1acc7cea9 + type: playbook + task: + id: eb680898-4271-4270-8249-7de1acc7cea9 + version: -1 + name: Detonate File - JoeSecurity + description: |- + Detonates one or more files using the Joe Security - Joe Sandbox integration. + Returns relevant reports to the War Room and file reputations to the context data. + All file types are supported. + playbookName: Detonate File - JoeSecurity + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 50, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "9": + id: "9" + taskid: de2bc919-5bdb-4bdf-8346-dea2f40822d1 + type: playbook + task: + id: de2bc919-5bdb-4bdf-8346-dea2f40822d1 + version: -1 + name: ATD - Detonate File + description: |- + Detonates a File using the McAfee Advanced Threat Defense sandbox. + Advanced Threat Defense supports the following File Types: + 32-bit Portable Executables (PE)files; 64-bit PE+files + exe, sys, dll, com, scr, cpl, ocx, cgi + Microsoft Office Suite documents + doc,dotm, docx, dotx, xls, ppam, xlsx, pps, xlsb, ppsx, xlsm, ppsm, ppt, ppt, pptx, pptm, rtf, shs, xltm, sldm, xltx, sldx, xlam, thmx, docm, xar + Just Systems Ichitaro documents + jtd, jtdc + Adobe + pdf, swf + Compressed files + gz, 7z, tgz, msi, zip, lzh, cab, lzma, rar + Android application package + apk, Java, JAR, CLASS, Java Script, Java bin files + Image files + jpeg, png, gif + Other file types + cmd, ace, bat, arj, vbs, chm, xml, lnk, url, mof, htm, ocx, html, potm, eml, potx, msg, ps1, vb, reg, vba, wsc, vbe, wsf, vbs, wsh + playbookName: ATD - Detonate File + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + File: + complex: + root: inputs.File + Interval: + simple: "1" + Timeout: + simple: "15" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 480, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "10": + id: "10" + taskid: 579d4c4e-ea47-490e-85ba-eb2b8d985873 + type: playbook + task: + id: 579d4c4e-ea47-490e-85ba-eb2b8d985873 + version: -1 + name: Detonate File - ThreatGrid + description: Detonate one or more files using the ThreatGrid integration. This + playbook returns relevant reports to the War Room and file reputations to + the context data. The detonation supports the following file types - EXE, + DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, XZ, + GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, HWPX, + BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM + playbookName: Detonate File - ThreatGrid + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + File: + complex: + root: inputs.File + FileName: + simple: file-detonated-via-demisto + Interval: + simple: "1" + Private: {} + Source: {} + Tags: {} + Timeout: + simple: "15" + VM: {} + playbook: + simple: default + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 910, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "11": + id: "11" + taskid: 8fcc8803-c38d-4aae-8900-ccbc9d9a19ae + type: playbook + task: + id: 8fcc8803-c38d-4aae-8900-ccbc9d9a19ae + version: -1 + name: CrowdStrike Falcon Sandbox - Detonate file + description: Detonate one or more files using the CrowdStrike Falcon Sandbox + integration. This playbook returns relevant reports to the War Room and file + reputations to the context data. The detonation supports the following file + types - PE32, EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, + ZIP, VBN, SEP, XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, + JTTC, HWP, HWT, HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM + playbookName: CrowdStrike Falcon Sandbox - Detonate file + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + EnvironmentID: + simple: "100" + File: + complex: + root: inputs.File + Interval: + simple: "5" + Timeout: + simple: "30" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 1340, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "13": + id: "13" + taskid: 5d6a8999-d509-45d4-81c8-3d86758f09ff + type: playbook + task: + id: 5d6a8999-d509-45d4-81c8-3d86758f09ff + version: -1 + name: WildFire - Detonate file + description: |- + Detonate one or more files using the Wildfire integration. This playbook + returns relevant reports to the War Room and file reputations to the context data. + The detonation supports the following file types - + APK, JAR, DOC, DOCX, RTF, XLS, XLSX, PPT, PPTX, OOXML, PE32, PDF, DMG, PKG, RAR, 7Z + playbookId: WildFire - Detonate file + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + File: + complex: + root: inputs.File + Interval: + simple: "1" + ReportFileType: {} + Timeout: + simple: "15" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 1780, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "14": + id: "14" + taskid: 2ea061e9-20ec-4db2-8561-833ebfb9924e + type: playbook + task: + id: 2ea061e9-20ec-4db2-8561-833ebfb9924e + version: -1 + name: Detonate File - Lastline v2 + description: |- + Detonates a File using the Lastline sandbox. + Lastline supports the following File Types: + EXE, SYS, DLL, COM, SCR, CPL, OCX, CGI, DOC, DOTM, DOCX, DOTX, XLS, PPAM, XSLX, PPS, XLSB, PPSX, XLSM, PPSM, PPT, PPTX, PPTM, RTF, SHS, XLTM, SLDM, XLTX, SLDX, XLAM, THMX, DOCM, XAR, JTD, JTDC, PDF, SWF, GZ, 7Z, TGZ, MSI, ZIP, LZH, CAB, LZMA, APK, JAR, CLASS, JPEG, PNG, GIF, CMD, ACE, BAT, ARJ, VBS, CHM, XML, LNK, URL, MOF, HTM, OCX, HTML, POTM, EML, POTX, MSG, PS, |VB, REG, VBA, WSC, VBE, WSF, VBS, WSH + playbookName: Detonate File - Lastline v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + File: + complex: + root: inputs.File + Interval: + simple: "1" + Timeout: + simple: "15" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 2200, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "15": + id: "15" + taskid: f46bc6da-5b3b-4acd-8d8a-7d21e02c12f3 + type: playbook + task: + id: f46bc6da-5b3b-4acd-8d8a-7d21e02c12f3 + version: -1 + name: Detonate File - Cuckoo + description: Detonating file with Cuckoo + playbookName: Detonate File - Cuckoo + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + File: + simple: ${inputs.File} + interval: + simple: "1" + timeout: + simple: "10" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 2630, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "16": + id: "16" + taskid: b8804e5e-310a-43fe-86a9-ad68ed0641f4 + type: playbook + task: + id: b8804e5e-310a-43fe-86a9-ad68ed0641f4 + version: -1 + name: Detonate File - SNDBOX + description: |- + Detonates a File using the SNDBOX. + Advanced Threat Defense supports the following File Types: + Microsoft (2003 and earlier) + doc, dot, xls, csv, xlt, xlm, ppt, pot, pps + + Microsoft (2007 and later): + docx, docm, dotx, dotm, dotm, xlsx, xlsm, xltx, xltm, xlsb, xla, xlam, iqy, pptx, pptm, potx, ppsx, xml + + Other: + pe32, rtf, pdf, vbs, vbe, ps1, js, lnk, html, bat + playbookName: Detonate File - SNDBOX + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + File: + complex: + root: File + Interval: + simple: "1" + Timeout: + simple: "15" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 3060, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "17": + id: "17" + taskid: b10694a4-f49b-48f7-8e43-e6448541ff65 + type: playbook + task: + id: b10694a4-f49b-48f7-8e43-e6448541ff65 + version: -1 + name: Detonate File - HybridAnalysis + description: |- + Detonates one or more files using the Hybrid Analysis integration. + Returns relevant reports to the War Room and file reputations to the context data. + All file types are supported. + playbookName: Detonate File - HybridAnalysis + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + Comments: {} + EnvironmentID: + simple: "100" + File: + complex: + root: File + InternetAccess: + simple: "True" + Interval: + simple: "1" + ReportFileType: {} + Systems: {} + Timeout: + simple: "15" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 3490, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "18": + id: "18" + taskid: 08685dd3-4865-4dda-8b8a-4018c98e1518 + type: playbook + task: + id: 08685dd3-4865-4dda-8b8a-4018c98e1518 + version: -1 + name: Detonate File - ANYRUN + description: |- + Detonates one or more files using the ANYRUN sandbox integration. + Returns relevant reports to the War Room and file reputations to the context data. + All file types are supported. + playbookName: Detonate File - ANYRUN + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + File: + complex: + root: File + Interval: + simple: "1" + Timeout: + simple: "15" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 3920, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "19": + id: "19" + taskid: 0d0261e2-a689-46c1-8321-79cc173dac64 + type: playbook + task: + id: 0d0261e2-a689-46c1-8321-79cc173dac64 + version: -1 + name: Detonate File - FireEye AX + description: Detonate one or more files using the FireEye AX integration. This + playbook returns relevant reports to the War Room and file reputations to + the context data. The detonation supports the following file types - PE32, + EXE, DLL, JAR, JS, PDF, DOC, DOCX, RTF, XLS, PPT, PPTX, XML, ZIP, VBN, SEP, + XZ, GZ, BZ2, TAR, MHTML, SWF, LNK, URL, MSI, JTD, JTT, JTDC, JTTC, HWP, HWT, + HWPX, BAT, HTA, PS1, VBS, WSF, JSE, VBE, CHM, JPG, JPEG, GIF, PNG, XLSX + playbookName: Detonate File - FireEye AX + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 4350, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "20": + id: "20" + taskid: 330dba59-a610-47a5-852d-5d9e4d39c7e9 + type: playbook + task: + id: 330dba59-a610-47a5-852d-5d9e4d39c7e9 + version: -1 + name: Detonate File - VMRay + description: Detonating file with VMRay + playbookName: Detonate File - VMRay + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + File: + complex: + root: File + transformers: + - operator: uniq + archive_password: {} + document_password: {} + interval: + simple: "1" + max_jobs: {} + reanalyze: {} + sample_type: {} + shareable: {} + tags: {} + timeout: + simple: "10" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 4780, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 385, + "width": 5110, + "x": 50, + "y": 50 + } + } + } +inputs: +- key: EntryID + value: + complex: + root: File + accessor: EntryID + required: false + description: Entry ID of file to be detonated + playbookInputQuery: +- key: File + value: + complex: + root: File + required: false + description: File object of file to be detonated + playbookInputQuery: +outputs: +- contextPath: Joe.Analysis.Status + description: Analysis Status + type: string +- contextPath: Joe.Analysis.WebID + description: Web ID + type: string +- contextPath: File.Name + description: Filename (only in case of report type=json) + type: string +- contextPath: File.SHA1 + description: SHA1 of the file + type: string +- contextPath: File.SHA256 + description: SHA256 of the file + type: string +- contextPath: File.Size + description: File size (only in case of report type=json) + type: number +- contextPath: File.Type + description: File type e.g. "PE" (only in case of report type=json) + type: string +- contextPath: File.Malicious + description: The File malicious description + type: unknown +- contextPath: File.Malicious.Description + description: For malicious files, the reason for the vendor to make the decision + type: string +- contextPath: File.Malicious.Vendor + description: For malicious files, the vendor that made the decision + type: string +- contextPath: DBotScore + description: The Indicator's object + type: unknown +- contextPath: DBotScore.Indicator + description: The indicator that was tested + type: string +- contextPath: DBotScore.Score + description: The actual score + type: number +- contextPath: DBotScore.Type + description: The type of the indicator + type: string +- contextPath: DBotScore.Vendor + description: Vendor used to calculate the score + type: string +- contextPath: IP.Address + description: IP's relevant to the sample + type: string +- contextPath: DBotScore.Malicious.Vendor + description: Vendor used to calculate the score + type: string +- contextPath: DBotScore.Malicious.Detections + description: The sub analysis detection statuses + type: string +- contextPath: DBotScore.Malicious.SHA1 + description: The SHA1 of the file + type: string +- contextPath: Sample.State + description: The sample state +- contextPath: Sample.ID + description: The sample ID +- contextPath: File + description: The File's object + type: unknown +- contextPath: File.MD5 + description: MD5 of the file + type: string +- contextPath: Joe.Analysis.SampleName + description: Sample Data, could be a file name or URL + type: string +- contextPath: Joe.Analysis.Comments + description: Analysis Comments + type: string +- contextPath: Joe.Analysis.Time + description: Submitted Time + type: date +- contextPath: Joe.Analysis.Runs + description: Sub-Analysis Information + type: unknown +- contextPath: Joe.Analysis.Result + description: Analysis Results + type: string +- contextPath: Joe.Analysis.Errors + description: Raised errors during sampling + type: unknown +- contextPath: Joe.Analysis.Systems + description: Analysis OS + type: unknown +- contextPath: Joe.Analysis.MD5 + description: MD5 of analysis sample + type: string +- contextPath: Joe.Analysis.SHA1 + description: SHA1 of analysis sample + type: string +- contextPath: Joe.Analysis.SHA256 + description: SHA256 of analysis sample + type: string +- contextPath: InfoFile.Name + description: FileName of the report file + type: string +- contextPath: InfoFile.EntryID + description: The EntryID of the report file + type: string +- contextPath: InfoFile.Size + description: File Size + type: number +- contextPath: InfoFile.Type + description: File type e.g. "PE" + type: string +- contextPath: InfoFile.Info + description: Basic information of the file + type: string +- contextPath: File.Extension + description: File Extension + type: string +- contextPath: InfoFile + description: The report file's object + type: unknown +- contextPath: WildFire.Report + description: The submission object + type: unknown +- contextPath: WildFire.Report.Status + description: The status of the submission + type: string +- contextPath: WildFire.Report.SHA256 + description: SHA256 of the submission + type: string +- contextPath: WildFire.Report.MD5 + description: MD5 of the submission + type: string +- contextPath: WildFire.Report.FileType + description: The type of the submission + type: string +- contextPath: WildFire.Report.Size + description: The size of the submission + type: number +- contextPath: Joe.Analysis + description: Thee Analysis object + type: unknown +- contextPath: Cuckoo.Task.Category + description: Category of task +- contextPath: Cuckoo.Task.Machine + description: Machine of task +- contextPath: Cuckoo.Task.Errors + description: Errors of task +- contextPath: Cuckoo.Task.Target + description: Target of task +- contextPath: Cuckoo.Task.Package + description: Package of task +- contextPath: Cuckoo.Task.SampleID + description: Sample ID of task +- contextPath: Cuckoo.Task.Guest + description: Task guest +- contextPath: Cuckoo.Task.Custom + description: Custom values of task +- contextPath: Cuckoo.Task.Owner + description: Task owner +- contextPath: Cuckoo.Task.Priority + description: Priority of task +- contextPath: Cuckoo.Task.Platform + description: Platform of task +- contextPath: Cuckoo.Task.Options + description: Task options +- contextPath: Cuckoo.Task.Status + description: Task status +- contextPath: Cuckoo.Task.EnforceTimeout + description: Is timeout of task enforced +- contextPath: Cuckoo.Task.Timeout + description: Task timeout +- contextPath: Cuckoo.Task.Memory + description: Task memory +- contextPath: Cuckoo.Task.Tags + description: Task tags +- contextPath: Cuckoo.Task.ID + description: ID of task +- contextPath: Cuckoo.Task.AddedOn + description: Date on which the task was added +- contextPath: Cuckoo.Task.CompletedOn + description: Date on which the task was completed +- contextPath: Cuckoo.Task.Score + description: Reported score of the the task +- contextPath: Cuckoo.Task.Monitor + description: Monitor of the reported task +- contextPath: SNDBOX.Analysis.ID + description: Analysis ID + type: string +- contextPath: SNDBOX.Analysis.SampleName + description: Sample Data, could be a file name or URL + type: string +- contextPath: SNDBOX.Analysis.Status + description: Analysis Status + type: string +- contextPath: SNDBOX.Analysis.Time + description: Submitted Time + type: date +- contextPath: SNDBOX.Analysis.Result + description: Analysis Results + type: string +- contextPath: SNDBOX.Analysis.Errors + description: Raised errors during sampling +- contextPath: SNDBOX.Analysis.Link + description: Analysis Link + type: string +- contextPath: SNDBOX.Analysis.MD5 + description: MD5 of analysis sample + type: string +- contextPath: SNDBOX.Analysis.SHA1 + description: SHA1 of analysis sample + type: string +- contextPath: SNDBOX.Analysis.SHA256 + description: SHA256 of analysis sample + type: string +- contextPath: SNDBOX.Analysis + description: SNDBOX analysis + type: unknown +- contextPath: HybridAnalysis.Submit.State + description: The state of the process + type: string +- contextPath: HybridAnalysis.Submit.SHA256 + description: The submission SHA256 + type: string +- contextPath: HybridAnalysis.Submit.JobID + description: The JobID of the submission + type: string +- contextPath: HybridAnalysis.Submit.EnvironmentID + description: The environmentID of the submission + type: string +- contextPath: HybridAnalysis.Submit + description: The HybridAnalysis object + type: unknown +- contextPath: ANYRUN.Task.AnalysisDate + description: Date and time the analysis was executed. + type: String +- contextPath: ANYRUN.Task.Behavior.Category + description: Category of a process behavior. + type: String +- contextPath: ANYRUN.Task.Behavior.Action + description: Actions performed by a process. + type: String +- contextPath: ANYRUN.Task.Behavior.ThreatLevel + description: Threat score associated with a process behavior. + type: Number +- contextPath: ANYRUN.Task.Behavior.ProcessUUID + description: Unique ID of the process whose behaviors are being profiled. + type: String +- contextPath: ANYRUN.Task.Connection.Reputation + description: Connection reputation. + type: String +- contextPath: ANYRUN.Task.Connection.ProcessUUID + description: ID of the process that created the connection. + type: String +- contextPath: ANYRUN.Task.Connection.ASN + description: Connection autonomous system network. + type: String +- contextPath: ANYRUN.Task.Connection.Country + description: Connection country. + type: String +- contextPath: ANYRUN.Task.Connection.Protocol + description: Connection protocol. + type: String +- contextPath: ANYRUN.Task.Connection.Port + description: Connection port number. + type: Number +- contextPath: ANYRUN.Task.Connection.IP + description: Connection IP number. + type: String +- contextPath: ANYRUN.Task.DnsRequest.Reputation + description: Reputation of the DNS request. + type: String +- contextPath: ANYRUN.Task.DnsRequest.IP + description: IP addresses associated with a DNS request. + type: Unknown +- contextPath: ANYRUN.Task.DnsRequest.Domain + description: Domain resolution of a DNS request. + type: String +- contextPath: ANYRUN.Task.Threat.ProcessUUID + description: Unique process ID from where the threat originated. + type: String +- contextPath: ANYRUN.Task.Threat.Msg + description: Threat message. + type: String +- contextPath: ANYRUN.Task.Threat.Class + description: Class of the threat. + type: String +- contextPath: ANYRUN.Task.Threat.SrcPort + description: Port on which the threat originated. + type: Number +- contextPath: ANYRUN.Task.Threat.DstPort + description: Destination port of the threat. + type: Number +- contextPath: ANYRUN.Task.Threat.SrcIP + description: Source IP address where the threat originated. + type: String +- contextPath: ANYRUN.Task.Threat.DstIP + description: Destination IP address of the threat. + type: String +- contextPath: ANYRUN.Task.HttpRequest.Reputation + description: Reputation of the HTTP request. + type: String +- contextPath: ANYRUN.Task.HttpRequest.Country + description: HTTP request country. + type: String +- contextPath: ANYRUN.Task.HttpRequest.ProcessUUID + description: ID of the process making the HTTP request. + type: String +- contextPath: ANYRUN.Task.HttpRequest.Body + description: HTTP request body parameters and details. + type: Unknown +- contextPath: ANYRUN.Task.HttpRequest.HttpCode + description: HTTP request response code. + type: Number +- contextPath: ANYRUN.Task.HttpRequest.Status + description: Status of the HTTP request. + type: String +- contextPath: ANYRUN.Task.HttpRequest.ProxyDetected + description: Whether the HTTP request was made through a proxy. + type: Boolean +- contextPath: ANYRUN.Task.HttpRequest.Port + description: HTTP request port. + type: Number +- contextPath: ANYRUN.Task.HttpRequest.IP + description: HTTP request IP address. + type: String +- contextPath: ANYRUN.Task.HttpRequest.URL + description: HTTP request URL. + type: String +- contextPath: ANYRUN.Task.HttpRequest.Host + description: HTTP request host. + type: String +- contextPath: ANYRUN.Task.HttpRequest.Method + description: HTTP request method type. + type: String +- contextPath: ANYRUN.Task.FileInfo + description: Details of the submitted file. + type: String +- contextPath: ANYRUN.Task.OS + description: OS of the sandbox in which the file was analyzed. + type: String +- contextPath: ANYRUN.Task.ID + description: The unique ID of the task. + type: String +- contextPath: ANYRUN.Task.MIME + description: The MIME of the file submitted for analysis. + type: String +- contextPath: ANYRUN.Task.MD5 + description: The MD5 hash of the file submitted for analysis. + type: String +- contextPath: ANYRUN.Task.SHA1 + description: The SHA1 hash of the file submitted for analysis. + type: String +- contextPath: ANYRUN.Task.SHA256 + description: The SHA256 hash of the file submitted for analysis. + type: String +- contextPath: ANYRUN.Task.SSDeep + description: SSDeep hash of the file submitted for analysis. + type: String +- contextPath: ANYRUN.Task.Verdict + description: ANY.RUN verdict for the maliciousness of the submitted file or URL. + type: String +- contextPath: ANYRUN.Task.Process.FileName + description: File name of the process. + type: String +- contextPath: ANYRUN.Task.Process.PID + description: Process identification number. + type: Number +- contextPath: ANYRUN.Task.Process.PPID + description: Parent process identification number. + type: Number +- contextPath: ANYRUN.Task.Process.ProcessUUID + description: Unique process ID (used by ANY.RUN). + type: String +- contextPath: ANYRUN.Task.Process.CMD + description: Process command. + type: String +- contextPath: ANYRUN.Task.Process.Path + description: Path of the executed command. + type: String +- contextPath: ANYRUN.Task.Process.User + description: User who executed the command. + type: String +- contextPath: ANYRUN.Task.Process.IntegrityLevel + description: The process integrity level. + type: String +- contextPath: ANYRUN.Task.Process.ExitCode + description: Process exit code. + type: Number +- contextPath: ANYRUN.Task.Process.MainProcess + description: Whether the process is the main process. + type: Boolean +- contextPath: ANYRUN.Task.Process.Version.Company + description: Company responsible for the program executed. + type: String +- contextPath: ANYRUN.Task.Process.Version.Description + description: Description of the type of program. + type: String +- contextPath: ANYRUN.Task.Process.Version.Version + description: Version of the program executed. + type: String +- contextPath: File.Extension + description: Extension of the file submitted for analysis. + type: String +- contextPath: File.Name + description: The name of the file submitted for analysis. + type: String +- contextPath: File.MD5 + description: MD5 hash of the file submitted for analysis. + type: String +- contextPath: File.SHA1 + description: SHA1 hash of the file submitted for analysis. + type: String +- contextPath: File.SHA256 + description: SHA256 hash of the file submitted for analysis. + type: String +- contextPath: File.SSDeep + description: SSDeep hash of the file submitted for analysis. + type: String +- contextPath: File.Malicious.Vendor + description: For malicious files, the vendor that made the decision. + type: String +- contextPath: File.Malicious.Description + description: For malicious files, the reason that the vendor made the decision. + type: String +- contextPath: ANYRUN.Task.Status + description: Task analysis status. + type: String +fromversion: 4.0.0 +tests: +- Detonate File - Generic Test diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Detonate_URL_-_Generic.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Detonate_URL_-_Generic.yml index c0e9580ee0a..995a8937d24 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Detonate_URL_-_Generic.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Detonate_URL_-_Generic.yml @@ -1,698 +1,663 @@ -id: detonate_url_-_generic -version: -1 -name: Detonate URL - Generic -fromversion: 4.0.0 -description: Detonate URL through active integrations that support URL detonation -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: 32fe7da3-a280-49c6-83d4-6cb1fb474458 - type: start - task: - id: 32fe7da3-a280-49c6-83d4-6cb1fb474458 - version: -1 - name: "" - description: Playbook start point - iscommand: false - brand: "" - nexttasks: - '#none#': - - "11" - - "13" - - "12" - - "14" - - "15" - - "16" - - "17" - separatecontext: false - view: |- - { - "position": { - "x": 1340, - "y": 50 - } - } - note: false - timertriggers: [] - ignoreworker: false - "3": - id: "3" - taskid: 40c6a1c6-dce9-4a0b-87b8-fec50f7933ae - type: title - task: - id: 40c6a1c6-dce9-4a0b-87b8-fec50f7933ae - version: -1 - name: Done - description: Done - type: title - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 1340, - "y": 370 - } - } - note: false - timertriggers: [] - ignoreworker: false - "11": - id: "11" - taskid: 7902e341-c29c-4037-8e6a-6c2289d3806e - type: playbook - task: - id: 7902e341-c29c-4037-8e6a-6c2289d3806e - version: -1 - name: Detonate URL - ThreatGrid - description: Detonate one or more URLs using the Threat Grid integration. This - playbook returns relevant reports to the War Room and URL reputations to the - context data. - playbookName: Detonate URL - ThreatGrid - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - FileName: - simple: file-detonated-via-demisto - Interval: - simple: "1" - OS: {} - OSVersion: {} - Private: {} - Source: {} - Tags: {} - Timeout: - simple: "15" - URL: - complex: - root: inputs.URL - accessor: Data - VM: {} - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 50, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "12": - id: "12" - taskid: 7119396c-ac89-473c-82fa-c634c25788d6 - type: playbook - task: - id: 7119396c-ac89-473c-82fa-c634c25788d6 - version: -1 - name: Detonate URL - McAfee ATD - description: Detonates a URL using the McAfee Advanced Threat Defense sandbox - integration. - playbookName: Detonate URL - McAfee ATD - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - URL: - complex: - root: inputs.URL - accessor: Data - interval: - simple: "1" - timeout: - simple: "15" - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 480, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "13": - id: "13" - taskid: 7a53b305-64ef-47c4-85f7-8ff702cb4209 - type: playbook - task: - id: 7a53b305-64ef-47c4-85f7-8ff702cb4209 - version: -1 - name: Detonate URL - JoeSecurity - description: |- - Detonates one or more URLs using the Joe Security sandbox integration. - Returns relevant reports to the War Room and url reputations to the context data. - playbookName: Detonate URL - JoeSecurity - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - URL: - complex: - root: inputs.URL - accessor: Data - comments: {} - internet-access: - simple: "True" - interval: - simple: "1" - report-file-type: - simple: html - systems: {} - timeout: - simple: "15" - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 910, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "14": - id: "14" - taskid: 2555400f-2fd3-4bdc-82e4-3e5be8948952 - type: playbook - task: - id: 2555400f-2fd3-4bdc-82e4-3e5be8948952 - version: -1 - name: Detonate URL - CrowdStrike - description: Detonate one or more files using the Wildfire integration. This - playbook returns relevant reports to the War Room and file reputations to - the context data. - playbookName: Detonate URL - CrowdStrike - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - EnvironmentID: - simple: "100" - Interval: - simple: "5" - Timeout: - simple: "30" - URL: - complex: - root: inputs.URL - accessor: Data - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 1340, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "15": - id: "15" - taskid: 4e47aa4e-bef0-4566-8aae-b249bdf06ce0 - type: playbook - task: - id: 4e47aa4e-bef0-4566-8aae-b249bdf06ce0 - version: -1 - name: Detonate URL - Lastline v2 - description: Detonates a URL using the Lastline sandbox integration. - playbookName: Detonate URL - Lastline v2 - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - Interval: - simple: "1" - Timeout: - simple: "15" - URL: - complex: - root: inputs.URL - accessor: Data - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 1770, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "16": - id: "16" - taskid: 317e29bb-856f-4081-8fdd-f4a189d01c90 - type: playbook - task: - id: 317e29bb-856f-4081-8fdd-f4a189d01c90 - version: -1 - name: Detonate URL - Cuckoo - description: Detonates a file using Cuckoo sandbox - playbookName: Detonate URL - Cuckoo - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - scriptarguments: - URL: - complex: - root: inputs.URL - accessor: Data - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 2200, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "17": - id: "17" - taskid: a2cbc7cf-2d9e-4eda-87e9-909b88265839 - type: playbook - task: - id: a2cbc7cf-2d9e-4eda-87e9-909b88265839 - version: -1 - name: Detonate URL - ANYRUN - description: Detonates a URL using ANYRUN sandbox - playbookName: Detonate URL - ANYRUN - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - separatecontext: true - view: |- - { - "position": { - "x": 2630, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false -view: |- - { - "linkLabelsPosition": {}, - "paper": { - "dimensions": { - "height": 385, - "width": 2960, - "x": 50, - "y": 50 - } - } - } -inputs: -- key: URL - value: - complex: - root: URL - required: false - description: URL object of url to be detonated. -outputs: -- contextPath: File - description: The File's object - type: unknown -- contextPath: File.Name - description: Filename - type: string -- contextPath: File.Size - description: File size - type: number -- contextPath: File.Type - description: File type e.g. "PE" (only in case of report type=json) - type: string -- contextPath: File.SHA256 - description: SHA256 of the file - type: string -- contextPath: File.SHA1 - description: SHA1 of the file - type: string -- contextPath: File.MD5 - description: MD5 of the file - type: string -- contextPath: File.Malicious.Vendor - description: For malicious files, the vendor that made the decision - type: string -- contextPath: File.Malicious.Description - description: For malicious files, the reason for the vendor to make the decision - type: string -- contextPath: DBotScore - description: The Indicator's object - type: unknown -- contextPath: DBotScore.Type - description: The type of the indicator - type: string -- contextPath: DBotScore.Indicator - description: The indicator we tested - type: string -- contextPath: DBotScore.Vendor - description: Vendor used to calculate the score - type: string -- contextPath: DBotScore.Score - description: The actual score - type: number -- contextPath: Joe.Analysis.WebID - description: Web ID - type: string -- contextPath: Joe.Analysis.Status - description: Analysis Status - type: string -- contextPath: Joe.Analysis.Comments - description: Analysis Comments - type: string -- contextPath: Joe.Analysis.Time - description: Submitted Time - type: date -- contextPath: Joe.Analysis.Runs - description: Sub-Analysis Information - type: unknown -- contextPath: Joe.Analysis.Result - description: Analysis Results - type: string -- contextPath: Joe.Analysis.Errors - description: Raised errors during sampling - type: unknown -- contextPath: Joe.Analysis.Systems - description: Analysis OS - type: unknown -- contextPath: Joe.Analysis.MD5 - description: MD5 of analysis sample - type: string -- contextPath: Joe.Analysis.SHA1 - description: SHA1 of analysis sample - type: string -- contextPath: Joe.Analysis.SHA256 - description: SHA256 of analysis sample - type: string -- contextPath: Joe.Analysis.SampleName - description: Sample Data, could be a file name or URL - type: string -- contextPath: InfoFile.Name - description: FileName - type: string -- contextPath: InfoFile.EntryID - description: The EntryID of the sample - type: string -- contextPath: InfoFile.Size - description: File Size - type: number -- contextPath: InfoFile.Type - description: File type e.g. "PE" - type: string -- contextPath: InfoFile.Info - description: Basic information of the file - type: string -- contextPath: Sample.State - description: The sample state - type: string -- contextPath: Sample.ID - description: The sample ID - type: string -- contextPath: IP.Address - description: IP's relevant to the sample - type: string -- contextPath: InfoFile - description: The report file's object - type: unknown -- contextPath: Cuckoo.Task.Category - description: Category of task -- contextPath: Cuckoo.Task.Machine - description: Machine of task -- contextPath: Cuckoo.Task.Errors - description: Errors of task -- contextPath: Cuckoo.Task.Target - description: Target of task -- contextPath: Cuckoo.Task.Package - description: Package of task -- contextPath: Cuckoo.Task.SampleID - description: Sample ID of task -- contextPath: Cuckoo.Task.Guest - description: Task guest -- contextPath: Cuckoo.Task.Custom - description: Custom values of task -- contextPath: Cuckoo.Task.Owner - description: Task owner -- contextPath: Cuckoo.Task.Priority - description: Priority of task -- contextPath: Cuckoo.Task.Platform - description: Platform of task -- contextPath: Cuckoo.Task.Options - description: Task options -- contextPath: Cuckoo.Task.Status - description: Task status -- contextPath: Cuckoo.Task.EnforceTimeout - description: Is timeout of task enforced -- contextPath: Cuckoo.Task.Timeout - description: Task timeout -- contextPath: Cuckoo.Task.Memory - description: Task memory -- contextPath: Cuckoo.Task.Tags - description: Task tags -- contextPath: Cuckoo.Task.ID - description: ID of task -- contextPath: Cuckoo.Task.AddedOn - description: Date on which the task was added -- contextPath: Cuckoo.Task.CompletedOn - description: Date on which the task was completed -- contextPath: Cuckoo.Task.Score - description: Reported score of the the task -- contextPath: Cuckoo.Task.Monitor - description: Monitor of the reported task -- contextPath: ANYRUN.Task.AnalysisDate - description: Date and time the analysis was executed. - type: String -- contextPath: ANYRUN.Task.Behavior.Category - description: Category of a process behavior. - type: String -- contextPath: ANYRUN.Task.Behavior.Action - description: Actions performed by a process. - type: String -- contextPath: ANYRUN.Task.Behavior.ThreatLevel - description: Threat score associated with a process behavior. - type: Number -- contextPath: ANYRUN.Task.Behavior.ProcessUUID - description: Unique ID of the process whose behaviors are being profiled. - type: String -- contextPath: ANYRUN.Task.Connection.Reputation - description: Connection reputation. - type: String -- contextPath: ANYRUN.Task.Connection.ProcessUUID - description: ID of the process that created the connection. - type: String -- contextPath: ANYRUN.Task.Connection.ASN - description: Connection autonomous system network. - type: String -- contextPath: ANYRUN.Task.Connection.Country - description: Connection country. - type: String -- contextPath: ANYRUN.Task.Connection.Protocol - description: Connection protocol. - type: String -- contextPath: ANYRUN.Task.Connection.Port - description: Connection port number. - type: Number -- contextPath: ANYRUN.Task.Connection.IP - description: Connection IP number. - type: String -- contextPath: ANYRUN.Task.DnsRequest.Reputation - description: Reputation of the DNS request. - type: String -- contextPath: ANYRUN.Task.DnsRequest.IP - description: IP addresses associated with a DNS request. - type: Unknown -- contextPath: ANYRUN.Task.DnsRequest.Domain - description: Domain resolution of a DNS request. - type: String -- contextPath: ANYRUN.Task.Threat.ProcessUUID - description: Unique process ID from where the threat originated. - type: String -- contextPath: ANYRUN.Task.Threat.Msg - description: Threat message. - type: String -- contextPath: ANYRUN.Task.Threat.Class - description: Class of the threat. - type: String -- contextPath: ANYRUN.Task.Threat.SrcPort - description: Port on which the threat originated. - type: Number -- contextPath: ANYRUN.Task.Threat.DstPort - description: Destination port of the threat. - type: Number -- contextPath: ANYRUN.Task.Threat.SrcIP - description: Source IP address where the threat originated. - type: String -- contextPath: ANYRUN.Task.Threat.DstIP - description: Destination IP address of the threat. - type: String -- contextPath: ANYRUN.Task.HttpRequest.Reputation - description: Reputation of the HTTP request. - type: String -- contextPath: ANYRUN.Task.HttpRequest.Country - description: HTTP request country. - type: String -- contextPath: ANYRUN.Task.HttpRequest.ProcessUUID - description: ID of the process making the HTTP request. - type: String -- contextPath: ANYRUN.Task.HttpRequest.Body - description: HTTP request body parameters and details. - type: Unknown -- contextPath: ANYRUN.Task.HttpRequest.HttpCode - description: HTTP request response code. - type: Number -- contextPath: ANYRUN.Task.HttpRequest.Status - description: Status of the HTTP request. - type: String -- contextPath: ANYRUN.Task.HttpRequest.ProxyDetected - description: Whether the HTTP request was made through a proxy. - type: Boolean -- contextPath: ANYRUN.Task.HttpRequest.Port - description: HTTP request port. - type: Number -- contextPath: ANYRUN.Task.HttpRequest.IP - description: HTTP request IP address. - type: String -- contextPath: ANYRUN.Task.HttpRequest.URL - description: HTTP request URL. - type: String -- contextPath: ANYRUN.Task.HttpRequest.Host - description: HTTP request host. - type: String -- contextPath: ANYRUN.Task.HttpRequest.Method - description: HTTP request method type. - type: String -- contextPath: ANYRUN.Task.FileInfo - description: Details of the submitted file. - type: String -- contextPath: ANYRUN.Task.OS - description: OS of the sandbox in which the file was analyzed. - type: String -- contextPath: ANYRUN.Task.ID - description: The unique ID of the task. - type: String -- contextPath: ANYRUN.Task.MIME - description: The MIME of the file submitted for analysis. - type: String -- contextPath: ANYRUN.Task.Verdict - description: ANY.RUN verdict for the maliciousness of the submitted file or URL. - type: String -- contextPath: ANYRUN.Task.Process.FileName - description: File name of the process. - type: String -- contextPath: ANYRUN.Task.Process.PID - description: Process identification number. - type: Number -- contextPath: ANYRUN.Task.Process.PPID - description: Parent process identification number. - type: Number -- contextPath: ANYRUN.Task.Process.ProcessUUID - description: Unique process ID (used by ANY.RUN). - type: String -- contextPath: ANYRUN.Task.Process.CMD - description: Process command. - type: String -- contextPath: ANYRUN.Task.Process.Path - description: Path of the executed command. - type: String -- contextPath: ANYRUN.Task.Process.User - description: User who executed the command. - type: String -- contextPath: ANYRUN.Task.Process.IntegrityLevel - description: The process integrity level. - type: String -- contextPath: ANYRUN.Task.Process.ExitCode - description: Process exit code. - type: Number -- contextPath: ANYRUN.Task.Process.MainProcess - description: Whether the process is the main process. - type: Boolean -- contextPath: ANYRUN.Task.Process.Version.Company - description: Company responsible for the program executed. - type: String -- contextPath: ANYRUN.Task.Process.Version.Description - description: Description of the type of program. - type: String -- contextPath: ANYRUN.Task.Process.Version.Version - description: Version of the program executed. - type: String -- contextPath: DBotScore.Indicator - description: The indicator that was tested. - type: String -- contextPath: DBotScore.Score - description: The actual score. - type: Number -- contextPath: DBotScore.Type - description: Type of indicator. - type: String -- contextPath: DBotScore.Vendor - description: Vendor used to calculate the score. - type: String -- contextPath: URL.Data - description: URL data. - type: String -- contextPath: URL.Malicious.Vendor - description: For malicious URLs, the vendor that made the decision. - type: String -- contextPath: URL.Malicious.Description - description: For malicious URLs, the reason for the vendor to make the decision. - type: String -- contextPath: ANYRUN.Task.Status - description: Task analysis status. - type: String -tests: -- Detonate URL - Generic Test \ No newline at end of file +id: detonate_url_-_generic +version: -1 +name: Detonate URL - Generic +description: Detonate URL through active integrations that support URL detonation +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 6b297ce6-c5e2-4f24-8dcb-41070c90a3fb + type: start + task: + id: 6b297ce6-c5e2-4f24-8dcb-41070c90a3fb + version: -1 + name: "" + description: Playbook start point + iscommand: false + brand: "" + nexttasks: + '#none#': + - "11" + - "13" + - "12" + - "14" + - "15" + - "16" + - "17" + separatecontext: false + view: |- + { + "position": { + "x": 1340, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "3": + id: "3" + taskid: 1fc0bb86-45c3-41ae-878e-df4ef11c1962 + type: title + task: + id: 1fc0bb86-45c3-41ae-878e-df4ef11c1962 + version: -1 + name: Done + description: Done + type: title + iscommand: false + brand: "" + separatecontext: false + view: |- + { + "position": { + "x": 1340, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "11": + id: "11" + taskid: dafc8370-20e5-4a82-8bb7-d06bc0105799 + type: playbook + task: + id: dafc8370-20e5-4a82-8bb7-d06bc0105799 + version: -1 + name: Detonate URL - ThreatGrid + description: Detonate one or more URLs using the Threat Grid integration. This + playbook returns relevant reports to the War Room and URL reputations to the + context data. + playbookName: Detonate URL - ThreatGrid + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 50, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "12": + id: "12" + taskid: 0fa1d1eb-6f40-4f31-8a6b-ba7e9fd57fc6 + type: playbook + task: + id: 0fa1d1eb-6f40-4f31-8a6b-ba7e9fd57fc6 + version: -1 + name: Detonate URL - McAfee ATD + description: Detonates a URL using the McAfee Advanced Threat Defense sandbox + integration. + playbookName: Detonate URL - McAfee ATD + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 480, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "13": + id: "13" + taskid: 89907712-1aa5-43fb-8728-d9773dd75f5f + type: playbook + task: + id: 89907712-1aa5-43fb-8728-d9773dd75f5f + version: -1 + name: Detonate URL - JoeSecurity + description: |- + Detonates one or more URLs using the Joe Security sandbox integration. + Returns relevant reports to the War Room and url reputations to the context data. + playbookName: Detonate URL - JoeSecurity + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 910, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "14": + id: "14" + taskid: bf259681-c0d3-4b7f-8bd6-0ece1323359a + type: playbook + task: + id: bf259681-c0d3-4b7f-8bd6-0ece1323359a + version: -1 + name: Detonate URL - CrowdStrike + description: Detonate one or more files using the Wildfire integration. This + playbook returns relevant reports to the War Room and file reputations to + the context data. + playbookName: Detonate URL - CrowdStrike + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 1340, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "15": + id: "15" + taskid: 2ae02fff-51ea-4dad-894f-22d5612dece0 + type: playbook + task: + id: 2ae02fff-51ea-4dad-894f-22d5612dece0 + version: -1 + name: Detonate URL - Lastline v2 + description: Detonates a URL using the Lastline sandbox integration. + playbookName: Detonate URL - Lastline v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 1770, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "16": + id: "16" + taskid: 5d7f87a9-26e8-4bc9-824c-4ebbf69f6956 + type: playbook + task: + id: 5d7f87a9-26e8-4bc9-824c-4ebbf69f6956 + version: -1 + name: Detonate URL - Cuckoo + description: Detonates a file using Cuckoo sandbox + playbookName: Detonate URL - Cuckoo + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 2200, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "17": + id: "17" + taskid: 0890fbf7-9411-4a55-83de-96ce4d71210f + type: playbook + task: + id: 0890fbf7-9411-4a55-83de-96ce4d71210f + version: -1 + name: Detonate URL - ANYRUN + description: Detonates a URL using ANYRUN sandbox + playbookName: Detonate URL - ANYRUN + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 2630, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 +system: true +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 385, + "width": 2960, + "x": 50, + "y": 50 + } + } + } +inputs: +- key: URL + value: + complex: + root: URL + required: false + description: URL object of url to be detonated. + playbookInputQuery: +outputs: +- contextPath: File + description: The File's object + type: unknown +- contextPath: File.Name + description: Filename + type: string +- contextPath: File.Size + description: File size + type: number +- contextPath: File.Type + description: File type e.g. "PE" (only in case of report type=json) + type: string +- contextPath: File.SHA256 + description: SHA256 of the file + type: string +- contextPath: File.SHA1 + description: SHA1 of the file + type: string +- contextPath: File.MD5 + description: MD5 of the file + type: string +- contextPath: File.Malicious.Vendor + description: For malicious files, the vendor that made the decision + type: string +- contextPath: File.Malicious.Description + description: For malicious files, the reason for the vendor to make the decision + type: string +- contextPath: DBotScore + description: The Indicator's object + type: unknown +- contextPath: DBotScore.Type + description: The type of the indicator + type: string +- contextPath: DBotScore.Indicator + description: The indicator we tested + type: string +- contextPath: DBotScore.Vendor + description: Vendor used to calculate the score + type: string +- contextPath: DBotScore.Score + description: The actual score + type: number +- contextPath: Joe.Analysis.WebID + description: Web ID + type: string +- contextPath: Joe.Analysis.Status + description: Analysis Status + type: string +- contextPath: Joe.Analysis.Comments + description: Analysis Comments + type: string +- contextPath: Joe.Analysis.Time + description: Submitted Time + type: date +- contextPath: Joe.Analysis.Runs + description: Sub-Analysis Information + type: unknown +- contextPath: Joe.Analysis.Result + description: Analysis Results + type: string +- contextPath: Joe.Analysis.Errors + description: Raised errors during sampling + type: unknown +- contextPath: Joe.Analysis.Systems + description: Analysis OS + type: unknown +- contextPath: Joe.Analysis.MD5 + description: MD5 of analysis sample + type: string +- contextPath: Joe.Analysis.SHA1 + description: SHA1 of analysis sample + type: string +- contextPath: Joe.Analysis.SHA256 + description: SHA256 of analysis sample + type: string +- contextPath: Joe.Analysis.SampleName + description: Sample Data, could be a file name or URL + type: string +- contextPath: InfoFile.Name + description: FileName + type: string +- contextPath: InfoFile.EntryID + description: The EntryID of the sample + type: string +- contextPath: InfoFile.Size + description: File Size + type: number +- contextPath: InfoFile.Type + description: File type e.g. "PE" + type: string +- contextPath: InfoFile.Info + description: Basic information of the file + type: string +- contextPath: Sample.State + description: The sample state + type: string +- contextPath: Sample.ID + description: The sample ID + type: string +- contextPath: IP.Address + description: IP's relevant to the sample + type: string +- contextPath: InfoFile + description: The report file's object + type: unknown +- contextPath: Cuckoo.Task.Category + description: Category of task +- contextPath: Cuckoo.Task.Machine + description: Machine of task +- contextPath: Cuckoo.Task.Errors + description: Errors of task +- contextPath: Cuckoo.Task.Target + description: Target of task +- contextPath: Cuckoo.Task.Package + description: Package of task +- contextPath: Cuckoo.Task.SampleID + description: Sample ID of task +- contextPath: Cuckoo.Task.Guest + description: Task guest +- contextPath: Cuckoo.Task.Custom + description: Custom values of task +- contextPath: Cuckoo.Task.Owner + description: Task owner +- contextPath: Cuckoo.Task.Priority + description: Priority of task +- contextPath: Cuckoo.Task.Platform + description: Platform of task +- contextPath: Cuckoo.Task.Options + description: Task options +- contextPath: Cuckoo.Task.Status + description: Task status +- contextPath: Cuckoo.Task.EnforceTimeout + description: Is timeout of task enforced +- contextPath: Cuckoo.Task.Timeout + description: Task timeout +- contextPath: Cuckoo.Task.Memory + description: Task memory +- contextPath: Cuckoo.Task.Tags + description: Task tags +- contextPath: Cuckoo.Task.ID + description: ID of task +- contextPath: Cuckoo.Task.AddedOn + description: Date on which the task was added +- contextPath: Cuckoo.Task.CompletedOn + description: Date on which the task was completed +- contextPath: Cuckoo.Task.Score + description: Reported score of the the task +- contextPath: Cuckoo.Task.Monitor + description: Monitor of the reported task +- contextPath: ANYRUN.Task.AnalysisDate + description: Date and time the analysis was executed. + type: String +- contextPath: ANYRUN.Task.Behavior.Category + description: Category of a process behavior. + type: String +- contextPath: ANYRUN.Task.Behavior.Action + description: Actions performed by a process. + type: String +- contextPath: ANYRUN.Task.Behavior.ThreatLevel + description: Threat score associated with a process behavior. + type: Number +- contextPath: ANYRUN.Task.Behavior.ProcessUUID + description: Unique ID of the process whose behaviors are being profiled. + type: String +- contextPath: ANYRUN.Task.Connection.Reputation + description: Connection reputation. + type: String +- contextPath: ANYRUN.Task.Connection.ProcessUUID + description: ID of the process that created the connection. + type: String +- contextPath: ANYRUN.Task.Connection.ASN + description: Connection autonomous system network. + type: String +- contextPath: ANYRUN.Task.Connection.Country + description: Connection country. + type: String +- contextPath: ANYRUN.Task.Connection.Protocol + description: Connection protocol. + type: String +- contextPath: ANYRUN.Task.Connection.Port + description: Connection port number. + type: Number +- contextPath: ANYRUN.Task.Connection.IP + description: Connection IP number. + type: String +- contextPath: ANYRUN.Task.DnsRequest.Reputation + description: Reputation of the DNS request. + type: String +- contextPath: ANYRUN.Task.DnsRequest.IP + description: IP addresses associated with a DNS request. + type: Unknown +- contextPath: ANYRUN.Task.DnsRequest.Domain + description: Domain resolution of a DNS request. + type: String +- contextPath: ANYRUN.Task.Threat.ProcessUUID + description: Unique process ID from where the threat originated. + type: String +- contextPath: ANYRUN.Task.Threat.Msg + description: Threat message. + type: String +- contextPath: ANYRUN.Task.Threat.Class + description: Class of the threat. + type: String +- contextPath: ANYRUN.Task.Threat.SrcPort + description: Port on which the threat originated. + type: Number +- contextPath: ANYRUN.Task.Threat.DstPort + description: Destination port of the threat. + type: Number +- contextPath: ANYRUN.Task.Threat.SrcIP + description: Source IP address where the threat originated. + type: String +- contextPath: ANYRUN.Task.Threat.DstIP + description: Destination IP address of the threat. + type: String +- contextPath: ANYRUN.Task.HttpRequest.Reputation + description: Reputation of the HTTP request. + type: String +- contextPath: ANYRUN.Task.HttpRequest.Country + description: HTTP request country. + type: String +- contextPath: ANYRUN.Task.HttpRequest.ProcessUUID + description: ID of the process making the HTTP request. + type: String +- contextPath: ANYRUN.Task.HttpRequest.Body + description: HTTP request body parameters and details. + type: Unknown +- contextPath: ANYRUN.Task.HttpRequest.HttpCode + description: HTTP request response code. + type: Number +- contextPath: ANYRUN.Task.HttpRequest.Status + description: Status of the HTTP request. + type: String +- contextPath: ANYRUN.Task.HttpRequest.ProxyDetected + description: Whether the HTTP request was made through a proxy. + type: Boolean +- contextPath: ANYRUN.Task.HttpRequest.Port + description: HTTP request port. + type: Number +- contextPath: ANYRUN.Task.HttpRequest.IP + description: HTTP request IP address. + type: String +- contextPath: ANYRUN.Task.HttpRequest.URL + description: HTTP request URL. + type: String +- contextPath: ANYRUN.Task.HttpRequest.Host + description: HTTP request host. + type: String +- contextPath: ANYRUN.Task.HttpRequest.Method + description: HTTP request method type. + type: String +- contextPath: ANYRUN.Task.FileInfo + description: Details of the submitted file. + type: String +- contextPath: ANYRUN.Task.OS + description: OS of the sandbox in which the file was analyzed. + type: String +- contextPath: ANYRUN.Task.ID + description: The unique ID of the task. + type: String +- contextPath: ANYRUN.Task.MIME + description: The MIME of the file submitted for analysis. + type: String +- contextPath: ANYRUN.Task.Verdict + description: ANY.RUN verdict for the maliciousness of the submitted file or URL. + type: String +- contextPath: ANYRUN.Task.Process.FileName + description: File name of the process. + type: String +- contextPath: ANYRUN.Task.Process.PID + description: Process identification number. + type: Number +- contextPath: ANYRUN.Task.Process.PPID + description: Parent process identification number. + type: Number +- contextPath: ANYRUN.Task.Process.ProcessUUID + description: Unique process ID (used by ANY.RUN). + type: String +- contextPath: ANYRUN.Task.Process.CMD + description: Process command. + type: String +- contextPath: ANYRUN.Task.Process.Path + description: Path of the executed command. + type: String +- contextPath: ANYRUN.Task.Process.User + description: User who executed the command. + type: String +- contextPath: ANYRUN.Task.Process.IntegrityLevel + description: The process integrity level. + type: String +- contextPath: ANYRUN.Task.Process.ExitCode + description: Process exit code. + type: Number +- contextPath: ANYRUN.Task.Process.MainProcess + description: Whether the process is the main process. + type: Boolean +- contextPath: ANYRUN.Task.Process.Version.Company + description: Company responsible for the program executed. + type: String +- contextPath: ANYRUN.Task.Process.Version.Description + description: Description of the type of program. + type: String +- contextPath: ANYRUN.Task.Process.Version.Version + description: Version of the program executed. + type: String +- contextPath: DBotScore.Indicator + description: The indicator that was tested. + type: String +- contextPath: DBotScore.Score + description: The actual score. + type: Number +- contextPath: DBotScore.Type + description: Type of indicator. + type: String +- contextPath: DBotScore.Vendor + description: Vendor used to calculate the score. + type: String +- contextPath: URL.Data + description: URL data. + type: String +- contextPath: URL.Malicious.Vendor + description: For malicious URLs, the vendor that made the decision. + type: String +- contextPath: URL.Malicious.Description + description: For malicious URLs, the reason for the vendor to make the decision. + type: String +- contextPath: ANYRUN.Task.Status + description: Task analysis status. + type: String +fromversion: 4.0.0 +tests: +- Detonate URL - Generic Test diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Endpoint_Enrichment_-_Generic_v2.1.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Endpoint_Enrichment_-_Generic_v2.1.yml index fd0920ce718..6e7d79f9f62 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Endpoint_Enrichment_-_Generic_v2.1.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Endpoint_Enrichment_-_Generic_v2.1.yml @@ -1,1002 +1,1006 @@ -id: Endpoint Enrichment - Generic v2.1 -version: -1 -fromversion: 4.1.0 -name: Endpoint Enrichment - Generic v2.1 -description: |- - Enrich an endpoint by hostname using one or more integrations. - Supported integrations: - - Active Directory Query v2 - - McAfee ePolicy Orchestrator - - Carbon Black Enterprise Response v2 - - Cylance Protect v2 - - CrowdStrike Falcon Host - - ExtraHop Reveal(x) -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: 29bcd70f-1953-4061-84ce-4cde781ad9f7 - type: start - task: - id: 29bcd70f-1953-4061-84ce-4cde781ad9f7 - version: -1 - name: "" - description: "" - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - separatecontext: false - view: |- - { - "position": { - "x": 50, - "y": 50 - } - } - note: false - timertriggers: [] - ignoreworker: false - "1": - id: "1" - taskid: 54895e0d-9904-4e62-8f45-ebd0d17ad5c9 - type: title - task: - id: 54895e0d-9904-4e62-8f45-ebd0d17ad5c9 - version: -1 - name: Endpoint Products - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "16" - - "18" - - "19" - - "20" - - "30" - separatecontext: false - view: |- - { - "position": { - "x": 1280, - "y": 440 - } - } - note: false - timertriggers: [] - ignoreworker: false - "2": - id: "2" - taskid: c9799048-288a-40cc-8d2f-c561d0ea2f6b - type: condition - task: - id: c9799048-288a-40cc-8d2f-c561d0ea2f6b - version: -1 - name: Is McAfee ePolicy Orchestrator enabled? - description: Checks if there is an active instance of the McAfee ePolicy Orchestrator integration enabled. - scriptName: Exists - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "4" - "yes": - - "5" - scriptarguments: - value: - complex: - root: modules - filters: - - - operator: isEqualString - left: - value: - simple: brand - iscontext: true - right: - value: - simple: epo - - - operator: isEqualString - left: - value: - simple: state - iscontext: true - right: - value: - simple: active - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 360, - "y": 750 - } - } - note: false - timertriggers: [] - ignoreworker: false - "3": - id: "3" - taskid: efeca58b-3c8f-40aa-8c2e-f9e84257b1bb - type: condition - task: - id: efeca58b-3c8f-40aa-8c2e-f9e84257b1bb - version: -1 - name: Is there an endpoint to enrich? - description: Checks whether there is at least one endpoint to enrich (by hostname). - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "4" - "yes": - - "24" - - "1" - scriptarguments: - value: - simple: ${inputs.Hostname} - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isExists - left: - value: - simple: inputs.Hostname - iscontext: true - view: |- - { - "position": { - "x": 50, - "y": 215 - } - } - note: false - timertriggers: [] - ignoreworker: false - "4": - id: "4" - taskid: ea90c16b-6985-4f28-816f-78608df3fe51 - type: title - task: - id: ea90c16b-6985-4f28-816f-78608df3fe51 - version: -1 - name: Done - description: "" - type: title - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 50, - "y": 1630 - } - } - note: false - timertriggers: [] - ignoreworker: false - "5": - id: "5" - taskid: 44a06d71-1772-47af-8d41-8c6dbdd149e7 - type: regular - task: - id: 44a06d71-1772-47af-8d41-8c6dbdd149e7 - version: -1 - name: Get host information from McAfee ePO - description: Gets host information from McAfee ePolicy Orchestrator. - script: epo|||epo-find-system - type: regular - iscommand: true - brand: epo - nexttasks: - '#none#': - - "4" - scriptarguments: - searchText: - complex: - root: inputs.Hostname - transformers: - - operator: uniq - verbose: {} - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 360, - "y": 1086 - } - } - note: false - timertriggers: [] - ignoreworker: false - "8": - id: "8" - taskid: 9fa921fa-d196-40ba-8419-ed0c4f838ab8 - type: condition - task: - id: 9fa921fa-d196-40ba-8419-ed0c4f838ab8 - version: -1 - name: Is Carbon Black Enterprise Response enabled? - description: Checks if there is an active instance of the Carbon Black Enterprise Response integration enabled. - scriptName: Exists - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "4" - "yes": - - "9" - scriptarguments: - value: - complex: - root: modules - filters: - - - operator: isEqualString - left: - value: - simple: brand - iscontext: true - right: - value: - simple: carbonblack-v2 - - - operator: isEqualString - left: - value: - simple: state - iscontext: true - right: - value: - simple: active - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 830, - "y": 750 - } - } - note: false - timertriggers: [] - ignoreworker: false - "9": - id: "9" - taskid: 79f17c3a-2456-47d9-8e68-cc3d84ef01bd - type: regular - task: - id: 79f17c3a-2456-47d9-8e68-cc3d84ef01bd - version: -1 - name: Get host information from Carbon Black Enterprise Response - description: Gets host information from Carbon Black Enterprise Response. - script: carbonblack-v2|||cb-sensor-info - type: regular - iscommand: true - brand: carbonblack-v2 - nexttasks: - '#none#': - - "4" - scriptarguments: - groupid: {} - hostname: - complex: - root: inputs.Hostname - transformers: - - operator: uniq - ip: {} - sensor: {} - reputationcalc: 1 - continueonerror: true - separatecontext: false - view: |- - { - "position": { - "x": 830, - "y": 1086 - } - } - note: false - timertriggers: [] - ignoreworker: false - "10": - id: "10" - taskid: 216aed2b-2f34-4c5e-8c54-60b978218896 - type: condition - task: - id: 216aed2b-2f34-4c5e-8c54-60b978218896 - version: -1 - name: Is CrowdStrike Falcon Host enabled? - description: Checks if there is an active instance of the CrowdStrike Falcon Host integration enabled. - scriptName: Exists - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "4" - "yes": - - "27" - scriptarguments: - value: - complex: - root: modules - filters: - - - operator: isEqualString - left: - value: - simple: brand - iscontext: true - right: - value: - simple: FalconHost - - - operator: isEqualString - left: - value: - simple: state - iscontext: true - right: - value: - simple: active - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 2150, - "y": 770 - } - } - note: false - timertriggers: [] - ignoreworker: false - "16": - id: "16" - taskid: d9d617d9-2efd-466e-8ce7-190f8db83b95 - type: title - task: - id: d9d617d9-2efd-466e-8ce7-190f8db83b95 - version: -1 - name: McAfee ePolicy Orchestrator - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - separatecontext: false - view: |- - { - "position": { - "x": 360, - "y": 605 - } - } - note: false - timertriggers: [] - ignoreworker: false - "18": - id: "18" - taskid: 6cf08862-644d-479e-89ce-f9e173a8c562 - type: title - task: - id: 6cf08862-644d-479e-89ce-f9e173a8c562 - version: -1 - name: Carbon Black Enterprise Response - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "8" - separatecontext: false - view: |- - { - "position": { - "x": 830, - "y": 605 - } - } - note: false - timertriggers: [] - ignoreworker: false - "19": - id: "19" - taskid: 471d3862-a05c-42b1-871d-c1faa2fbb7a9 - type: title - task: - id: 471d3862-a05c-42b1-871d-c1faa2fbb7a9 - version: -1 - name: Cylance Protect v2 - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "26" - separatecontext: false - view: |- - { - "position": { - "x": 1280, - "y": 605 - } - } - note: false - timertriggers: [] - ignoreworker: false - "20": - id: "20" - taskid: 5d371f29-3a4c-43c5-8f71-b383db2e5320 - type: title - task: - id: 5d371f29-3a4c-43c5-8f71-b383db2e5320 - version: -1 - name: CrowdStrike Falcon Host - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "10" - separatecontext: false - view: |- - { - "position": { - "x": 2150, - "y": 605 - } - } - note: false - timertriggers: [] - ignoreworker: false - "22": - id: "22" - taskid: f7f190b9-5a39-4d8a-83a5-77d5a023f0d4 - type: condition - task: - id: f7f190b9-5a39-4d8a-83a5-77d5a023f0d4 - version: -1 - name: Is Active Directory Query v2 enabled? - description: Checks if there is an active instance of the Active Directory Query v2 integration enabled. - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "4" - "yes": - - "23" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isExists - left: - value: - complex: - root: modules - filters: - - - operator: isEqualString - left: - value: - simple: brand - iscontext: true - right: - value: - simple: Active Directory Query v2 - - - operator: isEqualString - left: - value: - simple: state - iscontext: true - right: - value: - simple: active - iscontext: true - view: |- - { - "position": { - "x": -616, - "y": 750 - } - } - note: false - timertriggers: [] - ignoreworker: false - "23": - id: "23" - taskid: 23c75906-3b4e-42e8-8e32-c883d5f06fb3 - type: regular - task: - id: 23c75906-3b4e-42e8-8e32-c883d5f06fb3 - version: -1 - name: Get host information from Active Directory - description: |- - Uses Active Directory to retrieve detailed information about the computer of the account specified. The computer can be specified by name, email address, or as an Active Directory Distinguished Name (DN). - If no filters are specified, returns all computers. - script: Active Directory Query v2|||ad-get-computer - type: regular - iscommand: true - brand: Active Directory Query v2 - nexttasks: - '#none#': - - "4" - scriptarguments: - attributes: {} - custom-field-data: {} - custom-field-type: {} - dn: {} - name: - complex: - root: inputs.Hostname - transformers: - - operator: uniq - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": -616, - "y": 1056 - } - } - note: false - timertriggers: [] - ignoreworker: false - "24": - id: "24" - taskid: 9706cc39-d338-44cd-8ee1-efc5ea95b04d - type: title - task: - id: 9706cc39-d338-44cd-8ee1-efc5ea95b04d - version: -1 - name: Active Directory - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "22" - separatecontext: false - view: |- - { - "position": { - "x": -616, - "y": 440 - } - } - note: false - timertriggers: [] - ignoreworker: false - "26": - id: "26" - taskid: c3597e3d-8bd1-460c-862f-f40421717b16 - type: playbook - task: - id: c3597e3d-8bd1-460c-862f-f40421717b16 - version: -1 - name: Endpoint Enrichment - Cylance Protect v2 - description: Enriches endpoints using the Cylance Protect v2 integration. - playbookName: Endpoint Enrichment - Cylance Protect v2 - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "4" - scriptarguments: - Hostname: - complex: - root: inputs.Hostname - transformers: - - operator: uniq - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 1280, - "y": 1086 - } - } - note: false - timertriggers: [] - ignoreworker: false - "27": - id: "27" - taskid: f74a190a-1427-4557-8cf1-ff7865da3042 - type: regular - task: - id: f74a190a-1427-4557-8cf1-ff7865da3042 - version: -1 - name: Get Crowdstrike device ID - description: Gets the Crowdstrike Falcon Host device ID that corresponds to - the endpoint that is being enriched. The device ID is necessary to get information - about the endpoint. - script: '|||cs-device-search' - type: regular - iscommand: true - brand: "" - nexttasks: - '#none#': - - "28" - scriptarguments: - filter: - complex: - root: inputs.Hostname - transformers: - - operator: concat - args: - prefix: - value: - simple: hostname:" - suffix: - value: - simple: '"' - limit: {} - offset: {} - query: {} - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 2250, - "y": 1070 - } - } - note: false - timertriggers: [] - ignoreworker: false - "28": - id: "28" - taskid: 9c60a60d-b2f3-4707-8b0f-690891e080d0 - type: condition - task: - id: 9c60a60d-b2f3-4707-8b0f-690891e080d0 - version: -1 - name: Was a device ID found? - description: Checks whether a Crowdstrike device ID was found for the hostname - that is being enriched. - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "4" - "yes": - - "29" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isExists - left: - value: - complex: - root: FalconHostDevices - iscontext: true - view: |- - { - "position": { - "x": 2250, - "y": 1220 - } - } - note: false - timertriggers: [] - ignoreworker: false - "29": - id: "29" - taskid: 9681a79e-1d5e-462c-8e65-ec0bfe1bb7d8 - type: regular - task: - id: 9681a79e-1d5e-462c-8e65-ec0bfe1bb7d8 - version: -1 - name: Get host information from Crowdstrike Falcon Host - description: Gets details for one or more devices, according to device ID. - script: '|||cs-device-details' - type: regular - iscommand: true - brand: "" - nexttasks: - '#none#': - - "4" - scriptarguments: - ids: - complex: - root: FalconHostDevices - transformers: - - operator: uniq - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 2460, - "y": 1440 - } - } - note: false - timertriggers: [] - ignoreworker: false - "30": - id: "30" - taskid: ec344482-77f7-42b5-8ee4-34317afd1179 - type: title - task: - id: ec344482-77f7-42b5-8ee4-34317afd1179 - version: -1 - name: ExtraHop Reveal(x) - description: "" - type: title - iscommand: false - brand: "" - nexttasks: - '#none#': - - "31" - separatecontext: false - view: |- - { - "position": { - "x": 1710, - "y": 605 - } - } - note: false - timertriggers: [] - ignoreworker: false - "31": - id: "31" - taskid: 58c8b4be-657c-45f6-8eca-5a01da85f1f3 - type: condition - task: - id: 58c8b4be-657c-45f6-8eca-5a01da85f1f3 - version: -1 - name: Is ExtraHop Reveal(x) enabled? - description: Checks if there is an active instance of the ExtraHop Reveal(x) - integration enabled. - scriptName: Exists - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "4" - "yes": - - "32" - scriptarguments: - value: - complex: - root: modules - filters: - - - operator: isEqualString - left: - value: - simple: brand - iscontext: true - right: - value: - simple: ExtraHop v2 - - - operator: isEqualString - left: - value: - simple: state - iscontext: true - right: - value: - simple: active - reputationcalc: 1 - separatecontext: false - view: |- - { - "position": { - "x": 1710, - "y": 770 - } - } - note: false - timertriggers: [] - ignoreworker: false - "32": - id: "32" - taskid: 344e1330-e5f8-4292-83df-7a4fba147ebf - type: regular - task: - id: 344e1330-e5f8-4292-83df-7a4fba147ebf - version: -1 - name: Get host information from ExtraHop Reveal(x) - description: Get host information from ExtraHop Reveal(x). - script: '|||extrahop-device-search' - type: regular - iscommand: true - brand: "" - nexttasks: - '#none#': - - "4" - scriptarguments: - active_from: {} - active_until: {} - activity: {} - discover_time: {} - ip: {} - l3_only: {} - limit: {} - mac: {} - match_type: {} - name: - simple: ${inputs.Hostname} - operator: {} - role: {} - software: {} - tag: {} - vendor: {} - vlan: {} - separatecontext: false - view: |- - { - "position": { - "x": 1730, - "y": 1086 - } - } - note: false - timertriggers: [] - ignoreworker: false -view: |- - { - "linkLabelsPosition": { - "10_27_yes": 0.69, - "10_4_#default#": 0.1, - "22_23_yes": 0.54, - "22_4_#default#": 0.15, - "28_29_yes": 0.4, - "28_4_#default#": 0.1, - "2_4_#default#": 0.21, - "2_5_yes": 0.64, - "31_32_yes": 0.64, - "31_4_#default#": 0.1, - "3_1_yes": 0.3, - "3_24_yes": 0.41, - "3_4_#default#": 0.12, - "8_4_#default#": 0.16, - "8_9_yes": 0.62 - }, - "paper": { - "dimensions": { - "height": 1645, - "width": 3456, - "x": -616, - "y": 50 - } - } - } -inputs: -- key: Hostname - value: - complex: - root: Endpoint - accessor: Hostname - transformers: - - operator: uniq - required: false - description: The hostname of the endpoint to enrich. -outputs: -- contextPath: Endpoint - description: The endpoint object of the endpoint that was enriched. - type: unknown -- contextPath: Endpoint.Hostname - description: The hostnames of the endpoints that were enriched. - type: string -- contextPath: Endpoint.OS - description: The operating systems running on the endpoints that were enriched. - type: string -- contextPath: Endpoint.IP - description: A list of the IP addresses of the endpoints. -- contextPath: Endpoint.MAC - description: A list of the MAC addresses of the endpoints that were enriched. -- contextPath: Endpoint.Domain - description: The domain names of the endpoints that were enriched. - type: string -- contextPath: CylanceProtectDevice - description: The device information about the hostname that was enriched using Cylance - Protect v2. - type: unknown -- contextPath: ExtraHop.Device.Macaddr - description: The MAC Address of the device. - type: String -- contextPath: ExtraHop.Device.DeviceClass - description: The class of the device. - type: String -- contextPath: ExtraHop.Device.UserModTime - description: The time of the most recent update, expressed in milliseconds since - the epoch. - type: Number -- contextPath: ExtraHop.Device.AutoRole - description: The role automatically detected by the ExtraHop. - type: String -- contextPath: ExtraHop.Device.ParentId - description: The ID of the parent device. - type: Number -- contextPath: ExtraHop.Device.Vendor - description: The device vendor. - type: String -- contextPath: ExtraHop.Device.Analysis - description: The level of analysis preformed on the device. - type: string -- contextPath: ExtraHop.Device.DiscoveryId - description: The UUID given by the Discover appliance. - type: String -- contextPath: ExtraHop.Device.DefaultName - description: The default name of the device. - type: String -- contextPath: ExtraHop.Device.DisplayName - description: The display name of device. - type: String -- contextPath: ExtraHop.Device.OnWatchlist - description: Whether the device is on the advanced analysis whitelist. - type: Boolean -- contextPath: ExtraHop.Device.ModTime - description: The time of the most recent update, expressed in milliseconds since - the epoch. - type: Number -- contextPath: ExtraHop.Device.IsL3 - description: Indicates whether the device is a Layer 3 device. - type: Boolean -- contextPath: ExtraHop.Device.Role - description: The role of the device. - type: String -- contextPath: ExtraHop.Device.DiscoverTime - description: The time that the device was discovered. - type: Number -- contextPath: ExtraHop.Device.Id - description: The ID of the device. - type: Number -- contextPath: ExtraHop.Device.Ipaddr4 - description: The IPv4 address of the device. - type: String -- contextPath: ExtraHop.Device.Vlanid - description: The ID of VLan. - type: Number -- contextPath: ExtraHop.Device.Ipaddr6 - description: The IPv6 address of the device. - type: string -- contextPath: ExtraHop.Device.NodeId - description: The Node ID of the Discover appliance. - type: number -- contextPath: ExtraHop.Device.Description - description: A user customizable description of the device. - type: string -- contextPath: ExtraHop.Device.DnsName - description: The DNS name associated with the device. - type: string -- contextPath: ExtraHop.Device.DhcpName - description: The DHCP name associated with the device. - type: string -- contextPath: ExtraHop.Device.CdpName - description: The Cisco Discovery Protocol name associated with the device. - type: string -- contextPath: ExtraHop.Device.NetbiosName - description: The NetBIOS name associated with the device. - type: string -- contextPath: ExtraHop.Device.Url - description: Link to the device details page in ExtraHop. - type: string -tests: - - Endpoint Enrichment - Generic v2.1 - Test +id: Endpoint Enrichment - Generic v2.1 +version: -1 +fromversion: 4.1.0 +name: Endpoint Enrichment - Generic v2.1 +description: |- + Enrich an endpoint by hostname using one or more integrations. + Supported integrations: + - Active Directory Query v2 + - McAfee ePolicy Orchestrator + - Carbon Black Enterprise Response v2 + - Cylance Protect v2 + - CrowdStrike Falcon Host + - ExtraHop Reveal(x) +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 29bcd70f-1953-4061-84ce-4cde781ad9f7 + type: start + task: + id: 29bcd70f-1953-4061-84ce-4cde781ad9f7 + version: -1 + name: "" + description: "" + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + "1": + id: "1" + taskid: 54895e0d-9904-4e62-8f45-ebd0d17ad5c9 + type: title + task: + id: 54895e0d-9904-4e62-8f45-ebd0d17ad5c9 + version: -1 + name: Endpoint Products + description: "" + type: title + iscommand: false + brand: "" + nexttasks: + '#none#': + - "16" + - "18" + - "19" + - "20" + - "30" + separatecontext: false + view: |- + { + "position": { + "x": 1280, + "y": 440 + } + } + note: false + timertriggers: [] + ignoreworker: false + "2": + id: "2" + taskid: c9799048-288a-40cc-8d2f-c561d0ea2f6b + type: condition + task: + id: c9799048-288a-40cc-8d2f-c561d0ea2f6b + version: -1 + name: Is McAfee ePolicy Orchestrator enabled? + description: Checks if there is an active instance of the McAfee ePolicy Orchestrator + integration enabled. + scriptName: Exists + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "4" + "yes": + - "5" + scriptarguments: + value: + complex: + root: modules + filters: + - - operator: isEqualString + left: + value: + simple: brand + iscontext: true + right: + value: + simple: epo + - - operator: isEqualString + left: + value: + simple: state + iscontext: true + right: + value: + simple: active + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 360, + "y": 750 + } + } + note: false + timertriggers: [] + ignoreworker: false + "3": + id: "3" + taskid: efeca58b-3c8f-40aa-8c2e-f9e84257b1bb + type: condition + task: + id: efeca58b-3c8f-40aa-8c2e-f9e84257b1bb + version: -1 + name: Is there an endpoint to enrich? + description: Checks whether there is at least one endpoint to enrich (by hostname). + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "4" + "yes": + - "24" + - "1" + scriptarguments: + value: + simple: ${inputs.Hostname} + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + simple: inputs.Hostname + iscontext: true + view: |- + { + "position": { + "x": 50, + "y": 215 + } + } + note: false + timertriggers: [] + ignoreworker: false + "4": + id: "4" + taskid: ea90c16b-6985-4f28-816f-78608df3fe51 + type: title + task: + id: ea90c16b-6985-4f28-816f-78608df3fe51 + version: -1 + name: Done + description: "" + type: title + iscommand: false + brand: "" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 1630 + } + } + note: false + timertriggers: [] + ignoreworker: false + "5": + id: "5" + taskid: 44a06d71-1772-47af-8d41-8c6dbdd149e7 + type: regular + task: + id: 44a06d71-1772-47af-8d41-8c6dbdd149e7 + version: -1 + name: Get host information from McAfee ePO + description: Gets host information from McAfee ePolicy Orchestrator. + script: epo|||epo-find-system + type: regular + iscommand: true + brand: epo + nexttasks: + '#none#': + - "4" + scriptarguments: + searchText: + complex: + root: inputs.Hostname + transformers: + - operator: uniq + verbose: {} + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 360, + "y": 1086 + } + } + note: false + timertriggers: [] + ignoreworker: false + "8": + id: "8" + taskid: 9fa921fa-d196-40ba-8419-ed0c4f838ab8 + type: condition + task: + id: 9fa921fa-d196-40ba-8419-ed0c4f838ab8 + version: -1 + name: Is Carbon Black Enterprise Response enabled? + description: Checks if there is an active instance of the Carbon Black Enterprise + Response integration enabled. + scriptName: Exists + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "4" + "yes": + - "9" + scriptarguments: + value: + complex: + root: modules + filters: + - - operator: isEqualString + left: + value: + simple: brand + iscontext: true + right: + value: + simple: carbonblack-v2 + - - operator: isEqualString + left: + value: + simple: state + iscontext: true + right: + value: + simple: active + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 830, + "y": 750 + } + } + note: false + timertriggers: [] + ignoreworker: false + "9": + id: "9" + taskid: 79f17c3a-2456-47d9-8e68-cc3d84ef01bd + type: regular + task: + id: 79f17c3a-2456-47d9-8e68-cc3d84ef01bd + version: -1 + name: Get host information from Carbon Black Enterprise Response + description: Gets host information from Carbon Black Enterprise Response. + script: carbonblack-v2|||cb-sensor-info + type: regular + iscommand: true + brand: carbonblack-v2 + nexttasks: + '#none#': + - "4" + scriptarguments: + groupid: {} + hostname: + complex: + root: inputs.Hostname + transformers: + - operator: uniq + ip: {} + sensor: {} + reputationcalc: 1 + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 830, + "y": 1086 + } + } + note: false + timertriggers: [] + ignoreworker: false + "10": + id: "10" + taskid: 216aed2b-2f34-4c5e-8c54-60b978218896 + type: condition + task: + id: 216aed2b-2f34-4c5e-8c54-60b978218896 + version: -1 + name: Is CrowdStrike Falcon Host enabled? + description: Checks if there is an active instance of the CrowdStrike Falcon + Host integration enabled. + scriptName: Exists + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "4" + "yes": + - "27" + scriptarguments: + value: + complex: + root: modules + filters: + - - operator: isEqualString + left: + value: + simple: brand + iscontext: true + right: + value: + simple: FalconHost + - - operator: isEqualString + left: + value: + simple: state + iscontext: true + right: + value: + simple: active + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 2150, + "y": 770 + } + } + note: false + timertriggers: [] + ignoreworker: false + "16": + id: "16" + taskid: d9d617d9-2efd-466e-8ce7-190f8db83b95 + type: title + task: + id: d9d617d9-2efd-466e-8ce7-190f8db83b95 + version: -1 + name: McAfee ePolicy Orchestrator + description: "" + type: title + iscommand: false + brand: "" + nexttasks: + '#none#': + - "2" + separatecontext: false + view: |- + { + "position": { + "x": 360, + "y": 605 + } + } + note: false + timertriggers: [] + ignoreworker: false + "18": + id: "18" + taskid: 6cf08862-644d-479e-89ce-f9e173a8c562 + type: title + task: + id: 6cf08862-644d-479e-89ce-f9e173a8c562 + version: -1 + name: Carbon Black Enterprise Response + description: "" + type: title + iscommand: false + brand: "" + nexttasks: + '#none#': + - "8" + separatecontext: false + view: |- + { + "position": { + "x": 830, + "y": 605 + } + } + note: false + timertriggers: [] + ignoreworker: false + "19": + id: "19" + taskid: 471d3862-a05c-42b1-871d-c1faa2fbb7a9 + type: title + task: + id: 471d3862-a05c-42b1-871d-c1faa2fbb7a9 + version: -1 + name: Cylance Protect v2 + description: "" + type: title + iscommand: false + brand: "" + nexttasks: + '#none#': + - "26" + separatecontext: false + view: |- + { + "position": { + "x": 1280, + "y": 605 + } + } + note: false + timertriggers: [] + ignoreworker: false + "20": + id: "20" + taskid: 5d371f29-3a4c-43c5-8f71-b383db2e5320 + type: title + task: + id: 5d371f29-3a4c-43c5-8f71-b383db2e5320 + version: -1 + name: CrowdStrike Falcon Host + description: "" + type: title + iscommand: false + brand: "" + nexttasks: + '#none#': + - "10" + separatecontext: false + view: |- + { + "position": { + "x": 2150, + "y": 605 + } + } + note: false + timertriggers: [] + ignoreworker: false + "22": + id: "22" + taskid: f7f190b9-5a39-4d8a-83a5-77d5a023f0d4 + type: condition + task: + id: f7f190b9-5a39-4d8a-83a5-77d5a023f0d4 + version: -1 + name: Is Active Directory Query v2 enabled? + description: Checks if there is an active instance of the Active Directory Query + v2 integration enabled. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "4" + "yes": + - "23" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + complex: + root: modules + filters: + - - operator: isEqualString + left: + value: + simple: brand + iscontext: true + right: + value: + simple: Active Directory Query v2 + - - operator: isEqualString + left: + value: + simple: state + iscontext: true + right: + value: + simple: active + iscontext: true + view: |- + { + "position": { + "x": -616, + "y": 750 + } + } + note: false + timertriggers: [] + ignoreworker: false + "23": + id: "23" + taskid: 23c75906-3b4e-42e8-8e32-c883d5f06fb3 + type: regular + task: + id: 23c75906-3b4e-42e8-8e32-c883d5f06fb3 + version: -1 + name: Get host information from Active Directory + description: |- + Uses Active Directory to retrieve detailed information about the computer of the account specified. The computer can be specified by name, email address, or as an Active Directory Distinguished Name (DN). + If no filters are specified, returns all computers. + script: Active Directory Query v2|||ad-get-computer + type: regular + iscommand: true + brand: Active Directory Query v2 + nexttasks: + '#none#': + - "4" + scriptarguments: + attributes: {} + custom-field-data: {} + custom-field-type: {} + dn: {} + name: + complex: + root: inputs.Hostname + transformers: + - operator: uniq + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": -616, + "y": 1056 + } + } + note: false + timertriggers: [] + ignoreworker: false + "24": + id: "24" + taskid: 9706cc39-d338-44cd-8ee1-efc5ea95b04d + type: title + task: + id: 9706cc39-d338-44cd-8ee1-efc5ea95b04d + version: -1 + name: Active Directory + description: "" + type: title + iscommand: false + brand: "" + nexttasks: + '#none#': + - "22" + separatecontext: false + view: |- + { + "position": { + "x": -616, + "y": 440 + } + } + note: false + timertriggers: [] + ignoreworker: false + "26": + id: "26" + taskid: c3597e3d-8bd1-460c-862f-f40421717b16 + type: playbook + task: + id: c3597e3d-8bd1-460c-862f-f40421717b16 + version: -1 + name: Endpoint Enrichment - Cylance Protect v2 + description: Enriches endpoints using the Cylance Protect v2 integration. + playbookName: Endpoint Enrichment - Cylance Protect v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "4" + scriptarguments: + Hostname: + complex: + root: inputs.Hostname + transformers: + - operator: uniq + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + view: |- + { + "position": { + "x": 1280, + "y": 1086 + } + } + note: false + timertriggers: [] + ignoreworker: false + "27": + id: "27" + taskid: f74a190a-1427-4557-8cf1-ff7865da3042 + type: regular + task: + id: f74a190a-1427-4557-8cf1-ff7865da3042 + version: -1 + name: Get Crowdstrike device ID + description: Gets the Crowdstrike Falcon Host device ID that corresponds to + the endpoint that is being enriched. The device ID is necessary to get information + about the endpoint. + script: '|||cs-device-search' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "28" + scriptarguments: + filter: + complex: + root: inputs.Hostname + transformers: + - operator: concat + args: + prefix: + value: + simple: hostname:" + suffix: + value: + simple: '"' + limit: {} + offset: {} + query: {} + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 2250, + "y": 1070 + } + } + note: false + timertriggers: [] + ignoreworker: false + "28": + id: "28" + taskid: 9c60a60d-b2f3-4707-8b0f-690891e080d0 + type: condition + task: + id: 9c60a60d-b2f3-4707-8b0f-690891e080d0 + version: -1 + name: Was a device ID found? + description: Checks whether a Crowdstrike device ID was found for the hostname + that is being enriched. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "4" + "yes": + - "29" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + complex: + root: FalconHostDevices + iscontext: true + view: |- + { + "position": { + "x": 2250, + "y": 1220 + } + } + note: false + timertriggers: [] + ignoreworker: false + "29": + id: "29" + taskid: 9681a79e-1d5e-462c-8e65-ec0bfe1bb7d8 + type: regular + task: + id: 9681a79e-1d5e-462c-8e65-ec0bfe1bb7d8 + version: -1 + name: Get host information from Crowdstrike Falcon Host + description: Gets details for one or more devices, according to device ID. + script: '|||cs-device-details' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "4" + scriptarguments: + ids: + complex: + root: FalconHostDevices + transformers: + - operator: uniq + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 2460, + "y": 1440 + } + } + note: false + timertriggers: [] + ignoreworker: false + "30": + id: "30" + taskid: ec344482-77f7-42b5-8ee4-34317afd1179 + type: title + task: + id: ec344482-77f7-42b5-8ee4-34317afd1179 + version: -1 + name: ExtraHop Reveal(x) + description: "" + type: title + iscommand: false + brand: "" + nexttasks: + '#none#': + - "31" + separatecontext: false + view: |- + { + "position": { + "x": 1710, + "y": 605 + } + } + note: false + timertriggers: [] + ignoreworker: false + "31": + id: "31" + taskid: 58c8b4be-657c-45f6-8eca-5a01da85f1f3 + type: condition + task: + id: 58c8b4be-657c-45f6-8eca-5a01da85f1f3 + version: -1 + name: Is ExtraHop Reveal(x) enabled? + description: Checks if there is an active instance of the ExtraHop Reveal(x) + integration enabled. + scriptName: Exists + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "4" + "yes": + - "32" + scriptarguments: + value: + complex: + root: modules + filters: + - - operator: isEqualString + left: + value: + simple: brand + iscontext: true + right: + value: + simple: ExtraHop v2 + - - operator: isEqualString + left: + value: + simple: state + iscontext: true + right: + value: + simple: active + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 1710, + "y": 770 + } + } + note: false + timertriggers: [] + ignoreworker: false + "32": + id: "32" + taskid: 344e1330-e5f8-4292-83df-7a4fba147ebf + type: regular + task: + id: 344e1330-e5f8-4292-83df-7a4fba147ebf + version: -1 + name: Get host information from ExtraHop Reveal(x) + description: Get host information from ExtraHop Reveal(x). + script: '|||extrahop-device-search' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "4" + scriptarguments: + active_from: {} + active_until: {} + activity: {} + discover_time: {} + ip: {} + l3_only: {} + limit: {} + mac: {} + match_type: {} + name: + simple: ${inputs.Hostname} + operator: {} + role: {} + software: {} + tag: {} + vendor: {} + vlan: {} + separatecontext: false + view: |- + { + "position": { + "x": 1730, + "y": 1086 + } + } + note: false + timertriggers: [] + ignoreworker: false +view: |- + { + "linkLabelsPosition": { + "10_27_yes": 0.69, + "10_4_#default#": 0.1, + "22_23_yes": 0.54, + "22_4_#default#": 0.15, + "28_29_yes": 0.4, + "28_4_#default#": 0.1, + "2_4_#default#": 0.21, + "2_5_yes": 0.64, + "31_32_yes": 0.64, + "31_4_#default#": 0.1, + "3_1_yes": 0.3, + "3_24_yes": 0.41, + "3_4_#default#": 0.12, + "8_4_#default#": 0.16, + "8_9_yes": 0.62 + }, + "paper": { + "dimensions": { + "height": 1645, + "width": 3456, + "x": -616, + "y": 50 + } + } + } +inputs: +- key: Hostname + value: + complex: + root: Endpoint + accessor: Hostname + transformers: + - operator: uniq + required: false + description: The hostname of the endpoint to enrich. +outputs: +- contextPath: Endpoint + description: The endpoint object of the endpoint that was enriched. + type: unknown +- contextPath: Endpoint.Hostname + description: The hostnames of the endpoints that were enriched. + type: string +- contextPath: Endpoint.OS + description: The operating systems running on the endpoints that were enriched. + type: string +- contextPath: Endpoint.IP + description: A list of the IP addresses of the endpoints. +- contextPath: Endpoint.MAC + description: A list of the MAC addresses of the endpoints that were enriched. +- contextPath: Endpoint.Domain + description: The domain names of the endpoints that were enriched. + type: string +- contextPath: CylanceProtectDevice + description: The device information about the hostname that was enriched using Cylance + Protect v2. + type: unknown +- contextPath: ExtraHop.Device.Macaddr + description: The MAC Address of the device. + type: String +- contextPath: ExtraHop.Device.DeviceClass + description: The class of the device. + type: String +- contextPath: ExtraHop.Device.UserModTime + description: The time of the most recent update, expressed in milliseconds since + the epoch. + type: Number +- contextPath: ExtraHop.Device.AutoRole + description: The role automatically detected by the ExtraHop. + type: String +- contextPath: ExtraHop.Device.ParentId + description: The ID of the parent device. + type: Number +- contextPath: ExtraHop.Device.Vendor + description: The device vendor. + type: String +- contextPath: ExtraHop.Device.Analysis + description: The level of analysis preformed on the device. + type: string +- contextPath: ExtraHop.Device.DiscoveryId + description: The UUID given by the Discover appliance. + type: String +- contextPath: ExtraHop.Device.DefaultName + description: The default name of the device. + type: String +- contextPath: ExtraHop.Device.DisplayName + description: The display name of device. + type: String +- contextPath: ExtraHop.Device.OnWatchlist + description: Whether the device is on the advanced analysis whitelist. + type: Boolean +- contextPath: ExtraHop.Device.ModTime + description: The time of the most recent update, expressed in milliseconds since + the epoch. + type: Number +- contextPath: ExtraHop.Device.IsL3 + description: Indicates whether the device is a Layer 3 device. + type: Boolean +- contextPath: ExtraHop.Device.Role + description: The role of the device. + type: String +- contextPath: ExtraHop.Device.DiscoverTime + description: The time that the device was discovered. + type: Number +- contextPath: ExtraHop.Device.Id + description: The ID of the device. + type: Number +- contextPath: ExtraHop.Device.Ipaddr4 + description: The IPv4 address of the device. + type: String +- contextPath: ExtraHop.Device.Vlanid + description: The ID of VLan. + type: Number +- contextPath: ExtraHop.Device.Ipaddr6 + description: The IPv6 address of the device. + type: string +- contextPath: ExtraHop.Device.NodeId + description: The Node ID of the Discover appliance. + type: number +- contextPath: ExtraHop.Device.Description + description: A user customizable description of the device. + type: string +- contextPath: ExtraHop.Device.DnsName + description: The DNS name associated with the device. + type: string +- contextPath: ExtraHop.Device.DhcpName + description: The DHCP name associated with the device. + type: string +- contextPath: ExtraHop.Device.CdpName + description: The Cisco Discovery Protocol name associated with the device. + type: string +- contextPath: ExtraHop.Device.NetbiosName + description: The NetBIOS name associated with the device. + type: string +- contextPath: ExtraHop.Device.Url + description: Link to the device details page in ExtraHop. + type: string +tests: +- Endpoint Enrichment - Generic v2.1 - Test diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-File_Enrichment_-_Generic_v2.yml b/Packs/CommonPlaybooks/Playbooks/playbook-File_Enrichment_-_Generic_v2.yml index d9ca12185db..809f8eb1c35 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-File_Enrichment_-_Generic_v2.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-File_Enrichment_-_Generic_v2.yml @@ -1,326 +1,327 @@ -id: File Enrichment - Generic v2 -version: -1 -fromversion: 4.1.0 -name: File Enrichment - Generic v2 -description: |- - Enrich a file using one or more integrations. - - - Provide threat information - -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: 6fa65b00-15dc-4cab-8b4e-7ab8e2720215 - type: start - task: - id: 6fa65b00-15dc-4cab-8b4e-7ab8e2720215 - version: -1 - name: "" - description: "" - iscommand: false - brand: "" - nexttasks: - '#none#': - - "25" - - "29" - separatecontext: false - view: |- - { - "position": { - "x": 735, - "y": -90 - } - } - note: false - timertriggers: [] - ignoreworker: false - "7": - id: "7" - taskid: d2deb7de-75cc-4f33-8ba3-6f83370096f8 - type: title - task: - id: d2deb7de-75cc-4f33-8ba3-6f83370096f8 - version: -1 - name: Done - type: title - description: "" - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 735, - "y": 620 - } - } - note: false - timertriggers: [] - ignoreworker: false - "25": - id: "25" - taskid: 9ce11d97-a210-4566-8929-a2c7236c34dd - type: condition - task: - id: 9ce11d97-a210-4566-8929-a2c7236c34dd - version: -1 - name: Is there a SHA256 hash? - description: Check if there is a SHA256 hash in context. - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "7" - "yes": - - "27" - scriptarguments: - value: - simple: ${File.SHA256} - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isExists - left: - value: - complex: - root: inputs.SHA256 - iscontext: true - view: |- - { - "position": { - "x": 470, - "y": 50 - } - } - note: false - timertriggers: [] - ignoreworker: false - "27": - id: "27" - taskid: 96571487-7027-42f8-8c89-ca96f16b2a33 - type: condition - task: - id: 96571487-7027-42f8-8c89-ca96f16b2a33 - version: -1 - name: Is Cylance Protect v2 enabled? - description: Checks if there is an active instance of the Cylance Protect v2 integration enabled. - type: condition - iscommand: false - brand: "" - nexttasks: - '#default#': - - "7" - "yes": - - "28" - separatecontext: false - conditions: - - label: "yes" - condition: - - - operator: isExists - left: - value: - complex: - root: modules - filters: - - - operator: isEqualString - left: - value: - simple: modules.brand - iscontext: true - right: - value: - simple: Cylance Protect v2 - ignorecase: true - - - operator: isEqualString - left: - value: - simple: modules.state - iscontext: true - right: - value: - simple: active - ignorecase: true - accessor: brand - iscontext: true - view: |- - { - "position": { - "x": 470, - "y": 250 - } - } - note: false - timertriggers: [] - ignoreworker: false - "28": - id: "28" - taskid: 49c6d1e2-ac63-4783-8733-794570f1bdb5 - type: regular - task: - id: 49c6d1e2-ac63-4783-8733-794570f1bdb5 - version: -1 - name: Get threat information from Cylance Protect v2 - description: Gets threat information from the Cylance Protect v2 integration. - script: Cylance Protect v2|||cylance-protect-get-threat - type: regular - iscommand: true - brand: Cylance Protect v2 - nexttasks: - '#none#': - - "7" - scriptarguments: - sha256: - complex: - root: inputs.SHA256 - transformers: - - operator: uniq - reputationcalc: 1 - continueonerror: true - separatecontext: false - view: |- - { - "position": { - "x": 470, - "y": 450 - } - } - note: false - timertriggers: [] - ignoreworker: false - "29": - id: "29" - taskid: 4e009c34-dfb2-4626-8c6e-b8da7850d084 - type: playbook - task: - id: 4e009c34-dfb2-4626-8c6e-b8da7850d084 - version: -1 - name: File Enrichment - Virus Total Private API - description: Get file information using the Virus Total Private API integration. - playbookName: File Enrichment - Virus Total Private API - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "7" - scriptarguments: - MD5: - complex: - root: inputs.MD5 - transformers: - - operator: uniq - SHA1: - complex: - root: inputs.SHA1 - transformers: - - operator: uniq - SHA256: - complex: - root: inputs.SHA256 - transformers: - - operator: uniq - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 990, - "y": 50 - } - } - note: false - timertriggers: [] - ignoreworker: false -view: |- - { - "linkLabelsPosition": { - "25_27_yes": 0.59, - "25_7_#default#": 0.44, - "27_28_yes": 0.57, - "27_7_#default#": 0.63 - }, - "paper": { - "dimensions": { - "height": 775, - "width": 900, - "x": 470, - "y": -90 - } - } - } -inputs: -- key: MD5 - value: - complex: - root: File - accessor: MD5 - transformers: - - operator: uniq - required: false - description: File MD5 hash to enrich. -- key: SHA256 - value: - complex: - root: File - accessor: SHA256 - transformers: - - operator: uniq - required: false - description: The file SHA256 hash to enrich. -- key: SHA1 - value: - complex: - root: File - accessor: SHA1 - transformers: - - operator: uniq - required: false - description: The file SHA1 hash to enrich. -outputs: -- contextPath: DBotScore.Indicator - description: The indicator that was tested. - type: string -- contextPath: DBotScore.Type - description: The indicator type. - type: string -- contextPath: File.SHA1 - description: SHA1 hash of the file. - type: string -- contextPath: File.SHA256 - description: SHA256 hash of the file. - type: string -- contextPath: File.Malicious.Vendor - description: For malicious files, the vendor that made the decision. - type: string -- contextPath: File.MD5 - description: MD5 hash of the file. - type: string -- contextPath: DBotScore - description: The DBotScore object. - type: unknown -- contextPath: File - description: The file object - type: unknown -- contextPath: DBotScore.Vendor - description: Vendor used to calculate the score. - type: string -- contextPath: DBotScore.Score - description: The actual score. - type: number -- contextPath: File.VirusTotal.Scans - description: The scan object. - type: unknown -- contextPath: File.VirusTotal.Scans.Source - description: Vendor that scanned this hash. -- contextPath: File.VirusTotal.Scans.Detected - description: Whether a scan was detected for this hash (True/False). -- contextPath: File.VirusTotal.Scans.Result - description: Scan result for this hash - signature, etc. -tests: - - File Enrichment - Generic v2 - Test \ No newline at end of file +id: File Enrichment - Generic v2 +version: -1 +name: File Enrichment - Generic v2 +description: |- + Enrich a file using one or more integrations. + + - Provide threat information +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 00109219-5fc8-4bbb-881e-e597ec3b7439 + type: start + task: + id: 00109219-5fc8-4bbb-881e-e597ec3b7439 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "25" + - "29" + separatecontext: false + view: |- + { + "position": { + "x": 735, + "y": -90 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "7": + id: "7" + taskid: 89ce26db-58e9-4a6d-88f2-d6810e458ee2 + type: title + task: + id: 89ce26db-58e9-4a6d-88f2-d6810e458ee2 + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 735, + "y": 620 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "25": + id: "25" + taskid: 339fc232-e5d0-468b-87ea-cf8d41ea0ca6 + type: condition + task: + id: 339fc232-e5d0-468b-87ea-cf8d41ea0ca6 + version: -1 + name: Is there a SHA256 hash? + description: Check if there is a SHA256 hash in context. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "7" + "yes": + - "27" + scriptarguments: + value: + simple: ${File.SHA256} + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + complex: + root: inputs.SHA256 + iscontext: true + view: |- + { + "position": { + "x": 470, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "27": + id: "27" + taskid: 0783a3a6-5d8b-48f1-8dee-f3f0ef62defc + type: condition + task: + id: 0783a3a6-5d8b-48f1-8dee-f3f0ef62defc + version: -1 + name: Is Cylance Protect v2 enabled? + description: Checks if there is an active instance of the Cylance Protect v2 + integration enabled. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "7" + "yes": + - "28" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + complex: + root: modules + filters: + - - operator: isEqualString + left: + value: + simple: modules.brand + iscontext: true + right: + value: + simple: Cylance Protect v2 + ignorecase: true + - - operator: isEqualString + left: + value: + simple: modules.state + iscontext: true + right: + value: + simple: active + ignorecase: true + accessor: brand + iscontext: true + view: |- + { + "position": { + "x": 470, + "y": 250 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "28": + id: "28" + taskid: ff014724-3ad2-4ce2-8578-5106c126e76b + type: regular + task: + id: ff014724-3ad2-4ce2-8578-5106c126e76b + version: -1 + name: Get threat information from Cylance Protect v2 + description: Gets threat information from the Cylance Protect v2 integration. + script: Cylance Protect v2|||cylance-protect-get-threat + type: regular + iscommand: true + brand: Cylance Protect v2 + nexttasks: + '#none#': + - "7" + scriptarguments: + sha256: + complex: + root: inputs.SHA256 + transformers: + - operator: uniq + reputationcalc: 1 + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 470, + "y": 450 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "29": + id: "29" + taskid: e5eae00a-9da2-4d93-8ed2-693e0c6c2c89 + type: playbook + task: + id: e5eae00a-9da2-4d93-8ed2-693e0c6c2c89 + version: -1 + name: File Enrichment - Virus Total Private API + description: Get file information using the Virus Total Private API integration. + playbookName: File Enrichment - Virus Total Private API + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "7" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 990, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 +system: true +view: |- + { + "linkLabelsPosition": { + "25_27_yes": 0.59, + "25_7_#default#": 0.44, + "27_28_yes": 0.57, + "27_7_#default#": 0.63 + }, + "paper": { + "dimensions": { + "height": 775, + "width": 900, + "x": 470, + "y": -90 + } + } + } +inputs: +- key: MD5 + value: + complex: + root: File + accessor: MD5 + transformers: + - operator: uniq + required: false + description: File MD5 hash to enrich. + playbookInputQuery: +- key: SHA256 + value: + complex: + root: File + accessor: SHA256 + transformers: + - operator: uniq + required: false + description: The file SHA256 hash to enrich. + playbookInputQuery: +- key: SHA1 + value: + complex: + root: File + accessor: SHA1 + transformers: + - operator: uniq + required: false + description: The file SHA1 hash to enrich. + playbookInputQuery: +outputs: +- contextPath: DBotScore.Indicator + description: The indicator that was tested. + type: string +- contextPath: DBotScore.Type + description: The indicator type. + type: string +- contextPath: File.SHA1 + description: SHA1 hash of the file. + type: string +- contextPath: File.SHA256 + description: SHA256 hash of the file. + type: string +- contextPath: File.Malicious.Vendor + description: For malicious files, the vendor that made the decision. + type: string +- contextPath: File.MD5 + description: MD5 hash of the file. + type: string +- contextPath: DBotScore + description: The DBotScore object. + type: unknown +- contextPath: File + description: The file object + type: unknown +- contextPath: DBotScore.Vendor + description: Vendor used to calculate the score. + type: string +- contextPath: DBotScore.Score + description: The actual score. + type: number +- contextPath: File.VirusTotal.Scans + description: The scan object. + type: unknown +- contextPath: File.VirusTotal.Scans.Source + description: Vendor that scanned this hash. +- contextPath: File.VirusTotal.Scans.Detected + description: Whether a scan was detected for this hash (True/False). +- contextPath: File.VirusTotal.Scans.Result + description: Scan result for this hash - signature, etc. +fromversion: 4.1.0 +tests: +- File Enrichment - Generic v2 - Test diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Get_File_Sample_By_Hash_-_Generic_v2.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Get_File_Sample_By_Hash_-_Generic_v2.yml index 79028e84557..cdff05a4e59 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Get_File_Sample_By_Hash_-_Generic_v2.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Get_File_Sample_By_Hash_-_Generic_v2.yml @@ -1,165 +1,169 @@ -id: Get File Sample By Hash - Generic v2 -version: -1 -name: Get File Sample By Hash - Generic v2 -fromversion: 4.0.0 -description: |- - This playbook returns a file sample correlating to a hash in the war-room using the following sub-playbooks: - - Get File Sample By Hash - Carbon Black Enterprise Response - - Get File Sample By Hash - Cylance Protect v2 -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: 0131a1f1-22f0-489d-8c41-ec4a0e89369d - type: start - task: - id: 0131a1f1-22f0-489d-8c41-ec4a0e89369d - version: -1 - name: "" - description: "" - iscommand: false - brand: "" - nexttasks: - '#none#': - - "3" - - "5" - separatecontext: false - view: |- - { - "position": { - "x": 265, - "y": 50 - } - } - note: false - timertriggers: [] - ignoreworker: false - "3": - id: "3" - taskid: 1da5490c-6904-40e5-8acf-94035fb926c1 - type: playbook - task: - id: 1da5490c-6904-40e5-8acf-94035fb926c1 - version: -1 - name: Get File Sample By Hash - Carbon Black Enterprise Response - description: Returns to the war-room a file sample correlating to MD5 hashes - in the input using Carbon Black Enterprise Response integration - playbookName: Get File Sample By Hash - Carbon Black Enterprise Response - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "4" - scriptarguments: - MD5: - complex: - root: inputs.MD5 - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 50, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "4": - id: "4" - taskid: 905fca17-4fc2-4efb-8db3-322ff915dee8 - type: title - task: - id: 905fca17-4fc2-4efb-8db3-322ff915dee8 - version: -1 - name: Done - description: "" - type: title - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 265, - "y": 370 - } - } - note: false - timertriggers: [] - ignoreworker: false - "5": - id: "5" - taskid: 5989c92e-a48a-4546-8fab-5a879606db38 - type: playbook - task: - id: 5989c92e-a48a-4546-8fab-5a879606db38 - version: -1 - name: Get File Sample By Hash - Cylance Protect v2 - description: This playbook returns a file sample to the war-room given the file's - SHA256 hash, using Cylance Protect v2 integration. - playbookName: Get File Sample By Hash - Cylance Protect v2 - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "4" - scriptarguments: - SHA256: - complex: - root: inputs.SHA256 - unzip: {} - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 480, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false -view: |- - { - "linkLabelsPosition": {}, - "paper": { - "dimensions": { - "height": 385, - "width": 810, - "x": 50, - "y": 50 - } - } - } -inputs: -- key: MD5 - value: - complex: - root: File - accessor: MD5 - required: false - description: Get file sample from MD5 input -- key: SHA256 - value: - complex: - root: File - accessor: SHA256 - required: false - description: Get file sample from SHA256 input -outputs: -- contextPath: File - description: File sample object - type: unknown -tests: - - No test +id: Get File Sample By Hash - Generic v2 +version: -1 +name: Get File Sample By Hash - Generic v2 +description: |- + This playbook returns a file sample correlating to a hash in the war-room using the following sub-playbooks: + - Get File Sample By Hash - Carbon Black Enterprise Response + - Get File Sample By Hash - Cylance Protect v2 +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: e1c3bf5a-d7ba-4062-8877-ad2799d1db03 + type: start + task: + id: e1c3bf5a-d7ba-4062-8877-ad2799d1db03 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "3" + - "5" + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "3": + id: "3" + taskid: 09f337a9-fb19-48ce-8b0f-902e0dc9f047 + type: playbook + task: + id: 09f337a9-fb19-48ce-8b0f-902e0dc9f047 + version: -1 + name: Get File Sample By Hash - Carbon Black Enterprise Response + description: Returns to the war-room a file sample correlating to MD5 hashes + in the input using Carbon Black Enterprise Response integration + playbookName: Get File Sample By Hash - Carbon Black Enterprise Response + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "4" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 50, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "4": + id: "4" + taskid: b5e5705d-8e32-41bb-8c3b-63c78bd2d14f + type: title + task: + id: b5e5705d-8e32-41bb-8c3b-63c78bd2d14f + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "5": + id: "5" + taskid: 3a3ab19d-7b69-4631-847b-27eb7f7f80ee + type: playbook + task: + id: 3a3ab19d-7b69-4631-847b-27eb7f7f80ee + version: -1 + name: Get File Sample By Hash - Cylance Protect v2 + description: This playbook returns a file sample to the war-room given the file's + SHA256 hash, using Cylance Protect v2 integration. + playbookName: Get File Sample By Hash - Cylance Protect v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "4" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 480, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 +system: true +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 385, + "width": 810, + "x": 50, + "y": 50 + } + } + } +inputs: +- key: MD5 + value: + complex: + root: File + accessor: MD5 + required: false + description: Get file sample from MD5 input + playbookInputQuery: +- key: SHA256 + value: + complex: + root: File + accessor: SHA256 + required: false + description: Get file sample from SHA256 input + playbookInputQuery: +outputs: +- contextPath: File + description: File sample object + type: unknown +fromversion: 4.0.0 +tests: +- No test diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Isolate_Endpoint_-_Generic.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Isolate_Endpoint_-_Generic.yml index e158eff2575..060bd7f53ce 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Isolate_Endpoint_-_Generic.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Isolate_Endpoint_-_Generic.yml @@ -1,245 +1,249 @@ -id: Isolate Endpoint - Generic -version: -1 -name: Isolate Endpoint - Generic -fromversion: 4.5.0 -description: |- - This playbook isolates a given endpoint using the following integrations: - - Carbon Black Enterprise Response - - Palo Alto Networks Traps -starttaskid: "0" -tasks: - "0": - id: "0" - taskid: c28a842f-4020-44b3-87be-61b3e4d321d5 - type: start - task: - id: c28a842f-4020-44b3-87be-61b3e4d321d5 - version: -1 - name: "" - description: "" - iscommand: false - brand: "" - nexttasks: - '#none#': - - "1" - - "3" - - "4" - - "5" - separatecontext: false - view: |- - { - "position": { - "x": 695, - "y": 50 - } - } - note: false - timertriggers: [] - ignoreworker: false - "1": - id: "1" - taskid: d9b85b38-149f-4d94-87f5-2b988b4768b2 - type: playbook - task: - id: d9b85b38-149f-4d94-87f5-2b988b4768b2 - version: -1 - name: Block Endpoint - Carbon Black Response - description: Carbon Black Response - isolate an endpoint, given a hostname. - playbookName: Block Endpoint - Carbon Black Response - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - Hostname: - complex: - root: inputs.Hostname - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 50, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "2": - id: "2" - taskid: 5d7c932e-551c-4771-852a-3213db3e26aa - type: title - task: - id: 5d7c932e-551c-4771-852a-3213db3e26aa - version: -1 - name: Done - description: "" - type: title - iscommand: false - brand: "" - separatecontext: false - view: |- - { - "position": { - "x": 695, - "y": 370 - } - } - note: false - timertriggers: [] - ignoreworker: false - "3": - id: "3" - taskid: 5118e345-64b7-48a0-8fa8-29b13a7920de - type: playbook - task: - id: 5118e345-64b7-48a0-8fa8-29b13a7920de - version: -1 - name: Traps Isolate Endpoint - playbookName: Traps Isolate Endpoint - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - EndpointId: - complex: - root: inputs.EndpointId - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 480, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "4": - id: "4" - taskid: 0d638e3d-9061-495e-835b-f64ce541f710 - type: playbook - task: - id: 0d638e3d-9061-495e-835b-f64ce541f710 - version: -1 - name: Cortex XDR - Isolate Endpoint - playbookName: Cortex XDR - Isolate Endpoint - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - endpoint_id: - complex: - root: inputs.xdr_endpoint_id - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 910, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false - "5": - id: "5" - taskid: 6ff6aacf-a0b2-4c8a-8237-de2a0911b5d3 - type: playbook - task: - id: 6ff6aacf-a0b2-4c8a-8237-de2a0911b5d3 - version: -1 - name: Isolate Endpoint - Cybereason - playbookName: Isolate Endpoint - Cybereason - description: "" - type: playbook - iscommand: false - brand: "" - nexttasks: - '#none#': - - "2" - scriptarguments: - Hostname: - complex: - root: inputs.Hostname - separatecontext: true - loop: - iscommand: false - exitCondition: "" - wait: 1 - view: |- - { - "position": { - "x": 1340, - "y": 195 - } - } - note: false - timertriggers: [] - ignoreworker: false -view: |- - { - "linkLabelsPosition": {}, - "paper": { - "dimensions": { - "height": 385, - "width": 1670, - "x": 50, - "y": 50 - } - } - } -inputs: -- key: Hostname - value: {} - required: false - description: Hostname of the endpoint to block. -- key: EndpointId - value: {} - required: false - description: Endpoint ID to isolate using Traps. -- key: xdr_endpoint_id - value: - complex: - root: PaloAltoNetworksXDR - accessor: Endpoint.endpoint_id - required: false - description: The endpoint ID (string) to isolate using Cortex XDR. You can retrieve - the string from the xdr-get-endpoints command. -outputs: -- contextPath: CbResponse.Sensors.CbSensorID - description: Carbon Black Response Sensors ids that has been isolated. - type: string -- contextPath: Endpoint - description: The isolated enpoint. - type: string -- contextPath: Traps.Isolate.EndpointID - description: The ID of the endpoint. - type: string -- contextPath: Traps.IsolateResult.Status - description: The status of the isolation operation. - type: string -tests: - - No Test +id: Isolate Endpoint - Generic +version: -1 +name: Isolate Endpoint - Generic +description: |- + This playbook isolates a given endpoint using the following integrations: + - Carbon Black Enterprise Response + - Palo Alto Networks Traps +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 20f01f93-7b37-4f3f-8c17-a466dac351ef + type: start + task: + id: 20f01f93-7b37-4f3f-8c17-a466dac351ef + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "1" + - "3" + - "4" + - "5" + separatecontext: false + view: |- + { + "position": { + "x": 695, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "1": + id: "1" + taskid: 04788a57-6aec-4937-815e-9e3d15884911 + type: playbook + task: + id: 04788a57-6aec-4937-815e-9e3d15884911 + version: -1 + name: Block Endpoint - Carbon Black Response + description: Carbon Black Response - isolate an endpoint, given a hostname. + playbookName: Block Endpoint - Carbon Black Response + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 50, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "2": + id: "2" + taskid: 050d36dd-0ec3-4490-827e-e210ac5e9a04 + type: title + task: + id: 050d36dd-0ec3-4490-827e-e210ac5e9a04 + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 695, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "3": + id: "3" + taskid: 3bbb5acd-9a81-43ac-83aa-c44958724c89 + type: playbook + task: + id: 3bbb5acd-9a81-43ac-83aa-c44958724c89 + version: -1 + name: Traps Isolate Endpoint + playbookName: Traps Isolate Endpoint + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 480, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "4": + id: "4" + taskid: 1a99bbfd-5d0b-4f8f-8c14-292e77965358 + type: playbook + task: + id: 1a99bbfd-5d0b-4f8f-8c14-292e77965358 + version: -1 + name: Cortex XDR - Isolate Endpoint + playbookName: Cortex XDR - Isolate Endpoint + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 910, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "5": + id: "5" + taskid: e0c2fa1f-4bfd-4ede-88cb-70615209b420 + type: playbook + task: + id: e0c2fa1f-4bfd-4ede-88cb-70615209b420 + version: -1 + name: Isolate Endpoint - Cybereason + playbookName: Isolate Endpoint - Cybereason + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 1340, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 +system: true +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 385, + "width": 1670, + "x": 50, + "y": 50 + } + } + } +inputs: +- key: Hostname + value: {} + required: false + description: Hostname of the endpoint to block. + playbookInputQuery: +- key: EndpointId + value: {} + required: false + description: Endpoint ID to isolate using Traps. + playbookInputQuery: +- key: xdr_endpoint_id + value: + complex: + root: PaloAltoNetworksXDR + accessor: Endpoint.endpoint_id + required: false + description: The endpoint ID (string) to isolate using Cortex XDR. You can retrieve + the string from the xdr-get-endpoints command. + playbookInputQuery: +outputs: +- contextPath: CbResponse.Sensors.CbSensorID + description: Carbon Black Response Sensors ids that has been isolated. + type: string +- contextPath: Endpoint + description: The isolated enpoint. + type: string +- contextPath: Traps.Isolate.EndpointID + description: The ID of the endpoint. + type: string +- contextPath: Traps.IsolateResult.Status + description: The status of the isolation operation. + type: string +fromversion: 4.5.0 +tests: +- No Test diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_V2.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_V2.yml new file mode 100644 index 00000000000..4f581f1c965 --- /dev/null +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_V2.yml @@ -0,0 +1,418 @@ +id: Search Endpoints By Hash - Generic V2 +version: -1 +name: Search Endpoints By Hash - Generic V2 +description: Hunt using available tools +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: c485e19b-c83a-48e4-892c-8bd91e17ced2 + type: start + task: + id: c485e19b-c83a-48e4-892c-8bd91e17ced2 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "9" + - "10" + separatecontext: false + view: |- + { + "position": { + "x": 690, + "y": -50 + } + } + note: false + timertriggers: [] + ignoreworker: false + "5": + id: "5" + taskid: f4b71101-7ae3-4ce8-87b7-10eeb13c1a79 + type: playbook + task: + id: f4b71101-7ae3-4ce8-87b7-10eeb13c1a79 + version: -1 + name: Search Endpoints By Hash - CrowdStrike + playbookName: Search Endpoints By Hash - CrowdStrike + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "12" + scriptarguments: + MD5Hash: + complex: + root: inputs + accessor: MD5Hash + SHA1Hash: + complex: + root: inputs + accessor: SHA1Hash + SHA256Hash: + complex: + root: inputs + accessor: SHA256Hash + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + view: |- + { + "position": { + "x": 63, + "y": 320 + } + } + note: false + timertriggers: [] + ignoreworker: false + "8": + id: "8" + taskid: 912e992b-d3bd-4353-8177-5ea207ef2ac6 + type: playbook + task: + id: 912e992b-d3bd-4353-8177-5ea207ef2ac6 + version: -1 + name: Search Endpoints By Hash - Carbon Black Protection + playbookName: Search Endpoints By Hash - Carbon Black Protection + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "12" + scriptarguments: + Hash: + complex: + root: inputs + accessor: MD5Hash + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + view: |- + { + "position": { + "x": 1350, + "y": 500 + } + } + note: false + timertriggers: [] + ignoreworker: false + "9": + id: "9" + taskid: 9510dbd8-98c3-4611-802f-333acf31875b + type: title + task: + id: 9510dbd8-98c3-4611-802f-333acf31875b + version: -1 + name: MD5 Only + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "11" + separatecontext: false + view: |- + { + "position": { + "x": 1148, + "y": 200 + } + } + note: false + timertriggers: [] + ignoreworker: false + "10": + id: "10" + taskid: ce67117f-133a-4da3-84be-14e4a831756a + type: title + task: + id: ce67117f-133a-4da3-84be-14e4a831756a + version: -1 + name: MD5 / SHA1 / SHA256 + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "5" + - "13" + - "15" + separatecontext: false + view: |- + { + "position": { + "x": 63, + "y": 160 + } + } + note: false + timertriggers: [] + ignoreworker: false + "11": + id: "11" + taskid: 05df1d6e-f77e-4b06-8c62-2750064f5b00 + type: condition + task: + id: 05df1d6e-f77e-4b06-8c62-2750064f5b00 + version: -1 + name: Is MD5 hash? + description: Is MD5 hash? + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "14" + "yes": + - "8" + - "16" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + complex: + root: inputs + accessor: MD5Hash + iscontext: true + view: |- + { + "position": { + "x": 1148, + "y": 309 + } + } + note: false + timertriggers: [] + ignoreworker: false + "12": + id: "12" + taskid: f2a05482-2b17-4a09-8813-be48459935c3 + type: title + task: + id: f2a05482-2b17-4a09-8813-be48459935c3 + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 790, + "y": 690 + } + } + note: false + timertriggers: [] + ignoreworker: false + "13": + id: "13" + taskid: a6785055-98d6-4b2e-8da8-c2e0c6b90887 + type: playbook + task: + id: a6785055-98d6-4b2e-8da8-c2e0c6b90887 + version: -1 + name: Search Endpoints By Hash - McAfee TIE + description: |- + Hunt for sightings of MD5, SHA1 and/or SHA256 hashes on endpoints, using McAfee TIE (requires ePO as well). + + Input: + * Hash (default, takes all different hashes from context) + + Output: + * All endpoints with TIE on which the file with the hash was found. + * Enrich Agents info from ePO + playbookName: Search Endpoints By Hash - TIE + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "12" + scriptarguments: + Hash: + simple: ${.=Object.keys(val.inputs).map(function(f) { return val.inputs[f]; + }).reduce(function(a, b){ return a.concat(b); }, [])} + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + view: |- + { + "position": { + "x": 480, + "y": 320 + } + } + note: false + timertriggers: [] + ignoreworker: false + "14": + id: "14" + taskid: 974d2e04-3c66-445c-844d-be5ebdbc218e + type: title + task: + id: 974d2e04-3c66-445c-844d-be5ebdbc218e + version: -1 + name: No MD5 + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "12" + separatecontext: false + view: |- + { + "position": { + "x": 1770, + "y": 480 + } + } + note: false + timertriggers: [] + ignoreworker: false + "15": + id: "15" + taskid: 9a4ed50f-2387-466f-8d3f-a1b1c05c57d1 + type: playbook + task: + id: 9a4ed50f-2387-466f-8d3f-a1b1c05c57d1 + version: -1 + name: Search Endpoints By Hash - Cybereason + playbookName: Search Endpoints By Hash - Cybereason + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "12" + scriptarguments: + MD5Hash: + complex: + root: inputs.MD5Hash + SHA1Hash: + complex: + root: inputs.SHA1Hash + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + view: |- + { + "position": { + "x": -350, + "y": 320 + } + } + note: false + timertriggers: [] + ignoreworker: false + "16": + id: "16" + taskid: 0776ac69-dbd9-4a61-8b55-7d721d2dafe7 + type: playbook + task: + id: 0776ac69-dbd9-4a61-8b55-7d721d2dafe7 + version: -1 + name: Search Endpoints By Hash - Carbon Black Response V2 + playbookName: Search Endpoints By Hash - Carbon Black Response V2 + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "12" + scriptarguments: + Hash: + complex: + root: File + accessor: MD5 + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + view: |- + { + "position": { + "x": 920, + "y": 500 + } + } + note: false + timertriggers: [] + ignoreworker: false +view: |- + { + "linkLabelsPosition": { + "11_16_yes": 0.47, + "11_8_yes": 0.58 + }, + "paper": { + "dimensions": { + "height": 805, + "width": 2500, + "x": -350, + "y": -50 + } + } + } +inputs: +- key: MD5Hash + value: + complex: + root: File + accessor: MD5 + required: false + description: MD5 Hash +- key: SHA1Hash + value: + complex: + root: File + accessor: SHA1 + required: false + description: SHA1 Hash +- key: SHA256Hash + value: + complex: + root: File + accessor: SHA256 + required: false + description: SHA256 Hash +outputs: +- contextPath: Endpoint.Hostname + description: Device hostname + type: string +- contextPath: Endpoint + description: The endpoint + type: unknown +fromversion: 4.5.0 +tests: +- No tests diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_V2_README.md b/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_V2_README.md new file mode 100644 index 00000000000..986d2903322 --- /dev/null +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_V2_README.md @@ -0,0 +1,41 @@ +Hunt using available tools + +## Dependencies +This playbook uses the following sub-playbooks, integrations, and scripts. + +### Sub-playbooks +* Search Endpoints By Hash - CrowdStrike +* Search Endpoints By Hash - Cybereason +* Search Endpoints By Hash - TIE +* Search Endpoints By Hash - Carbon Black Response V2 +* Search Endpoints By Hash - Carbon Black Protection + +### Integrations +This playbook does not use any integrations. + +### Scripts +This playbook does not use any scripts. + +### Commands +This playbook does not use any commands. + +## Playbook Inputs +--- + +| **Name** | **Description** | **Default Value** | **Required** | +| --- | --- | --- | --- | +| MD5Hash | MD5 Hash | File.MD5 | Optional | +| SHA1Hash | SHA1 Hash | File.SHA1 | Optional | +| SHA256Hash | SHA256 Hash | File.SHA256 | Optional | + +## Playbook Outputs +--- + +| **Path** | **Description** | **Type** | +| --- | --- | --- | +| Endpoint.Hostname | Device hostname | string | +| Endpoint | The endpoint | unknown | + +## Playbook Image +--- +![Search Endpoints By Hash - Generic V2](Insert the link to your image here) \ No newline at end of file diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Send_Investigation_Summary_Reports.yml b/Packs/CommonPlaybooks/Playbooks/playbook-Send_Investigation_Summary_Reports.yml index 743baf60e19..a413fb214d6 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Send_Investigation_Summary_Reports.yml +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Send_Investigation_Summary_Reports.yml @@ -40,7 +40,7 @@ tasks: version: -1 name: Find Closed Incidents description: Searches Demisto incidents to identify closed incidents. - scriptName: SearchIncidents + scriptName: SearchIncidentsV2 type: regular iscommand: false brand: "" diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Send_Investigation_Summary_Reports_README.md b/Packs/CommonPlaybooks/Playbooks/playbook-Send_Investigation_Summary_Reports_README.md index 2616c1835d4..0def7848f87 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Send_Investigation_Summary_Reports_README.md +++ b/Packs/CommonPlaybooks/Playbooks/playbook-Send_Investigation_Summary_Reports_README.md @@ -10,7 +10,7 @@ This playbook does not use any sub-playbooks. * Builtin ### Scripts -* SearchIncidents +* SearchIncidentsV2 * GenerateSummaryReports * Exists diff --git a/Packs/CommonPlaybooks/ReleaseNotes/1_0_1.md b/Packs/CommonPlaybooks/ReleaseNotes/1_0_1.md index d1748de0380..1c7308af87f 100644 --- a/Packs/CommonPlaybooks/ReleaseNotes/1_0_1.md +++ b/Packs/CommonPlaybooks/ReleaseNotes/1_0_1.md @@ -1,4 +1,4 @@ - -### Playbooks -- __Detonate File - Generic__ -- + +### Playbooks +- __Detonate File - Generic__ +- \ No newline at end of file diff --git a/Packs/CommonPlaybooks/ReleaseNotes/1_1_0.md b/Packs/CommonPlaybooks/ReleaseNotes/1_1_0.md new file mode 100644 index 00000000000..fce4e38b215 --- /dev/null +++ b/Packs/CommonPlaybooks/ReleaseNotes/1_1_0.md @@ -0,0 +1,4 @@ + +#### Playbooks +##### Detonate File - Generic + diff --git a/Packs/CommonPlaybooks/ReleaseNotes/1_1_1.md b/Packs/CommonPlaybooks/ReleaseNotes/1_1_1.md new file mode 100644 index 00000000000..12d2cd3b0c9 --- /dev/null +++ b/Packs/CommonPlaybooks/ReleaseNotes/1_1_1.md @@ -0,0 +1,4 @@ + +#### Playbooks +##### __Send Investigation Summary Reports__ +- Updated the command SearchIncidents to SearchIncidentsV2. diff --git a/Packs/CommonPlaybooks/ReleaseNotes/1_2_0.md b/Packs/CommonPlaybooks/ReleaseNotes/1_2_0.md new file mode 100644 index 00000000000..e7ab8faccd9 --- /dev/null +++ b/Packs/CommonPlaybooks/ReleaseNotes/1_2_0.md @@ -0,0 +1,13 @@ + \ No newline at end of file diff --git a/Packs/CommonPlaybooks/ReleaseNotes/1_3_0.md b/Packs/CommonPlaybooks/ReleaseNotes/1_3_0.md new file mode 100644 index 00000000000..e093cacd5cd --- /dev/null +++ b/Packs/CommonPlaybooks/ReleaseNotes/1_3_0.md @@ -0,0 +1,3 @@ + +#### Playbooks +##### Detonate File - Generic diff --git a/Packs/CommonPlaybooks/ReleaseNotes/1_4_0.md b/Packs/CommonPlaybooks/ReleaseNotes/1_4_0.md new file mode 100644 index 00000000000..98b3af208e9 --- /dev/null +++ b/Packs/CommonPlaybooks/ReleaseNotes/1_4_0.md @@ -0,0 +1,4 @@ + +#### Playbooks +##### Get Original Email - Generic +- Added an output of email headers. diff --git a/Packs/CommonPlaybooks/ReleaseNotes/1_5_0.md b/Packs/CommonPlaybooks/ReleaseNotes/1_5_0.md new file mode 100644 index 00000000000..c2afe0f1582 --- /dev/null +++ b/Packs/CommonPlaybooks/ReleaseNotes/1_5_0.md @@ -0,0 +1,4 @@ + +#### Playbooks +##### New: Entity Enrichment - Generic v3 +Enrich entities using one or more integrations. diff --git a/Packs/CommonPlaybooks/TestPlaybooks/playbook-Send_Investigation_Summary_Reports_Test.yml b/Packs/CommonPlaybooks/TestPlaybooks/playbook-Send_Investigation_Summary_Reports_Test.yml index 6424072d5e4..58a09e58ad8 100644 --- a/Packs/CommonPlaybooks/TestPlaybooks/playbook-Send_Investigation_Summary_Reports_Test.yml +++ b/Packs/CommonPlaybooks/TestPlaybooks/playbook-Send_Investigation_Summary_Reports_Test.yml @@ -340,7 +340,7 @@ tasks: id: 821bfa0a-952b-4066-81fa-34348543fad1 iscommand: false name: Get Incident - script: SearchIncidents + script: SearchIncidentsV2 type: regular version: -1 taskid: 821bfa0a-952b-4066-81fa-34348543fad1 diff --git a/Packs/CommonPlaybooks/doc_files/Entity_Enrichment_-_Generic_v3.png b/Packs/CommonPlaybooks/doc_files/Entity_Enrichment_-_Generic_v3.png new file mode 100644 index 00000000000..9f3cb025ac4 Binary files /dev/null and b/Packs/CommonPlaybooks/doc_files/Entity_Enrichment_-_Generic_v3.png differ diff --git a/Packs/CommonPlaybooks/doc_files/Search_Endpoints_By_Hash_-_Generic_V2.png b/Packs/CommonPlaybooks/doc_files/Search_Endpoints_By_Hash_-_Generic_V2.png new file mode 100644 index 00000000000..d8b4016afba Binary files /dev/null and b/Packs/CommonPlaybooks/doc_files/Search_Endpoints_By_Hash_-_Generic_V2.png differ diff --git a/Packs/CommonPlaybooks/pack_metadata.json b/Packs/CommonPlaybooks/pack_metadata.json index 41263ca5792..52f2995fe70 100644 --- a/Packs/CommonPlaybooks/pack_metadata.json +++ b/Packs/CommonPlaybooks/pack_metadata.json @@ -1,14 +1,292 @@ -{ - "name": "Common Playbooks", - "description": "Frequently used playbooks pack.", - "support": "xsoar", - "currentVersion": "1.0.1", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-05-14T08:33:25Z", - "categories": [], - "tags": [], - "useCases": [], - "keywords": [] +{ + "name": "Common Playbooks", + "description": "Frequently used playbooks pack.", + "support": "xsoar", + "currentVersion": "1.5.0", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-05-14T08:33:25Z", + "categories": [], + "tags": [], + "useCases": [], + "keywords": [], + "dependencies": { + "VirusTotal": { + "mandatory": false, + "display_name": "VirusTotal" + }, + "ExtraHop": { + "mandatory": false, + "display_name": "ExtraHop Reveal(x)" + }, + "CommonScripts": { + "mandatory": true, + "display_name": "Common Scripts" + }, + "JoeSecurity": { + "mandatory": false, + "display_name": "Joe Security" + }, + "SNDBOX": { + "mandatory": false, + "display_name": "SNDBOX" + }, + "McAfee-TIE": { + "mandatory": false, + "display_name": "McAfee Threat Intelligence Exchange" + }, + "GmailSingleUser": { + "mandatory": false, + "display_name": "Gmail Single User (Beta)" + }, + "Flashpoint": { + "mandatory": false, + "display_name": "Flashpoint" + }, + "CarbonBlackProtect": { + "mandatory": false, + "display_name": "Carbon Black Enterprise Protection" + }, + "CrowdStrikeIntel": { + "mandatory": false, + "display_name": "CrowdStrike Falcon Intel" + }, + "CalculateTimeDifference": { + "mandatory": true, + "display_name": "CalculateTimeDifference" + }, + "Cylance_Protect": { + "mandatory": false, + "display_name": "Cylance Protect" + }, + "Active_Directory_Query": { + "mandatory": false, + "display_name": "Active Directory Query" + }, + "ReversingLabs_Titanium_Cloud": { + "mandatory": false, + "display_name": "ReversingLabs Titanium Cloud" + }, + "Anomali_ThreatStream": { + "mandatory": false, + "display_name": "Anomali ThreatStream" + }, + "VulnDB": { + "mandatory": false, + "display_name": "VulnDB" + }, + "ThreatMiner": { + "mandatory": false, + "display_name": "ThreatMiner" + }, + "AutoFocus": { + "mandatory": false, + "display_name": "AutoFocus" + }, + "Cofense-Intelligence": { + "mandatory": false, + "display_name": "Cofense Intelligence" + }, + "VirusTotal-Private_API": { + "mandatory": false, + "display_name": "VirusTotal - Private API" + }, + "Carbon_Black_Enterprise_Response": { + "mandatory": false, + "display_name": "Carbon Black Enterprise Response" + }, + "Palo_Alto_Networks_WildFire": { + "mandatory": false, + "display_name": "Palo Alto Networks WildFire" + }, + "ThreatQ": { + "mandatory": false, + "display_name": "ThreatQ" + }, + "CheckpointFirewall": { + "mandatory": false, + "display_name": "Check Point Firewall" + }, + "CortexXDR": { + "mandatory": false, + "display_name": "Palo Alto Networks Cortex XDR - Investigation and Response" + }, + "Gmail": { + "mandatory": false, + "display_name": "Gmail" + }, + "D2": { + "mandatory": false, + "display_name": "D2" + }, + "CrowdStrikeHost": { + "mandatory": false, + "display_name": "FalconHost" + }, + "McAfee_Advanced_Threat_Defense": { + "mandatory": false, + "display_name": "McAfee Advanced Threat Defense" + }, + "Phishing": { + "mandatory": false, + "display_name": "Phishing" + }, + "ReversingLabs_A1000": { + "mandatory": false, + "display_name": "ReversingLabs A1000" + }, + "MicrosoftGraphListener": { + "mandatory": false, + "display_name": "Microsoft Graph Mail Single User" + }, + "Lastline": { + "mandatory": false, + "display_name": "Lastline" + }, + "illuminate": { + "mandatory": false, + "display_name": "illuminate" + }, + "MicrosoftGraphMail": { + "mandatory": false, + "display_name": "Microsoft Graph Mail" + }, + "isight": { + "mandatory": false, + "display_name": "FireEye iSIGHT" + }, + "CrowdStrikeFalconSandbox": { + "mandatory": false, + "display_name": "CrowdStrike Falcon Sandbox" + }, + "fireeye": { + "mandatory": false, + "display_name": "FireEye (AX Series)" + }, + "Threat_Crowd": { + "mandatory": false, + "display_name": "Threat Crowd" + }, + "XFE": { + "mandatory": false, + "display_name": "IBM X-Force Exchange" + }, + "ML": { + "mandatory": false, + "display_name": "Machine Learning" + }, + "Symantec_Deepsight": { + "mandatory": false, + "display_name": "Symantec Deepsight Intelligence (Beta)" + }, + "rasterize": { + "mandatory": false, + "display_name": "Rasterize" + }, + "CuckooSandbox": { + "mandatory": false, + "display_name": "Cuckoo Sandbox" + }, + "ANYRUN": { + "mandatory": false, + "display_name": "ANY.RUN" + }, + "MailSenderNew": { + "mandatory": false, + "display_name": "Mail Sender (New)" + }, + "ThreatExchange": { + "mandatory": false, + "display_name": "ThreatExchange" + }, + "AlienVault_OTX": { + "mandatory": false, + "display_name": "AlienVault OTX" + }, + "ThreatGrid": { + "mandatory": false, + "display_name": "Cisco Threat Grid" + }, + "ThreatConnect": { + "mandatory": false, + "display_name": "ThreatConnect" + }, + "Zscaler": { + "mandatory": false, + "display_name": "Zscaler" + }, + "Maltiverse": { + "mandatory": false, + "display_name": "Maltiverse" + }, + "EclecticIQ": { + "mandatory": false, + "display_name": "EclecticIQ Platform" + }, + "Traps": { + "mandatory": false, + "display_name": "Palo Alto Networks Traps" + }, + "PAN-OS": { + "mandatory": false, + "display_name": "PAN-OS" + }, + "TruSTAR": { + "mandatory": false, + "display_name": "TruSTAR" + }, + "epo": { + "mandatory": false, + "display_name": "McAfee ePO" + }, + "Recorded_Future": { + "mandatory": false, + "display_name": "Recorded Future" + }, + "EWSMailSender": { + "mandatory": false, + "display_name": "EWS Mail Sender" + }, + "PolySwarm": { + "mandatory": false, + "display_name": "PolySwarm" + }, + "Cisco-umbrella": { + "mandatory": false, + "display_name": "Cisco Umbrella Investigate" + }, + "ImageOCR": { + "mandatory": false, + "display_name": "Image OCR" + }, + "EWS": { + "mandatory": false, + "display_name": "EWS" + }, + "XForceExchange": { + "mandatory": false, + "display_name": "IBM X-Force Exchange" + }, + "URLHaus": { + "mandatory": false, + "display_name": "URLhaus" + }, + "MISP": { + "mandatory": false, + "display_name": "MISP" + }, + "Cybereason": { + "mandatory": false, + "display_name": "Cybereason" + }, + "VMRay": { + "mandatory": false, + "display_name": "VMRay" + }, + "HybridAnalysis": { + "mandatory": false, + "display_name": "Hybrid Analysis" + } + } } \ No newline at end of file diff --git a/Packs/CommonReports/pack_metadata.json b/Packs/CommonReports/pack_metadata.json index 7aa8a30c8aa..95a88f56db3 100644 --- a/Packs/CommonReports/pack_metadata.json +++ b/Packs/CommonReports/pack_metadata.json @@ -12,5 +12,6 @@ ], "tags": [], "useCases": [], - "keywords": [] -} + "keywords": [], + "dependencies": {} +} \ No newline at end of file diff --git a/Packs/CommonScripts/.pack-ignore b/Packs/CommonScripts/.pack-ignore index e69de29bb2d..7462085e7ee 100644 --- a/Packs/CommonScripts/.pack-ignore +++ b/Packs/CommonScripts/.pack-ignore @@ -0,0 +1,2 @@ +[file:GetDuplicatesMlv2.yml] +ignore=SC100 diff --git a/Packs/CommonScripts/ReleaseNotes/1_1_4.md b/Packs/CommonScripts/ReleaseNotes/1_1_4.md new file mode 100644 index 00000000000..862ae7feaf3 --- /dev/null +++ b/Packs/CommonScripts/ReleaseNotes/1_1_4.md @@ -0,0 +1,4 @@ + +#### Scripts +##### __SetGridField__ +- Fixed an issue in which non alphabetically sorted values given to the **columns** were not processed as expected. diff --git a/Packs/CommonScripts/ReleaseNotes/1_1_5.md b/Packs/CommonScripts/ReleaseNotes/1_1_5.md new file mode 100644 index 00000000000..c688bedd8b7 --- /dev/null +++ b/Packs/CommonScripts/ReleaseNotes/1_1_5.md @@ -0,0 +1,4 @@ + +#### Scripts +##### __GetDuplicatesMlv2__ +- Moved script between packs. diff --git a/Packs/CommonScripts/ReleaseNotes/1_1_6.md b/Packs/CommonScripts/ReleaseNotes/1_1_6.md new file mode 100644 index 00000000000..ce6c3e171d2 --- /dev/null +++ b/Packs/CommonScripts/ReleaseNotes/1_1_6.md @@ -0,0 +1,4 @@ + +#### Scripts +##### VerifyJSON +- Updated the Docker image to PowerShell 7. diff --git a/Packs/CommonScripts/ReleaseNotes/1_1_7.md b/Packs/CommonScripts/ReleaseNotes/1_1_7.md new file mode 100644 index 00000000000..bbf13b921e0 --- /dev/null +++ b/Packs/CommonScripts/ReleaseNotes/1_1_7.md @@ -0,0 +1,4 @@ + +#### Scripts +##### __TimeStampCompare__ +- Removed an empty tag from the **TimeStampCompare** script. diff --git a/Packs/CommonScripts/ReleaseNotes/1_1_8.md b/Packs/CommonScripts/ReleaseNotes/1_1_8.md new file mode 100644 index 00000000000..6b0855d5ac5 --- /dev/null +++ b/Packs/CommonScripts/ReleaseNotes/1_1_8.md @@ -0,0 +1,4 @@ + +#### Scripts +##### __CompareLists__ +- Moved to CommonScripts pack diff --git a/Packs/CommonScripts/ReleaseNotes/1_1_9.md b/Packs/CommonScripts/ReleaseNotes/1_1_9.md new file mode 100644 index 00000000000..cc6cf730188 --- /dev/null +++ b/Packs/CommonScripts/ReleaseNotes/1_1_9.md @@ -0,0 +1,4 @@ + +#### Scripts +##### __DateStringToISOFormat__ +- Added new transformer script for converting arbitrary date strings to ISO-8601 format. diff --git a/Packs/IPWhitelisting/Scripts/CompareLists/CHANGELOG.md b/Packs/CommonScripts/Scripts/CompareLists/CHANGELOG.md similarity index 100% rename from Packs/IPWhitelisting/Scripts/CompareLists/CHANGELOG.md rename to Packs/CommonScripts/Scripts/CompareLists/CHANGELOG.md diff --git a/Packs/IPWhitelisting/Scripts/CompareLists/CompareLists.py b/Packs/CommonScripts/Scripts/CompareLists/CompareLists.py similarity index 100% rename from Packs/IPWhitelisting/Scripts/CompareLists/CompareLists.py rename to Packs/CommonScripts/Scripts/CompareLists/CompareLists.py diff --git a/Packs/IPWhitelisting/Scripts/CompareLists/CompareLists.yml b/Packs/CommonScripts/Scripts/CompareLists/CompareLists.yml similarity index 94% rename from Packs/IPWhitelisting/Scripts/CompareLists/CompareLists.yml rename to Packs/CommonScripts/Scripts/CompareLists/CompareLists.yml index f8af890442c..f1c3edd479b 100644 --- a/Packs/IPWhitelisting/Scripts/CompareLists/CompareLists.yml +++ b/Packs/CommonScripts/Scripts/CompareLists/CompareLists.yml @@ -26,6 +26,6 @@ outputs: scripttarget: 0 subtype: python3 runonce: false -dockerimage: demisto/python3:3.8.2.6981 +dockerimage: demisto/python3:3.8.3.8715 runas: DBotWeakRole fromversion: 5.0.0 diff --git a/Packs/IPWhitelisting/Scripts/CompareLists/CompareLists_test.py b/Packs/CommonScripts/Scripts/CompareLists/CompareLists_test.py similarity index 100% rename from Packs/IPWhitelisting/Scripts/CompareLists/CompareLists_test.py rename to Packs/CommonScripts/Scripts/CompareLists/CompareLists_test.py diff --git a/Packs/IPWhitelisting/Scripts/CompareLists/Pipfile b/Packs/CommonScripts/Scripts/CompareLists/Pipfile similarity index 100% rename from Packs/IPWhitelisting/Scripts/CompareLists/Pipfile rename to Packs/CommonScripts/Scripts/CompareLists/Pipfile diff --git a/Packs/IPWhitelisting/Scripts/CompareLists/Pipfile.lock b/Packs/CommonScripts/Scripts/CompareLists/Pipfile.lock similarity index 100% rename from Packs/IPWhitelisting/Scripts/CompareLists/Pipfile.lock rename to Packs/CommonScripts/Scripts/CompareLists/Pipfile.lock diff --git a/Packs/CommonScripts/Scripts/ConvertFile/ConvertFile_test.py b/Packs/CommonScripts/Scripts/ConvertFile/ConvertFile_test.py index 63803fbb2e7..8ea0a7d8945 100644 --- a/Packs/CommonScripts/Scripts/ConvertFile/ConvertFile_test.py +++ b/Packs/CommonScripts/Scripts/ConvertFile/ConvertFile_test.py @@ -9,9 +9,11 @@ RETURN_ERROR_TARGET = 'ConvertFile.return_error' -# set logging to DEBUG for better understanding when the tests fails + @pytest.fixture(autouse=True) def set_logging(caplog): + """set logging to DEBUG for better understanding when the tests fails + """ caplog.set_level(logging.DEBUG) # easier to debug if the test fails diff --git a/Packs/CommonScripts/Scripts/DateStringToISOFormat/DateStringToISOFormat.py b/Packs/CommonScripts/Scripts/DateStringToISOFormat/DateStringToISOFormat.py new file mode 100644 index 00000000000..68368cf00fa --- /dev/null +++ b/Packs/CommonScripts/Scripts/DateStringToISOFormat/DateStringToISOFormat.py @@ -0,0 +1,26 @@ +import demistomock as demisto +from dateutil.parser import ParserError, parse # type: ignore + + +def parse_datestring_to_iso(date_value: str, day_first: bool, year_first: bool, fuzzy: bool) -> str: + try: + date_string = parse(date_value, dayfirst=day_first, yearfirst=year_first, fuzzy=fuzzy).isoformat() + except ParserError as e: + demisto.error(f'ParserError occurred: {e}\n Returning the original date string.') + date_string = date_value + return date_string + + +def main(): + args = demisto.args() + date_value = args.get('value') + day_first = args.get('dayfirst', 'True').lower() == 'true' + year_first = args.get('yearfirst', 'False').lower() == 'true' + fuzzy = args.get('fuzzy', 'True').lower() == 'true' + iso_string = parse_datestring_to_iso(date_value, day_first, year_first, fuzzy) + demisto.results(iso_string) + + +# python2 uses __builtin__ python3 uses builtins +if __name__ in ('__builtin__', 'builtins', '__main__'): + main() diff --git a/Packs/CommonScripts/Scripts/DateStringToISOFormat/DateStringToISOFormat.yml b/Packs/CommonScripts/Scripts/DateStringToISOFormat/DateStringToISOFormat.yml new file mode 100644 index 00000000000..629a8a6a3ef --- /dev/null +++ b/Packs/CommonScripts/Scripts/DateStringToISOFormat/DateStringToISOFormat.yml @@ -0,0 +1,49 @@ +commonfields: + id: DateStringToISOFormat + version: -1 +name: DateStringToISOFormat +script: '-' +type: python +tags: +- transformer +- date +comment: This is a thin wrapper around the `dateutil.parser.parse` function. It will + parse a string containing a date/time stamp and return it in ISO 8601 format. +enabled: true +args: +- name: value + required: true + description: Date value to convert. +- name: dayfirst + default: true + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Whether to interpret the first value in an ambiguous 3-integer date + (e.g. 01/05/09) as the day (``True``) or month (``False``). If ``yearfirst`` is + set to ``True``, this distinguishes between YDM and YMD. + defaultValue: "true" +- name: yearfirst + default: true + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Whether to interpret the first value in an ambiguous 3-integer date + (e.g. 01/05/09) as the year. If ``True``, the first number is taken to be the + year, otherwise the last number is taken to be the year. + defaultValue: "false" +- name: fuzzy + default: true + auto: PREDEFINED + predefined: + - "true" + - "false" + description: Whether to allow fuzzy parsing, allowing for string like "Today is + January 1, 2047 at 8:21:00AM". + defaultValue: "true" +system: false +timeout: '0' +subtype: python3 +dockerimage: demisto/python3:3.8.3.9324 diff --git a/Packs/CommonScripts/Scripts/DateStringToISOFormat/DateStringToISOFormat_test.py b/Packs/CommonScripts/Scripts/DateStringToISOFormat/DateStringToISOFormat_test.py new file mode 100644 index 00000000000..494675dbe82 --- /dev/null +++ b/Packs/CommonScripts/Scripts/DateStringToISOFormat/DateStringToISOFormat_test.py @@ -0,0 +1,62 @@ +from DateStringToISOFormat import parse_datestring_to_iso +import pytest + + +# date_value, day_first, year_first, fuzzy, expected_output +testdata = [ + ('05-11-2929', True, True, True, '2929-11-05T00:00:00'), + ('05-11-2929', True, False, True, '2929-11-05T00:00:00'), + ('05-11-2929', True, True, False, '2929-11-05T00:00:00'), + ('05-11-2929', True, False, False, '2929-11-05T00:00:00'), + ('05-11-2929', False, True, True, '2929-05-11T00:00:00'), + ('05-11-2929', False, False, True, '2929-05-11T00:00:00'), + ('05-11-2929', False, False, False, '2929-05-11T00:00:00'), + ('2020-06-11T17:34:35.754203+03:00', True, True, True, '2020-11-06T17:34:35.754203+03:00'), + ('2020-06-11T17:34:35.754203+03:00', True, False, True, '2020-11-06T17:34:35.754203+03:00'), + ('2020-06-11T17:34:35.754203+03:00', True, True, False, '2020-11-06T17:34:35.754203+03:00'), + ('2020-06-11T17:34:35.754203+03:00', True, False, False, '2020-11-06T17:34:35.754203+03:00'), + ('2020-06-11T17:34:35.754203+03:00', False, True, True, '2020-06-11T17:34:35.754203+03:00'), + ('2020-06-11T17:34:35.754203+03:00', False, False, True, '2020-06-11T17:34:35.754203+03:00'), + ('2020-06-11T17:34:35.754203+03:00', False, False, False, '2020-06-11T17:34:35.754203+03:00'), + ("June 21st 2020 Eastern Standard Time", True, True, True, "2020-06-21T00:00:00"), + ("June 21st 2020 Eastern Standard Time", True, False, True, "2020-06-21T00:00:00"), + ("June 21st 2020 Eastern Standard Time", True, True, False, "June 21st 2020 Eastern Standard Time"), + ("June 21st 2020 Eastern Standard Time", True, False, False, "June 21st 2020 Eastern Standard Time"), + ("June 21st 2020 Eastern Standard Time", False, True, True, "2020-06-21T00:00:00"), + ("June 21st 2020 Eastern Standard Time", False, False, True, "2020-06-21T00:00:00"), + ("June 21st 2020 Eastern Standard Time", False, False, False, "June 21st 2020 Eastern Standard Time"), + ("The 1st of June 2020", True, True, True, "2020-06-01T00:00:00"), + ("The 1st of June 2020", True, False, True, "2020-06-01T00:00:00"), + ("The 1st of June 2020", True, True, False, "The 1st of June 2020"), + ("The 1st of June 2020", True, False, False, "The 1st of June 2020"), + ("The 1st of June 2020", False, True, True, "2020-06-01T00:00:00"), + ("The 1st of June 2020", False, False, True, "2020-06-01T00:00:00"), + ("The 1st of June 2020", False, False, False, "The 1st of June 2020") +] + + +@pytest.mark.parametrize('date_value,day_first,year_first,fuzzy,expected_output', testdata) +def test_parse_datestring_to_iso(date_value, day_first, year_first, fuzzy, expected_output, capfd): + '''Scenario: Parse an arbitrary date string and convert it to ISO 8601 format + + Given + - An arbitrary date string + When + - The date string can be an ambiguous 3-integer date, fuzzy date string or an + already iso-8601 formatted date string + Then + - Ensure the output date string is in iso-8601 format in all cases + + Args: + date_value (str): A string containing a date stamp. + day_first (bool): Whether to interpret the first value in an ambiguous 3-integer date + (e.g. 01/05/09) as the day or month. + year_first (bool): Whether to interpret the first value in an ambiguous 3-integer date + (e.g. 01/05/09) as the year. If ``True``, the first number is taken to + be the year, otherwise the last number is taken to be the year. + fuzzy (bool): Whether to allow fuzzy parsing, allowing for string like "Today is + January 1, 2047 at 8:21:00AM". + expected_output (str): The iso 8601 formatted date to check the result against + ''' + with capfd.disabled(): + assert parse_datestring_to_iso(date_value, day_first, year_first, fuzzy) == expected_output diff --git a/Packs/CommonScripts/Scripts/ExtractDomainAndFQDNFromUrlAndEmail/ExtractDomainAndFQDNFromUrlAndEmail_test.py b/Packs/CommonScripts/Scripts/ExtractDomainAndFQDNFromUrlAndEmail/ExtractDomainAndFQDNFromUrlAndEmail_test.py index f722a95789d..a627e935f48 100644 --- a/Packs/CommonScripts/Scripts/ExtractDomainAndFQDNFromUrlAndEmail/ExtractDomainAndFQDNFromUrlAndEmail_test.py +++ b/Packs/CommonScripts/Scripts/ExtractDomainAndFQDNFromUrlAndEmail/ExtractDomainAndFQDNFromUrlAndEmail_test.py @@ -4,19 +4,27 @@ @pytest.mark.parametrize('input,fqdn,domain', [ # noqa: E501 disable-secrets-detection - ('http://this.is.test.com', 'this.is.test.com', 'test.com'), - ('https://caseapi.phishlabs.com', 'caseapi.phishlabs.com', 'phishlabs.com'), - ('www.bücher.de', 'www.bücher.de', 'bücher.de'), - ('https://urldefense.proofpoint.com/v2/url?u=http-3A__go.getpostman.com_y4wULsdG0h0DDMY0Dv00100&d=DwMFaQ&c=ywDJJevdGcjv4rm9P3FcNg&r=s5kA2oIAQRXsacJiBKmTORIWyRN39ZKhobje2GyRgNs&m=vN1dVSiZvEoM9oExtQqEptm9Dbvq9tnjACDZzrBLaWI&s=zroN7KQdBCPBOfhOmv5SP1DDzZKZ1y9I3x4STS5PbHA&e=', 'go.getpostman.com', 'getpostman.com'), # noqa: E501 - ('hxxps://www[.]demisto[.]com', 'www.demisto.com', 'demisto.com'), - ('https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2FPhilipsBeLux&data=02|01||cb2462dc8640484baf7608d638d2a698|1a407a2d76754d178692b3ac285306e4|0|0|636758874714819880&sdata=dnJiphWFhnAKsk5Ps0bj0p%2FvXVo8TpidtGZcW6t8lDQ%3D&reserved=0%3E%5bcid:image003.gif@01CF4D7F.1DF62650%5d%3C', '', 'twitter.com'), # noqa: E501 disable-secrets-detection - ('dummy@recipient.com', '', 'recipient.com'), - ('content-test-service-acc@content-test-236508.iam.gserviceaccount.com', 'content-test-236508.iam.gserviceaccount.com', 'gserviceaccount.com'), # noqa: E501 - ('CAJaFoefy_acEKaqSMGfojbLzKoUnzfpPcnNemuD6K0oQZ2PikQ@mail.gmail.com', 'mail.gmail.com', 'gmail.com'), - ('5be9245893ff486d98c3640879bb2657.protect@whoisguard.com', '', 'whoisguard.com'), - ('test@www.bücher.de', 'www.bücher.de', 'bücher.de'), - ('test@www[.]demisto[.]com', 'www.demisto.com', 'demisto.com'), - ]) # noqa: E124 + ('http://this.is.test.com', 'this.is.test.com', 'test.com'), + ('https://caseapi.phishlabs.com', 'caseapi.phishlabs.com', 'phishlabs.com'), + ('www.bücher.de', 'www.bücher.de', 'bücher.de'), + ('https://urldefense.proofpoint.com/v2/url?u=http-3A__go.getpostman.com_y4wULsdG0h0DDMY0Dv00100&d=DwMFaQ&c' + '=ywDJJevdGcjv4rm9P3FcNg&r=s5kA2oIAQRXsacJiBKmTORIWyRN39ZKhobje2GyRgNs&m' + '=vN1dVSiZvEoM9oExtQqEptm9Dbvq9tnjACDZzrBLaWI&s=zroN7KQdBCPBOfhOmv5SP1DDzZKZ1y9I3x4STS5PbHA&e=', + 'go.getpostman.com', 'getpostman.com'), # noqa: E501 + ('hxxps://www[.]demisto[.]com', 'www.demisto.com', 'demisto.com'), + ('https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2FPhilipsBeLux&data=02|01' + '||cb2462dc8640484baf7608d638d2a698|1a407a2d76754d178692b3ac285306e4|0|0|636758874714819880&sdata' + '=dnJiphWFhnAKsk5Ps0bj0p%2FvXVo8TpidtGZcW6t8lDQ%3D&reserved=0%3E%5bcid:image003.gif@01CF4D7F.1DF62650%5d' + '%3C', + '', 'twitter.com'), # noqa: E501 disable-secrets-detection + ('dummy@recipient.com', '', 'recipient.com'), + ('content-test-service-acc@content-test-236508.iam.gserviceaccount.com', + 'content-test-236508.iam.gserviceaccount.com', 'gserviceaccount.com'), # noqa: E501 + ('CAJaFoefy_acEKaqSMGfojbLzKoUnzfpPcnNemuD6K0oQZ2PikQ@mail.gmail.com', 'mail.gmail.com', 'gmail.com'), + ('5be9245893ff486d98c3640879bb2657.protect@whoisguard.com', '', 'whoisguard.com'), + ('test@www.bücher.de', 'www.bücher.de', 'bücher.de'), + ('test@www[.]demisto[.]com', 'www.demisto.com', 'demisto.com'), +]) # noqa: E124 def test_extract_fqdn_or_domain(input, fqdn, domain): extracted_fqdn = extract_fqdn_or_domain(input, is_fqdn=True) extracted_domain = extract_fqdn_or_domain(input, is_domain=True) diff --git a/Packs/CommonScripts/Scripts/FindSimilarIncidentsV2/FindSimilarIncidentsV2.yml b/Packs/CommonScripts/Scripts/FindSimilarIncidentsV2/FindSimilarIncidentsV2.yml index 6a6e86fa708..1262ebc42fe 100644 --- a/Packs/CommonScripts/Scripts/FindSimilarIncidentsV2/FindSimilarIncidentsV2.yml +++ b/Packs/CommonScripts/Scripts/FindSimilarIncidentsV2/FindSimilarIncidentsV2.yml @@ -149,5 +149,5 @@ type: python dockerimage: demisto/python:2.7.17.6981 runonce: false tests: -- dedup_-_generic_-_test +- Dedup - Generic v2 - Test fromversion: 4.5.0 diff --git a/Packs/ML/Scripts/GetDuplicatesMlv2/CHANGELOG.md b/Packs/CommonScripts/Scripts/GetDuplicatesMlv2/CHANGELOG.md similarity index 100% rename from Packs/ML/Scripts/GetDuplicatesMlv2/CHANGELOG.md rename to Packs/CommonScripts/Scripts/GetDuplicatesMlv2/CHANGELOG.md diff --git a/Packs/ML/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2.py b/Packs/CommonScripts/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2.py similarity index 100% rename from Packs/ML/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2.py rename to Packs/CommonScripts/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2.py diff --git a/Packs/ML/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2.yml b/Packs/CommonScripts/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2.yml similarity index 99% rename from Packs/ML/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2.yml rename to Packs/CommonScripts/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2.yml index 75c399c7d2a..9532fadf3ee 100644 --- a/Packs/ML/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2.yml +++ b/Packs/CommonScripts/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2.yml @@ -99,4 +99,4 @@ scripttarget: 0 runonce: false dockerimage: demisto/machine-learning tests: - - dedup_-_generic_-_test \ No newline at end of file + - Dedup - Generic v2 - Test diff --git a/Packs/ML/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2_test.py b/Packs/CommonScripts/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2_test.py similarity index 100% rename from Packs/ML/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2_test.py rename to Packs/CommonScripts/Scripts/GetDuplicatesMlv2/GetDuplicatesMlv2_test.py diff --git a/Packs/ML/Scripts/GetDuplicatesMlv2/Pipfile b/Packs/CommonScripts/Scripts/GetDuplicatesMlv2/Pipfile similarity index 100% rename from Packs/ML/Scripts/GetDuplicatesMlv2/Pipfile rename to Packs/CommonScripts/Scripts/GetDuplicatesMlv2/Pipfile diff --git a/Packs/ML/Scripts/GetDuplicatesMlv2/Pipfile.lock b/Packs/CommonScripts/Scripts/GetDuplicatesMlv2/Pipfile.lock similarity index 100% rename from Packs/ML/Scripts/GetDuplicatesMlv2/Pipfile.lock rename to Packs/CommonScripts/Scripts/GetDuplicatesMlv2/Pipfile.lock diff --git a/Packs/CommonScripts/Scripts/SetGridField/Pipfile b/Packs/CommonScripts/Scripts/SetGridField/Pipfile new file mode 100644 index 00000000000..0c441d288fb --- /dev/null +++ b/Packs/CommonScripts/Scripts/SetGridField/Pipfile @@ -0,0 +1,21 @@ +[[source]] +name = "pypi" +url = "https://pypi.org/simple" +verify_ssl = true + +[dev-packages] +pylint = "*" +pytest = "==5.0.1" +pytest-mock = "*" +requests-mock = "*" +pytest-asyncio = "*" +pytest-xdist = "*" +freezegun = "*" +pytest-datadir-ng = "*" + +[packages] +pandas = "*" +phrases_case = "*" + +[requires] +python_version = "3.8" diff --git a/Packs/CommonScripts/Scripts/SetGridField/Pipfile.lock b/Packs/CommonScripts/Scripts/SetGridField/Pipfile.lock new file mode 100644 index 00000000000..eb83ef03e32 --- /dev/null +++ b/Packs/CommonScripts/Scripts/SetGridField/Pipfile.lock @@ -0,0 +1,90 @@ +{ + "_meta": { + "hash": { + "sha256": "44a2006c840cfcfa4b8855e84f23bc17646a2b9634c870d36836c27d43571d6c" + }, + "pipfile-spec": 6, + "requires": { + "python_version": "3.8" + }, + "sources": [ + { + "name": "pypi", + "url": "https://pypi.org/simple", + "verify_ssl": true + } + ] + }, + "default": { + "numpy": { + "hashes": [ + "sha256:0172304e7d8d40e9e49553901903dc5f5a49a703363ed756796f5808a06fc233", + "sha256:34e96e9dae65c4839bd80012023aadd6ee2ccb73ce7fdf3074c62f301e63120b", + "sha256:3676abe3d621fc467c4c1469ee11e395c82b2d6b5463a9454e37fe9da07cd0d7", + "sha256:3dd6823d3e04b5f223e3e265b4a1eae15f104f4366edd409e5a5e413a98f911f", + "sha256:4064f53d4cce69e9ac613256dc2162e56f20a4e2d2086b1956dd2fcf77b7fac5", + "sha256:4674f7d27a6c1c52a4d1aa5f0881f1eff840d2206989bae6acb1c7668c02ebfb", + "sha256:7d42ab8cedd175b5ebcb39b5208b25ba104842489ed59fbb29356f671ac93583", + "sha256:965df25449305092b23d5145b9bdaeb0149b6e41a77a7d728b1644b3c99277c1", + "sha256:9c9d6531bc1886454f44aa8f809268bc481295cf9740827254f53c30104f074a", + "sha256:a78e438db8ec26d5d9d0e584b27ef25c7afa5a182d1bf4d05e313d2d6d515271", + "sha256:a7acefddf994af1aeba05bbbafe4ba983a187079f125146dc5859e6d817df824", + "sha256:a87f59508c2b7ceb8631c20630118cc546f1f815e034193dc72390db038a5cb3", + "sha256:ac792b385d81151bae2a5a8adb2b88261ceb4976dbfaaad9ce3a200e036753dc", + "sha256:b03b2c0badeb606d1232e5f78852c102c0a7989d3a534b3129e7856a52f3d161", + "sha256:b39321f1a74d1f9183bf1638a745b4fd6fe80efbb1f6b32b932a588b4bc7695f", + "sha256:cae14a01a159b1ed91a324722d746523ec757357260c6804d11d6147a9e53e3f", + "sha256:cd49930af1d1e49a812d987c2620ee63965b619257bd76eaaa95870ca08837cf", + "sha256:e15b382603c58f24265c9c931c9a45eebf44fe2e6b4eaedbb0d025ab3255228b", + "sha256:e91d31b34fc7c2c8f756b4e902f901f856ae53a93399368d9a0dc7be17ed2ca0", + "sha256:ef627986941b5edd1ed74ba89ca43196ed197f1a206a3f18cc9faf2fb84fd675", + "sha256:f718a7949d1c4f622ff548c572e0c03440b49b9531ff00e4ed5738b459f011e8" + ], + "version": "==1.18.5" + }, + "pandas": { + "hashes": [ + "sha256:034185bb615dc96d08fa13aacba8862949db19d5e7804d6ee242d086f07bcc46", + "sha256:0c9b7f1933e3226cc16129cf2093338d63ace5c85db7c9588e3e1ac5c1937ad5", + "sha256:1f6fcf0404626ca0475715da045a878c7062ed39bc859afc4ccf0ba0a586a0aa", + "sha256:1fc963ba33c299973e92d45466e576d11f28611f3549469aec4a35658ef9f4cc", + "sha256:29b4cfee5df2bc885607b8f016e901e63df7ffc8f00209000471778f46cc6678", + "sha256:2a8b6c28607e3f3c344fe3e9b3cd76d2bf9f59bc8c0f2e582e3728b80e1786dc", + "sha256:2bc2ff52091a6ac481cc75d514f06227dc1b10887df1eb72d535475e7b825e31", + "sha256:415e4d52fcfd68c3d8f1851cef4d947399232741cc994c8f6aa5e6a9f2e4b1d8", + "sha256:519678882fd0587410ece91e3ff7f73ad6ded60f6fcb8aa7bcc85c1dc20ecac6", + "sha256:51e0abe6e9f5096d246232b461649b0aa627f46de8f6344597ca908f2240cbaa", + "sha256:698e26372dba93f3aeb09cd7da2bb6dd6ade248338cfe423792c07116297f8f4", + "sha256:83af85c8e539a7876d23b78433d90f6a0e8aa913e37320785cf3888c946ee874", + "sha256:982cda36d1773076a415ec62766b3c0a21cdbae84525135bdb8f460c489bb5dd", + "sha256:a647e44ba1b3344ebc5991c8aafeb7cca2b930010923657a273b41d86ae225c4", + "sha256:b35d625282baa7b51e82e52622c300a1ca9f786711b2af7cbe64f1e6831f4126", + "sha256:bab51855f8b318ef39c2af2c11095f45a10b74cbab4e3c8199efcc5af314c648" + ], + "index": "pypi", + "version": "==1.0.4" + }, + "python-dateutil": { + "hashes": [ + "sha256:73ebfe9dbf22e832286dafa60473e4cd239f8592f699aa5adaf10050e6e1823c", + "sha256:75bb3f31ea686f1197762692a9ee6a7550b59fc6ca3a1f4b5d7e32fb98e2da2a" + ], + "version": "==2.8.1" + }, + "pytz": { + "hashes": [ + "sha256:a494d53b6d39c3c6e44c3bec237336e14305e4f29bbf800b599253057fbb79ed", + "sha256:c35965d010ce31b23eeb663ed3cc8c906275d6be1a34393a1d73a41febf4a048" + ], + "version": "==2020.1" + }, + "six": { + "hashes": [ + "sha256:30639c035cdb23534cd4aa2dd52c3bf48f06e5f4a941509c8bafd8ce11080259", + "sha256:8b74bedcbbbaca38ff6d7491d76f2b06b3592611af620f8426e82dddb04a5ced" + ], + "version": "==1.15.0" + } + }, + "develop": {} +} diff --git a/Packs/CommonScripts/Scripts/SetGridField/SetGridField.py b/Packs/CommonScripts/Scripts/SetGridField/SetGridField.py index 5608a1a066e..714956aae11 100644 --- a/Packs/CommonScripts/Scripts/SetGridField/SetGridField.py +++ b/Packs/CommonScripts/Scripts/SetGridField/SetGridField.py @@ -199,19 +199,23 @@ def build_grid(context_path: str, keys: List[str], columns: List[str], unpack_ne # Handle entry context as dict, with unpacking of nested elements table = pd.DataFrame(unpack_all_data_from_dict(entry_context_data, keys, columns)) table.rename(columns=dict(zip(table.columns, columns)), inplace=True) + table.columns = table.columns.sort_values() elif data_type == 'list': # Handle entry context as list of value table = pd.DataFrame(entry_context_data) table.rename(columns=dict(zip(table.columns, columns)), inplace=True) + table.columns = table.columns.sort_values() elif isinstance(entry_context_data, list): # Handle entry context as list of dicts entry_context_data = [filter_dict(item, keys, len(columns)) for item in entry_context_data] table = pd.DataFrame(entry_context_data) table.rename(columns=dict(zip(table.columns, columns)), inplace=True) + table.columns = table.columns.sort_values() elif isinstance(entry_context_data, dict): # Handle entry context key-value of primitive types option entry_context_data = filter_dict(entry_context_data, keys).items() table = pd.DataFrame(entry_context_data, columns=columns[:2]) + table.columns = table.columns.sort_values() else: table = [] diff --git a/Packs/CommonScripts/Scripts/SetGridField/SetGridField.yml b/Packs/CommonScripts/Scripts/SetGridField/SetGridField.yml index 7cbdd67a595..1fefea88c0d 100644 --- a/Packs/CommonScripts/Scripts/SetGridField/SetGridField.yml +++ b/Packs/CommonScripts/Scripts/SetGridField/SetGridField.yml @@ -65,4 +65,4 @@ system: false tags: [] timeout: '0' type: python -dockerimage: demisto/pandas:1.0.0.7793 +dockerimage: demisto/pandas:1.0.0.8854 diff --git a/Packs/CommonScripts/Scripts/SetGridField/SetGridField_test.py b/Packs/CommonScripts/Scripts/SetGridField/SetGridField_test.py index 06fae2d5bd4..64e0a073aca 100644 --- a/Packs/CommonScripts/Scripts/SetGridField/SetGridField_test.py +++ b/Packs/CommonScripts/Scripts/SetGridField/SetGridField_test.py @@ -53,6 +53,8 @@ def test_validate_entry_context(entry_context: dict, keys: list, raise_exception False), (["*"], ["col1", "col2"], "context_entry_dict_with_elements.json", "expected_dict_with_elements_grid.json", True), + (["name", "value"], ["col2", "col1"], "context_entry_list.json", "expected_list_grid.json", + False), ]) def test_build_grid(datadir, mocker, keys: list, columns: list, dt_response_json: str, expected_json: str, unpack_nested: bool): @@ -63,6 +65,6 @@ def test_build_grid(datadir, mocker, keys: list, columns: list, dt_response_json mocker.patch.object(SetGridField, 'demisto') SetGridField.demisto.dt.return_value = json.load(open(datadir[dt_response_json])) expected_grid = json.load(open(datadir[expected_json])) - assert pd.DataFrame(expected_grid).to_dict() == \ - SetGridField.build_grid(context_path=mocker.MagicMock(), keys=keys, columns=columns, - unpack_nested_elements=unpack_nested).to_dict() + assert pd.DataFrame(expected_grid).to_dict() == SetGridField.build_grid( + context_path=mocker.MagicMock(), keys=keys, columns=columns, unpack_nested_elements=unpack_nested + ).to_dict() diff --git a/Packs/CommonScripts/Scripts/TimeStampCompare/TimeStampCompare.yml b/Packs/CommonScripts/Scripts/TimeStampCompare/TimeStampCompare.yml index 028e8982f79..67adfdbefd2 100644 --- a/Packs/CommonScripts/Scripts/TimeStampCompare/TimeStampCompare.yml +++ b/Packs/CommonScripts/Scripts/TimeStampCompare/TimeStampCompare.yml @@ -36,8 +36,7 @@ outputs: script: '-' subtype: python3 system: false -tags: -- '' +tags: [] timeout: '0' type: python -dockerimage: demisto/python3:3.7.4.2245 +dockerimage: demisto/python3:3.8.3.8715 diff --git a/Packs/CommonScripts/Scripts/VerifyJSON/VerifyJSON.Tests.ps1 b/Packs/CommonScripts/Scripts/VerifyJSON/VerifyJSON.Tests.ps1 index bfa270e8787..4cc1d3e861e 100644 --- a/Packs/CommonScripts/Scripts/VerifyJSON/VerifyJSON.Tests.ps1 +++ b/Packs/CommonScripts/Scripts/VerifyJSON/VerifyJSON.Tests.ps1 @@ -1,8 +1,12 @@ -. $PSScriptRoot\VerifyJSON.ps1 +BeforeAll { + . $PSScriptRoot\VerifyJSON.ps1 +} Describe 'VerifJSON' { Context "Valid Json" { - Mock ReturnOutputs {} + BeforeAll { + Mock ReturnOutputs {} + } It 'Check Valid Json passes' { $demisto.ContextArgs = @{json = '{"test": "this"}' } Main @@ -11,7 +15,9 @@ Describe 'VerifJSON' { } Context "InValid Json" { - Mock ReturnError {} + BeforeAll { + Mock ReturnError {} + } It 'Check InValid Json fails' { $demisto.ContextArgs = @{json = '{"test": this"}' } Main @@ -20,7 +26,10 @@ Describe 'VerifJSON' { } Context "Schema Validation" { - Mock ReturnError {} + BeforeAll { + Mock ReturnError {} + } + It 'Check InValid Json schema fails' { $schema = @' { diff --git a/Packs/CommonScripts/Scripts/VerifyJSON/VerifyJSON.yml b/Packs/CommonScripts/Scripts/VerifyJSON/VerifyJSON.yml index 897ca93ad8d..2f9b8129e92 100644 --- a/Packs/CommonScripts/Scripts/VerifyJSON/VerifyJSON.yml +++ b/Packs/CommonScripts/Scripts/VerifyJSON/VerifyJSON.yml @@ -27,5 +27,5 @@ tags: - JSON - Utility type: powershell -dockerimage: demisto/powershell:6.2.4.6166 +dockerimage: demisto/powershell:7.0.1.9103 fromversion: 5.5.0 diff --git a/Packs/CommonScripts/TestPlaybooks/playbook-ExposeIncidentOwner-Test.yml b/Packs/CommonScripts/TestPlaybooks/playbook-ExposeIncidentOwner-Test.yml index f62acf0725e..4c2c38d0a72 100644 --- a/Packs/CommonScripts/TestPlaybooks/playbook-ExposeIncidentOwner-Test.yml +++ b/Packs/CommonScripts/TestPlaybooks/playbook-ExposeIncidentOwner-Test.yml @@ -5,10 +5,10 @@ starttaskid: "0" tasks: "0": id: "0" - taskid: b86b1453-bf78-4555-876c-e6a34d113b59 + taskid: a17a72b9-a3eb-4c4d-8e75-2ebbc74f45cf type: start task: - id: b86b1453-bf78-4555-876c-e6a34d113b59 + id: a17a72b9-a3eb-4c4d-8e75-2ebbc74f45cf version: -1 name: "" iscommand: false @@ -31,10 +31,10 @@ tasks: quietmode: 0 "1": id: "1" - taskid: 505a5981-74f6-43ca-897a-291edd09ab79 + taskid: 1a7e58fa-99c5-4b17-876c-84efa847a839 type: regular task: - id: 505a5981-74f6-43ca-897a-291edd09ab79 + id: 1a7e58fa-99c5-4b17-876c-84efa847a839 version: -1 name: AssignAnalystToIncident description: |- @@ -72,10 +72,10 @@ tasks: quietmode: 0 "2": id: "2" - taskid: 5435febf-58c9-492d-88e2-9e9fe43f8fa8 + taskid: ae667d80-b514-4825-8759-c6464fe0915a type: regular task: - id: 5435febf-58c9-492d-88e2-9e9fe43f8fa8 + id: ae667d80-b514-4825-8759-c6464fe0915a version: -1 name: ExposeIncidentOwner description: Expose the incident owner into IncidentOwner context key @@ -103,10 +103,10 @@ tasks: quietmode: 0 "3": id: "3" - taskid: 660e7c80-8140-483c-80a6-b32f2d9d4deb + taskid: ec1f5155-a8a8-483f-86f6-2f1c2eacbc0a type: condition task: - id: 660e7c80-8140-483c-80a6-b32f2d9d4deb + id: ec1f5155-a8a8-483f-86f6-2f1c2eacbc0a version: -1 name: AreValuesEqual description: Check whether the values provided in arguments are equal. @@ -118,7 +118,7 @@ tasks: "no": - "5" "yes": - - "4" + - "6" scriptarguments: left: simple: ${incident.owner} @@ -139,21 +139,17 @@ tasks: ignoreworker: false skipunavailable: false quietmode: 0 - "4": - id: "4" - taskid: 96fe633d-c088-4b71-8ac0-ec49ffe79fd8 + "5": + id: "5" + taskid: 41d47758-7788-424d-84d0-40139b75f475 type: regular task: - id: 96fe633d-c088-4b71-8ac0-ec49ffe79fd8 + id: 41d47758-7788-424d-84d0-40139b75f475 version: -1 - name: Close - scriptName: CloseInvestigation + name: Error type: regular iscommand: false brand: "" - scriptarguments: - notes: {} - reason: {} separatecontext: false view: |- { @@ -167,15 +163,15 @@ tasks: ignoreworker: false skipunavailable: false quietmode: 0 - "5": - id: "5" - taskid: 1046b7f1-b263-41fa-8d40-08ea70e4d6e8 - type: regular + "6": + id: "6" + taskid: 45b57291-8cfe-4ad2-8b1d-ab6e2740dbd1 + type: title task: - id: 1046b7f1-b263-41fa-8d40-08ea70e4d6e8 + id: 45b57291-8cfe-4ad2-8b1d-ab6e2740dbd1 version: -1 - name: Error - type: regular + name: Done + type: title iscommand: false brand: "" separatecontext: false @@ -183,7 +179,7 @@ tasks: { "position": { "x": 480, - "y": 720 + "y": 735 } } note: false diff --git a/Packs/CommonScripts/TestPlaybooks/playbook-FileCreateAndUpload_Test.yml b/Packs/CommonScripts/TestPlaybooks/playbook-FileCreateAndUpload_Test.yml index f301364e3b8..482cd65dc67 100644 --- a/Packs/CommonScripts/TestPlaybooks/playbook-FileCreateAndUpload_Test.yml +++ b/Packs/CommonScripts/TestPlaybooks/playbook-FileCreateAndUpload_Test.yml @@ -5,10 +5,10 @@ starttaskid: "0" tasks: "0": id: "0" - taskid: 579bf7e6-490a-4a92-81de-0c94e4cff9c8 + taskid: 2efc1a8b-2917-44b1-859f-3ef25c5305ce type: start task: - id: 579bf7e6-490a-4a92-81de-0c94e4cff9c8 + id: 2efc1a8b-2917-44b1-859f-3ef25c5305ce version: -1 name: "" iscommand: false @@ -31,10 +31,10 @@ tasks: quietmode: 0 "1": id: "1" - taskid: c854074a-b1c3-4611-861d-2b362b96bb11 + taskid: 4cb52547-2af7-4f02-837d-58436097f902 type: regular task: - id: c854074a-b1c3-4611-861d-2b362b96bb11 + id: 4cb52547-2af7-4f02-837d-58436097f902 version: -1 name: Print Something scriptName: Print @@ -62,10 +62,10 @@ tasks: quietmode: 0 "2": id: "2" - taskid: c3157dad-7569-4802-8a55-99e6b85f4e8e + taskid: 1fd08984-45a8-42d5-888d-2a38e8cd3cc4 type: regular task: - id: c3157dad-7569-4802-8a55-99e6b85f4e8e + id: 1fd08984-45a8-42d5-888d-2a38e8cd3cc4 version: -1 name: FileCreateAndUpload from entry scriptName: FileCreateAndUpload @@ -96,10 +96,10 @@ tasks: quietmode: 0 "3": id: "3" - taskid: bb1872e9-bdea-40f6-8e33-a31c6f1d2064 + taskid: 03d8983e-0bd4-4b0b-8c7f-440ae938f931 type: regular task: - id: bb1872e9-bdea-40f6-8e33-a31c6f1d2064 + id: 03d8983e-0bd4-4b0b-8c7f-440ae938f931 version: -1 name: DeleteContext scriptName: DeleteContext @@ -128,10 +128,10 @@ tasks: quietmode: 0 "4": id: "4" - taskid: 339b8304-28a1-4354-8c31-b9ecd521a66c + taskid: d7a2f2fa-449d-43a3-8798-5ec3bce0091b type: regular task: - id: 339b8304-28a1-4354-8c31-b9ecd521a66c + id: d7a2f2fa-449d-43a3-8798-5ec3bce0091b version: -1 name: Verify we got the right filename scriptName: Print @@ -159,10 +159,10 @@ tasks: quietmode: 0 "5": id: "5" - taskid: b5f82ac1-91f3-41c8-83cd-386b0416ae87 + taskid: 203d25ec-a22d-4d4b-898a-ba40c52b6887 type: regular task: - id: b5f82ac1-91f3-41c8-83cd-386b0416ae87 + id: 203d25ec-a22d-4d4b-898a-ba40c52b6887 version: -1 name: FileCreateAndUpload from data scriptName: FileCreateAndUpload @@ -193,19 +193,16 @@ tasks: quietmode: 0 "6": id: "6" - taskid: aaf51824-9eca-4e9e-816a-a5398682b311 + taskid: df2a2365-b1c6-4171-84ae-a0c579a88f7a type: regular task: - id: aaf51824-9eca-4e9e-816a-a5398682b311 + id: df2a2365-b1c6-4171-84ae-a0c579a88f7a version: -1 name: Verify we got the right filename scriptName: Print type: regular iscommand: false brand: "" - nexttasks: - '#none#': - - "7" scriptarguments: value: simple: ${File.Name(val=="testPlaybookForFileCreateAndUpload-FileFromData.txt")} @@ -222,40 +219,12 @@ tasks: ignoreworker: false skipunavailable: false quietmode: 0 - "7": - id: "7" - taskid: ad011c37-ccb8-45d9-8be6-3ced3bb350e2 - type: regular - task: - id: ad011c37-ccb8-45d9-8be6-3ced3bb350e2 - version: -1 - name: Close incident - scriptName: CloseInvestigation - type: regular - iscommand: false - brand: "" - scriptarguments: - notes: {} - reason: {} - separatecontext: false - view: |- - { - "position": { - "x": 50, - "y": 1310 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 1355, + "height": 1150, "width": 380, "x": 50, "y": 50 diff --git a/Packs/CommonScripts/TestPlaybooks/playbook-HTTPListRedirects_Basic_Test.yml b/Packs/CommonScripts/TestPlaybooks/playbook-HTTPListRedirects_Basic_Test.yml index 10b51e511a4..7176f9ab125 100644 --- a/Packs/CommonScripts/TestPlaybooks/playbook-HTTPListRedirects_Basic_Test.yml +++ b/Packs/CommonScripts/TestPlaybooks/playbook-HTTPListRedirects_Basic_Test.yml @@ -5,10 +5,10 @@ starttaskid: "0" tasks: "0": id: "0" - taskid: f87beb81-eff3-48d3-87c0-dc05d6dd6bd3 + taskid: c9a1c1c7-85c2-4270-8fc9-48e9235d1be1 type: start task: - id: f87beb81-eff3-48d3-87c0-dc05d6dd6bd3 + id: c9a1c1c7-85c2-4270-8fc9-48e9235d1be1 version: -1 name: "" iscommand: false @@ -31,10 +31,10 @@ tasks: quietmode: 0 "1": id: "1" - taskid: d30a7f4b-0b4a-4f77-8d86-073fb318745b + taskid: 8423b0b5-829e-4ac1-88cc-c247fc291887 type: regular task: - id: d30a7f4b-0b4a-4f77-8d86-073fb318745b + id: 8423b0b5-829e-4ac1-88cc-c247fc291887 version: -1 name: HTTPListRedirects description: List the redirects for a given URL @@ -66,10 +66,10 @@ tasks: quietmode: 0 "2": id: "2" - taskid: 52f142e1-b319-4a2f-8b61-14712791a916 + taskid: 0e0a70e6-71f5-49b6-885f-b1e992a35a7b type: condition task: - id: 52f142e1-b319-4a2f-8b61-14712791a916 + id: 0e0a70e6-71f5-49b6-885f-b1e992a35a7b version: -1 name: AreValuesEqual description: Check whether the values provided in arguments are equal. @@ -102,21 +102,15 @@ tasks: quietmode: 0 "3": id: "3" - taskid: acac8a92-326b-4ac6-8bd7-a36f87407d69 - type: regular + taskid: 6539bd08-2588-4d1f-8c02-52afe1e4b7c3 + type: title task: - id: acac8a92-326b-4ac6-8bd7-a36f87407d69 + id: 6539bd08-2588-4d1f-8c02-52afe1e4b7c3 version: -1 - name: Close incident - scriptName: CloseInvestigation - type: regular + name: Done + type: title iscommand: false brand: "" - scriptarguments: - notes: - simple: Done - reason: - simple: All good separatecontext: false view: |- { @@ -135,7 +129,7 @@ view: |- "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 590, + "height": 560, "width": 380, "x": 50, "y": 50 diff --git a/Packs/CommonScripts/TestPlaybooks/playbook-TestExtractHTMLTables.yml b/Packs/CommonScripts/TestPlaybooks/playbook-TestExtractHTMLTables.yml index dfe45f55f6c..e92fe85ce1e 100644 --- a/Packs/CommonScripts/TestPlaybooks/playbook-TestExtractHTMLTables.yml +++ b/Packs/CommonScripts/TestPlaybooks/playbook-TestExtractHTMLTables.yml @@ -5,10 +5,10 @@ starttaskid: "0" tasks: "0": id: "0" - taskid: 27097a72-8399-4e27-85f5-897c27106ce3 + taskid: 6f985d96-565d-4836-84a8-5c64a6f0f054 type: start task: - id: 27097a72-8399-4e27-85f5-897c27106ce3 + id: 6f985d96-565d-4836-84a8-5c64a6f0f054 version: -1 name: "" iscommand: false @@ -24,12 +24,17 @@ tasks: "y": 50 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "1": id: "1" - taskid: 4447dd62-1e51-483b-802f-202205b781f4 + taskid: fdb233ee-250f-4e76-8a44-5c8cb60e3742 type: regular task: - id: 4447dd62-1e51-483b-802f-202205b781f4 + id: fdb233ee-250f-4e76-8a44-5c8cb60e3742 version: -1 name: DeleteContext description: Delete field from context @@ -52,12 +57,17 @@ tasks: "y": 195 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "2": id: "2" - taskid: 6cc1640f-24df-4b6a-8cf2-5d2daaac5c57 + taskid: 84b8ce61-dbf9-44f5-81ea-cb36210a6a96 type: regular task: - id: 6cc1640f-24df-4b6a-8cf2-5d2daaac5c57 + id: 84b8ce61-dbf9-44f5-81ea-cb36210a6a96 version: -1 name: ExtractHTMLTables with single one column table with header description: |- @@ -85,12 +95,17 @@ tasks: "y": 370 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "3": id: "3" - taskid: 9f902e22-b34e-4559-8238-8752c1afda3e + taskid: 69356d1f-4850-4f81-8cc8-a0c337ff3a81 type: condition task: - id: 9f902e22-b34e-4559-8238-8752c1afda3e + id: 69356d1f-4850-4f81-8cc8-a0c337ff3a81 version: -1 name: Both values exist in array description: Check if a given value exists in the context. Will return 'no' @@ -115,36 +130,17 @@ tasks: "y": 545 } } - "4": - id: "4" - taskid: 4861114d-746b-4d17-8a2f-3a730474a3eb - type: regular - task: - id: 4861114d-746b-4d17-8a2f-3a730474a3eb - version: -1 - name: Close - scriptName: CloseInvestigation - type: regular - iscommand: false - brand: "" - scriptarguments: - notes: - simple: All good - reason: {} - separatecontext: false - view: |- - { - "position": { - "x": 592.5, - "y": 2295 - } - } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "5": id: "5" - taskid: 50da60bb-61ac-4ad6-8f89-8f43eb32cb9f + taskid: 46e4b665-56cd-4025-8dc6-b6e5c29b4e4f type: regular task: - id: 50da60bb-61ac-4ad6-8f89-8f43eb32cb9f + id: 46e4b665-56cd-4025-8dc6-b6e5c29b4e4f version: -1 name: Bad scriptName: Print @@ -161,12 +157,17 @@ tasks: "y": 2295 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "6": id: "6" - taskid: f3996270-b954-45af-8c5a-2aa642158c5d + taskid: 5cdcb58d-4398-4cb2-84c0-ec4c138e80a9 type: regular task: - id: f3996270-b954-45af-8c5a-2aa642158c5d + id: 5cdcb58d-4398-4cb2-84c0-ec4c138e80a9 version: -1 name: DeleteContext scriptName: DeleteContext @@ -188,12 +189,17 @@ tasks: "y": 720 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "7": id: "7" - taskid: 6c97d562-b5ba-4ae3-8247-dff72f8e60f4 + taskid: 0edabdca-e319-4746-8ec1-f996259aa82e type: regular task: - id: 6c97d562-b5ba-4ae3-8247-dff72f8e60f4 + id: 0edabdca-e319-4746-8ec1-f996259aa82e version: -1 name: ExtractHTMLTables with single one column table without header description: |- @@ -221,12 +227,17 @@ tasks: "y": 895 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "8": id: "8" - taskid: 5b223b46-ef77-4705-8235-ed9f1914284b + taskid: 583d4e43-5d38-423d-8a93-24623e778876 type: condition task: - id: 5b223b46-ef77-4705-8235-ed9f1914284b + id: 583d4e43-5d38-423d-8a93-24623e778876 version: -1 name: Both values exist in array description: Check if a given value exists in the context. Will return 'no' @@ -251,12 +262,17 @@ tasks: "y": 1070 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "9": id: "9" - taskid: b00906ec-8c99-4640-8e94-b27ab0d4d6ad + taskid: 5fd0ceec-578d-4695-8469-c37084e34433 type: regular task: - id: b00906ec-8c99-4640-8e94-b27ab0d4d6ad + id: 5fd0ceec-578d-4695-8469-c37084e34433 version: -1 name: DeleteContext scriptName: DeleteContext @@ -278,12 +294,17 @@ tasks: "y": 1245 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "10": id: "10" - taskid: b8d9b854-ff36-42b8-8b13-a246e05eb894 + taskid: f5d4fc0b-beb5-4b65-8c45-b1064e4489d0 type: regular task: - id: b8d9b854-ff36-42b8-8b13-a246e05eb894 + id: f5d4fc0b-beb5-4b65-8c45-b1064e4489d0 version: -1 name: ExtractHTMLTables with two columns and no headers description: |- @@ -311,12 +332,17 @@ tasks: "y": 1420 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "11": id: "11" - taskid: f84d4e7d-ba50-4356-84a5-2b1d6bfe975b + taskid: b3a182f9-c634-4c36-83c4-b11ac4e08bd1 type: condition task: - id: f84d4e7d-ba50-4356-84a5-2b1d6bfe975b + id: b3a182f9-c634-4c36-83c4-b11ac4e08bd1 version: -1 name: Both objects exist description: Check if a given value exists in the context. Will return 'no' @@ -341,12 +367,17 @@ tasks: "y": 1595 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "12": id: "12" - taskid: 1d36419e-6dec-413b-8a0c-1cfe0821c9be + taskid: 923566c3-69e7-4c6b-8ac6-4a4fbd008647 type: regular task: - id: 1d36419e-6dec-413b-8a0c-1cfe0821c9be + id: 923566c3-69e7-4c6b-8ac6-4a4fbd008647 version: -1 name: DeleteContext scriptName: DeleteContext @@ -368,12 +399,17 @@ tasks: "y": 1770 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "13": id: "13" - taskid: e2a761e1-7877-458f-8efd-a1387983208b + taskid: 9be54c10-3781-4902-8064-fc4f5be5ba2f type: regular task: - id: e2a761e1-7877-458f-8efd-a1387983208b + id: 9be54c10-3781-4902-8064-fc4f5be5ba2f version: -1 name: ExtractHTMLTables with two columns and headers description: |- @@ -401,12 +437,17 @@ tasks: "y": 1945 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 "14": id: "14" - taskid: 2d78f082-e841-47f2-86e1-0e6d59f8d90f + taskid: df03d00f-21d2-4ced-8aff-aa87a5375244 type: condition task: - id: 2d78f082-e841-47f2-86e1-0e6d59f8d90f + id: df03d00f-21d2-4ced-8aff-aa87a5375244 version: -1 name: All objects exist description: Check if a given value exists in the context. Will return 'no' @@ -419,7 +460,7 @@ tasks: '#default#': - "5" "yes": - - "4" + - "15" scriptarguments: value: simple: ${HTMLTables(val.kuku == 'a' && val.kaka == '1' || val.kuku == 'b' @@ -432,6 +473,35 @@ tasks: "y": 2120 } } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "15": + id: "15" + taskid: 3e903ef7-74e2-4a3e-8fa8-ba69ef2260a9 + type: title + task: + id: 3e903ef7-74e2-4a3e-8fa8-ba69ef2260a9 + version: -1 + name: Done + type: title + iscommand: false + brand: "" + separatecontext: false + view: |- + { + "position": { + "x": 592.5, + "y": 2310 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 view: |- { "linkLabelsPosition": {}, diff --git a/Packs/CommonScripts/TestPlaybooks/playbook-TestIsMaliciousIndicatorFound.yml b/Packs/CommonScripts/TestPlaybooks/playbook-TestIsMaliciousIndicatorFound.yml index 32da95f6942..a9467c99bf1 100644 --- a/Packs/CommonScripts/TestPlaybooks/playbook-TestIsMaliciousIndicatorFound.yml +++ b/Packs/CommonScripts/TestPlaybooks/playbook-TestIsMaliciousIndicatorFound.yml @@ -2,17 +2,19 @@ id: Test-IsMaliciousIndicatorFound version: -1 name: Test-IsMaliciousIndicatorFound starttaskid: "0" +description: Test playbook for IsMaliciousIndicatorFound. tasks: "0": id: "0" - taskid: dcec9b1e-550c-4e44-827d-e6fab92ffc9e + taskid: ce95c71e-2b2c-4ac1-846c-70a1466bc151 type: start task: - id: dcec9b1e-550c-4e44-827d-e6fab92ffc9e + id: ce95c71e-2b2c-4ac1-846c-70a1466bc151 version: -1 name: "" iscommand: false brand: "" + description: '' nexttasks: '#none#': - "22" @@ -31,10 +33,10 @@ tasks: quietmode: 0 "1": id: "1" - taskid: 793b8169-d455-4e53-8621-f148afea307a + taskid: 7f51e84c-2da8-45b6-8982-fe28354a99cf type: regular task: - id: 793b8169-d455-4e53-8621-f148afea307a + id: 7f51e84c-2da8-45b6-8982-fe28354a99cf version: -1 name: Create good indicator description: Modify indicator reputation @@ -77,10 +79,10 @@ tasks: quietmode: 0 "2": id: "2" - taskid: 1981e2f1-a458-4866-8218-9b70cb6c560e + taskid: 277d313e-0e5a-463a-816e-1a548b2c7312 type: condition task: - id: 1981e2f1-a458-4866-8218-9b70cb6c560e + id: 277d313e-0e5a-463a-816e-1a548b2c7312 version: -1 name: IsMaliciuosFound description: Checks if the investigation found any Malicious File/URL/IP, if @@ -113,10 +115,10 @@ tasks: quietmode: 0 "4": id: "4" - taskid: be276019-cd8c-4661-81ba-f8c467d3b081 + taskid: 8461d7be-c492-4a85-81c2-c8eab8081fe0 type: regular task: - id: be276019-cd8c-4661-81ba-f8c467d3b081 + id: 8461d7be-c492-4a85-81c2-c8eab8081fe0 version: -1 name: Create Bad indicator script: Builtin|||createNewIndicator @@ -158,7 +160,7 @@ tasks: { "position": { "x": 50, - "y": 1420 + "y": 1770 } } note: false @@ -168,10 +170,10 @@ tasks: quietmode: 0 "6": id: "6" - taskid: d17f4a94-9a53-4455-8ec3-e8c9427bba29 + taskid: 07d11d80-2f67-4eed-8426-63db73603d7c type: condition task: - id: d17f4a94-9a53-4455-8ec3-e8c9427bba29 + id: 07d11d80-2f67-4eed-8426-63db73603d7c version: -1 name: IsMaliciuosFound description: Checks if the investigation found any Malicious File/URL/IP, if @@ -181,8 +183,10 @@ tasks: iscommand: false brand: "" nexttasks: + "no": + - "36" "yes": - - "23" + - "33" scriptarguments: includeManual: {} includeSuspicious: {} @@ -193,7 +197,7 @@ tasks: { "position": { "x": 50, - "y": 1595 + "y": 1945 } } note: false @@ -203,10 +207,10 @@ tasks: quietmode: 0 "7": id: "7" - taskid: d809e135-f716-4d47-87ef-c4d926d2f80e + taskid: e8a41fa0-8470-4d23-8bd4-b6f55fe1d8de type: regular task: - id: d809e135-f716-4d47-87ef-c4d926d2f80e + id: e8a41fa0-8470-4d23-8bd4-b6f55fe1d8de version: -1 name: Create suspiciuos indicator script: Builtin|||createNewIndicator @@ -258,10 +262,10 @@ tasks: quietmode: 0 "8": id: "8" - taskid: 0953ee65-4264-4a5c-8dd4-ceaaaf53dad8 + taskid: 54c9bf70-06a8-48cf-855d-658745bdf2a4 type: condition task: - id: 0953ee65-4264-4a5c-8dd4-ceaaaf53dad8 + id: 54c9bf70-06a8-48cf-855d-658745bdf2a4 version: -1 name: IsMaliciuosFound-no-suspicious description: Checks if the investigation found any Malicious File/URL/IP, if @@ -294,10 +298,10 @@ tasks: quietmode: 0 "19": id: "19" - taskid: d635b4dc-1c80-4299-8360-0a479d5b8d9b + taskid: 965baa8d-a8c1-4a35-8d4d-e499aded282e type: condition task: - id: d635b4dc-1c80-4299-8360-0a479d5b8d9b + id: 965baa8d-a8c1-4a35-8d4d-e499aded282e version: -1 name: IsMaliciuosFound-include-suspicious description: Checks if the investigation found any Malicious File/URL/IP, if @@ -307,6 +311,8 @@ tasks: iscommand: false brand: "" nexttasks: + "no": + - "34" "yes": - "21" scriptarguments: @@ -330,21 +336,22 @@ tasks: quietmode: 0 "20": id: "20" - taskid: bef226a4-4895-41c7-8e70-a7e9d2e5c032 + taskid: 9c8a105c-435e-47c9-81c8-4a9f37bb8506 type: title task: - id: bef226a4-4895-41c7-8e70-a7e9d2e5c032 + id: 9c8a105c-435e-47c9-81c8-4a9f37bb8506 version: -1 name: Done type: title iscommand: false brand: "" + description: '' separatecontext: false view: |- { "position": { "x": 50, - "y": 3345 + "y": 4580 } } note: false @@ -354,10 +361,10 @@ tasks: quietmode: 0 "21": id: "21" - taskid: 04d3d065-6a15-4c12-8e9f-f43f6b676e94 + taskid: 97e48f85-1a96-45f0-8ffa-40368d811c6c type: regular task: - id: 04d3d065-6a15-4c12-8e9f-f43f6b676e94 + id: 97e48f85-1a96-45f0-8ffa-40368d811c6c version: -1 name: Delete Context scriptName: DeleteContext @@ -379,7 +386,7 @@ tasks: { "position": { "x": 50, - "y": 1245 + "y": 1595 } } note: false @@ -389,10 +396,10 @@ tasks: quietmode: 0 "22": id: "22" - taskid: 8a7e48d2-ca24-4bfc-8037-fde1aa45dfe0 + taskid: 05119ea9-5c4a-4757-8224-b1419753b270 type: regular task: - id: 8a7e48d2-ca24-4bfc-8037-fde1aa45dfe0 + id: 05119ea9-5c4a-4757-8224-b1419753b270 version: -1 name: DeleteContext description: Delete field from context @@ -423,79 +430,12 @@ tasks: ignoreworker: false skipunavailable: false quietmode: 0 - "23": - id: "23" - taskid: c37a30fc-74ba-47b6-8ed6-0f828eb14280 - type: regular - task: - id: c37a30fc-74ba-47b6-8ed6-0f828eb14280 - version: -1 - name: Delete Context - scriptName: DeleteContext - type: regular - iscommand: false - brand: "" - nexttasks: - '#none#': - - "24" - scriptarguments: - all: - simple: "yes" - index: {} - key: {} - keysToKeep: {} - subplaybook: {} - separatecontext: false - view: |- - { - "position": { - "x": 50, - "y": 1770 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - "24": - id: "24" - taskid: 189a236c-c17c-4341-8792-38f912dd8daf - type: regular - task: - id: 189a236c-c17c-4341-8792-38f912dd8daf - version: -1 - name: FileReputation-multiple bad - description: A context script for hash entities - scriptName: FileReputation - type: regular - iscommand: false - brand: "" - nexttasks: - '#none#': - - "26" - scriptarguments: - file: - simple: 85b794e080d83a91e904b97769e1e770 - separatecontext: false - view: |- - { - "position": { - "x": 50, - "y": 1945 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 "26": id: "26" - taskid: df245dba-d0f6-4998-825f-da617215b4da + taskid: 022fa758-3049-497b-8002-0ad4a62bb747 type: condition task: - id: df245dba-d0f6-4998-825f-da617215b4da + id: 022fa758-3049-497b-8002-0ad4a62bb747 version: -1 name: IsMaliciuosFound description: Checks if the investigation found any Malicious File/URL/IP, if @@ -505,6 +445,8 @@ tasks: iscommand: false brand: "" nexttasks: + "no": + - "38" "yes": - "32" scriptarguments: @@ -517,7 +459,7 @@ tasks: { "position": { "x": 50, - "y": 2120 + "y": 2645 } } note: false @@ -527,10 +469,10 @@ tasks: quietmode: 0 "27": id: "27" - taskid: a87b2042-8c7d-46bf-8cc5-e38360de68a0 + taskid: 113d8e4e-0e24-4c2c-85b9-73c9a0988137 type: condition task: - id: a87b2042-8c7d-46bf-8cc5-e38360de68a0 + id: 113d8e4e-0e24-4c2c-85b9-73c9a0988137 version: -1 name: IsMaliciuosFound description: Checks if the investigation found any Malicious File/URL/IP, if @@ -542,6 +484,8 @@ tasks: nexttasks: "no": - "20" + "yes": + - "40" scriptarguments: includeManual: {} includeSuspicious: {} @@ -552,7 +496,7 @@ tasks: { "position": { "x": 50, - "y": 3170 + "y": 4055 } } note: false @@ -562,10 +506,10 @@ tasks: quietmode: 0 "28": id: "28" - taskid: c858b092-01de-4e5b-87c1-ebd9dc5b2c17 + taskid: e6e76fe4-dbf0-4534-8196-23fb194755e1 type: regular task: - id: c858b092-01de-4e5b-87c1-ebd9dc5b2c17 + id: e6e76fe4-dbf0-4534-8196-23fb194755e1 version: -1 name: Create suspiciuos indicator script: Builtin|||createNewIndicator @@ -671,7 +615,7 @@ tasks: { "position": { "x": 50, - "y": 2470 + "y": 3345 } } note: false @@ -681,10 +625,10 @@ tasks: quietmode: 0 "29": id: "29" - taskid: f69c2c1a-a882-4703-8f71-e3b570cda227 + taskid: e48c96e6-cd61-41f1-87fc-819a794b6c9f type: regular task: - id: f69c2c1a-a882-4703-8f71-e3b570cda227 + id: e48c96e6-cd61-41f1-87fc-819a794b6c9f version: -1 name: Create suspiciuos indicator script: Builtin|||createNewIndicator @@ -790,7 +734,7 @@ tasks: { "position": { "x": 50, - "y": 2820 + "y": 3695 } } note: false @@ -800,10 +744,10 @@ tasks: quietmode: 0 "30": id: "30" - taskid: 8e4403c2-2c2f-452f-8363-df12a1249f74 + taskid: d9077d9a-465c-4c93-8329-8d018185f00c type: regular task: - id: 8e4403c2-2c2f-452f-8363-df12a1249f74 + id: d9077d9a-465c-4c93-8329-8d018185f00c version: -1 name: Create suspiciuos indicator script: Builtin|||createNewIndicator @@ -909,7 +853,7 @@ tasks: { "position": { "x": 50, - "y": 2995 + "y": 3870 } } note: false @@ -919,10 +863,10 @@ tasks: quietmode: 0 "31": id: "31" - taskid: 0a0145b9-24b6-4369-850e-66ee9ce580fb + taskid: 77b5e37b-8d65-4716-854f-07d258337718 type: regular task: - id: 0a0145b9-24b6-4369-850e-66ee9ce580fb + id: 77b5e37b-8d65-4716-854f-07d258337718 version: -1 name: Create suspiciuos indicator script: Builtin|||createNewIndicator @@ -1028,7 +972,7 @@ tasks: { "position": { "x": 50, - "y": 2645 + "y": 3520 } } note: false @@ -1038,10 +982,10 @@ tasks: quietmode: 0 "32": id: "32" - taskid: 2b1f057e-bb11-4048-8d7d-bd5598ccfa70 + taskid: e706bc0f-dd7d-494f-8cf3-18b272287306 type: regular task: - id: 2b1f057e-bb11-4048-8d7d-bd5598ccfa70 + id: e706bc0f-dd7d-494f-8cf3-18b272287306 version: -1 name: DeleteContext description: Delete field from context @@ -1064,6 +1008,300 @@ tasks: { "position": { "x": 50, + "y": 3170 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "33": + id: "33" + taskid: 4d212918-e576-4bac-8e58-ec31168840ee + type: regular + task: + id: 4d212918-e576-4bac-8e58-ec31168840ee + version: -1 + name: Create Bad indicator + script: Builtin|||createNewIndicator + type: regular + iscommand: true + brand: Builtin + nexttasks: + '#none#': + - "26" + scriptarguments: + accounttype: {} + actor: {} + admincountry: {} + adminemail: {} + adminname: {} + adminphone: {} + asn: {} + associatedfilenames: {} + associations: {} + biosversion: {} + comment: {} + creationdate: {} + customFields: {} + cvedescription: {} + cvemodified: {} + cvss: {} + description: {} + detectionengines: {} + devicemodel: {} + dhcpserver: {} + displayname: {} + dns: {} + domainname: {} + domainstatus: {} + emailaddress: {} + employeehealthstatus: {} + employeeresponsestatus: {} + entryid: {} + expirationdate: {} + fileextension: {} + filetype: {} + firstname: {} + firstseenbysource: {} + geocountry: {} + geolocation: {} + groups: {} + hostname: {} + imphash: {} + indicatoridentification: {} + internal: {} + ipaddress: {} + jobtitle: {} + lastname: {} + lastseenbysource: {} + macaddress: {} + malwarefamily: {} + md5: {} + memory: {} + merge: {} + mitrealiases: {} + mitrecontributors: {} + mitredatasources: {} + mitredefensebypassed: {} + mitredescription: {} + mitredetection: {} + mitreextendedaliases: {} + mitreexternalreferences: {} + mitreid: {} + mitreimpacttype: {} + mitrekillchainphases: {} + mitrelabels: {} + mitrename: {} + mitrepermissionsrequired: {} + mitreplatforms: {} + mitresystemrequirements: {} + mitretype: {} + mitreversion: {} + name: {} + namefield: {} + nameservers: {} + note: {} + office365category: {} + office365expressroute: {} + office365required: {} + operatingsystem: {} + operatingsystemversion: {} + organization: {} + organizationalunitou: {} + osversion: {} + path: {} + port: {} + positivedetections: {} + processor: {} + processors: {} + published: {} + quarantined: {} + recordedfutureevidencedetails: {} + region: {} + registrantcountry: {} + registrantemail: {} + registrantname: {} + registrantphone: {} + registrarabuseemail: {} + registrarabusephone: {} + registrarname: {} + relateToIncident: {} + relatedIncidents: + simple: ${incident.id} + reportedby: {} + reputation: + simple: Bad + seenNow: {} + service: {} + sha1: {} + sha256: {} + sha512: {} + shorttextfield: {} + signatureauthentihash: {} + signaturecopyright: {} + signaturedescription: {} + signaturefileversion: {} + signatureinternalname: {} + signed: {} + size: {} + source: {} + sourceTimeStamp: {} + sourceoriginalseverity: {} + ssdeep: {} + subdomains: {} + tags: {} + threattypes: {} + tmp: {} + trafficlightprotocol: {} + type: + simple: Email + updateddate: {} + username: {} + value: + simple: yulu@demisto.com + reputationcalc: 2 + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 2470 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "34": + id: "34" + taskid: 9e8b588e-8884-4562-86e0-2489df68f2ac + type: regular + task: + id: 9e8b588e-8884-4562-86e0-2489df68f2ac + version: -1 + name: Sleep + description: Sleep for X seconds + scriptName: Sleep + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "35" + scriptarguments: + seconds: + simple: "4" + separatecontext: false + view: |- + { + "position": { + "x": 360, + "y": 1250 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "35": + id: "35" + taskid: 9a869794-32db-4501-8452-ff3e1ddefdb2 + type: condition + task: + id: 9a869794-32db-4501-8452-ff3e1ddefdb2 + version: -1 + name: IsMaliciuosFound-include-suspicious + description: Checks if the investigation found any Malicious File/URL/IP, if + so return yes, otherwise no. + scriptName: IsMaliciousIndicatorFound + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "21" + scriptarguments: + includeManual: {} + includeSuspicious: + simple: "yes" + maliciousQueryOverride: {} + queryIndicators: {} + separatecontext: false + view: |- + { + "position": { + "x": 360, + "y": 1420 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "36": + id: "36" + taskid: 3694d4ea-b16e-480b-8a8c-acf26ee7c912 + type: regular + task: + id: 3694d4ea-b16e-480b-8a8c-acf26ee7c912 + version: -1 + name: Sleep + description: Sleep for X seconds + scriptName: Sleep + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "37" + scriptarguments: + seconds: + simple: "4" + separatecontext: false + view: |- + { + "position": { + "x": 360, + "y": 2120 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "37": + id: "37" + taskid: a6078fac-e689-4b3d-85d5-b215cb583a03 + type: condition + task: + id: a6078fac-e689-4b3d-85d5-b215cb583a03 + version: -1 + name: IsMaliciuosFound + description: Checks if the investigation found any Malicious File/URL/IP, if + so return yes, otherwise no. + scriptName: IsMaliciousIndicatorFound + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "33" + scriptarguments: + includeManual: {} + includeSuspicious: {} + maliciousQueryOverride: {} + queryIndicators: {} + separatecontext: false + view: |- + { + "position": { + "x": 360, "y": 2295 } } @@ -1072,13 +1310,148 @@ tasks: ignoreworker: false skipunavailable: false quietmode: 0 + "38": + id: "38" + taskid: 82f152ff-7d11-4efe-89a0-abde80bac262 + type: regular + task: + id: 82f152ff-7d11-4efe-89a0-abde80bac262 + version: -1 + name: Sleep + description: Sleep for X seconds + scriptName: Sleep + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "39" + scriptarguments: + seconds: + simple: "4" + separatecontext: false + view: |- + { + "position": { + "x": 360, + "y": 2820 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "39": + id: "39" + taskid: 55761573-5e71-4196-8e45-1b0e71ecdd0a + type: condition + task: + id: 55761573-5e71-4196-8e45-1b0e71ecdd0a + version: -1 + name: IsMaliciuosFound + description: Checks if the investigation found any Malicious File/URL/IP, if + so return yes, otherwise no. + scriptName: IsMaliciousIndicatorFound + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "32" + scriptarguments: + includeManual: {} + includeSuspicious: {} + maliciousQueryOverride: {} + queryIndicators: {} + separatecontext: false + view: |- + { + "position": { + "x": 360, + "y": 2995 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "40": + id: "40" + taskid: 9008d395-6fc8-4f57-85cf-5b0896d66ae6 + type: regular + task: + id: 9008d395-6fc8-4f57-85cf-5b0896d66ae6 + version: -1 + name: Sleep + description: Sleep for X seconds + scriptName: Sleep + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "41" + scriptarguments: + seconds: + simple: "4" + separatecontext: false + view: |- + { + "position": { + "x": 360, + "y": 4240 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "41": + id: "41" + taskid: a6695b95-69db-4575-8ad1-fbe1ed82b566 + type: condition + task: + id: a6695b95-69db-4575-8ad1-fbe1ed82b566 + version: -1 + name: IsMaliciuosFound + description: Checks if the investigation found any Malicious File/URL/IP, if + so return yes, otherwise no. + scriptName: IsMaliciousIndicatorFound + type: condition + iscommand: false + brand: "" + nexttasks: + "no": + - "20" + scriptarguments: + includeManual: {} + includeSuspicious: {} + maliciousQueryOverride: {} + queryIndicators: {} + separatecontext: false + view: |- + { + "position": { + "x": 360, + "y": 4410 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +system: true view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 3360, - "width": 380, + "height": 4595, + "width": 690, "x": 50, "y": 50 } @@ -1086,3 +1459,4 @@ view: |- } inputs: [] outputs: [] +fromversion: 4.1.0 diff --git a/Packs/CommonScripts/TestPlaybooks/playbook-TestIsValueInArray.yml b/Packs/CommonScripts/TestPlaybooks/playbook-TestIsValueInArray.yml index ee8ec27a8d8..c6f1482b86e 100644 --- a/Packs/CommonScripts/TestPlaybooks/playbook-TestIsValueInArray.yml +++ b/Packs/CommonScripts/TestPlaybooks/playbook-TestIsValueInArray.yml @@ -5,10 +5,10 @@ starttaskid: "0" tasks: "0": id: "0" - taskid: 268876ff-639e-4006-874a-a79e02cc95bf + taskid: 4e436ced-fc4d-4a67-80fe-ae0aaf602bbb type: start task: - id: 268876ff-639e-4006-874a-a79e02cc95bf + id: 4e436ced-fc4d-4a67-80fe-ae0aaf602bbb version: -1 name: "" iscommand: false @@ -20,8 +20,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": -112 + "x": 265, + "y": 50 } } note: false @@ -31,10 +31,10 @@ tasks: quietmode: 0 "1": id: "1" - taskid: 7db207a7-ad98-4343-8db3-80b8951302d4 + taskid: 2538bd73-c5f9-46a4-8d0b-6c7fe3b8f97f type: regular task: - id: 7db207a7-ad98-4343-8db3-80b8951302d4 + id: 2538bd73-c5f9-46a4-8d0b-6c7fe3b8f97f version: -1 name: Create array in context description: Find all users associated with a role @@ -56,8 +56,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 224 + "x": 265, + "y": 195 } } note: false @@ -67,10 +67,10 @@ tasks: quietmode: 0 "2": id: "2" - taskid: 803761a8-9be3-4bb7-8c0f-d4d305528f6f + taskid: e9061539-cf17-4165-8e03-446500f82b3b type: condition task: - id: 803761a8-9be3-4bb7-8c0f-d4d305528f6f + id: e9061539-cf17-4165-8e03-446500f82b3b version: -1 name: Check existing value description: Look for value in a list @@ -96,8 +96,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 398 + "x": 265, + "y": 370 } } note: false @@ -107,10 +107,10 @@ tasks: quietmode: 0 "3": id: "3" - taskid: 5bfe9ed3-c070-46ff-8faa-1b5feebf7804 + taskid: 99b95b38-f5cc-498c-8362-a81988d1dbbe type: regular task: - id: 5bfe9ed3-c070-46ff-8faa-1b5feebf7804 + id: 99b95b38-f5cc-498c-8362-a81988d1dbbe version: -1 name: Bad... type: regular @@ -120,8 +120,8 @@ tasks: view: |- { "position": { - "x": 22, - "y": 571 + "x": 50, + "y": 545 } } note: false @@ -131,10 +131,10 @@ tasks: quietmode: 0 "4": id: "4" - taskid: cdf4eb33-c8f7-42f3-8c76-523fdb8384a7 + taskid: 597cbd6c-650c-4501-8902-44a302bc3a40 type: condition task: - id: cdf4eb33-c8f7-42f3-8c76-523fdb8384a7 + id: 597cbd6c-650c-4501-8902-44a302bc3a40 version: -1 name: Check a non exist value scriptName: IsValueInArray @@ -159,8 +159,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 697 + "x": 480, + "y": 545 } } note: false @@ -170,10 +170,10 @@ tasks: quietmode: 0 "5": id: "5" - taskid: c3d3732b-6cc6-4008-84d7-ceafa0bb66ea + taskid: d4224065-aa6c-4d9f-8eb6-6ffd93062e7e type: regular task: - id: c3d3732b-6cc6-4008-84d7-ceafa0bb66ea + id: d4224065-aa6c-4d9f-8eb6-6ffd93062e7e version: -1 name: Bad... type: regular @@ -183,8 +183,8 @@ tasks: view: |- { "position": { - "x": 46, - "y": 875 + "x": 265, + "y": 720 } } note: false @@ -194,10 +194,10 @@ tasks: quietmode: 0 "6": id: "6" - taskid: ab8aaac0-d242-463f-8be1-9fd800dcdb45 + taskid: 6d43579b-fc97-4d73-8d22-851f22fba381 type: condition task: - id: ab8aaac0-d242-463f-8be1-9fd800dcdb45 + id: 6d43579b-fc97-4d73-8d22-851f22fba381 version: -1 name: 'Check two equal strings ' scriptName: IsValueInArray @@ -222,8 +222,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 1012 + "x": 695, + "y": 720 } } note: false @@ -233,10 +233,10 @@ tasks: quietmode: 0 "7": id: "7" - taskid: 0f19c80d-4cac-4848-83ef-5d2c0a09c8fa + taskid: fc6d9efa-2327-421f-855b-311d3f92f98c type: regular task: - id: 0f19c80d-4cac-4848-83ef-5d2c0a09c8fa + id: fc6d9efa-2327-421f-855b-311d3f92f98c version: -1 name: Bad... type: regular @@ -246,8 +246,8 @@ tasks: view: |- { "position": { - "x": 46, - "y": 1173 + "x": 480, + "y": 895 } } note: false @@ -257,10 +257,10 @@ tasks: quietmode: 0 "8": id: "8" - taskid: e770565c-9b81-4fbf-86af-a20be65283a3 + taskid: 59ee38a0-9df8-4d7f-8bd0-13b14d904f61 type: condition task: - id: e770565c-9b81-4fbf-86af-a20be65283a3 + id: 59ee38a0-9df8-4d7f-8bd0-13b14d904f61 version: -1 name: 'Check two non equal strings ' scriptName: IsValueInArray @@ -285,8 +285,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 1351 + "x": 910, + "y": 895 } } note: false @@ -296,10 +296,10 @@ tasks: quietmode: 0 "9": id: "9" - taskid: 36adc2a3-a170-4bc5-8f49-797fcbc6c895 + taskid: d0a415ea-7754-4934-8a5d-3c24a878abaa type: regular task: - id: 36adc2a3-a170-4bc5-8f49-797fcbc6c895 + id: d0a415ea-7754-4934-8a5d-3c24a878abaa version: -1 name: Bad... type: regular @@ -309,36 +309,8 @@ tasks: view: |- { "position": { - "x": 46, - "y": 1519 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 - "10": - id: "10" - taskid: 691e195e-0d5b-46fe-804a-3081e7652437 - type: regular - task: - id: 691e195e-0d5b-46fe-804a-3081e7652437 - version: -1 - name: Close - scriptName: CloseInvestigation - type: regular - iscommand: false - brand: "" - scriptarguments: - notes: {} - reason: {} - separatecontext: false - view: |- - { - "position": { - "x": 450, - "y": 2430 + "x": 695, + "y": 1070 } } note: false @@ -348,10 +320,10 @@ tasks: quietmode: 0 "11": id: "11" - taskid: f7d82642-3594-4464-83ca-b72dc0c6c804 + taskid: e0cbf7ae-4722-4599-83b3-0822451a384d type: condition task: - id: f7d82642-3594-4464-83ca-b72dc0c6c804 + id: e0cbf7ae-4722-4599-83b3-0822451a384d version: -1 name: Check empty array scriptName: IsValueInArray @@ -375,8 +347,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 1729 + "x": 1125, + "y": 1070 } } note: false @@ -386,10 +358,10 @@ tasks: quietmode: 0 "12": id: "12" - taskid: 10326c52-dfe8-4cbb-8f5f-f35857707a3e + taskid: c3f8fb52-a64b-49d2-8389-1aedde4c2ab2 type: regular task: - id: 10326c52-dfe8-4cbb-8f5f-f35857707a3e + id: c3f8fb52-a64b-49d2-8389-1aedde4c2ab2 version: -1 name: Bad... type: regular @@ -399,8 +371,8 @@ tasks: view: |- { "position": { - "x": 46, - "y": 1893 + "x": 910, + "y": 1245 } } note: false @@ -410,10 +382,10 @@ tasks: quietmode: 0 "13": id: "13" - taskid: ab42d7d4-0d3d-4dad-8fd1-448bc0adf9d8 + taskid: 18fb0ed0-515f-4f01-838a-4f32139fdab8 type: condition task: - id: ab42d7d4-0d3d-4dad-8fd1-448bc0adf9d8 + id: 18fb0ed0-515f-4f01-838a-4f32139fdab8 version: -1 name: Check empty value scriptName: IsValueInArray @@ -422,7 +394,7 @@ tasks: brand: "" nexttasks: "no": - - "10" + - "15" "yes": - "14" scriptarguments: @@ -437,8 +409,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 2056 + "x": 1340, + "y": 1245 } } note: false @@ -448,10 +420,10 @@ tasks: quietmode: 0 "14": id: "14" - taskid: 9bd5ef1c-e627-4bab-81ba-ea2833c9bc70 + taskid: 3ac8f0d5-c5ea-4b2f-80f1-2612c0623ecb type: regular task: - id: 9bd5ef1c-e627-4bab-81ba-ea2833c9bc70 + id: 3ac8f0d5-c5ea-4b2f-80f1-2612c0623ecb version: -1 name: Bad... type: regular @@ -461,8 +433,32 @@ tasks: view: |- { "position": { - "x": 46, - "y": 2225 + "x": 1125, + "y": 1420 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "15": + id: "15" + taskid: fa9ce7d1-e32e-43fe-8408-cdbea31246b6 + type: title + task: + id: fa9ce7d1-e32e-43fe-8408-cdbea31246b6 + version: -1 + name: Done + type: title + iscommand: false + brand: "" + separatecontext: false + view: |- + { + "position": { + "x": 1555, + "y": 1435 } } note: false @@ -475,10 +471,10 @@ view: |- "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 2637, - "width": 808, - "x": 22, - "y": -112 + "height": 1465, + "width": 1885, + "x": 50, + "y": 50 } } } diff --git a/Packs/CommonScripts/TestPlaybooks/playbook-langDetect-Test.yml b/Packs/CommonScripts/TestPlaybooks/playbook-langDetect-Test.yml index dd535a5a5ee..e92e858c339 100644 --- a/Packs/CommonScripts/TestPlaybooks/playbook-langDetect-Test.yml +++ b/Packs/CommonScripts/TestPlaybooks/playbook-langDetect-Test.yml @@ -6,10 +6,10 @@ starttaskid: "0" tasks: "0": id: "0" - taskid: 448ca2cf-2467-4306-8418-13a95c98ae9c + taskid: e878dc76-2922-4edf-8632-5ec19d61d958 type: start task: - id: 448ca2cf-2467-4306-8418-13a95c98ae9c + id: e878dc76-2922-4edf-8632-5ec19d61d958 version: -1 name: "" iscommand: false @@ -32,10 +32,10 @@ tasks: quietmode: 0 "1": id: "1" - taskid: e7f8493d-7ee9-4562-8f5d-5396fc52bac0 + taskid: b1e5a6ec-5705-49c8-821d-4c0f70b97ff2 type: regular task: - id: e7f8493d-7ee9-4562-8f5d-5396fc52bac0 + id: b1e5a6ec-5705-49c8-821d-4c0f70b97ff2 version: -1 name: Detect english scriptName: LanguageDetect @@ -64,10 +64,10 @@ tasks: quietmode: 0 "2": id: "2" - taskid: cb7d24b2-0f25-4d9e-87e3-89da25df5f1d + taskid: d1b82982-f1be-4a16-8bda-f0784412919f type: condition task: - id: cb7d24b2-0f25-4d9e-87e3-89da25df5f1d + id: d1b82982-f1be-4a16-8bda-f0784412919f version: -1 name: Check if we found English scriptName: Exists @@ -76,7 +76,7 @@ tasks: brand: "" nexttasks: "yes": - - "3" + - "7" scriptarguments: value: simple: ${langDetect(val.lang=='en')} @@ -93,40 +93,12 @@ tasks: ignoreworker: false skipunavailable: false quietmode: 0 - "3": - id: "3" - taskid: b734b4b5-931b-488c-860e-43d16bca90e0 - type: regular - task: - id: b734b4b5-931b-488c-860e-43d16bca90e0 - version: -1 - name: Close - scriptName: CloseInvestigation - type: regular - iscommand: false - brand: "" - scriptarguments: - notes: {} - reason: {} - separatecontext: false - view: |- - { - "position": { - "x": 50, - "y": 1070 - } - } - note: false - timertriggers: [] - ignoreworker: false - skipunavailable: false - quietmode: 0 "4": id: "4" - taskid: 6998200f-0ec7-4560-8489-6aa94c879875 + taskid: 44254d3c-7011-42cb-86af-3909f36bcb79 type: regular task: - id: 6998200f-0ec7-4560-8489-6aa94c879875 + id: 44254d3c-7011-42cb-86af-3909f36bcb79 version: -1 name: Sleep for 3 minutes scriptName: Sleep @@ -154,10 +126,10 @@ tasks: quietmode: 0 "5": id: "5" - taskid: 6af1144b-28a0-4e57-86f7-bed70791a315 + taskid: 6a34c6b7-766f-4ba3-8f9e-2a822e1d058e type: regular task: - id: 6af1144b-28a0-4e57-86f7-bed70791a315 + id: 6a34c6b7-766f-4ba3-8f9e-2a822e1d058e version: -1 name: Detect english once again scriptName: LanguageDetect @@ -185,10 +157,10 @@ tasks: quietmode: 0 "6": id: "6" - taskid: 0b20fdc4-5726-4ff6-8ccb-5d0d2844bfed + taskid: 2e87b599-df38-43f6-8399-b6f56b255d84 type: regular task: - id: 0b20fdc4-5726-4ff6-8ccb-5d0d2844bfed + id: 2e87b599-df38-43f6-8399-b6f56b255d84 version: -1 name: Delete Context scriptName: DeleteContext @@ -215,12 +187,36 @@ tasks: ignoreworker: false skipunavailable: false quietmode: 0 + "7": + id: "7" + taskid: df91e379-e7f9-4b05-849f-ab16dd6de22f + type: title + task: + id: df91e379-e7f9-4b05-849f-ab16dd6de22f + version: -1 + name: Done + type: title + iscommand: false + brand: "" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 1070 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 1115, + "height": 1085, "width": 380, "x": 50, "y": 50 @@ -228,4 +224,4 @@ view: |- } } inputs: [] -outputs: [] \ No newline at end of file +outputs: [] diff --git a/Packs/CommonScripts/TestPlaybooks/playbook-listExecutedCommands-Test.yml b/Packs/CommonScripts/TestPlaybooks/playbook-listExecutedCommands-Test.yml index eb8ff92af60..53aca5bc68b 100644 --- a/Packs/CommonScripts/TestPlaybooks/playbook-listExecutedCommands-Test.yml +++ b/Packs/CommonScripts/TestPlaybooks/playbook-listExecutedCommands-Test.yml @@ -5,10 +5,10 @@ starttaskid: "0" tasks: "0": id: "0" - taskid: e4c6f828-048f-4629-8c4b-f04edfc4f785 + taskid: 8cef38ca-8ef8-478b-89f2-9d1d2cac5aad type: start task: - id: e4c6f828-048f-4629-8c4b-f04edfc4f785 + id: 8cef38ca-8ef8-478b-89f2-9d1d2cac5aad version: -1 name: "" iscommand: false @@ -31,10 +31,10 @@ tasks: quietmode: 0 "1": id: "1" - taskid: af6e64e2-1df9-4a26-8d9c-0d773f9dbe5e + taskid: 8a4a1e56-afd9-4ec3-8802-1030eddc814b type: regular task: - id: af6e64e2-1df9-4a26-8d9c-0d773f9dbe5e + id: 8a4a1e56-afd9-4ec3-8802-1030eddc814b version: -1 name: Print Hello World description: Prints text to war room (Markdown supprted) @@ -63,10 +63,10 @@ tasks: quietmode: 0 "2": id: "2" - taskid: 9538b979-9c81-4419-8e2f-01e8be5e14a6 + taskid: 054f3ec5-2acb-4773-8a55-fce4757234bd type: regular task: - id: 9538b979-9c81-4419-8e2f-01e8be5e14a6 + id: 054f3ec5-2acb-4773-8a55-fce4757234bd version: -1 name: Get list of manual commands scriptName: listExecutedCommands @@ -94,10 +94,10 @@ tasks: quietmode: 0 "3": id: "3" - taskid: 06f1cccc-7518-4159-8e8c-4179c652d957 + taskid: 96fa6799-1ad0-48a0-8218-409ffd58a729 type: regular task: - id: 06f1cccc-7518-4159-8e8c-4179c652d957 + id: 96fa6799-1ad0-48a0-8218-409ffd58a729 version: -1 name: Save response to context description: "Takes the comments of a given entry ID and stores them in the @@ -132,10 +132,10 @@ tasks: quietmode: 0 "4": id: "4" - taskid: e5a2c1b3-2aea-4abd-8b90-a53bceb2dcfd + taskid: 4790839a-0c67-428b-87b4-3832b6126e0b type: condition task: - id: e5a2c1b3-2aea-4abd-8b90-a53bceb2dcfd + id: 4790839a-0c67-428b-87b4-3832b6126e0b version: -1 name: Check that we didn't get any commands scriptName: AreValuesEqual @@ -157,7 +157,7 @@ tasks: { "position": { "x": 50, - "y": 719 + "y": 720 } } note: false @@ -167,10 +167,10 @@ tasks: quietmode: 0 "5": id: "5" - taskid: 1aee5441-00ba-43f2-8fb4-9e7f5f1a4024 + taskid: 71594c4a-8f49-46c4-84ff-2b46cbfa6277 type: regular task: - id: 1aee5441-00ba-43f2-8fb4-9e7f5f1a4024 + id: 71594c4a-8f49-46c4-84ff-2b46cbfa6277 version: -1 name: Get playbook commands scriptName: listExecutedCommands @@ -198,10 +198,10 @@ tasks: quietmode: 0 "6": id: "6" - taskid: eff80cc0-b7d3-4ee2-802d-aaefbcd42162 + taskid: 79f3ae5c-f55d-4c61-83ec-9d64075eebda type: regular task: - id: eff80cc0-b7d3-4ee2-802d-aaefbcd42162 + id: 79f3ae5c-f55d-4c61-83ec-9d64075eebda version: -1 name: Save response to context scriptName: commentsToContext @@ -222,7 +222,7 @@ tasks: { "position": { "x": 50, - "y": 1069 + "y": 1070 } } note: false @@ -232,10 +232,10 @@ tasks: quietmode: 0 "7": id: "7" - taskid: 375275ba-f25e-44ae-8f51-c2e46c4e2ecb + taskid: d9feb548-f773-40cc-8bca-fd87ec8187db type: condition task: - id: 375275ba-f25e-44ae-8f51-c2e46c4e2ecb + id: d9feb548-f773-40cc-8bca-fd87ec8187db version: -1 name: Check that we got commands scriptName: AreValuesEqual @@ -267,19 +267,15 @@ tasks: quietmode: 0 "8": id: "8" - taskid: 24a124e4-346d-44ff-80c7-ff9a14d91d47 - type: regular + taskid: eaa2c7f0-ad0f-40b2-81ed-466ec3f35474 + type: title task: - id: 24a124e4-346d-44ff-80c7-ff9a14d91d47 + id: eaa2c7f0-ad0f-40b2-81ed-466ec3f35474 version: -1 - name: Close - scriptName: CloseInvestigation - type: regular + name: Done + type: title iscommand: false brand: "" - scriptarguments: - notes: {} - reason: {} separatecontext: false view: |- { @@ -298,7 +294,7 @@ view: |- "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 1465, + "height": 1435, "width": 380, "x": 50, "y": 50 diff --git a/Packs/CommonScripts/pack_metadata.json b/Packs/CommonScripts/pack_metadata.json index 02b8427af61..fb48a310adb 100644 --- a/Packs/CommonScripts/pack_metadata.json +++ b/Packs/CommonScripts/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Common Scripts", "description": "Frequently used scripts pack.", "support": "xsoar", - "currentVersion": "1.1.3", + "currentVersion": "1.1.9", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", @@ -10,5 +10,35 @@ "categories": [], "tags": [], "useCases": [], - "keywords": [] + "keywords": [], + "dependencies": { + "DemistoRESTAPI": { + "mandatory": true, + "display_name": "Demisto REST API" + }, + "Gmail": { + "mandatory": false, + "display_name": "Gmail" + }, + "EWSMailSender": { + "mandatory": false, + "display_name": "EWS Mail Sender" + }, + "MailSenderNew": { + "mandatory": false, + "display_name": "Mail Sender (New)" + }, + "GmailSingleUser": { + "mandatory": false, + "display_name": "Gmail Single User (Beta)" + }, + "MicrosoftGraphMail": { + "mandatory": false, + "display_name": "Microsoft Graph Mail" + }, + "MicrosoftGraphListener": { + "mandatory": false, + "display_name": "Microsoft Graph Mail Single User" + } + } } \ No newline at end of file diff --git a/Packs/CommonTypes/.pack-ignore b/Packs/CommonTypes/.pack-ignore index fcf49d67c92..1d0104896e2 100644 --- a/Packs/CommonTypes/.pack-ignore +++ b/Packs/CommonTypes/.pack-ignore @@ -90,3 +90,45 @@ ignore=IF107 [file:incidentfield-name.json] ignore=IF106 + +[file:reputation-cve.json] +ignore=RP102 + +[file:reputation-domain.json] +ignore=RP102 + +[file:reputation-host.json] +ignore=RP102 + +[file:reputation-account.json] +ignore=RP102 + +[file:reputation-email.json] +ignore=RP102 + +[file:reputation-url.json] +ignore=RP102 + +[file:reputation-file.json] +ignore=RP102 + +[file:reputation-hashRepSHA256.json] +ignore=RP102 + +[file:reputation-ip.json] +ignore=RP102 + +[file:reputation-ssdeepRep.json] +ignore=RP102 + +[file:reputation-hashRepSHA1.json] +ignore=RP102 + +[file:reputation-hashRepMD5.json] +ignore=RP102 + +[file:reputation-registryKey.json] +ignore=RP102 + +[file:incidentfield-Detection_URL.json] +ignore=IF107 \ No newline at end of file diff --git a/Packs/Malware/IncidentFields/incidentfield-Agent_ID.json b/Packs/CommonTypes/IncidentFields/incidentfield-Agent_ID.json similarity index 90% rename from Packs/Malware/IncidentFields/incidentfield-Agent_ID.json rename to Packs/CommonTypes/IncidentFields/incidentfield-Agent_ID.json index 20b85798544..853ee09da40 100644 --- a/Packs/Malware/IncidentFields/incidentfield-Agent_ID.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Agent_ID.json @@ -1,9 +1,6 @@ { - "associatedToAll": false, - "associatedTypes": [ - "Traps", - "Malware" - ], + "associatedToAll": true, + "associatedTypes": [], "breachScript": "", "caseInsensitive": true, "cliName": "agentid", diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Agent_ID_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Agent_ID_CHANGELOG.md new file mode 100644 index 00000000000..6e5befa5f6e --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Agent_ID_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +Added the Agent ID field to all incident types. \ No newline at end of file diff --git a/Packs/Malware/IncidentFields/incidentfield-Command_Line.json b/Packs/CommonTypes/IncidentFields/incidentfield-Command_Line.json similarity index 88% rename from Packs/Malware/IncidentFields/incidentfield-Command_Line.json rename to Packs/CommonTypes/IncidentFields/incidentfield-Command_Line.json index e05492711ef..9181f8c7c7f 100644 --- a/Packs/Malware/IncidentFields/incidentfield-Command_Line.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Command_Line.json @@ -1,10 +1,6 @@ { - "associatedToAll": false, - "associatedTypes": [ - "Crowdstrike", - "Traps", - "Malware" - ], + "associatedToAll": true, + "associatedTypes": [], "breachScript": "", "caseInsensitive": true, "cliName": "commandline", diff --git a/Packs/Malware/IncidentFields/incidentfield-Command_Line_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Command_Line_CHANGELOG.md similarity index 98% rename from Packs/Malware/IncidentFields/incidentfield-Command_Line_CHANGELOG.md rename to Packs/CommonTypes/IncidentFields/incidentfield-Command_Line_CHANGELOG.md index 0beb75aee69..d9ebab78568 100644 --- a/Packs/Malware/IncidentFields/incidentfield-Command_Line_CHANGELOG.md +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Command_Line_CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +- ## [20.5.2] - 2020-05-26 - diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Hostname.json b/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Hostname.json new file mode 100644 index 00000000000..052101f59bb --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Hostname.json @@ -0,0 +1,39 @@ +{ + "associatedToAll": true, + "associatedTypes": [], + "breachScript": "", + "caseInsensitive": true, + "cliName": "destinationhostname", + "closeForm": false, + "columns": null, + "content": true, + "defaultRows": null, + "description": "Destination hostname", + "editForm": true, + "fieldCalcScript": "", + "group": 0, + "hidden": false, + "id": "incident_destinationhostname", + "isReadOnly": false, + "locked": false, + "name": "Destination Hostname", + "neverSetAsRequired": false, + "ownerOnly": false, + "placeholder": "", + "required": false, + "script": "", + "selectValues": [], + "sla": 0, + "sortValues": null, + "system": false, + "systemAssociatedTypes": null, + "threshold": 72, + "type": "shortText", + "unmapped": false, + "unsearchable": false, + "useAsKpi": false, + "validatedError": "", + "validationRegex": "", + "version": -1, + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Hostname_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Hostname_CHANGELOG.md new file mode 100644 index 00000000000..d2adc8bf720 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Hostname_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +Added the Destination Hostname field. \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Destination_IP.json b/Packs/CommonTypes/IncidentFields/incidentfield-Destination_IP.json index 6e1477b2e34..c7d212469fb 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Destination_IP.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Destination_IP.json @@ -1,11 +1,7 @@ { "fromVersion": "5.0.0", - "associatedToAll": false, - "associatedTypes": [ - "Impossible Traveler", - "Cortex XDR Port Scan", - "Port Scan" - ], + "associatedToAll": true, + "associatedTypes": [], "breachScript": "", "caseInsensitive": true, "cliName": "destinationip", diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Port.json b/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Port.json new file mode 100644 index 00000000000..85474f8b363 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Port.json @@ -0,0 +1,37 @@ +{ + "fromVersion": "5.0.0", + "associatedToAll": true, + "associatedTypes": [], + "breachScript": "", + "caseInsensitive": true, + "cliName": "destinationport", + "closeForm": false, + "columns": null, + "content": true, + "defaultRows": null, + "description": "The destination port used.", + "editForm": true, + "fieldCalcScript": "", + "group": 0, + "hidden": false, + "id": "incident_destinationport", + "isReadOnly": false, + "locked": false, + "name": "Destination Port", + "neverSetAsRequired": false, + "ownerOnly": false, + "placeholder": "", + "required": false, + "script": "", + "selectValues": null, + "sla": 0, + "system": false, + "systemAssociatedTypes": null, + "threshold": 72, + "type": "shortText", + "unmapped": false, + "unsearchable": false, + "useAsKpi": true, + "validationRegex": "", + "version": -1 +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Port_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Port_CHANGELOG.md new file mode 100644 index 00000000000..084904703c8 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Destination_Port_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +Added the Destination Port field. \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-ExtraHop_Detection_URL.json b/Packs/CommonTypes/IncidentFields/incidentfield-Detection_URL.json similarity index 90% rename from Packs/CommonTypes/IncidentFields/incidentfield-ExtraHop_Detection_URL.json rename to Packs/CommonTypes/IncidentFields/incidentfield-Detection_URL.json index 9761ee0c831..7cc13881490 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-ExtraHop_Detection_URL.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Detection_URL.json @@ -23,11 +23,9 @@ "content": true, "group": 0, "hidden": false, - "associatedTypes": [ - "ExtraHop Detection" - ], + "associatedTypes": [], "systemAssociatedTypes": null, - "associatedToAll": false, + "associatedToAll": true, "unmapped": false, "unsearchable": false, "caseInsensitive": true, diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-ExtraHop_Detection_URL_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Detection_URL_CHANGELOG.md similarity index 100% rename from Packs/CommonTypes/IncidentFields/incidentfield-ExtraHop_Detection_URL_CHANGELOG.md rename to Packs/CommonTypes/IncidentFields/incidentfield-Detection_URL_CHANGELOG.md diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Device_Name.json b/Packs/CommonTypes/IncidentFields/incidentfield-Device_Name.json index 36dc9014fd6..bf996017ede 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Device_Name.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Device_Name.json @@ -1,8 +1,6 @@ { - "associatedToAll": false, - "associatedTypes": [ - "Traps" - ], + "associatedToAll": true, + "associatedTypes": [], "breachScript": "", "caseInsensitive": true, "cliName": "devicename", diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Event_ID.json b/Packs/CommonTypes/IncidentFields/incidentfield-Event_ID.json new file mode 100644 index 00000000000..e8f18f6643f --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Event_ID.json @@ -0,0 +1,37 @@ +{ + "associatedToAll": true, + "associatedTypes": [], + "breachScript": "", + "caseInsensitive": true, + "cliName": "eventid", + "closeForm": false, + "columns": null, + "content": true, + "defaultRows": null, + "description": "Event ID", + "editForm": true, + "fieldCalcScript": "", + "group": 0, + "hidden": false, + "id": "incident_eventid", + "isReadOnly": false, + "locked": false, + "name": "Event ID", + "neverSetAsRequired": false, + "ownerOnly": false, + "placeholder": "", + "required": false, + "script": "", + "selectValues": null, + "sla": 0, + "system": false, + "systemAssociatedTypes": null, + "threshold": 72, + "type": "shortText", + "unmapped": false, + "unsearchable": false, + "useAsKpi": false, + "validationRegex": "", + "version": -1, + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Event_ID_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Event_ID_CHANGELOG.md new file mode 100644 index 00000000000..9fb5ae612f5 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Event_ID_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +Added the Event ID field. \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Event_Type.json b/Packs/CommonTypes/IncidentFields/incidentfield-Event_Type.json new file mode 100644 index 00000000000..ed5fbddfa48 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Event_Type.json @@ -0,0 +1,37 @@ +{ + "associatedToAll": true, + "associatedTypes": [], + "breachScript": "", + "caseInsensitive": true, + "cliName": "eventtype", + "closeForm": false, + "columns": null, + "content": true, + "defaultRows": null, + "description": "Event Type", + "editForm": true, + "fieldCalcScript": "", + "group": 0, + "hidden": false, + "id": "incident_eventtype", + "isReadOnly": false, + "locked": false, + "name": "Event Type", + "neverSetAsRequired": false, + "ownerOnly": false, + "placeholder": "", + "required": false, + "script": "", + "selectValues": null, + "sla": 0, + "system": false, + "systemAssociatedTypes": null, + "threshold": 72, + "type": "shortText", + "unmapped": false, + "unsearchable": false, + "useAsKpi": false, + "validationRegex": "", + "version": -1, + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Event_Type_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Event_Type_CHANGELOG.md new file mode 100644 index 00000000000..a5d25aff5da --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Event_Type_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +Added the Event Type field. \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-File_Hash.json b/Packs/CommonTypes/IncidentFields/incidentfield-File_Hash.json index 2534335273e..498635712cc 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-File_Hash.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-File_Hash.json @@ -23,18 +23,9 @@ "content": true, "group": 0, "hidden": false, - "associatedTypes": [ - "Malware", - "Traps", - "Cortex XDR Port Scan", - "Port Scan" - ], - "systemAssociatedTypes": [ - "Malware", - "Traps", - "Cortex XDR Port Scan" - ], - "associatedToAll": false, + "associatedTypes": [], + "systemAssociatedTypes": null, + "associatedToAll": true, "unmapped": false, "unsearchable": false } \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-File_Name.json b/Packs/CommonTypes/IncidentFields/incidentfield-File_Name.json index 4a7bf8f6c93..7e3cbc3d0b4 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-File_Name.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-File_Name.json @@ -23,17 +23,9 @@ "content": true, "group": 0, "hidden": false, - "associatedTypes": [ - "Malware", - "Traps", - "Port Scan" - ], - "systemAssociatedTypes": [ - "Malware", - "Traps", - "Port Scan" - ], - "associatedToAll": false, + "associatedTypes": [], + "systemAssociatedTypes": null, + "associatedToAll": true, "unmapped": false, "unsearchable": false } \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-File_Path.json b/Packs/CommonTypes/IncidentFields/incidentfield-File_Path.json index 7c853e5e22e..f5998bb3355 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-File_Path.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-File_Path.json @@ -23,15 +23,9 @@ "content": true, "group": 0, "hidden": false, - "associatedTypes": [ - "Malware", - "Traps" - ], - "systemAssociatedTypes": [ - "Malware", - "Traps" - ], - "associatedToAll": false, + "associatedTypes": [], + "systemAssociatedTypes": null, + "associatedToAll": true, "unmapped": false, "unsearchable": false } \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-File_Size.json b/Packs/CommonTypes/IncidentFields/incidentfield-File_Size.json index 23e857969db..891fca968af 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-File_Size.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-File_Size.json @@ -1,9 +1,6 @@ { - "associatedToAll": false, - "associatedTypes": [ - "Traps", - "Malware" - ], + "associatedToAll": true, + "associatedTypes": [], "breachScript": "", "caseInsensitive": true, "cliName": "filesize", diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Log_Source.json b/Packs/CommonTypes/IncidentFields/incidentfield-Log_Source.json new file mode 100644 index 00000000000..646446e6b12 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Log_Source.json @@ -0,0 +1,37 @@ +{ + "associatedToAll": true, + "associatedTypes": [], + "breachScript": "", + "caseInsensitive": true, + "cliName": "logsource", + "closeForm": false, + "columns": null, + "content": true, + "defaultRows": null, + "description": "Log Source", + "editForm": true, + "fieldCalcScript": "", + "group": 0, + "hidden": false, + "id": "incident_logsource", + "isReadOnly": false, + "locked": false, + "name": "Log Source", + "neverSetAsRequired": false, + "ownerOnly": false, + "placeholder": "", + "required": false, + "script": "", + "selectValues": [], + "sla": 0, + "system": false, + "systemAssociatedTypes": null, + "threshold": 72, + "type": "shortText", + "unmapped": false, + "unsearchable": false, + "useAsKpi": false, + "validationRegex": "", + "version": -1, + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Log_Source_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Log_Source_CHANGELOG.md new file mode 100644 index 00000000000..7a8db299bae --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Log_Source_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +Added the Log Source field. \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-MAC_Address.json b/Packs/CommonTypes/IncidentFields/incidentfield-MAC_Address.json index 16c22526052..5c5f3b07afa 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-MAC_Address.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-MAC_Address.json @@ -1,9 +1,6 @@ { - "associatedToAll": false, - "associatedTypes": [ - "Malware", - "Brute Force" - ], + "associatedToAll": true, + "associatedTypes": [], "breachScript": "", "caseInsensitive": true, "cliName": "macaddress", diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-OS.json b/Packs/CommonTypes/IncidentFields/incidentfield-OS.json new file mode 100644 index 00000000000..4f8798fe828 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-OS.json @@ -0,0 +1,37 @@ +{ + "associatedToAll": true, + "associatedTypes": [], + "breachScript": "", + "caseInsensitive": true, + "cliName": "os", + "closeForm": false, + "columns": null, + "content": true, + "defaultRows": null, + "description": "The operating system.", + "editForm": true, + "fieldCalcScript": "", + "group": 0, + "hidden": false, + "id": "incident_os", + "isReadOnly": false, + "locked": false, + "name": "OS", + "neverSetAsRequired": false, + "ownerOnly": false, + "placeholder": "", + "required": false, + "script": "", + "selectValues": null, + "sla": 0, + "system": false, + "systemAssociatedTypes": null, + "threshold": 72, + "type": "shortText", + "unmapped": false, + "unsearchable": false, + "useAsKpi": false, + "validationRegex": "", + "version": -1, + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-OS_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-OS_CHANGELOG.md new file mode 100644 index 00000000000..b50938120cf --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-OS_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +Added the OS (Operating System) field. \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Protocol.json b/Packs/CommonTypes/IncidentFields/incidentfield-Protocol.json new file mode 100644 index 00000000000..6c3a7cd6210 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Protocol.json @@ -0,0 +1,37 @@ +{ + "associatedToAll": true, + "associatedTypes": [], + "breachScript": "", + "caseInsensitive": true, + "cliName": "protocol", + "closeForm": false, + "columns": null, + "content": true, + "defaultRows": null, + "description": "Protocol", + "editForm": true, + "fieldCalcScript": "", + "group": 0, + "hidden": false, + "id": "incident_protocol", + "isReadOnly": false, + "locked": false, + "name": "Protocol", + "neverSetAsRequired": false, + "ownerOnly": false, + "placeholder": "", + "required": false, + "script": "", + "selectValues": [], + "sla": 0, + "system": false, + "systemAssociatedTypes": null, + "threshold": 72, + "type": "shortText", + "unmapped": false, + "unsearchable": false, + "useAsKpi": false, + "validationRegex": "", + "version": -1, + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Protocol_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Protocol_CHANGELOG.md new file mode 100644 index 00000000000..e38fb7e5b45 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Protocol_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +Added the Protocol field. \ No newline at end of file diff --git a/Packs/CortexXDR/IncidentFields/XDR_Source_Hostname.json b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Hostname.json similarity index 89% rename from Packs/CortexXDR/IncidentFields/XDR_Source_Hostname.json rename to Packs/CommonTypes/IncidentFields/incidentfield-Source_Hostname.json index 6fd9cc8c268..fce489c42c3 100644 --- a/Packs/CortexXDR/IncidentFields/XDR_Source_Hostname.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Hostname.json @@ -1,9 +1,6 @@ { - "associatedToAll": false, - "associatedTypes": [ - "Cortex XDR Port Scan", - "Port Scan" - ], + "associatedToAll": true, + "associatedTypes": [], "breachScript": "", "caseInsensitive": true, "cliName": "sourcehostname", diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Source_Hostname_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Hostname_CHANGELOG.md new file mode 100644 index 00000000000..ba446f66a1c --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Hostname_CHANGELOG.md @@ -0,0 +1,6 @@ +## [Unreleased] +Associated the Source Hostname field to all incident types. + +## [20.5.2] - 2020-05-26 +- + diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Source_IP.json b/Packs/CommonTypes/IncidentFields/incidentfield-Source_IP.json index 2f5a8e00459..88ba4695965 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-Source_IP.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Source_IP.json @@ -1,11 +1,7 @@ { "fromVersion": "5.0.0", - "associatedToAll": false, - "associatedTypes": [ - "Impossible Traveler", - "Cortex XDR Port Scan", - "Port Scan" - ], + "associatedToAll": true, + "associatedTypes": [], "breachScript": "", "caseInsensitive": true, "cliName": "sourceip", diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Source_Port.json b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Port.json new file mode 100644 index 00000000000..03712490b78 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Port.json @@ -0,0 +1,37 @@ +{ + "fromVersion": "5.0.0", + "associatedToAll": true, + "associatedTypes": [], + "breachScript": "", + "caseInsensitive": true, + "cliName": "sourceport", + "closeForm": false, + "columns": null, + "content": true, + "defaultRows": null, + "description": "The source port that was used", + "editForm": true, + "fieldCalcScript": "", + "group": 0, + "hidden": false, + "id": "incident_sourceport", + "isReadOnly": false, + "locked": false, + "name": "Source Port", + "neverSetAsRequired": false, + "ownerOnly": false, + "placeholder": "", + "required": false, + "script": "", + "selectValues": null, + "sla": 0, + "system": false, + "systemAssociatedTypes": null, + "threshold": 72, + "type": "shortText", + "unmapped": false, + "unsearchable": false, + "useAsKpi": true, + "validationRegex": "", + "version": -1 +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Source_Port_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Port_CHANGELOG.md new file mode 100644 index 00000000000..201810b5a77 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Port_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +Added the Source Port field. \ No newline at end of file diff --git a/Packs/PortScan/IncidentFields/SourceUsername.json b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Username.json similarity index 88% rename from Packs/PortScan/IncidentFields/SourceUsername.json rename to Packs/CommonTypes/IncidentFields/incidentfield-Source_Username.json index 18e3b830124..f9bd0f487f3 100644 --- a/Packs/PortScan/IncidentFields/SourceUsername.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Username.json @@ -23,11 +23,9 @@ "content": true, "group": 0, "hidden": false, - "associatedTypes": [ - "Port Scan" - ], + "associatedTypes": [], "systemAssociatedTypes": null, - "associatedToAll": false, + "associatedToAll": true, "unmapped": false, "unsearchable": false, "caseInsensitive": true, diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Source_Username_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Username_CHANGELOG.md new file mode 100644 index 00000000000..ae9a8fe923e --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Source_Username_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +Added the Source Username field to all incident types. \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Tenant_Name.json b/Packs/CommonTypes/IncidentFields/incidentfield-Tenant_Name.json new file mode 100644 index 00000000000..6632f5b90af --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Tenant_Name.json @@ -0,0 +1,37 @@ +{ + "associatedToAll": true, + "associatedTypes": [], + "breachScript": "", + "caseInsensitive": true, + "cliName": "tenantname", + "closeForm": false, + "columns": null, + "content": true, + "defaultRows": null, + "description": "Tenant Name", + "editForm": true, + "fieldCalcScript": "", + "group": 0, + "hidden": false, + "id": "incident_tenantname", + "isReadOnly": false, + "locked": false, + "name": "Tenant Name", + "neverSetAsRequired": false, + "ownerOnly": false, + "placeholder": "", + "required": false, + "script": "", + "selectValues": null, + "sla": 0, + "system": false, + "systemAssociatedTypes": null, + "threshold": 72, + "type": "shortText", + "unmapped": false, + "unsearchable": false, + "useAsKpi": true, + "validationRegex": "", + "version": -1, + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-Tenant_Name_CHANGELOG.md b/Packs/CommonTypes/IncidentFields/incidentfield-Tenant_Name_CHANGELOG.md new file mode 100644 index 00000000000..e992f545816 --- /dev/null +++ b/Packs/CommonTypes/IncidentFields/incidentfield-Tenant_Name_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +Added the Tenant Name field. \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentFields/incidentfield-country.json b/Packs/CommonTypes/IncidentFields/incidentfield-country.json index cf494325df3..80df774aac7 100644 --- a/Packs/CommonTypes/IncidentFields/incidentfield-country.json +++ b/Packs/CommonTypes/IncidentFields/incidentfield-country.json @@ -22,13 +22,9 @@ "content": true, "group": 0, "hidden": false, - "associatedTypes": [ - "GDPR Data Breach", - "Impossible Traveler", - "Port Scan" - ], + "associatedTypes": [], "systemAssociatedTypes": null, - "associatedToAll": false, + "associatedToAll": true, "unmapped": false, "unsearchable": false, "caseInsensitive": true, diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Authentication.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Authentication.json new file mode 100644 index 00000000000..7543a3a3d64 --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Authentication.json @@ -0,0 +1,26 @@ +{ + "id": "Authentication", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Authentication", + "prevName": "", + "color": "#8052F3", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-C2Communication.json b/Packs/CommonTypes/IncidentTypes/incidenttype-C2Communication.json new file mode 100644 index 00000000000..719292a0009 --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-C2Communication.json @@ -0,0 +1,26 @@ +{ + "id": "C2Communication", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "C2Communication", + "prevName": "", + "color": "#C2195B", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": true, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Defacement.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Defacement.json new file mode 100644 index 00000000000..15e38986c05 --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Defacement.json @@ -0,0 +1,26 @@ +{ + "id": "Defacement", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Defacement", + "prevName": "", + "color": "#FA99D0", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-DoS.json b/Packs/CommonTypes/IncidentTypes/incidenttype-DoS.json new file mode 100644 index 00000000000..0c40c56f6eb --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-DoS.json @@ -0,0 +1,26 @@ +{ + "id": "DoS", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "DoS", + "prevName": "", + "color": "#00C853", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Exfiltration.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Exfiltration.json new file mode 100644 index 00000000000..7077fe47cce --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Exfiltration.json @@ -0,0 +1,26 @@ +{ + "id": "Exfiltration", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Exfiltration", + "prevName": "", + "color": "#1EE8B5", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Exploit.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Exploit.json new file mode 100644 index 00000000000..6bc83541898 --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Exploit.json @@ -0,0 +1,26 @@ +{ + "id": "Exploit", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Exploit", + "prevName": "", + "color": "#2979FF", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Hunt.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Hunt.json new file mode 100644 index 00000000000..962f70a3986 --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Hunt.json @@ -0,0 +1,26 @@ +{ + "id": "Hunt", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Hunt", + "prevName": "", + "color": "#FE2C8C", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Job.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Job.json new file mode 100644 index 00000000000..4035e5f994c --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Job.json @@ -0,0 +1,25 @@ +{ + "id": "Job", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Job", + "prevName": "", + "color": "#FF1D1E", + "hours": 0, + "days": 0, + "weeks": 0, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": true, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Lateral_Movement.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Lateral_Movement.json new file mode 100644 index 00000000000..a1c63620bb1 --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Lateral_Movement.json @@ -0,0 +1,26 @@ +{ + "id": "Lateral Movement", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Lateral Movement", + "prevName": "", + "color": "#FF6318", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Network.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Network.json new file mode 100644 index 00000000000..9e810213115 --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Network.json @@ -0,0 +1,26 @@ +{ + "id": "Network", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Network", + "prevName": "", + "color": "#FDE42E", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Policy_Violation.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Policy_Violation.json new file mode 100644 index 00000000000..acb90ca9a1d --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Policy_Violation.json @@ -0,0 +1,26 @@ +{ + "id": "Policy Violation", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Policy Violation", + "prevName": "", + "color": "#0097A7", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Reconnaissance.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Reconnaissance.json new file mode 100644 index 00000000000..6f04def920f --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Reconnaissance.json @@ -0,0 +1,26 @@ +{ + "id": "Reconnaissance", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Reconnaissance", + "prevName": "", + "color": "#3F51B5", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Simulation.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Simulation.json new file mode 100644 index 00000000000..f28592a50c9 --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Simulation.json @@ -0,0 +1,26 @@ +{ + "id": "Simulation", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Simulation", + "prevName": "", + "color": "#F9FF10", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-UnknownBinary.json b/Packs/CommonTypes/IncidentTypes/incidenttype-UnknownBinary.json new file mode 100644 index 00000000000..e6f2ecb0a15 --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-UnknownBinary.json @@ -0,0 +1,26 @@ +{ + "id": "UnknownBinary", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "UnknownBinary", + "prevName": "", + "color": "#FE2CD6", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IncidentTypes/incidenttype-Vulnerability.json b/Packs/CommonTypes/IncidentTypes/incidenttype-Vulnerability.json new file mode 100644 index 00000000000..ab0c6e1b23c --- /dev/null +++ b/Packs/CommonTypes/IncidentTypes/incidenttype-Vulnerability.json @@ -0,0 +1,26 @@ +{ + "id": "Vulnerability", + "version": -1, + "sortValues": null, + "vcShouldIgnore": false, + "locked": false, + "name": "Vulnerability", + "prevName": "", + "color": "#81D4FA", + "sla": 240, + "hours": 0, + "days": 3, + "weeks": 1, + "hoursR": 0, + "daysR": 0, + "weeksR": 0, + "system": false, + "readonly": false, + "default": false, + "autorun": false, + "preProcessingScript": "", + "closureScript": "", + "disabled": false, + "reputationCalc": 0, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IndicatorFields/incidentfield-campaign.json b/Packs/CommonTypes/IndicatorFields/incidentfield-campaign.json new file mode 100644 index 00000000000..a2b84b580cf --- /dev/null +++ b/Packs/CommonTypes/IndicatorFields/incidentfield-campaign.json @@ -0,0 +1,58 @@ +{ + "sortValues": null, + "closeForm": false, + "cliName": "campaign", + "neverSetAsRequired": false, + "threshold": 72, + "defaultRows": null, + "id": "indicator_campaign", + "validatedError": "", + "group": 2, + "script": "", + "isReadOnly": false, + "commitMessage": "", + "system": false, + "content": true, + "unsearchable": false, + "version": -1, + "unmapped": false, + "hidden": false, + "type": "multiSelect", + "breachScript": "", + "editForm": true, + "description": "", + "associatedToAll": false, + "shouldCommit": false, + "shouldPublish": false, + "associatedTypes": [ + "Registry Key", + "CVE", + "Domain", + "Email", + "IP", + "IPv6", + "CIDR", + "IPv6CIDR", + "File", + "URL" + ], + "caseInsensitive": true, + "columns": null, + "placeholder": "", + "useAsKpi": false, + "systemAssociatedTypes": null, + "prevName": "Campaign", + "locked": false, + "name": "Campaign", + "ownerOnly": false, + "required": false, + "modified": "2019-07-25T23:48:06.811606449Z", + "fieldCalcScript": "", + "selectValues": [ + "", + "" + ], + "validationRegex": "", + "sla": 0, + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/CommonTypes/IndicatorFields/incidentfield-malwarefamily.json b/Packs/CommonTypes/IndicatorFields/incidentfield-malwarefamily.json index f6603f4d42f..1b4a7bd1d18 100644 --- a/Packs/CommonTypes/IndicatorFields/incidentfield-malwarefamily.json +++ b/Packs/CommonTypes/IndicatorFields/incidentfield-malwarefamily.json @@ -30,6 +30,9 @@ "Domain", "Email", "IP", + "IPv6", + "CIDR", + "IPv6CIDR", "File", "URL" ], diff --git a/Packs/FeedMitreAttack/IndicatorFields/incidentfield-mitreexternalreferences.json b/Packs/CommonTypes/IndicatorFields/incidentfield-mitreexternalreferences.json similarity index 96% rename from Packs/FeedMitreAttack/IndicatorFields/incidentfield-mitreexternalreferences.json rename to Packs/CommonTypes/IndicatorFields/incidentfield-mitreexternalreferences.json index f170ec13220..ea08d4088d1 100644 --- a/Packs/FeedMitreAttack/IndicatorFields/incidentfield-mitreexternalreferences.json +++ b/Packs/CommonTypes/IndicatorFields/incidentfield-mitreexternalreferences.json @@ -30,6 +30,13 @@ "mergeStrategy": "", "hidden": false, "associatedTypes": [ + "Domain", + "IP", + "IPv6", + "CIDR", + "IPv6CIDR", + "File", + "URL", "MITRE ATT&CK" ], "systemAssociatedTypes": null, diff --git a/Packs/CommonTypes/IndicatorFields/incidentfield-port.json b/Packs/CommonTypes/IndicatorFields/incidentfield-port.json index f0ac32fece5..6068b867848 100644 --- a/Packs/CommonTypes/IndicatorFields/incidentfield-port.json +++ b/Packs/CommonTypes/IndicatorFields/incidentfield-port.json @@ -32,7 +32,9 @@ "hidden": false, "associatedTypes": [ "IP", - "IPv6" + "IPv6", + "Domain", + "URL" ], "systemAssociatedTypes": null, "associatedToAll": false, diff --git a/Packs/CommonTypes/IndicatorTypes/reputation-domain.json b/Packs/CommonTypes/IndicatorTypes/reputation-domain.json index 952ba1c446b..113ed017809 100644 --- a/Packs/CommonTypes/IndicatorTypes/reputation-domain.json +++ b/Packs/CommonTypes/IndicatorTypes/reputation-domain.json @@ -121,6 +121,23 @@ { "operator": "uniq", "args": {} + }, + { + "operator": "DateStringToISOFormat", + "args": { + "dayfirst": { + "value": null, + "isContext": false + }, + "fuzzy": { + "value": null, + "isContext": false + }, + "yearfirst": { + "value": null, + "isContext": false + } + } } ] } @@ -415,6 +432,23 @@ { "operator": "uniq", "args": {} + }, + { + "operator": "DateStringToISOFormat", + "args": { + "dayfirst": { + "value": null, + "isContext": false + }, + "fuzzy": { + "value": null, + "isContext": false + }, + "yearfirst": { + "value": null, + "isContext": false + } + } } ] } diff --git a/Packs/CommonTypes/README.md b/Packs/CommonTypes/README.md index e69de29bb2d..9ba4ecdab6d 100644 --- a/Packs/CommonTypes/README.md +++ b/Packs/CommonTypes/README.md @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/Packs/CommonTypes/ReleaseNotes/1_1_0.md b/Packs/CommonTypes/ReleaseNotes/1_1_0.md new file mode 100644 index 00000000000..b57753f0898 --- /dev/null +++ b/Packs/CommonTypes/ReleaseNotes/1_1_0.md @@ -0,0 +1,62 @@ +### IncidentTypes +Moved all system incident types to content. + +#### Network + +#### Policy Violation + +#### C2Communication + +#### Job + +#### Defacement + +#### Vulnerability + +#### Malware + +#### UnknownBinary + +#### DeviceLost + +#### DoS + +#### Hunt + +#### Reconnaissance + +#### Simulation + +#### Authentication + +#### Exfiltration + +#### Phishing + +#### Lateral Movement + +#### Access + +#### Ransomware + +#### Exploit + +#### Incident Fields +##### Tenant Name +##### Event Type +##### Event ID +##### Source IP +##### Destination Port +##### Protocol +##### Device Name +##### Country +##### File Name +##### File Hash +##### Source Port +##### OS +##### MAC Address +##### File Size +##### Destination Hostname +##### Destination IP +##### File Path +##### Log Source diff --git a/Packs/CommonTypes/ReleaseNotes/1_2_0.md b/Packs/CommonTypes/ReleaseNotes/1_2_0.md new file mode 100644 index 00000000000..c326568f7db --- /dev/null +++ b/Packs/CommonTypes/ReleaseNotes/1_2_0.md @@ -0,0 +1,19 @@ +#### IncidentFields +##### MAC Address +##### File Name +##### Event ID +##### Tenant Name +##### Country +##### Source Port +##### Destination IP +##### Log Source +##### Destination Hostname +##### File Path +##### File Hash +##### Source IP +##### Destination Port +##### Protocol +##### OS +##### Event Type +##### File Size +##### Device Name diff --git a/Packs/CommonTypes/ReleaseNotes/1_2_1.md b/Packs/CommonTypes/ReleaseNotes/1_2_1.md new file mode 100644 index 00000000000..21e78e33746 --- /dev/null +++ b/Packs/CommonTypes/ReleaseNotes/1_2_1.md @@ -0,0 +1,4 @@ + +#### IndicatorTypes +##### domainRepUnified +Updated the ***Domain*** indicator type's default mapping to use the new transformer *DateStringToISOFormat* (where relevant). diff --git a/Packs/CommonTypes/ReleaseNotes/1_2_2.md b/Packs/CommonTypes/ReleaseNotes/1_2_2.md new file mode 100644 index 00000000000..0fc3c8074d0 --- /dev/null +++ b/Packs/CommonTypes/ReleaseNotes/1_2_2.md @@ -0,0 +1,2 @@ +#### IncidentFields + - Associated the incident field port to indicator types domain and url. \ No newline at end of file diff --git a/Packs/CommonTypes/ReleaseNotes/1_2_3.md b/Packs/CommonTypes/ReleaseNotes/1_2_3.md new file mode 100644 index 00000000000..73dc287ad44 --- /dev/null +++ b/Packs/CommonTypes/ReleaseNotes/1_2_3.md @@ -0,0 +1,3 @@ +#### IndicatorFields + - Added the campaign indicator field. + - Associated the indicator fields malware family and mitre external reference to indicator types: IPv6, CIDR, IPv6CIDR. \ No newline at end of file diff --git a/Packs/CommonTypes/pack_metadata.json b/Packs/CommonTypes/pack_metadata.json index 006a66cc88f..0497c695a70 100644 --- a/Packs/CommonTypes/pack_metadata.json +++ b/Packs/CommonTypes/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Common Types", "description": "Common types pack.", "support": "xsoar", - "currentVersion": "1.0.2", + "currentVersion": "1.2.3", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", @@ -10,5 +10,6 @@ "categories": [], "tags": [], "useCases": [], - "keywords": [] + "keywords": [], + "dependencies": {} } \ No newline at end of file diff --git a/Packs/CommonWidgets/pack_metadata.json b/Packs/CommonWidgets/pack_metadata.json index b8c411e0368..33817104477 100644 --- a/Packs/CommonWidgets/pack_metadata.json +++ b/Packs/CommonWidgets/pack_metadata.json @@ -12,5 +12,6 @@ ], "tags": [], "useCases": [], - "keywords": [] + "keywords": [], + "dependencies": {} } \ No newline at end of file diff --git a/Packs/Compliance/IncidentFields/DPONotificationstatus.json b/Packs/Compliance/IncidentFields/DPONotificationstatus.json new file mode 100644 index 00000000000..63d51907eb9 --- /dev/null +++ b/Packs/Compliance/IncidentFields/DPONotificationstatus.json @@ -0,0 +1,45 @@ +{ + "id": "incident_dponotification", + "version": -1, + "modified": "2020-06-03T15:36:43.42179794Z", + "name": "DPO Notification", + "ownerOnly": false, + "placeholder": "", + "description": "", + "cliName": "dponotification", + "type": "singleSelect", + "closeForm": false, + "editForm": true, + "required": false, + "script": "", + "fieldCalcScript": "", + "neverSetAsRequired": false, + "isReadOnly": false, + "selectValues": [ + "Not started", + "In progress", + "Done" + ], + "validationRegex": "", + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "associatedTypes": [ + "HIPAA Breach Notification", + "US Breach Notification" + ], + "systemAssociatedTypes": null, + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "columns": null, + "defaultRows": null, + "sla": 0, + "threshold": 72, + "breachScript": "", + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/IPWhitelisting/CHANGELOG.md b/Packs/Compliance/IncidentFields/DPONotificationstatus_CHANGELOG.md similarity index 100% rename from Packs/IPWhitelisting/CHANGELOG.md rename to Packs/Compliance/IncidentFields/DPONotificationstatus_CHANGELOG.md diff --git a/Packs/Compliance/IncidentFields/IndividualsNotifictionStatus.json b/Packs/Compliance/IncidentFields/IndividualsNotifictionStatus.json new file mode 100644 index 00000000000..0336b2998b5 --- /dev/null +++ b/Packs/Compliance/IncidentFields/IndividualsNotifictionStatus.json @@ -0,0 +1,45 @@ +{ + "id": "incident_individualsnotification", + "version": -1, + "modified": "2020-06-03T15:36:57.307246472Z", + "name": "Individuals Notification", + "ownerOnly": false, + "placeholder": "", + "description": "", + "cliName": "individualsnotification", + "type": "singleSelect", + "closeForm": false, + "editForm": true, + "required": false, + "script": "", + "fieldCalcScript": "", + "neverSetAsRequired": false, + "isReadOnly": false, + "selectValues": [ + "Not started", + "In progress", + "Done" + ], + "validationRegex": "", + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "associatedTypes": [ + "HIPAA Breach Notification", + "US Breach Notification" + ], + "systemAssociatedTypes": null, + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "columns": null, + "defaultRows": null, + "sla": 0, + "threshold": 72, + "breachScript": "", + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/Legacy/CHANGELOG.md b/Packs/Compliance/IncidentFields/IndividualsNotifictionStatus_CHANGELOG.md similarity index 100% rename from Packs/Legacy/CHANGELOG.md rename to Packs/Compliance/IncidentFields/IndividualsNotifictionStatus_CHANGELOG.md diff --git a/Packs/Compliance/IncidentFields/ManagementNotificationStatus.json b/Packs/Compliance/IncidentFields/ManagementNotificationStatus.json new file mode 100644 index 00000000000..4a729bef7c6 --- /dev/null +++ b/Packs/Compliance/IncidentFields/ManagementNotificationStatus.json @@ -0,0 +1,45 @@ +{ + "id": "incident_managementnotification", + "version": -1, + "modified": "2020-06-03T15:37:41.233479795Z", + "name": "Management Notification", + "ownerOnly": false, + "placeholder": "", + "description": "", + "cliName": "managementnotification", + "type": "singleSelect", + "closeForm": false, + "editForm": true, + "required": false, + "script": "", + "fieldCalcScript": "", + "neverSetAsRequired": false, + "isReadOnly": false, + "selectValues": [ + "Not started", + "In progress", + "Done" + ], + "validationRegex": "", + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "associatedTypes": [ + "HIPAA Breach Notification", + "US Breach Notification" + ], + "systemAssociatedTypes": null, + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "columns": null, + "defaultRows": null, + "sla": 0, + "threshold": 72, + "breachScript": "", + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/Legacy/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_CHANGELOG.md b/Packs/Compliance/IncidentFields/ManagementNotificationStatus_CHANGELOG.md similarity index 100% rename from Packs/Legacy/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_CHANGELOG.md rename to Packs/Compliance/IncidentFields/ManagementNotificationStatus_CHANGELOG.md diff --git a/Packs/Compliance/IncidentFields/MediaNotificationStatus.json b/Packs/Compliance/IncidentFields/MediaNotificationStatus.json new file mode 100644 index 00000000000..5fa873c6d29 --- /dev/null +++ b/Packs/Compliance/IncidentFields/MediaNotificationStatus.json @@ -0,0 +1,45 @@ +{ + "id": "incident_medianotification", + "version": -1, + "modified": "2020-06-03T15:37:13.986451059Z", + "name": "Media Notification", + "ownerOnly": false, + "placeholder": "", + "description": "The status of the media notification", + "cliName": "medianotification", + "type": "singleSelect", + "closeForm": false, + "editForm": true, + "required": false, + "script": "", + "fieldCalcScript": "", + "neverSetAsRequired": false, + "isReadOnly": false, + "selectValues": [ + "Not started", + "In progress", + "Done" + ], + "validationRegex": "", + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "associatedTypes": [ + "HIPAA Breach Notification", + "US Breach Notification" + ], + "systemAssociatedTypes": null, + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "columns": null, + "defaultRows": null, + "sla": 0, + "threshold": 72, + "breachScript": "", + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/Compliance/IncidentFields/MediaNotificationStatus_CHANGELOG.md b/Packs/Compliance/IncidentFields/MediaNotificationStatus_CHANGELOG.md new file mode 100644 index 00000000000..4117bdc5e16 --- /dev/null +++ b/Packs/Compliance/IncidentFields/MediaNotificationStatus_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +- \ No newline at end of file diff --git a/Packs/Compliance/IncidentFields/SecretaryNotificationStatus.json b/Packs/Compliance/IncidentFields/SecretaryNotificationStatus.json new file mode 100644 index 00000000000..f4a5ce0f8bc --- /dev/null +++ b/Packs/Compliance/IncidentFields/SecretaryNotificationStatus.json @@ -0,0 +1,44 @@ +{ + "id": "incident_secretarynotification", + "version": -1, + "modified": "2020-06-03T15:38:03.354125757Z", + "name": "Secretary Notification", + "ownerOnly": false, + "placeholder": "", + "description": "", + "cliName": "secretarynotification", + "type": "singleSelect", + "closeForm": false, + "editForm": true, + "required": false, + "script": "", + "fieldCalcScript": "", + "neverSetAsRequired": false, + "isReadOnly": false, + "selectValues": [ + "Not started", + "In progress", + "Done" + ], + "validationRegex": "", + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "associatedTypes": [ + "HIPAA Breach Notification" + ], + "systemAssociatedTypes": null, + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "columns": null, + "defaultRows": null, + "sla": 0, + "threshold": 72, + "breachScript": "", + "fromVersion": "5.0.0" +} \ No newline at end of file diff --git a/Packs/Compliance/IncidentFields/SecretaryNotificationStatus_CHANGELOG.md b/Packs/Compliance/IncidentFields/SecretaryNotificationStatus_CHANGELOG.md new file mode 100644 index 00000000000..4117bdc5e16 --- /dev/null +++ b/Packs/Compliance/IncidentFields/SecretaryNotificationStatus_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +- \ No newline at end of file diff --git a/Packs/Compliance/ReleaseNotes/1_0_1.md b/Packs/Compliance/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..b191f4fb997 --- /dev/null +++ b/Packs/Compliance/ReleaseNotes/1_0_1.md @@ -0,0 +1,7 @@ + +### IncidentFields +- __Secretary Notification__ +- __Management Notification__ +- __DPO Notification__ +- __Media Notification__ +- __Individuals Notification__ \ No newline at end of file diff --git a/Packs/Compliance/pack_metadata.json b/Packs/Compliance/pack_metadata.json index 8ceb12d61c5..79e2055040b 100644 --- a/Packs/Compliance/pack_metadata.json +++ b/Packs/Compliance/pack_metadata.json @@ -2,9 +2,9 @@ "name": "Compliance", "description": "This pack contains essential incidents fields for compliance packs.", "support": "xsoar", - "currentVersion": "1.0.0", + "currentVersion": "1.0.1", "author": "Cortex XSOAR", - "url": "", + "url": "https://www.paloaltonetworks.com/cortex", "email": "", "categories": [], "tags": [ @@ -17,10 +17,9 @@ "Data breach" ], "created": "2020-05-10T10:50:52Z", - "updated": "2020-05-10T10:50:52Z", - "beta": false, - "deprecated": false, - "useCases": [], + "useCases": [ + "Compliance" + ], "keywords": [ "Compliance", "Breach", @@ -29,6 +28,5 @@ "Notification", "Breach notification", "Data breach" - ], - "dependencies": {} + ] } \ No newline at end of file diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py index 49f1a03ba88..4f7e665d4c4 100644 --- a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py +++ b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py @@ -1,8 +1,5 @@ -from dateutil import parser - +""" IMPORTS """ from CommonServerPython import * - -''' IMPORTS ''' import os import requests import json @@ -10,6 +7,8 @@ import base64 from cryptography.hazmat.primitives.ciphers.aead import AESGCM from typing import Dict, Any, List, Tuple, Callable +from tempfile import gettempdir +from dateutil import parser # disable insecure warnings requests.packages.urllib3.disable_warnings() @@ -501,7 +500,7 @@ def prepare_fetch_incidents_query(fetch_timestamp: str, Returns: SQL query that matches the arguments """ - query = f'SELECT * FROM `firewall.threat` ' # guardrails-disable-line + query = 'SELECT * FROM `firewall.threat` ' # guardrails-disable-line query += f'WHERE (TIME(time_generated) Between TIME(TIMESTAMP("{fetch_timestamp}")) ' \ f'AND TIME(CURRENT_TIMESTAMP))' if fetch_subtype and 'all' not in fetch_subtype: @@ -577,7 +576,7 @@ def get_critical_logs_command(args: dict, client: Client) -> Tuple[str, Dict[str """ logs_amount = args.get('limit') query_start_time, query_end_time = query_timestamp(args) - query = f'SELECT * FROM `firewall.threat` WHERE severity = "Critical" ' # guardrails-disable-line + query = 'SELECT * FROM `firewall.threat` WHERE severity = "Critical" ' # guardrails-disable-line query += f'AND (TIME(time_generated) BETWEEN TIME(TIMESTAMP("{query_start_time}")) AND ' \ f'TIME(TIMESTAMP("{query_end_time}"))) LIMIT {logs_amount}' @@ -611,7 +610,7 @@ def get_social_applications_command(args: dict, """ Queries Cortex Logging according to a pre-set query """ logs_amount = args.get('limit') query_start_time, query_end_time = query_timestamp(args) - query = f'SELECT * FROM `firewall.traffic` WHERE app_sub_category = "social-networking" ' # guardrails-disable-line + query = 'SELECT * FROM `firewall.traffic` WHERE app_sub_category = "social-networking" ' # guardrails-disable-line query += f' AND (TIME(time_generated) BETWEEN TIME(TIMESTAMP("{query_start_time}")) AND ' \ f'TIME(TIMESTAMP("{query_end_time}"))) LIMIT {logs_amount}' @@ -741,6 +740,7 @@ def fetch_incidents(client: Client, def main(): + os.environ['PAN_CREDENTIALS_DBFILE'] = os.path.join(gettempdir(), 'pancloud_credentials.json') params = demisto.params() registration_id_and_url = params.get(REGISTRATION_ID_CONST).split('@') if len(registration_id_and_url) != 2: diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml index f04be2fc46a..caacd93f8be 100644 --- a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml +++ b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml @@ -1506,7 +1506,7 @@ script: - contextPath: CDL.Logging.Threat.SourcePort description: Source port utilized by the session. type: Number - dockerimage: demisto/python_pancloud_v2:1.0.0.7727 + dockerimage: demisto/python_pancloud_v2:1.0.0.8888 feed: false isfetch: true longRunning: false diff --git a/Packs/CortexDataLake/ReleaseNotes/1_0_2.md b/Packs/CortexDataLake/ReleaseNotes/1_0_2.md new file mode 100644 index 00000000000..1340c4553cd --- /dev/null +++ b/Packs/CortexDataLake/ReleaseNotes/1_0_2.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Cortex Data Lake +- Internal code improvements. diff --git a/Packs/CortexDataLake/ReleaseNotes/1_0_3.md b/Packs/CortexDataLake/ReleaseNotes/1_0_3.md new file mode 100644 index 00000000000..205c8d463c9 --- /dev/null +++ b/Packs/CortexDataLake/ReleaseNotes/1_0_3.md @@ -0,0 +1,4 @@ + +### Integrations +- __Cortex Data Lake__ +Adjusted the integration to work with a setup of non-root user in a Docker container. diff --git a/Packs/CortexDataLake/pack_metadata.json b/Packs/CortexDataLake/pack_metadata.json index dcdf77591ca..a7347af6351 100644 --- a/Packs/CortexDataLake/pack_metadata.json +++ b/Packs/CortexDataLake/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Cortex Data Lake", "description": "Palo Alto Networks Cortex Data Lake provides cloud-based, centralized log storage and aggregation for your on premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR", "support": "xsoar", - "currentVersion": "1.0.1", + "currentVersion": "1.0.3", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/CortexXDR/IncidentFields/XDR_Description.json b/Packs/CortexXDR/IncidentFields/XDR_Description.json index b1be6324c71..ab31d409f99 100644 --- a/Packs/CortexXDR/IncidentFields/XDR_Description.json +++ b/Packs/CortexXDR/IncidentFields/XDR_Description.json @@ -9,7 +9,7 @@ "cliName": "xdrdescription", "closeForm": false, "columns": null, - "content": false, + "content": true, "defaultRows": null, "description": "", "editForm": true, @@ -37,4 +37,4 @@ "validationRegex": "", "version": -1, "fromVersion": "5.0.0" -} \ No newline at end of file +} diff --git a/Packs/CortexXDR/IncidentFields/XDR_Description_CHANGELOG.md b/Packs/CortexXDR/IncidentFields/XDR_Description_CHANGELOG.md new file mode 100644 index 00000000000..63439c17f37 --- /dev/null +++ b/Packs/CortexXDR/IncidentFields/XDR_Description_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +- diff --git a/Packs/CortexXDR/IncidentFields/XDR_Source_Hostname_CHANGELOG.md b/Packs/CortexXDR/IncidentFields/XDR_Source_Hostname_CHANGELOG.md deleted file mode 100644 index 23f916af83a..00000000000 --- a/Packs/CortexXDR/IncidentFields/XDR_Source_Hostname_CHANGELOG.md +++ /dev/null @@ -1,6 +0,0 @@ -## [Unreleased] - - -## [20.5.2] - 2020-05-26 -- - diff --git a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/CHANGELOG.md b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/CHANGELOG.md index 120a563867e..529d4431b66 100644 --- a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/CHANGELOG.md +++ b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/CHANGELOG.md @@ -1,4 +1,12 @@ ## [Unreleased] +- Added 6 commands. + - ***xdr-blacklist-files*** + - ***xdr-whitelist-files*** + - ***xdr-quarantine-files*** + - ***xdr-get-quarantine-status*** + - ***xdr-restore-file*** + - ***xdr-endpoint-scan*** +- Added get-quarantine-file-status playbook. - Fixed a bug in the ***xdr-get-endpoint*** command where only the last endpoint was displayed in context. ## [20.4.1] - 2020-04-29 @@ -6,7 +14,7 @@ ## [20.4.0] - 2020-04-14 - Fixed the issue where the ***xdr-isolate-endpoint*** command was failing when: - - The endpoint was disconnected. + - The endpoint was disconnected. - The isolation was still pending. - The isolation cancellation was still pending. - Fixed the issue where ***xdr-unisolate-endpoint*** was failing when: diff --git a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR.py b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR.py index cedcf46200d..4ef60dfa945 100644 --- a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR.py +++ b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR.py @@ -629,6 +629,197 @@ def get_audit_agent_reports(self, endpoint_ids, endpoint_names, result, _type, s return reply.get('reply').get('data', []) + def blacklist_files(self, hash_list, comment=None): + request_data: Dict[str, Any] = {"hash_list": hash_list} + if comment: + request_data["comment"] = comment + + self._headers['content-type'] = 'application/json' + reply = self._http_request( + method='POST', + url_suffix='/hash_exceptions/blacklist/', + json_data={'request_data': request_data}, + ok_codes=(200, 201), + ) + return reply.get('reply') + + def whitelist_files(self, hash_list, comment=None): + request_data: Dict[str, Any] = {"hash_list": hash_list} + if comment: + request_data["comment"] = comment + + self._headers['content-type'] = 'application/json' + reply = self._http_request( + method='POST', + url_suffix='/hash_exceptions/whitelist/', + json_data={'request_data': request_data}, + ok_codes=(201, 200), + ) + return reply.get('reply') + + def quarantine_files(self, endpoint_id_list, file_path, file_hash): + request_data: Dict[str, Any] = {} + filters = [] + if endpoint_id_list: + filters.append({ + 'field': 'endpoint_id_list', + 'operator': 'in', + 'value': endpoint_id_list + }) + + if filters: + request_data['filters'] = filters + + request_data['file_path'] = file_path + request_data['file_hash'] = file_hash + + self._headers['content-type'] = 'application/json' + reply = self._http_request( + method='POST', + url_suffix='/endpoints/quarantine/', + json_data={'request_data': request_data}, + ok_codes=(200, 201) + ) + + return reply.get('reply') + + def restore_file(self, file_hash, endpoint_id=None): + request_data: Dict[str, Any] = {'file_hash': file_hash} + request_data['endpoint_id'] = endpoint_id + + self._headers['content-type'] = 'application/json' + reply = self._http_request( + method='POST', + url_suffix='/endpoints/restore/', + json_data={'request_data': request_data}, + ok_codes=(200, 201), + ) + return reply.get('reply') + + def endpoint_scan(self, endpoint_id_list=None, dist_name=None, gte_first_seen=None, gte_last_seen=None, + lte_first_seen=None, + lte_last_seen=None, ip_list=None, group_name=None, platform=None, alias=None, isolate=None, + hostname=None): + request_data: Dict[str, Any] = {} + filters = [] + + if endpoint_id_list: + filters.append({ + 'field': 'endpoint_id_list', + 'operator': 'in', + 'value': endpoint_id_list + }) + + if dist_name: + filters.append({ + 'field': 'dist_name', + 'operator': 'in', + 'value': dist_name + }) + + if ip_list: + filters.append({ + 'field': 'ip_list', + 'operator': 'in', + 'value': ip_list + }) + + if group_name: + filters.append({ + 'field': 'group_name', + 'operator': 'in', + 'value': group_name + }) + + if platform: + filters.append({ + 'field': 'platform', + 'operator': 'in', + 'value': platform + }) + + if alias: + filters.append({ + 'field': 'alias_name', + 'operator': 'in', + 'value': alias + }) + + if isolate: + filters.append({ + 'field': 'isolate', + 'operator': 'in', + 'value': [isolate] + }) + + if hostname: + filters.append({ + 'field': 'hostname', + 'operator': 'in', + 'value': hostname + }) + + if gte_first_seen: + filters.append({ + 'field': 'first_seen', + 'operator': 'gte', + 'value': gte_first_seen + }) + + if lte_first_seen: + filters.append({ + 'field': 'first_seen', + 'operator': 'lte', + 'value': lte_first_seen + }) + + if gte_last_seen: + filters.append({ + 'field': 'last_seen', + 'operator': 'gte', + 'value': gte_last_seen + }) + + if lte_last_seen: + filters.append({ + 'field': 'last_seen', + 'operator': 'lte', + 'value': lte_last_seen + }) + + if filters: + request_data['filters'] = filters + else: + request_data['filters'] = 'all' + + self._headers['content-type'] = 'application/json' + reply = self._http_request( + method='POST', + url_suffix='/endpoints/scan/', + json_data={'request_data': request_data}, + ok_codes=(200, 201) + ) + return reply.get('reply') + + def get_quarantine_status(self, file_path, file_hash, endpoint_id): + request_data: Dict[str, Any] = {'files': [{ + 'endpoint_id': endpoint_id, + 'file_path': file_path, + 'file_hash': file_hash + }]} + self._headers['content-type'] = 'application/json' + reply = self._http_request( + method='POST', + url_suffix='/quarantine/status/', + json_data={'request_data': request_data} + ) + + reply_content = reply.get('reply') + if isinstance(reply_content, list): + return reply_content[0] + else: + raise TypeError(f'got unexpected response from api: {reply_content}\n') + def get_incidents_command(client, args): """ @@ -1265,6 +1456,150 @@ def create_distribution_command(client, args): ) +def blacklist_files_command(client, args): + hash_list = argToList(args.get('hash_list')) + comment = args.get('comment') + + client.blacklist_files(hash_list=hash_list, comment=comment) + markdown_data = [{'fileHash': file_hash} for file_hash in hash_list] + + return ( + tableToMarkdown('Blacklist Files', markdown_data, headers=['fileHash'], headerTransform=pascalToSpace), + { + f'{INTEGRATION_CONTEXT_BRAND}.blackList.fileHash(val.fileHash == obj.fileHash)': hash_list + }, + argToList(hash_list) + ) + + +def whitelist_files_command(client, args): + hash_list = argToList(args.get('hash_list')) + comment = args.get('comment') + + client.whitelist_files(hash_list=hash_list, comment=comment) + markdown_data = [{'fileHash': file_hash} for file_hash in hash_list] + return ( + tableToMarkdown('Whitelist Files', markdown_data, ['fileHash'], headerTransform=pascalToSpace), + { + f'{INTEGRATION_CONTEXT_BRAND}.whiteList.fileHash(val.fileHash == obj.fileHash)': hash_list + }, + argToList(hash_list) + ) + + +def quarantine_files_command(client, args): + endpoint_id_list = argToList(args.get("endpoint_id_list")) + file_path = args.get("file_path") + file_hash = args.get("file_hash") + + reply = client.quarantine_files( + endpoint_id_list=endpoint_id_list, + file_path=file_path, + file_hash=file_hash + ) + output = { + 'endpointIdList': endpoint_id_list, + 'filePath': file_path, + 'fileHash': file_hash, + 'actionId': reply.get("action_id") + } + + return ( + tableToMarkdown('Quarantine files', output, headers=[*output], + headerTransform=pascalToSpace), + { + f'{INTEGRATION_CONTEXT_BRAND}.quarantineFiles.actionIds(val.actionId === obj.actionId)': output + }, + reply + ) + + +def restore_file_command(client, args): + file_hash = args.get('file_hash') + endpoint_id = args.get('endpoint_id') + + reply = client.restore_file( + file_hash=file_hash, + endpoint_id=endpoint_id + ) + action_id = reply.get("action_id") + + return ( + tableToMarkdown('Restore files', {'Action Id': action_id}, ['Action Id']), + { + f'{INTEGRATION_CONTEXT_BRAND}.restoredFiles.actionId(val.actionId == obj.actionId)': action_id + }, + action_id + ) + + +def get_quarantine_status_command(client, args): + file_path = args.get('file_path') + file_hash = args.get('file_hash') + endpoint_id = args.get('endpoint_id') + + reply = client.get_quarantine_status( + file_path=file_path, + file_hash=file_hash, + endpoint_id=endpoint_id + ) + output = { + 'status': reply['status'], + 'endpointId': reply['endpoint_id'], + 'filePath': reply['file_path'], + 'fileHash': reply['file_hash'] + } + + return ( + tableToMarkdown('Quarantine files', output, headers=[*output], headerTransform=pascalToSpace), + { + f'{INTEGRATION_CONTEXT_BRAND}.quarantineFiles.status(val.fileHash === obj.fileHash &&' + f'val.endpointId === obj.endpointId && val.filePath === obj.filePath)': output + }, + reply + ) + + +def endpoint_scan_command(client, args): + endpoint_id_list = args.get('endpoint_id_list') + dist_name = args.get('dist_name') + gte_first_seen = args.get('gte_first_seen') + gte_last_seen = args.get('gte_last_seen') + lte_first_seen = args.get('lte_first_seen') + lte_last_seen = args.get('lte_last_seen') + ip_list = args.get('ip_list') + group_name = args.get('group_name') + platform = args.get('platform') + alias = args.get('alias') + isolate = args.get('isolate') + hostname = args.get('hostname') + + reply = client.endpoint_scan( + endpoint_id_list=argToList(endpoint_id_list), + dist_name=dist_name, + gte_first_seen=gte_first_seen, + gte_last_seen=gte_last_seen, + lte_first_seen=lte_first_seen, + lte_last_seen=lte_last_seen, + ip_list=ip_list, + group_name=group_name, + platform=platform, + alias=alias, + isolate=isolate, + hostname=hostname + ) + + action_id = reply.get("action_id") + + return ( + tableToMarkdown('Endpoint scan', {'Action Id': action_id}, ['Action Id']), + { + f'{INTEGRATION_CONTEXT_BRAND}.endpointScan.actionId(val.actionId == obj.actionId)': action_id + }, + reply + ) + + def fetch_incidents(client, first_fetch_time, last_run: dict = None): # Get the last fetch time, if exists last_fetch = last_run.get('time') if isinstance(last_run, dict) else None @@ -1383,6 +1718,23 @@ def main(): elif demisto.command() == 'xdr-get-audit-agent-reports': return_outputs(*get_audit_agent_reports_command(client, demisto.args())) + elif demisto.command() == 'xdr-blacklist-files': + return_outputs(*blacklist_files_command(client, demisto.args())) + + elif demisto.command() == 'xdr-whitelist-files': + return_outputs(*whitelist_files_command(client, demisto.args())) + + elif demisto.command() == 'xdr-quarantine-files': + return_outputs(*quarantine_files_command(client, demisto.args())) + + elif demisto.command() == 'xdr-get-quarantine-status': + return_outputs(*get_quarantine_status_command(client, demisto.args())) + + elif demisto.command() == 'xdr-restore-file': + return_outputs(*restore_file_command(client, demisto.args())) + + elif demisto.command() == 'xdr-endpoint-scan': + return_outputs(*endpoint_scan_command(client, demisto.args())) except Exception as err: if demisto.command() == 'fetch-incidents': LOG(str(err)) diff --git a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR.yml b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR.yml index b0123c318ce..6f4b879ca7e 100644 --- a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR.yml +++ b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR.yml @@ -834,8 +834,8 @@ script: isArray: false name: sort_order predefined: - - asc - - desc + - asc + - desc required: false secret: false deprecated: false @@ -1397,7 +1397,199 @@ script: - contextPath: PaloAltoNetworksXDR.AuditAgentReports.DESCRIPTION description: Agent report description. type: String - dockerimage: demisto/python3:3.7.4.977 + - arguments: + - default: false + description: String that represents a list of hashed files you want to blacklist. + Must be a valid SHA256 hash. + isArray: true + name: hash_list + required: true + secret: false + - default: false + description: String that represents additional information regarding the action. + isArray: false + name: comment + required: false + secret: false + deprecated: false + description: Blacklists requested files which have not already been blacklisted + or whitelisted. + execution: false + name: xdr-blacklist-files + - arguments: + - default: false + description: String that represents a list of hashed files you want to whitelist. + Must be a valid SHA256 hash. + isArray: true + name: hash_list + required: true + secret: false + - default: false + description: String that represents additional information regarding the action. + isArray: false + name: comment + required: false + secret: false + deprecated: false + description: Whitelists requested files which have not already been blacklisted + or whitelisted. + execution: false + name: xdr-whitelist-files + - arguments: + - default: false + description: List of endpoint IDs. + isArray: true + name: endpoint_id_list + required: true + secret: false + - default: false + description: String that represents the path of the file you want to quarantine. + isArray: false + name: file_path + required: true + secret: false + - default: false + description: String that represents the file’s hash. Must be a valid SHA256 hash. + isArray: false + name: file_hash + required: true + secret: false + deprecated: false + description: Quarantines a file on selected endpoints. You can select up to 1000 + endpoints. + execution: false + name: xdr-quarantine-files + - arguments: + - default: false + description: String the represents the endpoint ID. + isArray: false + name: endpoint_id + required: true + secret: false + - default: false + description: String that represents the file hash. Must be a valid SHA256 hash. + isArray: false + name: file_hash + required: true + secret: false + - default: false + description: String that represents the file path. + isArray: false + name: file_path + required: true + secret: false + deprecated: false + description: Retrieves the quarantine status for a selected file. + execution: false + name: xdr-get-quarantine-status + - arguments: + - default: false + description: String that represents the file in hash. Must be a valid SHA256 hash. + isArray: false + name: file_hash + required: true + secret: false + - default: false + description: String that represents the endpoint ID. If you do not enter a specific + endpoint ID, the request will run restore on all endpoints which relate to + the quarantined file you defined. + isArray: false + name: endpoint_id + required: false + secret: false + deprecated: false + description: Restores a quarantined file on requested endpoints. + execution: false + name: xdr-restore-file + - arguments: + - default: false + description: List of endpoint IDs. + isArray: false + name: endpoint_id_list + required: false + secret: false + - default: false + description: Name of the distribution list. + isArray: false + name: dist_name + required: false + secret: false + - default: false + description: Integer in timestamp epoch milliseconds. + isArray: false + name: gte_first_seen + required: false + secret: false + - default: false + description: Integer in timestamp epoch milliseconds. + isArray: false + name: gte_last_seen + required: false + secret: false + - default: false + description: Integer in timestamp epoch milliseconds + isArray: false + name: lte_first_seen + required: false + secret: false + - default: false + description: Integer in timestamp epoch milliseconds + isArray: false + name: lte_last_seen + required: false + secret: false + - default: false + description: List of IP addresses. + isArray: false + name: ip_list + required: false + secret: false + - default: false + description: Name of the endpoint group. + isArray: false + name: group_name + required: false + secret: false + - auto: PREDEFINED + default: false + description: Type of operating system. + isArray: false + name: platform + predefined: + - windows + - linux + - macos + - android + required: false + secret: false + - default: false + description: Endpoint alias name. + isArray: false + name: alias + required: false + secret: false + - auto: PREDEFINED + default: false + description: Whether an endpoint has been isolated. Can be "isolated" or "unisolated". + isArray: false + name: isolate + predefined: + - isolated + - unisolated + required: false + secret: false + - default: false + description: Name of the host. + isArray: false + name: hostname + required: false + secret: false + deprecated: false + description: Runs a scan on selected endpoints. To scan all endpoints, + run this command with no filters. + execution: true + name: xdr-endpoint-scan + dockerimage: demisto/python3:3.8.3.9324 feed: false isfetch: true longRunning: false @@ -1407,5 +1599,5 @@ script: subtype: python3 type: python fromversion: 4.1.0 -defaultClassifier: Cortex XDR - IR -defaultMapperIn: Cortex XDR - IR-mapper \ No newline at end of file +tests: + - Test XDR Playbook diff --git a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR_test.py b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR_test.py index 00e7995a7c6..7936f285e11 100644 --- a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR_test.py +++ b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/PaloAltoNetworks_XDR_test.py @@ -25,7 +25,7 @@ def test_get_incident_list(requests_mock): expected_output = { 'PaloAltoNetworksXDR.Incident(val.incident_id==obj.incident_id)': get_incidents_list_response.get('reply') - .get('incidents') + .get('incidents') } assert expected_output == outputs @@ -208,7 +208,7 @@ def test_isolate_endpoint(requests_mock): def test_isolate_endpoint_unconnected_machine(requests_mock, mocker): from PaloAltoNetworks_XDR import isolate_endpoint_command, Client -# return_error_mock = mocker.patch(RETURN_ERROR_TARGET) + # return_error_mock = mocker.patch(RETURN_ERROR_TARGET) requests_mock.post(f'{XDR_URL}/public_api/v1/endpoints/get_endpoint/', json={ 'reply': { @@ -483,3 +483,276 @@ def test_create_distribution(requests_mock): } } assert readable_output == f'Distribution {expected_distribution_id} created successfully' + + +def test_blacklist_files_command_with_more_than_one_file(requests_mock): + """ + Given: + - List of files' hashes to put in blacklist + When + - A user desires to mark more than one file + Then + - returns markdown, context data and raw response. + """ + + from PaloAltoNetworks_XDR import blacklist_files_command, Client + test_data = load_test_data('test_data/blacklist_whitelist_files_success.json') + expected_command_result = {'PaloAltoNetworksXDR.blackList.fileHash(val.fileHash == obj.fileHash)': + test_data['multi_command_args']['hash_list']} + requests_mock.post(f'{XDR_URL}/public_api/v1/hash_exceptions/blacklist/', json=test_data['api_response']) + + client = Client( + base_url=f'{XDR_URL}/public_api/v1' + ) + client._headers = {} + markdown, context, raw = blacklist_files_command(client, test_data['multi_command_args']) + + assert expected_command_result == context + + +def test_blacklist_files_command_with_single_file(requests_mock): + """ + Given: + - List of a file hashes to put in blacklist. + When + - A user desires to blacklist one file. + Then + - returns markdown, context data and raw response. + """ + + from PaloAltoNetworks_XDR import blacklist_files_command, Client + test_data = load_test_data('test_data/blacklist_whitelist_files_success.json') + expected_command_result = { + 'PaloAltoNetworksXDR.blackList.fileHash(val.fileHash == obj.fileHash)': + test_data['single_command_args']['hash_list']} + requests_mock.post(f'{XDR_URL}/public_api/v1/hash_exceptions/blacklist/', json=test_data['api_response']) + + client = Client( + base_url=f'{XDR_URL}/public_api/v1' + ) + client._headers = {} + markdown, context, raw = blacklist_files_command(client, test_data['single_command_args']) + + assert expected_command_result == context + + +def test_blacklist_files_command_with_no_comment_file(requests_mock): + """ + Given: + - ￿List of files' hashes to put in blacklist without passing the comment argument. + When + - A user desires to blacklist files without adding a comment. + Then + - returns markdown, context data and raw response. + """ + + from PaloAltoNetworks_XDR import blacklist_files_command, Client + test_data = load_test_data('test_data/blacklist_whitelist_files_success.json') + expected_command_result = { + 'PaloAltoNetworksXDR.blackList.fileHash(val.fileHash == obj.fileHash)': + test_data['no_comment_command_args']['hash_list']} + requests_mock.post(f'{XDR_URL}/public_api/v1/hash_exceptions/blacklist/', json=test_data['api_response']) + + client = Client( + base_url=f'{XDR_URL}/public_api/v1' + ) + client._headers = {} + markdown, context, raw = blacklist_files_command(client, test_data['no_comment_command_args']) + + assert expected_command_result == context + + +def test_whitelist_files_command_with_more_than_one_file(requests_mock): + """ + Given: + - ￿List of files' hashes to put in whitelist + When + - A user desires to mark more than one file + Then + - returns markdown, context data and raw response. + """ + + from PaloAltoNetworks_XDR import whitelist_files_command, Client + test_data = load_test_data('test_data/blacklist_whitelist_files_success.json') + expected_command_result = {'PaloAltoNetworksXDR.whiteList.fileHash(val.fileHash == obj.fileHash)': + test_data['multi_command_args']['hash_list']} + requests_mock.post(f'{XDR_URL}/public_api/v1/hash_exceptions/whitelist/', json=test_data['api_response']) + + client = Client( + base_url=f'{XDR_URL}/public_api/v1' + ) + client._headers = {} + markdown, context, raw = whitelist_files_command(client, test_data['multi_command_args']) + + assert expected_command_result == context + + +def test_whitelist_files_command_with_single_file(requests_mock): + """ + Given: + - List of a file hashes to put in whitelist. + When + - A user desires to whitelist one file. + Then + - returns markdown, context data and raw response. + """ + + from PaloAltoNetworks_XDR import whitelist_files_command, Client + test_data = load_test_data('test_data/blacklist_whitelist_files_success.json') + expected_command_result = { + 'PaloAltoNetworksXDR.whiteList.fileHash(val.fileHash == obj.fileHash)': + test_data['single_command_args']['hash_list']} + requests_mock.post(f'{XDR_URL}/public_api/v1/hash_exceptions/whitelist/', json=test_data['api_response']) + + client = Client( + base_url=f'{XDR_URL}/public_api/v1' + ) + client._headers = {} + markdown, context, raw = whitelist_files_command(client, test_data['single_command_args']) + + assert expected_command_result == context + + +def test_whitelist_files_command_with_no_comment_file(requests_mock): + """ + Given: + - List of files' hashes to put in whitelist without passing the comment argument. + When + - A user desires to whitelist files without adding a comment. + Then + - returns markdown, context data and raw response. + """ + + from PaloAltoNetworks_XDR import whitelist_files_command, Client + test_data = load_test_data('test_data/blacklist_whitelist_files_success.json') + expected_command_result = { + 'PaloAltoNetworksXDR.whiteList.fileHash(val.fileHash == obj.fileHash)': test_data['no_comment_command_args'][ + 'hash_list']} + requests_mock.post(f'{XDR_URL}/public_api/v1/hash_exceptions/whitelist/', json=test_data['api_response']) + + client = Client( + base_url=f'{XDR_URL}/public_api/v1' + ) + client._headers = {} + markdown, context, raw = whitelist_files_command(client, test_data['no_comment_command_args']) + + assert expected_command_result == context + + +def test_quarantine_files_command(requests_mock): + """ + Given: + - List of files' hashes to put in quarantine + When + - A user desires to quarantine files. + Then + - returns markdown, context data and raw response. + """ + from PaloAltoNetworks_XDR import quarantine_files_command, Client + test_data = load_test_data('test_data/quarantine_files.json') + quarantine_files_expected_tesult = {'PaloAltoNetworksXDR.quarantineFiles.actionIds(val.actionId === obj.actionId)': + test_data['context_data']} + requests_mock.post(f'{XDR_URL}/public_api/v1/endpoints/quarantine/', json=test_data['api_response']) + + client = Client( + base_url=f'{XDR_URL}/public_api/v1' + ) + client._headers = {} + markdown, context, raw = quarantine_files_command(client, test_data['command_args']) + + assert quarantine_files_expected_tesult == context + + +def test_get_quarantine_status_command(requests_mock): + """ + Given: + - Endpoint_id, file_path, file_hash + When + - A user desires to check a file's quarantine status. + Then + - returns markdown, context data and raw response. + """ + from PaloAltoNetworks_XDR import get_quarantine_status_command, Client + test_data = load_test_data('test_data/get_quarantine_status.json') + quarantine_files_expected_tesult = { + 'PaloAltoNetworksXDR.quarantineFiles.status(val.fileHash === obj.fileHash &&val.endpointId' + ' === obj.endpointId && val.filePath === obj.filePath)': + test_data['context_data']} + requests_mock.post(f'{XDR_URL}/public_api/v1/quarantine/status/', json=test_data['api_response']) + + client = Client( + base_url=f'{XDR_URL}/public_api/v1' + ) + client._headers = {} + markdown, context, raw = get_quarantine_status_command(client, test_data['command_args']) + + assert quarantine_files_expected_tesult == context + + +def test_restore_file_command(requests_mock): + """ + Given: + - file_hash + When + - A user desires to restore a file. + Then + - returns markdown, context data and raw response. + """ + from PaloAltoNetworks_XDR import restore_file_command, Client + + restore_expected_tesult = {'PaloAltoNetworksXDR.restoredFiles.actionId(val.actionId == obj.actionId)': 123} + requests_mock.post(f'{XDR_URL}/public_api/v1/endpoints/restore/', json={"reply": {"action_id": 123}}) + + client = Client( + base_url=f'{XDR_URL}/public_api/v1' + ) + client._headers = {} + markdown, context, raw = restore_file_command(client, {"file_hash": "123"}) + + assert restore_expected_tesult == context + + +def test_endpoint_scan_command(requests_mock): + """ + Given: + - endpoint_id_list, dist_name, gte_first_seen, gte_last_seen, lte_first_seen, lte_last_seen, ip_list, + group_name, platform, alias, isolate, hostname + When + - A user desires to scan endpoint. + Then + - returns markdown, context data and raw response. + """ + from PaloAltoNetworks_XDR import endpoint_scan_command, Client + test_data = load_test_data('test_data/scan_endpoints.json') + scan_expected_tesult = {'PaloAltoNetworksXDR.endpointScan.actionId(val.actionId == obj.actionId)': 123} + requests_mock.post(f'{XDR_URL}/public_api/v1/endpoints/scan/', json={"reply": {"action_id": 123}}) + + client = Client( + base_url=f'{XDR_URL}/public_api/v1' + ) + client._headers = {} + markdown, context, raw = endpoint_scan_command(client, test_data['command_args']) + + assert scan_expected_tesult == context + + +def test_endpoint_scan_command_scan_all_endpoints(requests_mock): + """ + Given: + - no filters. + When + - A user desires to scan all endpoints. + Then + - returns markdown, context data and raw response. + """ + from PaloAltoNetworks_XDR import endpoint_scan_command, Client + scan_expected_tesult = {'PaloAltoNetworksXDR.endpointScan.actionId(val.actionId == obj.actionId)': 123} + requests_mock.post(f'{XDR_URL}/public_api/v1/endpoints/scan/', json={"reply": {"action_id": 123}}) + + client = Client( + base_url=f'{XDR_URL}/public_api/v1' + ) + client._headers = {} + markdown, context, raw = endpoint_scan_command(client, {}) + + assert scan_expected_tesult == context diff --git a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/command_examples b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/command_examples index 0434780db0d..1c9ffb684cc 100644 --- a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/command_examples +++ b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/command_examples @@ -11,4 +11,10 @@ !xdr-insert-parsed-alert product="SandBlast" vendor="Checkpoint" local_ip="196.168.0.1" local_port="600" remote_ip="5.5.5.5" remote_port="500" event_timestampt="2020-01-01T00:00:00" severity="High" alert_name="some alert" alert_description="this is test alert" !xdr-insert-cef-alerts cef_alerts="CEF:0|Check Point|VPN-1 & FireWall-1|Check Point|Log|microsoft-ds|Unknown|act=AcceptdeviceDirection=0 rt=1569477512000 spt=56957 dpt=445 cs2Label=Rule Name cs2=ADPrimery layer_name=FW_Device_blackened Securitylayer_uuid=07693fc7-1a5c-4f31-8afe-77ae96c71b8c match_id=1806 parent_rule=0rule_action=Accept rule_uid=8e45f36b-d106-4d81-a1f0-9d1ed9a6be5c ifname=bond2logid=0 loguid={0x5d8c5388,0x61,0x29321fac,0xc0000022} origin=1.1.1.1originsicname=CN=DWdeviceBlackend,O=Blackend sequencenum=363 version=5dst=1.1.1.1 inzone=External outzone=Internal product=VPN-1 & FireWall-1 proto=6service_id=microsoft-ds src=1.1.1.1" !xdr-get-audit-agent-reports result=Success timestamp_gte="100 days" endpoint_ids=ea303670c76e4ad09600c8b346f7c804 type=Policy limit=2 -!xdr-get-audit-management-logs result=SUCCESS type=DISTRIBUTIONS limit=2 timestamp_gte="3 month" \ No newline at end of file +!xdr-get-audit-management-logs result=SUCCESS type=DISTRIBUTIONS limit=2 timestamp_gte="3 month" +!xdr-blacklist-files hash_list=55f8718109829bf506b09d8af615b9f107a266e19f7a311039d1035f180b22d4 +!xdr-whitelist-files hash_list=55f8718109829bf506b09d8af615b9f107a266e19f7a311039d1035f180b22d4 +!xdr-quarantine-files endpoint_id_list=f8a2f58846b542579c12090652e79f3d file_hash=55f8718109829bf506b09d8af615b9f107a266e19f7a311039d1035f180b22d4 file_path=/home/ec2-user/test_file.txt +!xdr-get-quarantine-status endpoint_id=f8a2f58846b542579c12090652e79f3d file_hash=55f8718109829bf506b09d8af615b9f107a266e19f7a311039d1035f180b22d4 file_path=/home/ec2-user/test_file.txt +!xdr-endpoint-scan endpoint_id_list=f8a2f58846b542579c12090652e79f3d +!xdr-restore-file file_hash=55f8718109829bf506b09d8af615b9f107a266e19f7a311039d1035f180b22d4 diff --git a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/blacklist_files_failure.json b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/blacklist_files_failure.json new file mode 100644 index 00000000000..5be8d92a6cf --- /dev/null +++ b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/blacklist_files_failure.json @@ -0,0 +1,20 @@ +{ + "command_args": { + "request_data":{ + "hash_list":[ + "032196FB1AC01311B4AA1A7D0FD5EB5F420CA9B215AFE54234DFCF69E5D553F0", + "365296EB1BC01311B4AA1A7D0FD5EB5F420CA9B215AFE24234DFCF69E7D553E4", + "365296EB1BC01311B4AA1A7D0FD5EB5F420CA9B215AFE24214DFCF69E5D523E4", + "365296EB1BC01311B4AA1A7D0FD5EB5F420CA9B215AFE24234DFCF69E5D553D4", + "365296EB1BC01311B4AA1A7D0FD5EB5F420CA9B215AFE24234DFCF63E5D553D4" + ], + "comment":"test" + } + }, + "api_response": + {"reply": + {"err_code": 401, + "err_msg": "\tUnauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", + "err_extra": "EXTRA_DATA"} + } +} \ No newline at end of file diff --git a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/blacklist_whitelist_files_success.json b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/blacklist_whitelist_files_success.json new file mode 100644 index 00000000000..450fa4ca452 --- /dev/null +++ b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/blacklist_whitelist_files_success.json @@ -0,0 +1,26 @@ +{ + "multi_command_args": { + "hash_list":[ + "032196FB1AC01311B4AA1A7D0FD5EB5F420CA9B215AFE54234DFCF69E5D553F0", + "365296EB1BC01311B4AA1A7D0FD5EB5F420CA9B215AFE24234DFCF69E7D553E4", + "365296EB1BC01311B4AA1A7D0FD5EB5F420CA9B215AFE24214DFCF69E5D523E4", + "365296EB1BC01311B4AA1A7D0FD5EB5F420CA9B215AFE24234DFCF69E5D553D4", + "365296EB1BC01311B4AA1A7D0FD5EB5F420CA9B215AFE24234DFCF63E5D553D4" + ], + "comment":"test" + }, + "single_command_args": { + "hash_list":[ + "032196FB1AC01311B4AA1A7D0FD5EB5F420CA9B215AFE54234DFCF69E5D553F0" + ], + "comment":"test" + }, + "no_comment_command_args": { + "hash_list":[ + "032196FB1AC01311B4AA1A7D0FD5EB5F420CA9B215AFE54234DFCF69E5D553F0" + ] + }, + "api_response": { + "reply": true + } +} diff --git a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/get_quarantine_status.json b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/get_quarantine_status.json new file mode 100644 index 00000000000..5afeb44e40b --- /dev/null +++ b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/get_quarantine_status.json @@ -0,0 +1,23 @@ +{ + "api_response": { + "reply": [ + { + "endpoint_id": "123", + "file_path": "C:\\Users\\test\\Desktop\\test_x64.msi", + "file_hash": "123", + "status": false + } + ] + }, + "command_args": { + "endpoint_id": "123", + "file_path": "C:\\Users\\test\\Desktop\\test_x64.msi", + "file_hash": "123" + }, + "context_data": { + "status": false, + "endpointId": "123", + "filePath":"C:\\Users\\test\\Desktop\\test_x64.msi", + "fileHash":"123" + } +} \ No newline at end of file diff --git a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/quarantine_files.json b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/quarantine_files.json new file mode 100644 index 00000000000..07ccf084e48 --- /dev/null +++ b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/quarantine_files.json @@ -0,0 +1,17 @@ +{ + "api_response": { + "reply": + {"action_id": 123} + }, + "command_args": { + "endpoint_id_list": "123", + "file_path":"C:\\Users\\test\\Desktop\\test_x64.msi", + "file_hash":"123" + }, + "context_data": { + "endpointIdList": ["123"], + "filePath":"C:\\Users\\test\\Desktop\\test_x64.msi", + "fileHash":"123", + "actionId": 123 + } +} \ No newline at end of file diff --git a/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/scan_endpoints.json b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/scan_endpoints.json new file mode 100644 index 00000000000..531218e4929 --- /dev/null +++ b/Packs/CortexXDR/Integrations/PaloAltoNetworks_XDR/test_data/scan_endpoints.json @@ -0,0 +1,20 @@ +{ + "command_args": { + "endpoint_id_list":[123], + "dist_name":"123", + "gte_first_seen":"123", + "gte_last_seen":"123", + "lte_first_seen":"123", + "lte_last_seen":"123", + "ip_list":"123", + "group_name":"123", + "platform":"windows", + "alias":"123", + "isolate":"true", + "hostname":"123" + }, + "api_response": { + "reply": + {"action_id": 123} + } +} \ No newline at end of file diff --git a/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Malware_Investigation.yml b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Malware_Investigation.yml new file mode 100644 index 00000000000..17dc413c0ee --- /dev/null +++ b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Malware_Investigation.yml @@ -0,0 +1,335 @@ +id: Cortex XDR - Malware Investigation +version: -1 +name: Cortex XDR - Malware Investigation +description: | + Investigates a Cortex XDR incident containing internal malware alerts. The playbook: + - Enriches the infected endpoint details. + - Lets the analyst manually retrieve the malicious file. + - Performs file detonation. + + The playbook is used as a sub- playbook in ‘Cortex XDR Incident Handling - v2’ +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 7013d486-d71b-4117-8551-801797af55ca + type: start + task: + id: 7013d486-d71b-4117-8551-801797af55ca + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "27" + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 1150 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "5": + id: "5" + taskid: 6496fddc-17e5-49d0-8dcc-2372d4b75188 + type: title + task: + id: 6496fddc-17e5-49d0-8dcc-2372d4b75188 + version: -1 + name: File Detonation + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "98" + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 1610 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "27": + id: "27" + taskid: ff288863-5690-432a-86ca-3a86d8350faa + type: title + task: + id: ff288863-5690-432a-86ca-3a86d8350faa + version: -1 + name: Endpoint Enrichment + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "91" + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 1295 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "45": + id: "45" + taskid: 497f868b-82fa-42ab-870f-0af527f51cc1 + type: title + task: + id: 497f868b-82fa-42ab-870f-0af527f51cc1 + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 2090 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "91": + id: "91" + taskid: 638288f3-a778-44ea-80fe-8bc2f2eda778 + type: regular + task: + id: 638288f3-a778-44ea-80fe-8bc2f2eda778 + version: -1 + name: Cortex XDR - get endpoints + description: Gets a list of endpoints, according to the passed filters. Filtering + by multiple fields should be concatenated using the AND condition (OR is not supported). + Maximum result set size is 100. Offset is the zero-based number of endpoint + from the start of the result set (start by counting from 0). + script: Cortex XDR - IR|||xdr-get-endpoints + type: regular + iscommand: true + brand: Cortex XDR - IR + nexttasks: + '#none#': + - "5" + scriptarguments: + alias_name: {} + dist_name: {} + endpoint_id_list: {} + first_seen_gte: {} + first_seen_lte: {} + group_name: {} + hostname: {} + ip_list: + complex: + root: inputs.host_ip + isolate: {} + last_seen_gte: {} + last_seen_lte: {} + limit: {} + page: {} + platform: {} + sort_by: {} + sort_order: {} + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 1440 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "98": + id: "98" + taskid: 2e3adef2-12c8-49fc-8963-78b8f0cf4295 + type: condition + task: + id: 2e3adef2-12c8-49fc-8963-78b8f0cf4295 + version: -1 + name: Manual - Retrieve file from XDR? + description: "Manual - Retrieve file from XDR to perform file detonation." + type: condition + iscommand: false + brand: "" + nexttasks: + "no": + - "45" + "yes": + - "111" + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 1750 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "111": + id: "111" + taskid: 511dc88b-b3ce-4b77-838f-dfbe2d911e27 + type: playbook + task: + id: 511dc88b-b3ce-4b77-838f-dfbe2d911e27 + version: -1 + name: Detonate File - Generic + playbookName: Detonate File - Generic + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "45" + separatecontext: true + view: |- + { + "position": { + "x": 720, + "y": 1920 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +view: |- + { + "linkLabelsPosition": { + "98_45_no": 0.52 + }, + "paper": { + "dimensions": { + "height": 1005, + "width": 620, + "x": 480, + "y": 1150 + } + } + } +inputs: +- key: xdr_alert_id + value: {} + required: false + description: Unique ID for the XDR alert. + playbookInputQuery: +- key: host_ip + value: {} + required: false + description: Host IP involved in the alert. + playbookInputQuery: +- key: file_name + value: {} + required: false + description: The name of the malicious file. + playbookInputQuery: +- key: file_sha256 + value: {} + required: false + description: SHA-256 hash of the file. + playbookInputQuery: +outputs: +- contextPath: Joe.Analysis + description: The Analysis object + type: unknown +- contextPath: File + description: The File's object. + type: unknown +- contextPath: File.Malicious + description: The malicious file's description. + type: unknown +- contextPath: DBotScore + description: The indicator's object. + type: unknown +- contextPath: IP + description: IP objects. + type: unknown +- contextPath: DBotScore.Malicious + description: Dbot Score malicious information. + type: unknown +- contextPath: Sample + description: Sample data object. + type: unknown +- contextPath: InfoFile + description: The report file's object. + type: unknown +- contextPath: WildFire + description: Wildfire analysis object. + type: unknown +- contextPath: WildFire.Report + description: The submission object. + type: unknown +- contextPath: Joe + description: Joe Sandbox analysis object. + type: unknown +- contextPath: Cuckoo.Task + description: Cuckoo task object. + type: unknown +- contextPath: SNDBOX.Analysis + description: SNDBOX analysis. + type: unknown +- contextPath: HybridAnalysis.Submit + description: The HybridAnalysis object + type: unknown +- contextPath: ANYRUN.Task + description: ANYRUN task object. + type: unknown +- contextPath: ANYRUN.Task.Behavior + description: ANYRUN task behavior. + type: unknown +- contextPath: ANYRUN.Task.Connection + description: ANYRUN task connection. + type: unknown +- contextPath: ANYRUN.Task.DnsRequest + description: ANYRUN task DNS request. + type: unknown +- contextPath: ANYRUN.Task.Threat + description: ANYRUN task threat. + type: unknown +- contextPath: ANYRUN.Task.HttpRequest + description: ANYRUN task HTTP request. + type: unknown +- contextPath: ANYRUN.Task.Process + description: ANYRUN task process information. + type: unknown +- contextPath: ANYRUN.Task.Process.Version + description: ANYRUN task process version. + type: unknown +tests: +- No test. +fromversion: 5.0.0 diff --git a/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Malware_Investigation_README.md b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Malware_Investigation_README.md new file mode 100644 index 00000000000..0c2938ba6fa --- /dev/null +++ b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Malware_Investigation_README.md @@ -0,0 +1,64 @@ +Investigates a Cortex XDR incident containing internal malware alerts. The playbook: +- Enriches the infected endpoint details. +- Lets the analyst manually retrieve the malicious file. +- Performs file detonation. + +The playbook is used as a sub- playbook in ‘Cortex XDR Incident Handling - v2’ + + +## Dependencies +This playbook uses the following sub-playbooks, integrations, and scripts. + +### Sub-playbooks +* Detonate File - Generic + +### Integrations +* Cortex XDR - IR + +### Scripts +This playbook does not use any scripts. + +### Commands +* xdr-get-endpoints + +## Playbook Inputs +--- + +| **Name** | **Description** | **Default Value** | **Required** | +| --- | --- | --- | --- | +| xdr_alert_id | Unique ID for the XDR alert. | | Optional | +| host_ip | Host IP involved in the alert. | | Optional | +| file_name | The name of the malicious file. | | Optional | +| file_sha256 | SHA\-256 hash of the file. | | Optional | + +## Playbook Outputs +--- + +| **Path** | **Description** | **Type** | +| --- | --- | --- | +| Joe.Analysis | The Analysis object | unknown | +| File | The File's object. | unknown | +| File.Malicious | The malicious file's description. | unknown | +| DBotScore | The indicator's object. | unknown | +| IP | IP objects. | unknown | +| DBotScore.Malicious | Dbot Score malicious information. | unknown | +| Sample | Sample data object. | unknown | +| InfoFile | The report file's object. | unknown | +| WildFire | Wildfire analysis object. | unknown | +| WildFire.Report | The submission object. | unknown | +| Joe | Joe Sandbox analysis object. | unknown | +| Cuckoo.Task | Cuckoo task object. | unknown | +| SNDBOX.Analysis | SNDBOX analysis. | unknown | +| HybridAnalysis.Submit | The HybridAnalysis object | unknown | +| ANYRUN.Task | ANYRUN task object. | unknown | +| ANYRUN.Task.Behavior | ANYRUN task behavior. | unknown | +| ANYRUN.Task.Connection | ANYRUN task connection. | unknown | +| ANYRUN.Task.DnsRequest | ANYRUN task DNS request. | unknown | +| ANYRUN.Task.Threat | ANYRUN task threat. | unknown | +| ANYRUN.Task.HttpRequest | ANYRUN task HTTP request. | unknown | +| ANYRUN.Task.Process | ANYRUN task process information. | unknown | +| ANYRUN.Task.Process.Version | ANYRUN task process version. | unknown | + +## Playbook Image +--- +![Cortex XDR - Malware Investigation](https://github.com/demisto/content/raw/3fadebe9e16eb7c9fc28ce3bb600319ec875e3b5/Packs/CortexXDR/doc_files/Cortex_XDR_-_Malware_Investigation.png) \ No newline at end of file diff --git a/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Port_Scan_-_Adjusted.yml b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Port_Scan_-_Adjusted.yml new file mode 100644 index 00000000000..2b117a0aa51 --- /dev/null +++ b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Port_Scan_-_Adjusted.yml @@ -0,0 +1,1155 @@ +id: Cortex XDR - Port Scan - Adjusted +version: -1 +name: Cortex XDR - Port Scan - Adjusted +description: |- + Investigates a Cortex XDR incident containing internal port scan alerts. The playbook: + - Syncs data with Cortex XDR. + - Notifies management about a compromised host. + - Escalates the incident in case of lateral movement alert detection. + + The playbook is used as a sub- playbook in 'Cortex XDR Incident Handling - v2' +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 7c46d5ad-2e77-4213-8d84-4de23934ce23 + type: start + task: + id: 7c46d5ad-2e77-4213-8d84-4de23934ce23 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "37" + - "45" + - "46" + - "40" + - "24" + - "49" + separatecontext: false + view: |- + { + "position": { + "x": 1770, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "3": + id: "3" + taskid: 1b4bbd64-b7ee-4c7d-8cdc-0ed013a62734 + type: regular + task: + id: 1b4bbd64-b7ee-4c7d-8cdc-0ed013a62734 + version: -1 + name: Check if attacker is internal or external + description: Uses an automated script to determine if the IP used in the incident + is in one of the ranges provided. + scriptName: IsIPInRanges + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "97" + scriptarguments: + ip: + complex: + root: AttackerIPs + transformers: + - operator: uniq + ipRanges: {} + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 950, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "24": + id: "24" + taskid: 7a7a6ec8-c9fa-415a-87bc-bc507762e35e + type: regular + task: + id: 7a7a6ec8-c9fa-415a-87bc-bc507762e35e + version: -1 + name: Save email addresses to notify + description: Saves the email addresses to notify about the compromised host + if any emails were configured in the playbook inputs. + scriptName: SetAndHandleEmpty + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "97" + scriptarguments: + append: {} + key: + simple: EmailAddressesToNotify + stringify: {} + value: + complex: + root: inputs.EmailAddressesToNotify + transformers: + - operator: splitAndTrim + args: + delimiter: + value: + simple: ',' + - operator: uniq + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 2620, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "32": + id: "32" + taskid: 9de655f8-11e9-4297-8a3d-90b5c7878c91 + type: condition + task: + id: 9de655f8-11e9-4297-8a3d-90b5c7878c91 + version: -1 + name: Has there been a successful login to the scanned host? + description: Manually check if there has been a successful login to the scanned + host following the port scan. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "98" + "yes": + - "34" + separatecontext: false + view: |- + { + "position": { + "x": 1760, + "y": 1835 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "34": + id: "34" + taskid: 65b36c78-8ae6-4b39-8db7-d7d0ad96039f + type: regular + task: + id: 65b36c78-8ae6-4b39-8db7-d7d0ad96039f + version: -1 + name: 'Set block ports to True ' + description: Checks if the specified value exists in context. If the value exists, + it will be set in context. + scriptName: SetAndHandleEmpty + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "96" + scriptarguments: + append: {} + key: + simple: PortScan.BlockPorts + stringify: {} + value: + simple: "True" + separatecontext: false + view: |- + { + "position": { + "x": 1490, + "y": 2010 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "37": + id: "37" + taskid: 64fbf8eb-55c3-4f8e-8b29-0fd97ddf5728 + type: regular + task: + id: 64fbf8eb-55c3-4f8e-8b29-0fd97ddf5728 + version: -1 + name: Save attacker IPs + description: Saves the IP address from which the port scan originated. + scriptName: SetAndHandleEmpty + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + append: {} + key: + simple: PortScan.AttackerIPs + stringify: {} + value: + complex: + root: PaloAltoNetworksXDR + filters: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + right: + value: + simple: inputs.xdr_alert_id + iscontext: true + accessor: Incident.alerts.host_ip + transformers: + - operator: uniq + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 950, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "40": + id: "40" + taskid: 67145acf-123a-44ac-83d5-6de9ad5967e0 + type: regular + task: + id: 67145acf-123a-44ac-83d5-6de9ad5967e0 + version: -1 + name: Save attacker username + description: Saves the username associated with the port scan. + scriptName: SetAndHandleEmpty + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "97" + scriptarguments: + append: {} + key: + simple: PortScan.AttackerUsername + stringify: {} + value: + complex: + root: PaloAltoNetworksXDR + filters: + - - operator: isExists + left: + value: + simple: user_name + iscontext: true + - - operator: isNotEqualString + left: + value: + simple: user_name + iscontext: true + right: + value: + simple: N/A + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + right: + value: + simple: inputs.xdr_alert_id + iscontext: true + accessor: Incident.alerts + transformers: + - operator: getField + args: + field: + value: + simple: user_name + reputationcalc: 1 + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 1770, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "45": + id: "45" + taskid: 90618b30-5615-45e8-84ca-91bb9e0fb297 + type: regular + task: + id: 90618b30-5615-45e8-84ca-91bb9e0fb297 + version: -1 + name: Save file artifacts + description: Saves file artifacts associated with the incident. + scriptName: SetAndHandleEmpty + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "97" + scriptarguments: + append: {} + key: + simple: PortScan.FileArtifacts + stringify: {} + value: + complex: + root: PaloAltoNetworksXDR + filters: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + right: + value: + simple: inputs.xdr_alert_id + iscontext: true + accessor: Incident.file_artifacts + transformers: + - operator: uniq + reputationcalc: 1 + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 2190, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "46": + id: "46" + taskid: a154ff28-c430-49ac-85ef-049af8fb1adc + type: regular + task: + id: a154ff28-c430-49ac-85ef-049af8fb1adc + version: -1 + name: Save attacker hostname + description: Saves the hostname that performed the port scan. + scriptName: SetAndHandleEmpty + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "97" + scriptarguments: + append: {} + key: + simple: PortScan.AttackerHostnames + stringify: {} + value: + complex: + root: PaloAltoNetworksXDR + filters: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + right: + value: + simple: inputs.xdr_alert_id + iscontext: true + accessor: Incident.alerts.host_name + transformers: + - operator: uniq + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 1350, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "48": + id: "48" + taskid: b86c3a71-3196-46ba-82d2-4394de10f48d + type: condition + task: + id: b86c3a71-3196-46ba-82d2-4394de10f48d + version: -1 + name: Was there a case of lateral movement following the scan? + description: Checks whether there was a lateral movement alert that came after + the port scan alert. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "88" + "yes": + - "86" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: PortScan.LateralMovementFirstDatetime + iscontext: true + - - operator: isBefore + left: + value: + simple: PortScan.PortScanFirstDatetime + iscontext: true + right: + value: + simple: LateralMovementFirstDatetime + iscontext: true + view: |- + { + "position": { + "x": 1760, + "y": 1030 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "49": + id: "49" + taskid: 50d1df58-29c9-4257-8ddf-01971eae17e9 + type: regular + task: + id: 50d1df58-29c9-4257-8ddf-01971eae17e9 + version: -1 + name: Save incident alerts + description: Saves the alerts associated with this incident in a new context + key. + scriptName: SetAndHandleEmpty + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "50" + - "51" + scriptarguments: + append: {} + key: + simple: IncidentAlerts + stringify: {} + value: + complex: + root: PaloAltoNetworksXDR + filters: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + right: + value: + simple: inputs.xdr_alert_id + iscontext: true + accessor: Incident.alerts + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 3105, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "50": + id: "50" + taskid: 81d8b30b-307b-4ea0-8426-0d4f01c5becc + type: regular + task: + id: 81d8b30b-307b-4ea0-8426-0d4f01c5becc + version: -1 + name: Save port scan date time + description: Saves the date and time of the first port scan alert. + scriptName: SetAndHandleEmpty + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "97" + scriptarguments: + append: + simple: "false" + key: + simple: PortScan.PortScanFirstDatetime + stringify: {} + value: + complex: + root: IncidentAlerts + filters: + - - operator: containsGeneral + left: + value: + simple: IncidentAlerts.name + iscontext: true + right: + value: + simple: Port Scan + ignorecase: true + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + right: + value: + simple: inputs.xdr_alert_id + iscontext: true + accessor: detection_timestamp + transformers: + - operator: sort + args: + descending: {} + - operator: atIndex + args: + index: + value: + simple: "0" + - operator: TimeStampToDate + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 2860, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "51": + id: "51" + taskid: 72154049-3cbe-4d93-8b24-676bd59cc38b + type: regular + task: + id: 72154049-3cbe-4d93-8b24-676bd59cc38b + version: -1 + name: Save lateral movement date time + description: Saves the date and time of the first lateral movement alert, when + it exists. + scriptName: SetAndHandleEmpty + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "97" + scriptarguments: + append: + simple: "false" + key: + simple: PortScan.LateralMovementFirstDatetime + stringify: {} + value: + complex: + root: IncidentAlerts + filters: + - - operator: containsGeneral + left: + value: + simple: IncidentAlerts.category + iscontext: true + right: + value: + simple: Lateral Movement + ignorecase: true + accessor: detection_timestamp + transformers: + - operator: sort + args: + descending: {} + - operator: atIndex + args: + index: + value: + simple: "0" + - operator: TimeStampToDate + reputationcalc: 1 + separatecontext: false + view: |- + { + "position": { + "x": 3320, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "63": + id: "63" + taskid: 6d49f70a-f26a-4fa6-80e9-70a448ad330a + type: regular + task: + id: 6d49f70a-f26a-4fa6-80e9-70a448ad330a + version: -1 + name: Escalate incident to higher tier + description: Assigns the incident to a random user who has the role configured + in the RoleForEscalation playbook input. + scriptName: AssignAnalystToIncident + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "88" + scriptarguments: + assignBy: + simple: random + email: {} + onCall: + complex: + root: inputs.OnCall + roles: + complex: + root: inputs.RoleForEscalation + username: {} + separatecontext: false + view: |- + { + "position": { + "x": 2440, + "y": 1520 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "64": + id: "64" + taskid: 1ab03196-0d35-431c-83f5-1b5d8b3b6e73 + type: condition + task: + id: 1ab03196-0d35-431c-83f5-1b5d8b3b6e73 + version: -1 + name: Can the incident be auto-escalated to a higher tier? + description: Checks whether a role from which analysts can be assigned to the + incident was configured in the RoleForEscalation playbook input. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "88" + "yes": + - "63" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + complex: + root: inputs.RoleForEscalation + iscontext: true + view: |- + { + "position": { + "x": 2220, + "y": 1350 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "75": + id: "75" + taskid: 4830e0a6-14de-40fb-8b7a-331a28311f0b + type: condition + task: + id: 4830e0a6-14de-40fb-8b7a-331a28311f0b + version: -1 + name: Can a host compromise notification be sent via email? + description: Checks whether any email addresses to notify were configured, and + whether any mail sender integrations are enabled. + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "48" + "yes": + - "76" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + complex: + root: inputs.EmailAddressesToNotify + iscontext: true + - - operator: isExists + left: + value: + complex: + root: modules + filters: + - - operator: isEqualString + left: + value: + simple: brand + iscontext: true + right: + value: + simple: EWS v2 + - operator: isEqualString + left: + value: + simple: brand + iscontext: true + right: + value: + simple: Gmail + - operator: isEqualString + left: + value: + simple: brand + iscontext: true + right: + value: + simple: Gmail Single User + - - operator: isEqualString + left: + value: + simple: state + iscontext: true + right: + value: + simple: active + iscontext: true + view: |- + { + "position": { + "x": 1502.5, + "y": 690 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "76": + id: "76" + taskid: b9dc1315-c732-4365-8561-999d8662de3d + type: regular + task: + id: b9dc1315-c732-4365-8561-999d8662de3d + version: -1 + name: Send notification emails about compromise + description: Sends an email to the email addresses configured in the playbook + inputs telling them that a host was compromised. + script: '|||send-mail' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "48" + scriptarguments: + additionalHeader: {} + attachCIDs: {} + attachIDs: {} + attachNames: {} + bcc: {} + body: {} + cc: {} + from: {} + htmlBody: {} + replyTo: {} + subject: + simple: Port scan & potential compromise + templateParams: {} + to: + complex: + root: inputs.EmailAddressesToNotify + transformers: + - operator: splitAndTrim + args: + delimiter: + value: + simple: ',' + - operator: uniq + transientFile: {} + transientFileCID: {} + transientFileContent: {} + separatecontext: false + view: |- + { + "position": { + "x": 1280, + "y": 860 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "86": + id: "86" + taskid: f0f2d1d0-d4c1-4089-8ed9-31e88ea93610 + type: title + task: + id: f0f2d1d0-d4c1-4089-8ed9-31e88ea93610 + version: -1 + name: Exploitation + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "64" + separatecontext: false + view: |- + { + "position": { + "x": 2220, + "y": 1200 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "88": + id: "88" + taskid: a6627a56-c465-4d96-8e3e-4f1ed0ed6bbb + type: title + task: + id: a6627a56-c465-4d96-8e3e-4f1ed0ed6bbb + version: -1 + name: Port Blocking + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "32" + separatecontext: false + view: |- + { + "position": { + "x": 1760, + "y": 1690 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "91": + id: "91" + taskid: e7bd791b-e0f7-4bb4-8a08-9b5112da9293 + type: playbook + task: + id: e7bd791b-e0f7-4bb4-8a08-9b5112da9293 + version: -1 + name: IP Enrichment - Internal - Generic v2 + description: |- + Enrich Internal IP addresses using one or more integrations. + + - Resolve IP address to hostname (DNS) + - Separate internal and external IP addresses + - Get host information for IP addresses + playbookName: IP Enrichment - Internal - Generic v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "48" + scriptarguments: + IP: + complex: + root: PortScan + accessor: AttackerIPs + transformers: + - operator: uniq + InternalRange: + complex: + root: inputs.InternalIPRanges + ResolveIP: + simple: "True" + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 0 + view: |- + { + "position": { + "x": 2047.5, + "y": 690 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "96": + id: "96" + taskid: 0dfd512e-ddfc-40ab-879c-301b55822d1a + type: title + task: + id: 0dfd512e-ddfc-40ab-879c-301b55822d1a + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 1760, + "y": 2180 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "97": + id: "97" + taskid: 65a62ec6-98d0-4d9f-870b-618561453d17 + type: title + task: + id: 65a62ec6-98d0-4d9f-870b-618561453d17 + version: -1 + name: Enrichment + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "91" + - "75" + separatecontext: false + view: |- + { + "position": { + "x": 1770, + "y": 545 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "98": + id: "98" + taskid: b50a8913-48c0-4157-84af-215f0bf57211 + type: regular + task: + id: b50a8913-48c0-4157-84af-215f0bf57211 + version: -1 + name: 'Set block ports to False ' + description: Checks if the specified value exists in context. If the value exists, + it will be set in context. + scriptName: SetAndHandleEmpty + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "96" + scriptarguments: + append: {} + key: + simple: BlockPorts + stringify: {} + value: + simple: "False" + separatecontext: false + view: |- + { + "position": { + "x": 2032.5, + "y": 2010 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +view: |- + { + "linkLabelsPosition": { + "32_34_yes": 0.51, + "32_98_#default#": 0.47, + "48_86_yes": 0.56, + "48_88_#default#": 0.44, + "64_63_yes": 0.44, + "64_88_#default#": 0.23, + "75_48_#default#": 0.52, + "75_76_yes": 0.59 + }, + "paper": { + "dimensions": { + "height": 2195, + "width": 2750, + "x": 950, + "y": 50 + } + } + } +inputs: +- key: WhitelistedPorts + value: {} + required: false + description: A list of comma-separated ports that should not be blocked even if + used in an attack. + playbookInputQuery: +- key: BlockAttackerIP + value: + simple: "False" + required: false + description: Determines whether attacking IPs should be automatically blocked using firewalls. + playbookInputQuery: +- key: EmailAddressesToNotify + value: {} + required: false + description: A list of comma-separated values of email addresses that should receive + a notification about compromised hosts. + playbookInputQuery: +- key: InternalIPRanges + value: {} + required: false + description: 'A list of IP ranges to check the IP against. The list should be provided + in CIDR notation, separated by commas. An example of a list of ranges would be: + "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes). If a list is not provided, + will use default list provided in the IsIPInRanges script (the known IPv4 private + address ranges).' + playbookInputQuery: +- key: RoleForEscalation + value: {} + required: false + description: The name of the Cortex XSOAR role of the users that the incident can be + escalated to in case of developments like lateral movement. If this input is left empty, no escalation will take place. + playbookInputQuery: +- key: OnCall + value: + simple: "false" + required: false + description: Set to true to assign only the users that are currently on shift. + playbookInputQuery: +- key: xdr_alert_id + value: {} + required: false + description: Unique ID for the XDR alert. + playbookInputQuery: +outputs: +- contextPath: PortScan.BlockPorts + description: Indicates whether there's a need to block the ports used for exploitation + on the scanned host. + type: unknown +- contextPath: PortScan.AttackerIPs + description: Attacker IPs from the port scan alert. + type: unknown +- contextPath: PortScan.AttackerHostnames + description: Attacker hostnames from the port scan alert. + type: unknown +- contextPath: PortScan.AttackerUsername + description: Attacker username from the port scan alert. + type: unknown +- contextPath: PortScan.FileArtifacts + description: File artifacts from the port scan alert. + type: unknown +- contextPath: PortScan.LateralMovementFirstDatetime + description: Lateral Movement First Date time from the port scan alert. + type: unknown +- contextPath: PortScan.PortScanFirstDatetime + description: Port Scan First Date time + type: unknown +tests: +- No test. +fromversion: 5.0.0 diff --git a/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Port_Scan_-_Adjusted_README.md b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Port_Scan_-_Adjusted_README.md new file mode 100644 index 00000000000..ff4ac0bb3b7 --- /dev/null +++ b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_Port_Scan_-_Adjusted_README.md @@ -0,0 +1,53 @@ +Investigates a Cortex XDR incident containing internal port scan alerts. The playbook: +- Syncs data with Cortex XDR. +- Notifies management about a compromised host. +- Escalates the incident in case of lateral movement alert detection. + +The playbook is used as a sub- playbook in 'Cortex XDR Incident Handling - v2' + +## Dependencies +This playbook uses the following sub-playbooks, integrations, and scripts. + +### Sub-playbooks +* IP Enrichment - Internal - Generic v2 + +### Integrations +This playbook does not use any integrations. + +### Scripts +* IsIPInRanges +* SetAndHandleEmpty +* AssignAnalystToIncident + +### Commands +* send-mail + +## Playbook Inputs +--- + +| **Name** | **Description** | **Default Value** | **Required** | +| --- | --- | --- | --- | +| WhitelistedPorts | A list of comma\-separated ports that should not be blocked even if used in an attack. | | Optional | +| BlockAttackerIP | Determines whether attacking IPs should be automatically blocked using firewalls. | False | Optional | +| EmailAddressesToNotify | A list of comma\-separated values of email addresses that should receive a notification about compromised hosts. | | Optional | +| InternalIPRanges | A list of IP ranges to check the IP against. The list should be provided in CIDR notation, separated by commas. An example of a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" \(without quotes\). If a list is not provided, will use default list provided in the IsIPInRanges script \(the known IPv4 private address ranges\). | | Optional | +| RoleForEscalation | The name of the Cortex XSOAR role of the users that the incident can be escalated to in case of developments like lateral movement. If this input is left empty, no escalation will take place. | | Optional | +| OnCall | Set to true to assign only the users that are currently on shift. | false | Optional | +| xdr_alert_id | Unique ID for the XDR alert. | | Optional | + +## Playbook Outputs +--- + +| **Path** | **Description** | **Type** | +| --- | --- | --- | +| PortScan.BlockPorts | Indicates whether there's a need to block the ports used for exploitation on the scanned host. | unknown | +| PortScan.AttackerIPs | Attacker IPs from the port scan alert. | unknown | +| PortScan.AttackerHostnames | Attacker hostnames from the port scan alert. | unknown | +| PortScan.AttackerUsername | Attacker username from the port scan alert. | unknown | +| PortScan.FileArtifacts | File artifacts from the port scan alert. | unknown | +| PortScan.LateralMovementFirstDatetime | Lateral Movement First Date time from the port scan alert. | unknown | +| PortScan.PortScanFirstDatetime | Port Scan First Date time | unknown | + +## Playbook Image +--- +![Cortex XDR - Port Scan - Adjusted](https://github.com/demisto/content/raw/3fadebe9e16eb7c9fc28ce3bb600319ec875e3b5/Packs/CortexXDR/doc_files/Cortex_XDR_-_Port_Scan_-_Adjusted.png) \ No newline at end of file diff --git a/Packs/CortexXDR/Playbooks/Cortex_XDR_-_quarantine_file.yml b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_quarantine_file.yml new file mode 100644 index 00000000000..672f850afde --- /dev/null +++ b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_quarantine_file.yml @@ -0,0 +1,223 @@ +id: Cortex XDR - quarantine file +version: -1 +name: Cortex XDR - quarantine file +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 698ce1e6-4540-40bb-8ec4-5dc2decebd93 + type: start + task: + id: 698ce1e6-4540-40bb-8ec4-5dc2decebd93 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "2" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "1": + id: "1" + taskid: 2b930111-1438-4488-8a2c-7f0fac67a84e + type: playbook + task: + id: 2b930111-1438-4488-8a2c-7f0fac67a84e + version: -1 + name: GenericPolling + description: |- + Use this playbook as a sub-playbook to block execution of the master playbook until a remote action is complete. + This playbook implements polling by continuously running the command in Step \#2 until the operation completes. + The remote action should have the following structure: + + 1. Initiate the operation. + 2. Poll to check if the operation completed. + 3. (optional) Get the results of the operation. + playbookName: GenericPolling + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + AdditionalPollingCommandArgNames: + simple: file_hash,file_path,endpoint_id + AdditionalPollingCommandArgValues: + simple: ${inputs.file_hash},${inputs.file_path},${inputs.endpoint_id} + Ids: + simple: Cortex_XDR_-_quarantine_file + Interval: + simple: "1" + PollingCommandArgName: + simple: actionId + PollingCommandName: + simple: xdr-get-quarantine-status + Timeout: + simple: "10" + dt: + simple: PaloAltoNetworksXDR.quarantineFiles.status(val.fileHash === '${inputs.file_hash}' + && val.endpointId === '${inputs.endpoint_id}' && val.filePath === '${inputs.file_path}' + && val.status === false) + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 50, + "y": 545 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "2": + id: "2" + taskid: b8e66e18-fc70-48ce-8cb4-859bd1ce7de6 + type: regular + task: + id: b8e66e18-fc70-48ce-8cb4-859bd1ce7de6 + version: -1 + name: Quarantine file + description: Quarantine a file on selected endpoints. You can select up to 1000 + endpoints. + script: '|||xdr-quarantine-files' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "5" + scriptarguments: + endpoint_id_list: + simple: ${inputs.endpoint_id} + file_hash: + simple: ${inputs.file_hash} + file_path: + simple: ${inputs.file_path} + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "3": + id: "3" + taskid: 454d0ef9-46e7-478c-809c-0b0931dce7ce + type: title + task: + id: 454d0ef9-46e7-478c-809c-0b0931dce7ce + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 720 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "5": + id: "5" + taskid: 932eceea-f7db-4839-845b-bba37414536d + type: regular + task: + id: 932eceea-f7db-4839-845b-bba37414536d + version: -1 + name: Get quarantine status + description: Retrieve the quarantine status for a selected file. + script: '|||xdr-get-quarantine-status' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "1" + scriptarguments: + endpoint_id: + simple: ${inputs.endpoint_id} + file_hash: + simple: ${inputs.file_hash} + file_path: + simple: ${inputs.file_path} + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 735, + "width": 380, + "x": 50, + "y": 50 + } + } + } +inputs: +- key: file_hash + value: {} + required: true + description: The file’s hash. Must be a valid SHA256 hash. + playbookInputQuery: +- key: file_path + value: {} + required: true + description: The path for the selected file. + playbookInputQuery: +- key: endpoint_id + value: {} + required: true + description: The file's location in the system. + playbookInputQuery: +outputs: [] +fromversion: 5.0.0 +description: '' +tests: + - Test XDR Playbook diff --git a/Packs/CortexXDR/Playbooks/Cortex_XDR_-_quarantine_file_README.md b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_quarantine_file_README.md new file mode 100644 index 00000000000..8993369074a --- /dev/null +++ b/Packs/CortexXDR/Playbooks/Cortex_XDR_-_quarantine_file_README.md @@ -0,0 +1,30 @@ +This playbook accepts file path, file hash and endpoint id in order to quarantine a selected file and wait until the action is done. + +## Dependencies +This playbook uses the following sub-playbooks, integrations, and scripts. + +### Sub-playbooks +* GenericPolling + +### Integrations +This playbook does not use any integrations. + +### Scripts +This playbook does not use any scripts. + +### Commands +* xdr-quarantine-file +* xdr-get-quarantine-status + +## Playbook Inputs +--- + +| **Name** | **Description** | **Default Value** | **Source** | **Required** | +| --- | --- | --- | --- | --- | +| endpoint_id | The endpoint ID \(string\) to search the selected file. You can retrieve the ID using the xdr\-get\-endpoints command. | | PaloAltoNetworksXDR | Mandatory | +| file_hash | Hash must be a valid SHA256. | | Endpoint | Mandatory | +| file_path | the path of the file you want to quarantine. | |Endpoint | Mandatory | + +## Playbook Outputs +--- +Quarantine status. true if the action was successful and false otherwise. \ No newline at end of file diff --git a/Packs/CortexXDR/Playbooks/Cortex_XDR_Alerts_Handling.yml b/Packs/CortexXDR/Playbooks/Cortex_XDR_Alerts_Handling.yml new file mode 100644 index 00000000000..dc4dd5e387e --- /dev/null +++ b/Packs/CortexXDR/Playbooks/Cortex_XDR_Alerts_Handling.yml @@ -0,0 +1,480 @@ +id: Cortex XDR Alerts Handling +version: -1 +name: Cortex XDR Alerts Handling +description: "This playbook is used to loop over every alert in a Cortex XDR incident.\ + \ \nSupported alert categories:\n- Malware\n- Port Scan" +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 9c36d95d-b324-4c82-8a03-1994ede59fdf + type: start + task: + id: 9c36d95d-b324-4c82-8a03-1994ede59fdf + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "6" + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "1": + id: "1" + taskid: 0f3a6f6f-7078-49ee-8ddd-42591880d7d0 + type: condition + task: + id: 0f3a6f6f-7078-49ee-8ddd-42591880d7d0 + version: -1 + name: Choose playbook by category + description: "Choose playbook to run by alert category." + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "7" + Malware: + - "2" + Port Scan: + - "8" + separatecontext: false + conditions: + - label: Malware + condition: + - - operator: isEqualString + left: + value: + complex: + root: PaloAltoNetworksXDR + filters: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + right: + value: + simple: inputs.alert_id + iscontext: true + accessor: Incident.alerts.category + iscontext: true + right: + value: + simple: Malware + - label: Port Scan + condition: + - - operator: isEqualString + left: + value: + complex: + root: PaloAltoNetworksXDR + filters: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + right: + value: + simple: inputs.alert_id + iscontext: true + accessor: Incident.alerts.category + iscontext: true + right: + value: + simple: Port Scan + view: |- + { + "position": { + "x": 480, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "2": + id: "2" + taskid: 2dabd406-b818-4523-82c8-b31a6808d5fd + type: playbook + task: + id: 2dabd406-b818-4523-82c8-b31a6808d5fd + version: -1 + name: Cortex XDR - Malware Investigation + description: "This playbook is triggered by a Palo Alto Networks Cortex threat\ + \ alert, generated by Traps. The playbook performs host enrichment for the\ + \ source host with Palo Alto Networks Traps, enriches information for the\ + \ suspicious file with Palo Alto Networks Minemeld and AutoFocus, and automatically\ + \ performs file detonation for the extracted file. It then performs IOC enrichment\ + \ with Minemeld for all related IOCs, and calculates the incident severity\ + \ based on all the findings. In addition, it detonates the file for the full\ + \ analysis report. \nThe analyst can perform a manual memory dump for the\ + \ suspected endpoint based on the incident’s severity, and choose to isolate\ + \ the source endpoint with Traps.\nHunting tasks to find more endpoints that\ + \ are infected are performed automatically based on a playbook input, and after\ + \ all infected endpoints are found, remediation for all malicious IOCs is\ + \ performed, including file quarantine, and IP and URLs blocking with Palo\ + \ Alto Networks FireWall components such as Dynamic Address Groups and Custom\ + \ URL Categories.\nAfter the investigation review, the incident is automatically\ + \ closed." + playbookName: Cortex XDR - Malware Investigation + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "5" + scriptarguments: + file_name: + complex: + root: PaloAltoNetworksXDR + filters: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + right: + value: + simple: inputs.alert_id + iscontext: true + accessor: Incident.file_artifacts.file_name + file_sha256: + complex: + root: PaloAltoNetworksXDR + filters: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + right: + value: + simple: inputs.alert_id + iscontext: true + accessor: Incident.file_artifacts.file_sha256 + host_ip: + complex: + root: PaloAltoNetworksXDR + filters: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + right: + value: + simple: inputs.alert_id + iscontext: true + accessor: Incident.alerts.host_ip + xdr_alert_id: + complex: + root: inputs.alert_id + separatecontext: false + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 50, + "y": 545 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "5": + id: "5" + taskid: 3ee49877-ed34-469e-8f5b-73536d3d40bd + type: title + task: + id: 3ee49877-ed34-469e-8f5b-73536d3d40bd + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 720 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "6": + id: "6" + taskid: 12258730-025a-4931-8da9-9f68bfb6a32c + type: regular + task: + id: 12258730-025a-4931-8da9-9f68bfb6a32c + version: -1 + name: Cortex XDR - get incident extra data + description: Returns additional data for the specified incident, for example, + related alerts, file artifacts, network artifacts, and so on. + script: Cortex XDR - IR|||xdr-get-incident-extra-data + type: regular + iscommand: true + brand: Cortex XDR - IR + nexttasks: + '#none#': + - "1" + scriptarguments: + alerts_limit: {} + incident_id: + complex: + root: inputs.incident_id + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "7": + id: "7" + taskid: 73393504-1664-4f81-8baf-f5e29f222cea + type: title + task: + id: 73393504-1664-4f81-8baf-f5e29f222cea + version: -1 + name: Other alert category + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "5" + separatecontext: false + view: |- + { + "position": { + "x": 920, + "y": 545 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "8": + id: "8" + taskid: dbf4c20e-2308-41d5-88df-477133c8e571 + type: playbook + task: + id: dbf4c20e-2308-41d5-88df-477133c8e571 + version: -1 + name: Cortex XDR - Port Scan - Adjusted + playbookName: Cortex XDR - Port Scan - Adjusted + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "5" + scriptarguments: + BlockAttackerIP: + simple: "False" + EmailAddressesToNotify: {} + InternalIPRanges: {} + OnCall: + simple: "false" + RoleForEscalation: {} + WhitelistedPorts: {} + xdr_alert_id: + complex: + root: inputs.alert_id + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 480, + "y": 545 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 735, + "width": 1250, + "x": 50, + "y": 50 + } + } + } +inputs: +- key: incident_id + value: + complex: + root: PaloAltoNetworksXDR + accessor: Incident.incident_id + required: false + description: Incident ID. + playbookInputQuery: +- key: alert_id + value: + complex: + root: PaloAltoNetworksXDR + accessor: Incident.alerts.alert_id + required: false + description: Alert ID. + playbookInputQuery: +outputs: +- contextPath: PaloAltoNetworksXDR.Incident.incident_id + description: Unique ID assigned to each returned incident. +- contextPath: PaloAltoNetworksXDR.Incident.description + description: Dynamic calculated description of the incident. +- contextPath: PaloAltoNetworksXDR.Incident.alerts.alert_id + description: Unique ID for each alert. +- contextPath: PaloAltoNetworksXDR.Incident.alerts.severity + description: Severity of the alert.,"low","medium","high""" +- contextPath: PaloAltoNetworksXDR.Incident.alerts.name + description: Calculated name of the alert. +- contextPath: PaloAltoNetworksXDR.Incident.alerts.category + description: Category of the alert, for example, Spyware Detected via Anti-Spyware + profile. +- contextPath: PaloAltoNetworksXDR.Incident.alerts.host_ip + description: Host IP involved in the alert. +- contextPath: PaloAltoNetworksXDR.Incident.alerts.host_name + description: Host name involved in the alert. +- contextPath: PaloAltoNetworksXDR.Incident.alerts.user_name + description: User name involved with the alert. +- contextPath: PaloAltoNetworksXDR.Incident.alerts.event_type + description: Event type "Process Execution","Network Event","File Event","Registry + Event","Injection Event","Load Image Event","Windows Event Log" +- contextPath: PaloAltoNetworksXDR.Incident.alerts.action + description: The action that triggered the alert. "REPORTED", "BLOCKED", "POST_DETECTED", + "SCANNED", "DOWNLOAD", "PROMPT_ALLOW", "PROMPT_BLOCK", "DETECTED", "BLOCKED_1", + "BLOCKED_2", "BLOCKED_3", "BLOCKED_5", "BLOCKED_6", "BLOCKED_7", "BLOCKED_8", + "BLOCKED_9", "BLOCKED_10", "BLOCKED_11", "BLOCKED_13", "BLOCKED_14", "BLOCKED_15", + "BLOCKED_16", "BLOCKED_17", "BLOCKED_24", "BLOCKED_25", "DETECTED_0", "DETECTED_4", + "DETECTED_18", "DETECTED_19", "DETECTED_20", "DETECTED_21", "DETECTED_22", "DETECTED_23" +- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_pretty + description: The action that triggered the alert "Detected (Reported)" "Prevented + (Blocked)" "Detected (Post Detected)" "Detected (Scanned)" "Detected (Download)" + "Detected (Prompt Allow)" "Prevented (Prompt Block)" "Detected" "Prevented (Denied + The Session)" "Prevented (Dropped The Session)" "Prevented (Dropped The Session + And Sent a TCP Reset)" "Prevented (Blocked The URL)" "Prevented (Blocked The IP)" + "Prevented (Dropped The Packet)" "Prevented (Dropped All Packets)" "Prevented + (Terminated The Session And Sent a TCP Reset To Both Sides Of The Connection)" + "Prevented (Terminated The Session And Sent a TCP Reset To The Client)" "Prevented + (Terminated The Session And Sent a TCP Reset To The Server)" "Prevented (Continue)" + "Prevented (Block-Override)" "Prevented (Override-Lockout)" "Prevented (Override)" + "Prevented (Random-Drop)" "Prevented (Silently Dropped The Session With An ICMP + Unreachable Message To The Host Or Application)" "Prevented (Block)" "Detected + (Allowed The Session)" "Detected (Raised An Alert)" "Detected (Syncookie Sent)" + "Detected (Forward)" "Detected (Wildfire Upload Success)" "Detected (Wildfire + Upload Failure)" "Detected (Wildfire Upload Skip)" "Detected (Sinkhole)" +- contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name + description: Image name +- contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line + description: Command line +- contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_status + description: Signature status "Signed" "Invalid Signature" "Unsigned" "Revoked" + "Signature Fail" "N/A" "Weak Hash" +- contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendor + description: Singature vendor name +- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_sha256 + description: Image SHA256 +- contextPath: PaloAltoNetworksXDR.Incident.alerts.is_whitelisted + description: Is whitelisted "Yes" "No" +- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type + description: Network artifact type "IP" +- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_domain + description: The domain related to the artifact. +- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_country + description: The country related to the artifact +- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip + description: The remote IP related to the artifact. +- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_status + description: Digital signature status of the file. "SIGNATURE_UNAVAILABLE" "SIGNATURE_SIGNED" + "SIGNATURE_INVALID" "SIGNATURE_UNSIGNED" "SIGNATURE_WEAK_HASH" +- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_process + description: Whether the file artifact is related to a process execution. +- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_name + description: Name of the file. +- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict + description: The file verdict, calculated by Wildfire. "BENIGN" "MALWARE" "GRAYWARE" + "PHISING" "UNKNOWN" +- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_malicious + description: Whether the artifact is malicious, decided by the Wildfire verdic +- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.type + description: The artifact type "META" "GID" "CID" "HASH" "IP" "DOMAIN" "REGISTRY" + "HOSTNAME" +- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256 + description: SHA-256 hash of the file +- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_vendor_name + description: File signature vendor name +- contextPath: PortScan.BlockPorts + description: Indicates whether there's a need to block the ports used for exploitation + on the scanned host. + type: unknown +- contextPath: PortScan.AttackerIPs + description: Attacker IPs from the port scan alert. + type: unknown +- contextPath: PortScan.AttackerHostnames + description: Attacker hostnames from the port scan alert. + type: unknown +- contextPath: PortScan.AttackerUsername + description: Attacker username from the port scan alert. + type: unknown +- contextPath: PortScan.FileArtifacts + description: File artifacts from the port scan alert. + type: unknown +- contextPath: PortScan.LateralMovementFirstDatetime + description: Lateral Movement First Date time from the port scan alert. + type: unknown +- contextPath: PortScan.PortScanFirstDatetime + description: Port Scan First Date time + type: unknown +tests: +- No test. +fromversion: 5.0.0 diff --git a/Packs/CortexXDR/Playbooks/Cortex_XDR_Alerts_Handling_README.md b/Packs/CortexXDR/Playbooks/Cortex_XDR_Alerts_Handling_README.md new file mode 100644 index 00000000000..ad561e92b25 --- /dev/null +++ b/Packs/CortexXDR/Playbooks/Cortex_XDR_Alerts_Handling_README.md @@ -0,0 +1,75 @@ +This playbook is used to loop over every alert in a Cortex XDR incident. +Supported alert categories: +- Malware +- Port Scan + +## Dependencies +This playbook uses the following sub-playbooks, integrations, and scripts. + +### Sub-playbooks +* Cortex XDR - Malware Investigation +* Cortex XDR - Port Scan - Adjusted + +### Integrations +* Cortex XDR - IR + +### Scripts +This playbook does not use any scripts. + +### Commands +* xdr-get-incident-extra-data + +## Playbook Inputs +--- + +| **Name** | **Description** | **Default Value** | **Required** | +| --- | --- | --- | --- | +| incident_id | Incident ID. | PaloAltoNetworksXDR.Incident.incident_id | Optional | +| alert_id | Alert ID. | PaloAltoNetworksXDR.Incident.alerts.alert_id | Optional | + +## Playbook Outputs +--- + +| **Path** | **Description** | **Type** | +| --- | --- | --- | +| PaloAltoNetworksXDR.Incident.incident_id | Unique ID assigned to each returned incident. | unknown | +| PaloAltoNetworksXDR.Incident.description | Dynamic calculated description of the incident. | unknown | +| PaloAltoNetworksXDR.Incident.alerts.alert_id | Unique ID for each alert. | unknown | +| PaloAltoNetworksXDR.Incident.alerts.severity | Severity of the alert.,"low","medium","high""" | unknown | +| PaloAltoNetworksXDR.Incident.alerts.name | Calculated name of the alert. | unknown | +| PaloAltoNetworksXDR.Incident.alerts.category | Category of the alert, for example, Spyware Detected via Anti\-Spyware profile. | unknown | +| PaloAltoNetworksXDR.Incident.alerts.host_ip | Host IP involved in the alert. | unknown | +| PaloAltoNetworksXDR.Incident.alerts.host_name | Host name involved in the alert. | unknown | +| PaloAltoNetworksXDR.Incident.alerts.user_name | User name involved with the alert. | unknown | +| PaloAltoNetworksXDR.Incident.alerts.event_type | Event type "Process Execution","Network Event","File Event","Registry Event","Injection Event","Load Image Event","Windows Event Log" | unknown | +| PaloAltoNetworksXDR.Incident.alerts.action | The action that triggered the alert. "REPORTED", "BLOCKED", "POST\_DETECTED", "SCANNED", "DOWNLOAD", "PROMPT\_ALLOW", "PROMPT\_BLOCK", "DETECTED", "BLOCKED\_1", "BLOCKED\_2", "BLOCKED\_3", "BLOCKED\_5", "BLOCKED\_6", "BLOCKED\_7", "BLOCKED\_8", "BLOCKED\_9", "BLOCKED\_10", "BLOCKED\_11", "BLOCKED\_13", "BLOCKED\_14", "BLOCKED\_15", "BLOCKED\_16", "BLOCKED\_17", "BLOCKED\_24", "BLOCKED\_25", "DETECTED\_0", "DETECTED\_4", "DETECTED\_18", "DETECTED\_19", "DETECTED\_20", "DETECTED\_21", "DETECTED\_22", "DETECTED\_23" | unknown | +| PaloAltoNetworksXDR.Incident.alerts.action_pretty | The action that triggered the alert "Detected \(Reported\)" "Prevented \(Blocked\)" "Detected \(Post Detected\)" "Detected \(Scanned\)" "Detected \(Download\)" "Detected \(Prompt Allow\)" "Prevented \(Prompt Block\)" "Detected" "Prevented \(Denied The Session\)" "Prevented \(Dropped The Session\)" "Prevented \(Dropped The Session And Sent a TCP Reset\)" "Prevented \(Blocked The URL\)" "Prevented \(Blocked The IP\)" "Prevented \(Dropped The Packet\)" "Prevented \(Dropped All Packets\)" "Prevented \(Terminated The Session And Sent a TCP Reset To Both Sides Of The Connection\)" "Prevented \(Terminated The Session And Sent a TCP Reset To The Client\)" "Prevented \(Terminated The Session And Sent a TCP Reset To The Server\)" "Prevented \(Continue\)" "Prevented \(Block\-Override\)" "Prevented \(Override\-Lockout\)" "Prevented \(Override\)" "Prevented \(Random\-Drop\)" "Prevented \(Silently Dropped The Session With An ICMP Unreachable Message To The Host Or Application\)" "Prevented \(Block\)" "Detected \(Allowed The Session\)" "Detected \(Raised An Alert\)" "Detected \(Syncookie Sent\)" "Detected \(Forward\)" "Detected \(Wildfire Upload Success\)" "Detected \(Wildfire Upload Failure\)" "Detected \(Wildfire Upload Skip\)" "Detected \(Sinkhole\)" | unknown | +| PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name | Image name | unknown | +| PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line | Command line | unknown | +| PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_status | Signature status "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash" | unknown | +| PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendor | Singature vendor name | unknown | +| PaloAltoNetworksXDR.Incident.alerts.action_process_image_sha256 | Image SHA256 | unknown | +| PaloAltoNetworksXDR.Incident.alerts.is_whitelisted | Is whitelisted "Yes" "No" | unknown | +| PaloAltoNetworksXDR.Incident.network_artifacts.type | Network artifact type "IP" | unknown | +| PaloAltoNetworksXDR.Incident.network_artifacts.network_domain | The domain related to the artifact. | unknown | +| PaloAltoNetworksXDR.Incident.network_artifacts.network_country | The country related to the artifact | unknown | +| PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip | The remote IP related to the artifact. | unknown | +| PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_status | Digital signature status of the file. "SIGNATURE\_UNAVAILABLE" "SIGNATURE\_SIGNED" "SIGNATURE\_INVALID" "SIGNATURE\_UNSIGNED" "SIGNATURE\_WEAK\_HASH" | unknown | +| PaloAltoNetworksXDR.Incident.file_artifacts.is_process | Whether the file artifact is related to a process execution. | unknown | +| PaloAltoNetworksXDR.Incident.file_artifacts.file_name | Name of the file. | unknown | +| PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict | The file verdict, calculated by Wildfire. "BENIGN" "MALWARE" "GRAYWARE" "PHISING" "UNKNOWN" | unknown | +| PaloAltoNetworksXDR.Incident.file_artifacts.is_malicious | Whether the artifact is malicious, decided by the Wildfire verdic | unknown | +| PaloAltoNetworksXDR.Incident.file_artifacts.type | The artifact type "META" "GID" "CID" "HASH" "IP" "DOMAIN" "REGISTRY" "HOSTNAME" | unknown | +| PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256 | SHA\-256 hash of the file | unknown | +| PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_vendor_name | File signature vendor name | unknown | +| PortScan.BlockPorts | Indicates whether there's a need to block the ports used for exploitation on the scanned host. | unknown | +| PortScan.AttackerIPs | Attacker IPs from the port scan alert. | unknown | +| PortScan.AttackerHostnames | Attacker hostnames from the port scan alert. | unknown | +| PortScan.AttackerUsername | Attacker username from the port scan alert. | unknown | +| PortScan.FileArtifacts | File artifacts from the port scan alert. | unknown | +| PortScan.LateralMovementFirstDatetime | Lateral Movement First Date time from the port scan alert. | unknown | +| PortScan.PortScanFirstDatetime | Port Scan First Date time | unknown | + +## Playbook Image +--- +![Cortex XDR Alerts Handling](https://github.com/demisto/content/raw/3fadebe9e16eb7c9fc28ce3bb600319ec875e3b5/Packs/CortexXDR/doc_files/Cortex_XDR_Alerts_Handling.png) \ No newline at end of file diff --git a/Packs/CortexXDR/Playbooks/Cortex_XDR_incident_handling_v2.yml b/Packs/CortexXDR/Playbooks/Cortex_XDR_incident_handling_v2.yml new file mode 100644 index 00000000000..9b6771c508c --- /dev/null +++ b/Packs/CortexXDR/Playbooks/Cortex_XDR_incident_handling_v2.yml @@ -0,0 +1,1813 @@ +id: Cortex XDR incident handling v2 +version: -1 +name: Cortex XDR incident handling v2 +description: "This playbook is triggered by fetching a Palo Alto Networks Cortex XDR\ + \ incident.\nThe playbook syncs and updates new XDR alerts that construct the incident\ + \ and triggers a sub-playbook to handle each alert by type.\nThen, the playbook\ + \ performs enrichment on the incident's indicators and hunting for related IOCs.\n\ + Based on the severity, it lets the analyst decide whether to continue to the remediation\ + \ stage or close the investigation as a false positive. \nAfter the remediation, if\ + \ there are no new alerts, the playbook stops the alert sync and closes the XDR incident\ + \ and investigation." +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 7f77db97-6498-4943-88a9-4f77dccbc713 + type: start + task: + id: 7f77db97-6498-4943-88a9-4f77dccbc713 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "12" + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": -815 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "2": + id: "2" + taskid: 3b28f395-c899-4fac-8c9a-539269b991f0 + type: title + task: + id: 3b28f395-c899-4fac-8c9a-539269b991f0 + version: -1 + name: Loop on alert id - Alert enrichment + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "15" + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 400 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "7": + id: "7" + taskid: dc1e28b9-1dc7-46a6-8c6e-67ef485cb555 + type: title + task: + id: dc1e28b9-1dc7-46a6-8c6e-67ef485cb555 + version: -1 + name: Remediation + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "25" + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 2135 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "11": + id: "11" + taskid: 6c507e81-addc-440c-81a4-1c57f97e676a + type: condition + task: + id: 6c507e81-addc-440c-81a4-1c57f97e676a + version: -1 + name: Are there new un-handled alerts? + description: "Check if there are new un-handled alerts." + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "13" + "yes": + - "30" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEqualString + left: + value: + complex: + root: incident + accessor: xdralertcount + iscontext: true + right: + value: + complex: + root: XDR + accessor: HandledAlerts + iscontext: true + view: |- + { + "position": { + "x": 265, + "y": 3150 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "12": + id: "12" + taskid: a2a6f137-d2dd-4cd4-80e1-4f6511fb5a4c + type: regular + task: + id: a2a6f137-d2dd-4cd4-80e1-4f6511fb5a4c + version: -1 + name: Cortex XDR - Sync Alerts + description: Syncs a single incident between Cortex XSOAR and Cortex XDR. This script always + uses the xdr-get-incident-extra-data command and outputs to the context the + entire incident JSON. When the incident is updated in Cortex XDR, the Cortex XSOAR incident + is updated accordingly and the default playbook reruns. When an incident + is updated in Cortex XSOAR, the script will execute the xdr-update-incident command + and update the incident in Cortex XDR. + scriptName: XDRSyncScript + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "40" + scriptarguments: + alert_count: {} + assigned_user_mail: {} + assigned_user_pretty_name: {} + description: {} + first: {} + high_severity_alert_count: {} + host_count: {} + incident_id: + complex: + root: incident + accessor: xdrincidentid + interval: + simple: "2" + low_severity_alert_count: {} + med_severity_alert_count: {} + notes: {} + playbook_to_run: {} + resolve_comment: {} + severity: {} + status: {} + user_count: {} + verbose: {} + xdr_alerts: {} + xdr_file_artifacts: {} + xdr_incident_from_previous_run: {} + xdr_incident_markdown_field: {} + xdr_network_artifacts: {} + xdr_url: {} + results: + - XDRSyncScriptTaskID + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": -655 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "13": + id: "13" + taskid: caec502d-3a9b-4783-8666-2e76cbbea300 + type: regular + task: + id: caec502d-3a9b-4783-8666-2e76cbbea300 + version: -1 + name: Stop XDR alerts sync + description: This stops the scheduled task whose ID is given in the taskID argument. + scriptName: StopScheduledTask + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "17" + scriptarguments: + taskID: + complex: + root: XDRSyncScriptTaskID + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 3660 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "15": + id: "15" + taskid: e495004a-cc3e-4fd8-8a5c-041e8e5a2f7a + type: playbook + task: + id: e495004a-cc3e-4fd8-8a5c-041e8e5a2f7a + version: -1 + name: Cortex XDR Alerts Handling + playbookName: Cortex XDR Alerts Handling + type: playbook + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "20" + scriptarguments: + alert_id: + complex: + root: PaloAltoNetworksXDR + accessor: Incident.alerts.alert_id + incident_id: + complex: + root: PaloAltoNetworksXDR + accessor: Incident.incident_id + separatecontext: false + loop: + iscommand: false + exitCondition: "" + wait: 5 + max: 100 + forEach: true + view: |- + { + "position": { + "x": 265, + "y": 545 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "16": + id: "16" + taskid: 3b818f3a-93c4-41f5-8b76-85082a6e98fb + type: title + task: + id: 3b818f3a-93c4-41f5-8b76-85082a6e98fb + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 4200 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "17": + id: "17" + taskid: 8990b518-32e8-4596-84d5-9f7a46783165 + type: regular + task: + id: 8990b518-32e8-4596-84d5-9f7a46783165 + version: -1 + name: Cortex XDR - close incident + description: Updates one or more fields of a specified incident. Missing fields + are ignored. To remove the assignment for an incident, pass a null value + in the assignee email argument. + script: Cortex XDR - IR|||xdr-update-incident + type: regular + iscommand: true + brand: Cortex XDR - IR + nexttasks: + '#none#': + - "18" + scriptarguments: + assigned_user_mail: {} + assigned_user_pretty_name: {} + incident_id: + complex: + root: PaloAltoNetworksXDR + accessor: Incident.incident_id + manual_severity: {} + resolve_comment: {} + status: + simple: RESOLVED_THREAT_HANDLED + unassign_user: {} + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 3840 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "18": + id: "18" + taskid: fceb6635-8178-413b-8dac-ec383f9cfeb9 + type: regular + task: + id: fceb6635-8178-413b-8dac-ec383f9cfeb9 + version: -1 + name: Close investigation + description: Closes the incident. + script: Builtin|||closeInvestigation + type: regular + iscommand: true + brand: Builtin + nexttasks: + '#none#': + - "16" + scriptarguments: + assetid: {} + closeNotes: + simple: Closed after investigation and remediation. + closeReason: {} + code42alerttype: {} + emailclassification: {} + id: {} + mndadone: {} + phishingconfirmationstatus: {} + phishingsubtype: {} + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 4025 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "20": + id: "20" + taskid: 72713a55-85da-4a6c-8a7b-1e1e5291ba23 + type: title + task: + id: 72713a55-85da-4a6c-8a7b-1e1e5291ba23 + version: -1 + name: Investigation + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "36" + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 720 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "23": + id: "23" + taskid: 5c987e33-d970-4f56-8a14-888fb6fb2e68 + type: playbook + task: + id: 5c987e33-d970-4f56-8a14-888fb6fb2e68 + version: -1 + name: Calculate Severity - Generic v2 + description: |- + Calculate and assign the incident severity based on the highest returned severity level from the following calculations: + + - DBotScores of indicators + - Critical assets + - Email authenticity + - Current incident severity + playbookName: Calculate Severity - Generic v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "37" + scriptarguments: + Account: + complex: + root: Account + transformers: + - operator: uniq + CriticalEndpoints: + complex: + root: inputs.CriticalHostnames + CriticalGroups: + complex: + root: inputs.CriticalADGroups + CriticalUsers: + complex: + root: inputs.CriticalUsernames + DBotScore: + complex: + root: DBotScore + EmailAuthenticityCheck: + complex: + root: Email + accessor: AuthenticityCheck + transformers: + - operator: uniq + Endpoint: + complex: + root: Endpoint + transformers: + - operator: uniq + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 265, + "y": 1740 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "24": + id: "24" + taskid: 89e6afb5-1da9-4446-855e-d5d34ef0deba + type: regular + task: + id: 89e6afb5-1da9-4446-855e-d5d34ef0deba + version: -1 + name: Manual malware analysis and forensics + description: "Manual malware analysis and forensics by the analyst." + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "33" + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 1215 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "25": + id: "25" + taskid: f8f7e19f-a7f8-4638-8466-30a21096ebca + type: condition + task: + id: f8f7e19f-a7f8-4638-8466-30a21096ebca + version: -1 + name: Auto remediation? + description: "Should the playbook perform auto-remediation or manual remediation?" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "26" + "yes": + - "32" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + simple: aa + iscontext: true + right: + value: + simple: a + view: |- + { + "position": { + "x": 265, + "y": 2300 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "26": + id: "26" + taskid: bc6cf7eb-f224-4f3b-8ba4-7894a063beda + type: regular + task: + id: bc6cf7eb-f224-4f3b-8ba4-7894a063beda + version: -1 + name: Manual remediation + description: "Manual remediation by the analyst." + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "52" + separatecontext: false + view: |- + { + "position": { + "x": 520, + "y": 2470 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "30": + id: "30" + taskid: c4f4ee4f-86d8-40ae-8512-62fedce1d77f + type: condition + task: + id: c4f4ee4f-86d8-40ae-8512-62fedce1d77f + version: -1 + name: Continue investigation? + description: "Continue investigation?" + type: condition + iscommand: false + brand: "" + nexttasks: + "no": + - "13" + "yes": + - "31" + separatecontext: false + view: |- + { + "position": { + "x": 520, + "y": 3320 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "31": + id: "31" + taskid: 8a3ed2d1-85c2-45dc-8fff-f6af952ab540 + type: regular + task: + id: 8a3ed2d1-85c2-45dc-8fff-f6af952ab540 + version: -1 + name: Manual - continue investigation for new alerts + description: "Manual - continue investigation for new alerts." + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "13" + separatecontext: false + view: |- + { + "position": { + "x": 750, + "y": 3490 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "32": + id: "32" + taskid: cb145e1a-ef5b-411d-8af3-0745e06cb1d5 + type: playbook + task: + id: cb145e1a-ef5b-411d-8af3-0745e06cb1d5 + version: -1 + name: Block Indicators - Generic v2 + description: |+ + This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks: + + - Block URL - Generic + - Block Account - Generic + - Block IP - Generic v2 + - Block File - Generic v2 + + playbookName: Block Indicators - Generic v2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "52" + scriptarguments: + AutoCommit: + simple: "No" + CustomBlockRule: + simple: "True" + CustomURLCategory: + simple: Demisto Remediation - Malicious URLs + DAG: {} + EDLServerIP: {} + IP: + complex: + root: DBotScore + filters: + - - operator: isEqualString + left: + value: + simple: DBotScore.Type + iscontext: true + right: + value: + simple: ip + ignorecase: true + - - operator: greaterThanOrEqual + left: + value: + simple: DBotScore.Score + iscontext: true + right: + value: + simple: "3" + accessor: Indicator + transformers: + - operator: append + args: + item: + value: + simple: PortScan.AttackerIPs + iscontext: true + - operator: uniq + IPBlacklistMiner: {} + IPListName: {} + LogForwarding: {} + MD5: + complex: + root: File + filters: + - - operator: isExists + left: + value: + simple: File.Malicious + iscontext: true + accessor: MD5 + transformers: + - operator: uniq + SHA256: + complex: + root: File + filters: + - - operator: isExists + left: + value: + simple: File.Malicious + iscontext: true + accessor: SHA256 + transformers: + - operator: uniq + StaticAddressGroup: {} + URL: + complex: + root: DBotScore + filters: + - - operator: isEqualString + left: + value: + simple: DBotScore.Type + iscontext: true + right: + value: + simple: url + ignorecase: true + - - operator: greaterThanOrEqual + left: + value: + simple: DBotScore.Score + iscontext: true + right: + value: + simple: "3" + accessor: Indicator + transformers: + - operator: uniq + URLBlacklistMiner: {} + URLListName: + simple: Demisto Remediation - URL EDL + Username: + complex: + root: DBotScore + filters: + - - operator: isEqualString + left: + value: + simple: DBotScore.Type + iscontext: true + right: + value: + simple: username + ignorecase: true + - - operator: greaterThanOrEqual + left: + value: + simple: DBotScore.Score + iscontext: true + right: + value: + simple: "3" + accessor: Indicator + transformers: + - operator: append + args: + item: + value: + simple: PortScan.AttackerUsername + iscontext: true + - operator: uniq + categories: {} + device-group: {} + type: {} + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 20, + "y": 2470 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "33": + id: "33" + taskid: 26c62802-b143-4bbc-8283-5cb9240fe5d0 + type: condition + task: + id: 26c62802-b143-4bbc-8283-5cb9240fe5d0 + version: -1 + name: Hunt for related IOCs? + description: "Run hunting playbook to find related IOCs?" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "23" + "yes": + - "34" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + complex: + root: inputs.Hunting + transformers: + - operator: toLowerCase + iscontext: true + right: + value: + simple: "yes" + view: |- + { + "position": { + "x": 265, + "y": 1400 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "34": + id: "34" + taskid: 6c63da52-3e6e-426e-8c10-b361829c26bd + type: playbook + task: + id: 6c63da52-3e6e-426e-8c10-b361829c26bd + version: -1 + name: PANW - Hunting and threat detection by indicator type V2 + description: "Integrations list: Cortex (Traps, PAN-OS, Analytics)\nThis is\ + \ a multipurpose playbook used for hunting and threat detection. The playbook\ + \ receives inputs based on hashes, IP addresses, or domain names provided\ + \ manually or from outputs by other playbooks. \nWith the received indicators,\ + \ the playbook leverages Palo Alto Cortex data received by products such as\ + \ Traps, Analytics and Pan-OS to search for IP addresses and hosts related\ + \ to that specific hash. \nThe output provided by the playbook facilitates\ + \ pivoting searches for possibly affected hosts, IP addresses, or users." + playbookName: PANW - Hunting and threat detection by indicator type V2 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "23" + scriptarguments: + IPAddresses: + complex: + root: IP + filters: + - - operator: isExists + left: + value: + simple: IP.Malicious + iscontext: true + accessor: Address + transformers: + - operator: append + args: + item: + value: + simple: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip + iscontext: true + - operator: uniq + InternalRange: + complex: + root: inputs.InternalRange + MD5: + complex: + root: File + filters: + - - operator: isExists + left: + value: + simple: File.Malicious + iscontext: true + accessor: MD5 + SHA1: + complex: + root: File + filters: + - - operator: isExists + left: + value: + simple: File.Malicious + iscontext: true + accessor: SHA1 + SHA256: + complex: + root: File + filters: + - - operator: isExists + left: + value: + simple: File.Malicious + iscontext: true + accessor: SHA256 + transformers: + - operator: append + args: + item: + value: + simple: PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256 + iscontext: true + - operator: uniq + URLDomain: + complex: + root: Domain + filters: + - - operator: isExists + left: + value: + simple: Domain.Malicious + iscontext: true + accessor: Name + transformers: + - operator: append + args: + item: + value: + simple: PaloAltoNetworksXDR.Incident.network_artifacts.network_domain + iscontext: true + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 530, + "y": 1570 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: true + quietmode: 0 + "35": + id: "35" + taskid: edf8888d-4ac0-464a-8a70-64069a895cb2 + type: playbook + task: + id: edf8888d-4ac0-464a-8a70-64069a895cb2 + version: -1 + name: Entity Enrichment - Generic v3 + description: Enrich entities using one or more integrations. + playbookName: Entity Enrichment - Generic v3 + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "24" + scriptarguments: + Domain: + complex: + root: Domain + accessor: Name + transformers: + - operator: uniq + Email: + complex: + root: Account + accessor: Email.Address + transformers: + - operator: uniq + Hostname: + complex: + root: Endpoint + accessor: Hostname + transformers: + - operator: uniq + IP: + complex: + root: IP + accessor: Address + transformers: + - operator: uniq + InternalDomains: {} + InternalRange: {} + MD5: + complex: + root: File + accessor: MD5 + transformers: + - operator: uniq + ResolveIP: + simple: "False" + SHA1: + complex: + root: File + accessor: SHA1 + transformers: + - operator: uniq + SHA256: + complex: + root: File + accessor: SHA256 + transformers: + - operator: uniq + URL: + complex: + root: URL + accessor: Data + transformers: + - operator: uniq + Username: + complex: + root: Account + accessor: Username + transformers: + - operator: uniq + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 265, + "y": 1040 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "36": + id: "36" + taskid: d9e48a5f-1ddd-4f3a-8fdd-9d339011a745 + type: regular + task: + id: d9e48a5f-1ddd-4f3a-8fdd-9d339011a745 + version: -1 + name: Count XDR alerts + description: Sets a value in context with the given context key. + scriptName: Set + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "35" + scriptarguments: + append: {} + key: + simple: XDR.HandledAlerts + stringify: {} + value: + complex: + root: incident + accessor: xdralertcount + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 870 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "37": + id: "37" + taskid: 5cedbf5c-e00f-4ef0-88eb-292752ca5102 + type: condition + task: + id: 5cedbf5c-e00f-4ef0-88eb-292752ca5102 + version: -1 + name: Continue to Remediation or close as false positive? + description: "Continue to Remediation or close the investigation as false positive?" + type: condition + iscommand: false + brand: "" + nexttasks: + CONTINUE: + - "7" + False Positive: + - "48" + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": 1930 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "38": + id: "38" + taskid: 69f1dcb2-0a11-4c10-80cb-c6ae786936e2 + type: regular + task: + id: 69f1dcb2-0a11-4c10-80cb-c6ae786936e2 + version: -1 + name: Close XDR incident as false positive + description: Updates one or more fields of a specified incident. Missing fields + will be ignored. To remove the assignment for an incident, pass a null value + in the assignee email argument. + script: '|||xdr-update-incident' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "49" + scriptarguments: + assigned_user_mail: {} + assigned_user_pretty_name: {} + incident_id: {} + manual_severity: {} + resolve_comment: {} + status: + simple: RESOLVED_FALSE_POSITIVE + unassign_user: {} + separatecontext: false + view: |- + { + "position": { + "x": -240, + "y": 3850 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "39": + id: "39" + taskid: e76161f6-f29f-4919-8f73-05b9f8233a42 + type: regular + task: + id: e76161f6-f29f-4919-8f73-05b9f8233a42 + version: -1 + name: Stop XDR alerts sync + description: This stops the scheduled task whose ID is given in the taskID argument. + scriptName: StopScheduledTask + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "38" + scriptarguments: + taskID: + complex: + root: XDRSyncScriptTaskID + separatecontext: false + view: |- + { + "position": { + "x": -240, + "y": 3660 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "40": + id: "40" + taskid: 5288d043-c7c7-4005-8817-bd91e3871227 + type: regular + task: + id: 5288d043-c7c7-4005-8817-bd91e3871227 + version: -1 + name: Find similar incidents + description: |- + Finds similar incidents by common incident keys, labels, custom fields or context keys. + It's highly recommended to use incident keys if possible (e.g., "type" for the same incident type). + For best performance, it's recommended to avoid using context keys whenever possible (for example, if the value also appears in a label key, use label). + scriptName: FindSimilarIncidents + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "43" + scriptarguments: + filterQuery: {} + hoursBack: {} + ignoreClosedIncidents: {} + incidentFieldsAppliedCondition: {} + maxNumberOfIncidents: {} + maxResults: {} + similarContextKeys: {} + similarCustomFields: {} + similarIncidentFields: {} + similarIncidentKeys: {} + similarLabelsKeys: {} + skipMissingValues: {} + timeField: {} + separatecontext: false + view: |- + { + "position": { + "x": 265, + "y": -470 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "41": + id: "41" + taskid: 825644a1-b3c7-41c1-8a87-1407188feca0 + type: condition + task: + id: 825644a1-b3c7-41c1-8a87-1407188feca0 + version: -1 + name: Link similar incidents? + description: "Link similar incidents?" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "44" + "yes": + - "42" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + complex: + root: inputs.LinkSimilarIncidents + transformers: + - operator: toLowerCase + iscontext: true + right: + value: + simple: "yes" + view: |- + { + "position": { + "x": 510, + "y": -110 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "42": + id: "42" + taskid: 3a9bc5da-eaf3-478e-80a0-856444353986 + type: regular + task: + id: 3a9bc5da-eaf3-478e-80a0-856444353986 + version: -1 + name: Link similar incidents + description: Link two or more incidents + scriptName: DemistoLinkIncidents + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "44" + scriptarguments: + masterID: + complex: + root: incident + accessor: id + otherIDs: + complex: + root: similarIncident + accessor: rawId + unlink: {} + separatecontext: false + view: |- + { + "position": { + "x": 800, + "y": 60 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "43": + id: "43" + taskid: 07335e9a-0e8b-4d79-89fa-2121b6585b26 + type: condition + task: + id: 07335e9a-0e8b-4d79-89fa-2121b6585b26 + version: -1 + name: Similar incidents found? + description: "Were any similar incidents found?" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "2" + "yes": + - "41" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + complex: + root: isSimilarIncidentFound + transformers: + - operator: toLowerCase + iscontext: true + right: + value: + simple: "true" + view: |- + { + "position": { + "x": 265, + "y": -280 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "44": + id: "44" + taskid: abc5dc8c-2591-4e4b-85f9-a48ad624ec76 + type: condition + task: + id: abc5dc8c-2591-4e4b-85f9-a48ad624ec76 + version: -1 + name: Close as duplicate? + description: "Close the incident as duplicate?" + type: condition + iscommand: false + brand: "" + nexttasks: + "no": + - "2" + "yes": + - "46" + separatecontext: false + view: |- + { + "position": { + "x": 510, + "y": 230 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "45": + id: "45" + taskid: 4f7fe854-6657-4a6d-8b56-0db79af51624 + type: regular + task: + id: 4f7fe854-6657-4a6d-8b56-0db79af51624 + version: -1 + name: Resolve XDR incident as duplicate + description: Updates one or more fields of a specified incident. Missing fields + will be ignored. To remove the assignment for an incident, pass a null value + in the assignee email argument. + script: '|||xdr-update-incident' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "50" + scriptarguments: + assigned_user_mail: {} + assigned_user_pretty_name: {} + incident_id: + complex: + root: incident + accessor: xdrincidentid + manual_severity: {} + resolve_comment: {} + status: + simple: RESOLVED_DUPLICATE + unassign_user: {} + separatecontext: false + view: |- + { + "position": { + "x": 1030, + "y": 3840 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "46": + id: "46" + taskid: 01cb812a-1551-4a14-8185-5b90fbe9bafe + type: title + task: + id: 01cb812a-1551-4a14-8185-5b90fbe9bafe + version: -1 + name: Close as duplicate + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "47" + separatecontext: false + view: |- + { + "position": { + "x": 1030, + "y": 400 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "47": + id: "47" + taskid: fefe6618-8fda-48c8-8ee0-ffc2d4eaa1c3 + type: regular + task: + id: fefe6618-8fda-48c8-8ee0-ffc2d4eaa1c3 + version: -1 + name: Stop XDR alerts sync + description: This stops the scheduled task whose ID is given in the taskID argument. + scriptName: StopScheduledTask + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "45" + scriptarguments: + taskID: + complex: + root: XDRSyncScriptTaskID + separatecontext: false + view: |- + { + "position": { + "x": 1030, + "y": 3660 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "48": + id: "48" + taskid: 71cc758b-06a0-4984-8b63-17a51f178d97 + type: title + task: + id: 71cc758b-06a0-4984-8b63-17a51f178d97 + version: -1 + name: False Positive + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "39" + separatecontext: false + view: |- + { + "position": { + "x": -240, + "y": 2135 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "49": + id: "49" + taskid: 8afdc355-e45a-4f50-881d-ea659099fc7c + type: regular + task: + id: 8afdc355-e45a-4f50-881d-ea659099fc7c + version: -1 + name: Close investigation - false positive + description: Closes the incident. + script: Builtin|||closeInvestigation + type: regular + iscommand: true + brand: Builtin + nexttasks: + '#none#': + - "16" + scriptarguments: + assetid: {} + closeNotes: + simple: Closed as false positive. + closeReason: {} + code42alerttype: {} + emailclassification: {} + id: {} + mndadone: {} + phishingconfirmationstatus: {} + phishingsubtype: {} + separatecontext: false + view: |- + { + "position": { + "x": -240, + "y": 4025 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "50": + id: "50" + taskid: d5c17989-770e-4ef2-8df4-174fc0731616 + type: regular + task: + id: d5c17989-770e-4ef2-8df4-174fc0731616 + version: -1 + name: Close investigation- duplicate + description: Closes the incident. + script: Builtin|||closeInvestigation + type: regular + iscommand: true + brand: Builtin + nexttasks: + '#none#': + - "16" + scriptarguments: + assetid: {} + closeNotes: + simple: Closed as duplicate. + closeReason: {} + code42alerttype: {} + emailclassification: {} + id: {} + mndadone: {} + phishingconfirmationstatus: {} + phishingsubtype: {} + separatecontext: false + view: |- + { + "position": { + "x": 1030, + "y": 4025 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "51": + id: "51" + taskid: ea8cab41-5994-4c0f-8cd2-89a16880c8e1 + type: regular + task: + id: ea8cab41-5994-4c0f-8cd2-89a16880c8e1 + version: -1 + name: Manually block ports used for exploitation on the scanned host. + description: "Manually block ports used for exploitation on the scanned host." + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "11" + separatecontext: false + view: |- + { + "position": { + "x": 740, + "y": 2980 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "52": + id: "52" + taskid: b1972e80-05b7-4890-859b-a0feaca1b35d + type: condition + task: + id: b1972e80-05b7-4890-859b-a0feaca1b35d + version: -1 + name: Was there a port scan alert investigated? + description: "Was there a port scan alert investigated as a part of the incident?" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "11" + "yes": + - "53" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + complex: + root: PortScan + iscontext: true + view: |- + { + "position": { + "x": 265, + "y": 2640 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "53": + id: "53" + taskid: 3002aab6-d3df-4e8b-8730-3330984beca4 + type: condition + task: + id: 3002aab6-d3df-4e8b-8730-3330984beca4 + version: -1 + name: Block ports? + description: "Is port blocking required?" + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "11" + "yes": + - "51" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + complex: + root: PortScan + accessor: BlockPorts + iscontext: true + right: + value: + simple: "True" + view: |- + { + "position": { + "x": 530, + "y": 2810 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +view: |- + { + "linkLabelsPosition": { + "11_13_#default#": 0.55, + "30_13_no": 0.38, + "33_23_#default#": 0.53, + "33_34_yes": 0.44, + "37_7_CONTINUE": 0.77, + "43_2_#default#": 0.32, + "44_2_no": 0.31, + "44_46_yes": 0.35, + "52_11_#default#": 0.46, + "52_53_yes": 0.53, + "53_11_#default#": 0.29 + }, + "paper": { + "dimensions": { + "height": 5080, + "width": 1650, + "x": -240, + "y": -815 + } + } + } +inputs: +- key: incident_id + value: {} + required: false + description: Incident ID. + playbookInputQuery: +- key: similarIncidentFields + value: {} + required: false + description: A comma-separated list of similar incident fields keys. + playbookInputQuery: +- key: LinkSimilarIncidents + value: + simple: "Yes" + required: false + description: This input indicates whether the playbook will link similar incidents. + Specify Yes/No. + playbookInputQuery: +- key: Hunting + value: + simple: "Yes" + required: false + description: Yes/No + playbookInputQuery: +- key: InternalRange + value: {} + required: false + description: 'A list of internal IP ranges to check IP addresses against. The list + should be provided in CIDR notation, separated by commas. An example of a list + of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" (without quotes). + If a list is not provided, will use default list provided in the IsIPInRanges + script (the known IPv4 private address ranges).' + playbookInputQuery: +- key: CriticalUsernames + value: + simple: admin,administrator + required: false + description: A list of comma-separated names of critical users in the organization. + This will affect the calculated severity of the incident. + playbookInputQuery: +- key: CriticalHostnames + value: {} + required: false + description: A list of comma-separated names of critical endpoints in the organization. + This will affect the calculated severity of the incident. + playbookInputQuery: +- key: CriticalADGroups + value: {} + required: false + description: CSV of DN names of critical Active Directory groups. This will affect + the severity calculated for this incident. + playbookInputQuery: +outputs: [] +tests: +- No test. +fromversion: 5.0.0 diff --git a/Packs/CortexXDR/Playbooks/Cortex_XDR_incident_handling_v2_README.md b/Packs/CortexXDR/Playbooks/Cortex_XDR_incident_handling_v2_README.md new file mode 100644 index 00000000000..b724b223f5b --- /dev/null +++ b/Packs/CortexXDR/Playbooks/Cortex_XDR_incident_handling_v2_README.md @@ -0,0 +1,52 @@ +This playbook is triggered by fetching a Palo Alto Networks Cortex XDR incident. +The playbook syncs and updates new XDR alerts that construct the incident and triggers a sub-playbook to handle each alert by type. +Then, the playbook performs enrichment on the incident's indicators and hunting for related IOCs. +Based on the severity, it lets the analyst decide whether to continue to the remediation stage or close the investigation as a false positive. +After the remediation, if there are no new alerts, the playbook stops the alert sync and closes the XDR incident and investigation. + +## Dependencies +This playbook uses the following sub-playbooks, integrations, and scripts. + +### Sub-playbooks +* PANW - Hunting and threat detection by indicator type V2 +* Calculate Severity - Generic v2 +* Cortex XDR Alerts Handling +* Entity Enrichment - Generic v3 +* Block Indicators - Generic v2 + +### Integrations +* PaloAltoNetworks_XDR +* Cortex XDR - IR + +### Scripts +* DemistoLinkIncidents +* StopScheduledTask +* XDRSyncScript +* FindSimilarIncidents +* Set + +### Commands +* xdr-update-incident +* closeInvestigation + +## Playbook Inputs +--- + +| **Name** | **Description** | **Default Value** | **Required** | +| --- | --- | --- | --- | +| incident_id | Incident ID. | | Optional | +| similarIncidentFields | A comma\-separated list of similar incident fields keys. | | Optional | +| LinkSimilarIncidents | This input indicates whether the playbook will link similar incidents. Specify Yes/No. | Yes | Optional | +| Hunting | Yes/No | Yes | Optional | +| InternalRange | A list of internal IP ranges to check IP addresses against. The list should be provided in CIDR notation, separated by commas. An example of a list of ranges would be: "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" \(without quotes\). If a list is not provided, will use default list provided in the IsIPInRanges script \(the known IPv4 private address ranges\). | | Optional | +| CriticalUsernames | A list of comma\-separated names of critical users in the organization. This will affect the calculated severity of the incident. | admin,administrator | Optional | +| CriticalHostnames | A list of comma\-separated names of critical endpoints in the organization. This will affect the calculated severity of the incident. | | Optional | +| CriticalADGroups | CSV of DN names of critical Active Directory groups. This will affect the severity calculated for this incident. | | Optional | + +## Playbook Outputs +--- +There are no outputs for this playbook. + +## Playbook Image +--- +![Cortex XDR incident handling v2](https://github.com/demisto/content/raw/3fadebe9e16eb7c9fc28ce3bb600319ec875e3b5/Packs/CortexXDR/doc_files/Cortex_XDR_incident_handling_v2.png) \ No newline at end of file diff --git a/Packs/CortexXDR/ReleaseNotes/1_0_1.md b/Packs/CortexXDR/ReleaseNotes/1_0_1.md deleted file mode 100644 index 2dd97600420..00000000000 --- a/Packs/CortexXDR/ReleaseNotes/1_0_1.md +++ /dev/null @@ -1,8 +0,0 @@ - -#### Classifiers -- __Cortex XDR - Classifier__ -Updated classifier according to new schema. - -#### Integrations -- __Cortex XDR - IR__ -Added default classifier and mapper. diff --git a/Packs/CortexXDR/ReleaseNotes/1_0_2.md b/Packs/CortexXDR/ReleaseNotes/1_0_2.md index d2b8e23155e..1265d04d17b 100644 --- a/Packs/CortexXDR/ReleaseNotes/1_0_2.md +++ b/Packs/CortexXDR/ReleaseNotes/1_0_2.md @@ -2,3 +2,7 @@ ### Integrations - __Cortex XDR - IR__ Fixed a bug in the ***xdr-get-endpoint*** command where only the last endpoint was displayed in context. + +### Playbooks +- __PaloAltoNetworks_XDR__ +Added a test for the quarantine file playbook. diff --git a/Packs/CortexXDR/ReleaseNotes/1_0_3.md b/Packs/CortexXDR/ReleaseNotes/1_0_3.md new file mode 100644 index 00000000000..0ea78f3fd8f --- /dev/null +++ b/Packs/CortexXDR/ReleaseNotes/1_0_3.md @@ -0,0 +1,5 @@ + diff --git a/Packs/CortexXDR/ReleaseNotes/1_1_0.md b/Packs/CortexXDR/ReleaseNotes/1_1_0.md new file mode 100644 index 00000000000..52be83a925a --- /dev/null +++ b/Packs/CortexXDR/ReleaseNotes/1_1_0.md @@ -0,0 +1,14 @@ + +#### Playbooks +##### Cortex XDR - quarantine file +Added a playbook that gets the status of a quarantined file. + +#### Integrations +##### Cortex XDR - IR +Added 6 commands. + - ***xdr-blacklist-files*** + - ***xdr-whitelist-files*** + - ***xdr-quarantine-files*** + - ***xdr-get-quarantine-status*** + - ***xdr-restore-file*** + - ***xdr-endpoint-scan*** diff --git a/Packs/CortexXDR/ReleaseNotes/2_0_0.md b/Packs/CortexXDR/ReleaseNotes/2_0_0.md new file mode 100644 index 00000000000..953ad95d37b --- /dev/null +++ b/Packs/CortexXDR/ReleaseNotes/2_0_0.md @@ -0,0 +1,33 @@ + +#### Playbooks +##### New: Cortex XDR - Malware Investigation +Investigates a Cortex XDR incident containing internal malware alerts. The playbook: + - Enriches the infected endpoint details. + - Lets the analyst manually retrieve the malicious file. + - Performs file detonation. + +The playbook is used as a sub- playbook in ‘Cortex XDR Incident Handling - v2’ + +##### New: Cortex XDR - Port Scan - Adjusted +Investigates a Cortex XDR incident containing internal port scan alerts. The playbook: + - Syncs data with Cortex XDR. + - Notifies management about a compromised host. + - Escalates the incident in case of lateral movement alert detection. + +The playbook is used as a sub- playbook in 'Cortex XDR Incident Handling - v2' + +##### New: Cortex XDR Alerts Handling +This playbook is used to loop over every alert in a Cortex XDR incident. +Supported alert categories: + - Malware + - Port Scan + +##### New: Cortex XDR Incident Handling v2 +This playbook is triggered by fetching a Palo Alto Networks Cortex XDR +incident. The playbook syncs and updates new XDR alerts that construct the incident +and triggers a sub-playbook to handle each alert by type. Then, the playbook +performs enrichment on the incident's indicators and hunting for related IOCs. +Based on the severity, it lets the analyst decide whether to continue to the remediation +stage or close the investigation as a false positive. After the remediation, if +there are no new alerts, the playbook stops the alert sync and closes the XDR incident +and investigation. \ No newline at end of file diff --git a/Packs/CortexXDR/TestPlaybooks/Test_XDR_Playbook.yml b/Packs/CortexXDR/TestPlaybooks/Test_XDR_Playbook.yml new file mode 100644 index 00000000000..0fe5d6a6b3e --- /dev/null +++ b/Packs/CortexXDR/TestPlaybooks/Test_XDR_Playbook.yml @@ -0,0 +1,1613 @@ +id: Test XDR Playbook +version: -1 +name: Test XDR Playbook +description: Cortex XDR Test Playbook +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 80c5df7e-ff62-411b-8685-f5cd704963ed + type: start + task: + id: 80c5df7e-ff62-411b-8685-f5cd704963ed + description: "" + version: -1 + name: "" + iscommand: false + brand: "" + nexttasks: + '#none#': + - "1" + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "1": + id: "1" + taskid: 27d3f4e6-da98-4fdd-8648-8473f5d21294 + type: regular + task: + id: 27d3f4e6-da98-4fdd-8648-8473f5d21294 + version: -1 + name: DeleteContext + description: DeleteContext + script: DeleteContext + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "2" + scriptarguments: + all: + simple: "yes" + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "2": + id: "2" + taskid: 6534ea93-0f85-43e0-8661-635eaf8be9ae + type: regular + task: + id: 6534ea93-0f85-43e0-8661-635eaf8be9ae + description: xdr-get-incidents + version: -1 + name: xdr-get-incidents + script: '|||xdr-get-incidents' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + gte_creation_time: + simple: 2010-10-10T00:00:00 + gte_modification_time: {} + incident_id_list: {} + limit: + simple: "3" + lte_creation_time: {} + lte_modification_time: {} + page: {} + since_creation_time: {} + since_modification_time: {} + sort_by_creation_time: + simple: asc + sort_by_modification_time: {} + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "3": + id: "3" + taskid: 19cf2982-3be8-4133-8bce-1c41eb456193 + type: condition + task: + description: Verify Outputs + id: 19cf2982-3be8-4133-8bce-1c41eb456193 + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "4" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Incident.incident_id + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Incident.severity + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Incident.xdr_url + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Incident.status + iscontext: true + view: |- + { + "position": { + "x": 377.5, + "y": 545 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "4": + id: "4" + taskid: d34ccbf7-87e3-44f8-8494-27ece963ae11 + type: regular + task: + id: d34ccbf7-87e3-44f8-8494-27ece963ae11 + description: xdr-get-incident-extra-data + version: -1 + name: xdr-get-incident-extra-data + script: '|||xdr-get-incident-extra-data' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "26" + scriptarguments: + alerts_limit: {} + incident_id: + simple: ${PaloAltoNetworksXDR.Incident.incident_id} + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 720 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "6": + id: "6" + taskid: 6ebf26a1-2e2d-452b-8f99-fcbcccf07a92 + type: regular + task: + id: 6ebf26a1-2e2d-452b-8f99-fcbcccf07a92 + description: xdr-update-incident + version: -1 + name: xdr-update-incident + script: '|||xdr-update-incident' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "27" + scriptarguments: + assigned_user_mail: {} + assigned_user_pretty_name: {} + incident_id: + complex: + root: PaloAltoNetworksXDR + accessor: Incident.incident_id + transformers: + - operator: FirstArrayElement + manual_severity: + simple: HIGH + resolve_comment: {} + status: + simple: UNDER_INVESTIGATION + unassign_user: {} + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 1070 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "7": + id: "7" + taskid: 852db387-f9ab-4537-82f3-6b461c1ef832 + type: regular + task: + id: 852db387-f9ab-4537-82f3-6b461c1ef832 + description: xdr-insert-parsed-alert + version: -1 + name: xdr-insert-parsed-alert + script: '|||xdr-insert-parsed-alert' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "32" + scriptarguments: + alert_description: + simple: This alert from content TestXDRPlaybook description + alert_name: + simple: This alert from content TestXDRPlaybook + event_timestampt: {} + local_ip: + simple: 196.168.0.111 + local_port: + simple: "2000" + product: + simple: SandBlast + remote_ip: + simple: 2.2.2.2 + remote_port: + simple: "6000" + severity: + simple: High + vendor: + simple: Checkpoint + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 2120 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "8": + id: "8" + taskid: 3d791b8b-2de2-4677-8e20-bf0a2d3732eb + type: regular + task: + id: 3d791b8b-2de2-4677-8e20-bf0a2d3732eb + description: xdr-insert-cef-alerts + version: -1 + name: xdr-insert-cef-alerts + script: '|||xdr-insert-cef-alerts' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "33" + scriptarguments: + cef_alerts: + simple: ${cef_alerts} + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 2470 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "9": + id: "9" + taskid: d1b73367-78e6-414d-8e5e-704b06e08c2d + type: regular + task: + id: d1b73367-78e6-414d-8e5e-704b06e08c2d + version: -1 + description: xdr-isolate-endpoint + name: xdr-isolate-endpoint + script: '|||xdr-isolate-endpoint' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "36" + scriptarguments: + endpoint_id: + simple: f8a2f58846b542579c12090652e79f3d + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 3170 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "10": + id: "10" + taskid: 8da5d27b-1a76-43ad-8449-736ca31dbf7d + type: regular + task: + id: 8da5d27b-1a76-43ad-8449-736ca31dbf7d + description: xdr-unisolate-endpoint + version: -1 + name: xdr-unisolate-endpoint + script: '|||xdr-unisolate-endpoint' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "36" + scriptarguments: + endpoint_id: + simple: f8a2f58846b542579c12090652e79f3d + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 3170 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "11": + id: "11" + taskid: e757095e-9e7f-47fc-8fb4-ba7ba19d0889 + type: regular + task: + id: e757095e-9e7f-47fc-8fb4-ba7ba19d0889 + description: xdr-get-endpoints + version: -1 + name: xdr-get-endpoints + script: '|||xdr-get-endpoints' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "12" + scriptarguments: + alias_name: {} + dist_name: {} + endpoint_id_list: {} + first_seen_gte: {} + first_seen_lte: {} + group_name: {} + hostname: + simple: ip-172-31-15-237.eu-central-1.compute.internal + ip_list: {} + isolate: {} + last_seen_gte: {} + last_seen_lte: {} + limit: {} + page: {} + platform: {} + sort_by: {} + sort_order: {} + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 3490 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "12": + id: "12" + taskid: 84ec1feb-2a07-472e-8e8c-4b4aba8a1fce + type: condition + task: + id: 84ec1feb-2a07-472e-8e8c-4b4aba8a1fce + description: Verify Outputs + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "13" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Endpoint.endpoint_id + iscontext: true + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Endpoint.os_type + iscontext: true + right: + value: + simple: AGENT_OS_LINUX + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Endpoint.ip + iscontext: true + view: |- + { + "position": { + "x": 480, + "y": 3665 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "13": + id: "13" + taskid: 73eb03d9-b51f-469a-8ea5-ecb46adc1ab5 + type: regular + task: + id: 73eb03d9-b51f-469a-8ea5-ecb46adc1ab5 + description: xdr-get-distribution-versions + version: -1 + name: xdr-get-distribution-versions + script: '|||xdr-get-distribution-versions' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "14" + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 3840 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "14": + id: "14" + taskid: 186d8567-7fd1-47b0-8652-8a0245d814f6 + type: condition + task: + id: 186d8567-7fd1-47b0-8652-8a0245d814f6 + description: Verify Outputs + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "15" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.DistributionVersions.windows + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.DistributionVersions.linux + iscontext: true + view: |- + { + "position": { + "x": 480, + "y": 4015 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "15": + id: "15" + taskid: 9912d3cc-68a0-4482-85bc-813de97c3990 + type: regular + task: + id: 9912d3cc-68a0-4482-85bc-813de97c3990 + description: xdr-create-distribution + version: -1 + name: xdr-create-distribution + script: '|||xdr-create-distribution' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "16" + scriptarguments: + agent_version: + complex: + root: PaloAltoNetworksXDR + accessor: DistributionVersions.linux + transformers: + - operator: FirstArrayElement + description: + simple: Created by TestXDRPlaybook + name: + simple: This is test distribution + package_type: + simple: standalone + platform: + simple: linux + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 4190 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "16": + id: "16" + taskid: f82142fa-d9fd-475d-8dc6-5e7d141d0aa8 + type: condition + task: + id: f82142fa-d9fd-475d-8dc6-5e7d141d0aa8 + description: Verify Outputs + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "19" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Distribution.id + iscontext: true + - - operator: isExists + left: + value: + simple: PaloAltoNetworksXDR.Distribution.platform + iscontext: true + view: |- + { + "position": { + "x": 480, + "y": 4365 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "17": + id: "17" + taskid: 1d1b30b0-48c7-49d8-8ff2-c1d0fccd7ed0 + type: regular + task: + id: 1d1b30b0-48c7-49d8-8ff2-c1d0fccd7ed0 + description: xdr-get-distribution-url + version: -1 + name: xdr-get-distribution-url + script: '|||xdr-get-distribution-url' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "18" + scriptarguments: + distribution_id: + simple: 2c74c11b63074653aa01d575a82bf52a + package_type: + simple: sh + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 4890 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "18": + id: "18" + taskid: f4476f37-73e7-41d2-89ab-660e5e8845dd + type: condition + task: + id: f4476f37-73e7-41d2-89ab-660e5e8845dd + description: Verify Outputs + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "21" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Distribution.url + iscontext: true + view: |- + { + "position": { + "x": 480, + "y": 5065 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "19": + id: "19" + taskid: 708a98f5-9a0a-43a8-8d19-be1578433bc2 + type: regular + task: + id: 708a98f5-9a0a-43a8-8d19-be1578433bc2 + description: xdr-get-create-distribution-status + version: -1 + name: xdr-get-create-distribution-status + script: '|||xdr-get-create-distribution-status' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "20" + scriptarguments: + distribution_ids: + simple: ${PaloAltoNetworksXDR.Distribution.id} + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 4540 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "20": + id: "20" + taskid: 4fa56dfe-54eb-4a5f-8987-f281678ca3c3 + type: condition + task: + id: 4fa56dfe-54eb-4a5f-8987-f281678ca3c3 + description: Verify Outputs + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "17" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Distribution.status + iscontext: true + right: + value: + simple: Completed + - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Distribution.status + iscontext: true + right: + value: + simple: In Progress + view: |- + { + "position": { + "x": 480, + "y": 4715 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "21": + id: "21" + taskid: 624af7da-e165-4ac5-8b42-548b2dbb604c + type: regular + task: + id: 624af7da-e165-4ac5-8b42-548b2dbb604c + description: xdr-get-audit-management-logs + version: -1 + name: xdr-get-audit-management-logs + script: '|||xdr-get-audit-management-logs' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "22" + scriptarguments: + email: {} + limit: + simple: "5" + page: {} + result: {} + sort_by: + simple: sub_type + sort_order: + simple: asc + sub_type: + simple: Authentication failed + timestamp_gte: + simple: "0" + timestamp_lte: {} + type: {} + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 5240 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "22": + id: "22" + taskid: db186f18-6d55-4fc2-837c-4548f5489369 + type: condition + task: + id: db186f18-6d55-4fc2-837c-4548f5489369 + description: Verify Outputs + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "23" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: containsGeneral + left: + value: + simple: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ENTITY_SUBTYPE + iscontext: true + right: + value: + simple: Authentication failed + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ID + iscontext: true + view: |- + { + "position": { + "x": 480, + "y": 5415 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "23": + id: "23" + taskid: f3db00eb-73a6-43c9-8e0d-a2d2f97af3c0 + type: regular + task: + id: f3db00eb-73a6-43c9-8e0d-a2d2f97af3c0 + description: xdr-get-audit-agent-reports + version: -1 + name: xdr-get-audit-agent-reports + script: '|||xdr-get-audit-agent-reports' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "24" + scriptarguments: + endpoint_ids: {} + endpoint_names: + simple: ip-172-31-15-237.eu-central-1.compute.internal + limit: + simple: "5" + page: {} + result: + simple: Success + sort_by: + simple: category + sort_order: + simple: desc + sub_type: {} + timestamp_gte: + simple: "2019-10-10" + timestamp_lte: {} + type: {} + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 5590 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "24": + id: "24" + taskid: d57ea2a9-bfcc-49f3-8ad1-61c90a05e19b + type: condition + task: + id: d57ea2a9-bfcc-49f3-8ad1-61c90a05e19b + description: Verify Outputs + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "37" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: containsGeneral + left: + value: + simple: PaloAltoNetworksXDR.AuditAgentReports.ENDPOINTNAME + iscontext: true + right: + value: + simple: ip-172-31-15-237.eu-central-1.compute.internal + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.AuditAgentReports.ENDPOINTID + iscontext: true + view: |- + { + "position": { + "x": 480, + "y": 5765 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "25": + id: "25" + taskid: 615404f8-b3ef-47a5-8052-ed8118fae345 + type: title + task: + id: 615404f8-b3ef-47a5-8052-ed8118fae345 + description: Test Done + version: -1 + name: Test Done + type: title + iscommand: false + brand: "" + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 6465 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "26": + id: "26" + taskid: e4aa305b-2acd-4a14-80fd-d8cd62da7f98 + type: condition + task: + id: e4aa305b-2acd-4a14-80fd-d8cd62da7f98 + description: Verify Outputs + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "6" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Incident.incident_id + iscontext: true + - - operator: isExists + left: + value: + simple: PaloAltoNetworksXDR.Incident.manual_severity + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Incident.severity + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Incident.xdr_url + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Incident.status + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.alert_id + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Incident.alerts.source + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip + iscontext: true + view: |- + { + "position": { + "x": 377.5, + "y": 895 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "27": + id: "27" + taskid: 2a7808f4-a68a-4125-8d2a-a0b6835bb01a + type: regular + task: + id: 2a7808f4-a68a-4125-8d2a-a0b6835bb01a + description: Save incident id + version: -1 + name: Save incident id + scriptName: Set + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "28" + scriptarguments: + append: {} + key: + simple: XDRIncidentID + value: + complex: + root: PaloAltoNetworksXDR + accessor: Incident.incident_id + transformers: + - operator: FirstArrayElement + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 1245 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "28": + id: "28" + taskid: d98a8474-de4c-4e39-8b14-7fbe19019fea + type: regular + task: + id: d98a8474-de4c-4e39-8b14-7fbe19019fea + description: DeleteContext + version: -1 + name: DeleteContext + scriptName: DeleteContext + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "29" + scriptarguments: + all: + simple: "yes" + index: {} + key: {} + keysToKeep: + simple: XDRIncidentID + subplaybook: {} + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 1420 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "29": + id: "29" + taskid: 87d97429-af45-4256-8f3e-e4ad149cb0fe + type: regular + task: + id: 87d97429-af45-4256-8f3e-e4ad149cb0fe + description: xdr-get-incidents + version: -1 + name: xdr-get-incidents + script: '|||xdr-get-incidents' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "30" + scriptarguments: + gte_creation_time: {} + gte_modification_time: {} + incident_id_list: + simple: ${XDRIncidentID} + limit: {} + lte_creation_time: {} + lte_modification_time: {} + page: {} + since_creation_time: {} + since_modification_time: {} + sort_by_creation_time: + simple: desc + sort_by_modification_time: {} + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 1595 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "30": + id: "30" + taskid: 720a9abf-e9b2-41bc-8097-4d481d2b0f15 + type: condition + task: + id: 720a9abf-e9b2-41bc-8097-4d481d2b0f15 + description: Verify updated values + version: -1 + name: Verify updated values + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "31" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.severity + iscontext: true + right: + value: + simple: high + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Incident.status + iscontext: true + right: + value: + simple: under_investigation + view: |- + { + "position": { + "x": 377.5, + "y": 1770 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "31": + id: "31" + taskid: d740b797-ab8e-445f-8323-d65abb4a17fa + type: regular + task: + id: d740b797-ab8e-445f-8323-d65abb4a17fa + description: xdr-update-incident + version: -1 + name: xdr-update-incident + script: '|||xdr-update-incident' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "7" + scriptarguments: + assigned_user_mail: {} + assigned_user_pretty_name: {} + incident_id: + simple: ${PaloAltoNetworksXDR.Incident.incident_id} + manual_severity: + simple: LOW + resolve_comment: {} + status: + simple: NEW + unassign_user: {} + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 1945 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "32": + id: "32" + taskid: 0e64b2a0-561d-4066-862e-7a7e798cd2a4 + type: regular + task: + id: 0e64b2a0-561d-4066-862e-7a7e798cd2a4 + description: Set 2 CEF alerts to context + version: -1 + name: Set 2 CEF alerts to context + scriptName: Set + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "8" + scriptarguments: + append: + simple: "false" + key: + simple: cef_alerts + value: + simple: |- + [ + "CEF:0|Check Point|VPN-1 & FireWall-1|Check Point|Log|microsoft-ds|Unknown|act=AcceptdeviceDirection=0 rt=1569477512000 spt=56957 dpt=445 cs2Label=Rule Name cs2=ADPrimery layer_name=FW_Device_blackened Securitylayer_uuid=07693fc7-1a5c-4f31-8afe-77ae96c71b8c match_id=1806 parent_rule=0rule_action=Accept rule_uid=8e45f36b-d106-4d81-a1f0-9d1ed9a6be5c ifname=bond2logid=0 loguid={0x5d8c5388,0x61,0x29321fac,0xc0000022} origin=1.1.1.1originsicname=CN=DWdeviceBlackend,O=Blackend sequencenum=363 version=5dst=1.1.1.1 inzone=External outzone=Internal product=VPN-1 & FireWall-1 proto=6service_id=microsoft-ds src=1.1.1.1", + "CEF:0|Check Point|VPN-1 & FireWall-1|Check Point|Log|Log|Unknown|act=AcceptdeviceDirection=0 rt=1569477501000 spt=63088 dpt=5985 cs2Label=Rule Namelayer_name=FW_Device_blackened Securitylayer_uuid=07693fc7-1a5c-4f31-8afe-77ae96c71b8c match_id=8899 parent_rule=0rule_action=Accept rule_uid=ae987933-82c0-470f-ab1c-1ad552c82369conn_direction=Internal ifname=bond1.12 logid=0loguid={0x5d8c537d,0xbb,0x29321fac,0xc0000014} origin=1.1.1.1originsicname=CN=DWdeviceBlackend,O=Blackend sequencenum=899 version=5dst=1.1.1.1 product=VPN-1 & FireWall-1 proto=6 src=1.1.1.1" + ] + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 2295 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "33": + id: "33" + taskid: 00ae118d-49eb-4202-8fd2-2b9705b3ebf4 + type: regular + task: + id: 00ae118d-49eb-4202-8fd2-2b9705b3ebf4 + version: -1 + name: Get Endpoint f8a2f58846b542579c12090652e79f3d + description: Gets a list of endpoints, according to the passed filters. Filtering + by multiple fields will be concatenated using AND condition (OR is not supported). + Maximum result set size is 100. Offset is the zero-based number of endpoint + from the start of the result set (start by counting from 0). + script: '|||xdr-get-endpoints' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "34" + scriptarguments: + alias_name: {} + dist_name: {} + endpoint_id_list: + simple: f8a2f58846b542579c12090652e79f3d + first_seen_gte: {} + first_seen_lte: {} + group_name: {} + hostname: {} + ip_list: {} + isolate: {} + last_seen_gte: {} + last_seen_lte: {} + limit: {} + page: {} + platform: {} + sort_by: {} + sort_order: {} + separatecontext: false + view: |- + { + "position": { + "x": 377.5, + "y": 2645 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "34": + id: "34" + taskid: a5be6ecb-b120-4a80-88f1-9898d9cd5b14 + type: condition + task: + id: a5be6ecb-b120-4a80-88f1-9898d9cd5b14 + description: To isolate + version: -1 + name: To isolate ? + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "35" + "yes": + - "9" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Endpoint.is_isolated + iscontext: true + right: + value: + simple: AGENT_UNISOLATED + view: |- + { + "position": { + "x": 377.5, + "y": 2820 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "35": + id: "35" + taskid: c2d6af71-0729-4500-8588-8dd36d5d78a1 + type: condition + task: + id: c2d6af71-0729-4500-8588-8dd36d5d78a1 + description: To unisolate + version: -1 + name: To unisolate? + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "36" + "yes": + - "10" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + simple: PaloAltoNetworksXDR.Endpoint.is_isolated + iscontext: true + right: + value: + simple: AGENT_ISOLATED + view: |- + { + "position": { + "x": 592.5, + "y": 2995 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "36": + id: "36" + taskid: 7b83fd0d-4bc0-46bb-8d8e-993659170860 + type: title + task: + id: 7b83fd0d-4bc0-46bb-8d8e-993659170860 + description: Isolation done + version: -1 + name: Isolation done + type: title + iscommand: false + brand: "" + nexttasks: + '#none#': + - "11" + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 3345 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "37": + id: "37" + taskid: 3927ff9f-29d2-4bb2-8136-252061bd227f + type: regular + task: + id: 3927ff9f-29d2-4bb2-8136-252061bd227f + version: -1 + name: xdr-get-endpoints + description: Gets a list of endpoints, according to the passed filters. If there + are no filters it will return all endpoints. Filtering by multiple fields + will be concatenated using AND condition (OR is not supported). Maximum result + set size is 100. Offset is the zero-based number of endpoint from the start + of the result set (start by counting from 0). + script: Cortex XDR - IR|||xdr-get-endpoints + type: regular + iscommand: true + brand: Cortex XDR - IR + nexttasks: + '#none#': + - "38" + scriptarguments: + alias_name: {} + dist_name: {} + endpoint_id_list: {} + first_seen_gte: {} + first_seen_lte: {} + group_name: {} + hostname: {} + ip_list: {} + isolate: {} + last_seen_gte: {} + last_seen_lte: {} + limit: {} + page: {} + platform: {} + sort_by: {} + sort_order: {} + separatecontext: false + view: |- + { + "position": { + "x": 480, + "y": 5940 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "38": + id: "38" + taskid: 9c91a2d8-16ad-41b6-8dc4-5447d345a88d + type: condition + task: + id: 9c91a2d8-16ad-41b6-8dc4-5447d345a88d + description: Check the number of endpoints in context + version: -1 + name: Check the number of endpoints in context + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "39" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: greaterThanOrEqual + left: + value: + complex: + root: PaloAltoNetworksXDR + accessor: Endpoint + transformers: + - operator: count + iscontext: true + right: + value: + simple: "3" + view: |- + { + "position": { + "x": 480, + "y": 6115 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "39": + id: "39" + taskid: 9d92c2f5-e835-4fd0-8cd1-8ecff6a721c5 + type: playbook + task: + id: 9d92c2f5-e835-4fd0-8cd1-8ecff6a721c5 + description: Cortex XDR - quarantine file + version: -1 + name: Cortex XDR - quarantine file + playbookName: Cortex XDR - quarantine file + type: playbook + iscommand: false + brand: "" + nexttasks: + '#none#': + - "25" + scriptarguments: + endpoint_id: + simple: ea303670c76e4ad09600c8b346f7c804 + file_hash: + simple: 55f8718109829bf506b09d8af615b9f107a266e19f7a311039d1035f180b22d4 + file_path: + simple: /home/ec2-user/test_file.txt + separatecontext: true + loop: + iscommand: false + exitCondition: "" + wait: 1 + max: 100 + view: |- + { + "position": { + "x": 480, + "y": 6290 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 6480, + "width": 922.5, + "x": 50, + "y": 50 + } + } + } +inputs: [] +outputs: [] +fromversion: 5.0.0 diff --git a/Packs/CortexXDR/TestPlaybooks/playbook-Cortex_XDR.yml b/Packs/CortexXDR/TestPlaybooks/Test_XDR_Playbook_4_5.yml similarity index 97% rename from Packs/CortexXDR/TestPlaybooks/playbook-Cortex_XDR.yml rename to Packs/CortexXDR/TestPlaybooks/Test_XDR_Playbook_4_5.yml index 64c7cec114a..9a66d8f04f1 100644 --- a/Packs/CortexXDR/TestPlaybooks/playbook-Cortex_XDR.yml +++ b/Packs/CortexXDR/TestPlaybooks/Test_XDR_Playbook_4_5.yml @@ -18,6 +18,7 @@ tasks: task: brand: "" id: 9355e318-8324-466b-8fb4-4074ccd511fe + description: "" iscommand: false name: "" version: -1 @@ -47,6 +48,7 @@ tasks: task: brand: "" id: 4d9fdb93-3ca3-448b-8eeb-535d341f59ef + description: "" iscommand: true name: DeleteContext script: DeleteContext @@ -90,6 +92,7 @@ tasks: task: brand: "" id: a0ef4168-fe72-4591-869a-aa553465b72a + description: "" iscommand: true name: xdr-get-incidents script: '|||xdr-get-incidents' @@ -141,6 +144,7 @@ tasks: task: brand: "" id: e6af4d9d-1aaf-45b6-8d1c-8bdbf1fbf86a + description: "" iscommand: false name: Verify Outputs type: condition @@ -172,6 +176,7 @@ tasks: task: brand: "" id: f3137c58-fdc7-4cfe-8d12-6edea202715c + description: "" iscommand: true name: xdr-get-incident-extra-data script: '|||xdr-get-incident-extra-data' @@ -215,6 +220,7 @@ tasks: task: brand: "" id: 37df27a3-05f5-4de2-8e0e-b1e2f36b9c7a + description: "" iscommand: true name: xdr-update-incident script: '|||xdr-update-incident' @@ -263,6 +269,7 @@ tasks: task: brand: "" id: 6cdbae07-a4e1-4029-84fa-9bcc3327fe0d + description: "" iscommand: true name: xdr-insert-parsed-alert script: '|||xdr-insert-parsed-alert' @@ -294,6 +301,7 @@ tasks: task: brand: "" id: a9fac6eb-5fd0-476f-831c-5789a22aaf3a + description: "" iscommand: true name: xdr-insert-cef-alerts script: '|||xdr-insert-cef-alerts' @@ -325,6 +333,7 @@ tasks: task: brand: "" id: ef67ef33-4848-4c03-88cf-d83d6cf01c90 + description: "" iscommand: true name: xdr-isolate-endpoint script: '|||xdr-isolate-endpoint' @@ -356,6 +365,7 @@ tasks: task: brand: "" id: 0eb4df46-64f8-459b-86e0-572f4fea3515 + description: "" iscommand: true name: xdr-unisolate-endpoint script: '|||xdr-unisolate-endpoint' @@ -402,6 +412,7 @@ tasks: task: brand: "" id: ad23f640-061a-4808-8649-487716541214 + description: "" iscommand: true name: xdr-get-endpoints script: '|||xdr-get-endpoints' @@ -451,6 +462,7 @@ tasks: task: brand: "" id: 7496a0ca-9f0d-4737-8ee4-af1c7415c067 + description: "" iscommand: false name: Verify Outputs type: condition @@ -478,6 +490,7 @@ tasks: task: brand: "" id: 3eac9fc0-8fb0-4dc9-8178-992e77203152 + description: "" iscommand: true name: xdr-get-distribution-versions script: '|||xdr-get-distribution-versions' @@ -520,6 +533,7 @@ tasks: brand: "" id: 69d299b3-d921-47cf-8152-80a9a3cd73bc iscommand: false + description: "" name: Verify Outputs type: condition version: -1 @@ -561,6 +575,7 @@ tasks: task: brand: "" id: dca70b3c-5bcc-4f1b-8786-3156727412a3 + description: "" iscommand: true name: xdr-create-distribution script: '|||xdr-create-distribution' @@ -602,6 +617,7 @@ tasks: task: brand: "" id: 049e8330-1afe-443b-869f-7ccd349ce4f6 + description: "" iscommand: false name: Verify Outputs type: condition @@ -634,6 +650,7 @@ tasks: task: brand: "" id: ec2b489a-fc34-475a-80f4-5176ca075065 + description: "" iscommand: true name: xdr-get-distribution-url script: '|||xdr-get-distribution-url' @@ -670,6 +687,7 @@ tasks: task: brand: "" id: ed313752-24c0-4d75-8d67-e56c7c33945b + description: "" iscommand: false name: Verify Outputs type: condition @@ -700,6 +718,7 @@ tasks: task: brand: "" id: d62689f5-ded4-4dbe-8440-96ca4b78580e + description: "" iscommand: true name: xdr-get-create-distribution-status script: '|||xdr-get-create-distribution-status' @@ -747,6 +766,7 @@ tasks: task: brand: "" id: 4c4e0329-3a96-4e8b-80df-4ee37b9f0901 + description: "" iscommand: false name: Verify Outputs type: condition @@ -790,6 +810,7 @@ tasks: task: brand: "" id: 0406e70a-94d6-4d45-89f2-70eded44c87f + description: "" iscommand: true name: xdr-get-audit-management-logs script: '|||xdr-get-audit-management-logs' @@ -834,6 +855,7 @@ tasks: task: brand: "" id: 70a198c1-491f-4f22-80fb-608e8c6bf7dc + description: "" iscommand: false name: Verify Outputs type: condition @@ -879,6 +901,7 @@ tasks: task: brand: "" id: c7d9dfcb-07a1-4fae-8140-cf322be8ed14 + description: "" iscommand: true name: xdr-get-audit-agent-reports script: '|||xdr-get-audit-agent-reports' @@ -923,6 +946,7 @@ tasks: task: brand: "" id: 31afe79e-32c1-42d8-8147-fe3ca4058155 + description: "" iscommand: false name: Verify Outputs type: condition @@ -947,6 +971,7 @@ tasks: task: brand: "" id: 562290eb-0d5a-4d24-8dc7-cbded688a67b + description: "" iscommand: false name: Test Done type: title @@ -1017,6 +1042,7 @@ tasks: task: brand: "" id: fbcad57e-344c-4cdc-84e8-bd4b07697a33 + description: "" iscommand: false name: Verify Outputs type: condition @@ -1054,6 +1080,7 @@ tasks: task: brand: "" id: 25c16991-1bdb-489a-80cd-be88c0091445 + description: "" iscommand: false name: Save incident id script: Set @@ -1090,6 +1117,7 @@ tasks: task: brand: "" id: c8f0f96a-1b36-40f7-8334-01a4736bb12f + description: "" iscommand: false name: DeleteContext script: DeleteContext @@ -1132,6 +1160,7 @@ tasks: task: brand: "" id: 89b9c63f-8b18-4054-8994-89ff54428f51 + description: "" iscommand: true name: xdr-get-incidents script: '|||xdr-get-incidents' @@ -1179,6 +1208,7 @@ tasks: task: brand: "" id: f169eea2-8fa4-469c-8496-c72b0a2cab3a + description: "" iscommand: false name: Verify updated values type: condition @@ -1217,6 +1247,7 @@ tasks: task: brand: "" id: 24ff66cb-1608-47ba-843e-d07847feeea0 + description: "" iscommand: true name: xdr-update-incident script: '|||xdr-update-incident' @@ -1256,6 +1287,7 @@ tasks: task: brand: "" id: 2d5419ec-5638-4c7a-89c3-fb33dc440611 + description: "" iscommand: false name: Set 2 CEF alerts to context script: Set @@ -1347,6 +1379,7 @@ tasks: task: brand: "" id: 8a3140eb-1c78-4bb2-8778-6367d4c3ba8e + description: "" iscommand: false name: To isolate ? type: condition @@ -1387,6 +1420,7 @@ tasks: task: brand: "" id: 174dbc0a-1d7d-45bf-8a4e-364455969582 + description: "" iscommand: false name: To unisolate? type: condition @@ -1414,6 +1448,7 @@ tasks: task: brand: "" id: 7abc47d8-83cb-4815-8863-893b60f9f145 + description: "" iscommand: false name: Isolation done type: title @@ -1506,6 +1541,7 @@ tasks: task: brand: "" id: dc496915-021f-421a-8ead-af206b54f671 + description: "" iscommand: false name: Check the number of endpoints in context type: condition @@ -1534,3 +1570,4 @@ view: |- } } fromversion: 4.1.0 +toversion: 4.9.9 \ No newline at end of file diff --git a/Packs/CortexXDR/doc_files/Cortex_XDR_-_Malware_Investigation.png b/Packs/CortexXDR/doc_files/Cortex_XDR_-_Malware_Investigation.png new file mode 100644 index 00000000000..709aea7faae Binary files /dev/null and b/Packs/CortexXDR/doc_files/Cortex_XDR_-_Malware_Investigation.png differ diff --git a/Packs/CortexXDR/doc_files/Cortex_XDR_-_Port_Scan_-_Adjusted.png b/Packs/CortexXDR/doc_files/Cortex_XDR_-_Port_Scan_-_Adjusted.png new file mode 100644 index 00000000000..a337b45387d Binary files /dev/null and b/Packs/CortexXDR/doc_files/Cortex_XDR_-_Port_Scan_-_Adjusted.png differ diff --git a/Packs/CortexXDR/doc_files/Cortex_XDR_Alerts_Handling.png b/Packs/CortexXDR/doc_files/Cortex_XDR_Alerts_Handling.png new file mode 100644 index 00000000000..e7a4d35c66c Binary files /dev/null and b/Packs/CortexXDR/doc_files/Cortex_XDR_Alerts_Handling.png differ diff --git a/Packs/CortexXDR/doc_files/Cortex_XDR_incident_handling_v2.png b/Packs/CortexXDR/doc_files/Cortex_XDR_incident_handling_v2.png new file mode 100644 index 00000000000..be7bf8420e3 Binary files /dev/null and b/Packs/CortexXDR/doc_files/Cortex_XDR_incident_handling_v2.png differ diff --git a/Packs/CortexXDR/pack_metadata.json b/Packs/CortexXDR/pack_metadata.json index a884bd9dcc6..caed2b290e7 100644 --- a/Packs/CortexXDR/pack_metadata.json +++ b/Packs/CortexXDR/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Palo Alto Networks Cortex XDR - Investigation and Response", "description": "Cortex XDR is the world's first detection and response app that natively integrates network, endpoint and cloud data to stop sophisticated attacks.", "support": "xsoar", - "currentVersion": "1.0.2", + "currentVersion": "2.0.0", "author": "Cortex XSOAR ", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/CounterCraft/pack_metadata.json b/Packs/CounterCraft/pack_metadata.json index 9fd9386518d..ca3d66db618 100644 --- a/Packs/CounterCraft/pack_metadata.json +++ b/Packs/CounterCraft/pack_metadata.json @@ -1,11 +1,11 @@ { "name": "CounterCraft Deception Director", "description": "CounterCraft Deception Solution detects advanced adversaries. Automate counterintelligence campaigns to discover targeted attacks with real-time active response.", - "support": "xsoar", + "support": "partner", "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", + "author": "Counter Craft", + "url": "", + "email": "support@countercraft.zendesk.com", "created": "2020-04-14T00:00:00Z", "categories": [ "Deception" diff --git a/Packs/CrisisManagement/Playbooks/Employee_Status_Survey_README.md b/Packs/CrisisManagement/Playbooks/Employee_Status_Survey_README.md index a7d073f0f20..e45b258aec0 100644 --- a/Packs/CrisisManagement/Playbooks/Employee_Status_Survey_README.md +++ b/Packs/CrisisManagement/Playbooks/Employee_Status_Survey_README.md @@ -32,7 +32,4 @@ There are no outputs for this playbook. ## Playbook Image --- -![Employee_Status_Survey](https://raw.githubusercontent.com/demisto/content/ec6cda315c0d1e15cf36a3c93cc936dd90dfbc48/Packs/CrisisManagement/doc_files/Employee_Status_Survey.png) - -## Playbook Demo Video -[Crisis Management in Cortex XSOAR](https://www.youtube.com/watch?v=J6DcD5y5B_U "Crisis Management in Cortex XSOAR") +![Employee_Status_Survey](https://raw.githubusercontent.com/demisto/content/ec6cda315c0d1e15cf36a3c93cc936dd90dfbc48/Packs/CrisisManagement/doc_files/Employee_Status_Survey.png) \ No newline at end of file diff --git a/Packs/CrisisManagement/Playbooks/Process_Survey_Response.yml b/Packs/CrisisManagement/Playbooks/Process_Survey_Response.yml index 2d8ec83434d..a883be1f9b0 100644 --- a/Packs/CrisisManagement/Playbooks/Process_Survey_Response.yml +++ b/Packs/CrisisManagement/Playbooks/Process_Survey_Response.yml @@ -1317,7 +1317,7 @@ fromversion: 5.5.0 tests: - No tests (auto formatted) description: "Note: This is a beta playbook, which lets you implement and test pre-release - software. Since the playbook is beta, it might contain bugs. Updates to the playbook + software. Since the playbook is in beta, it might contain bugs. Updates to the playbook during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the playbook to help us identify issues, fix them, and continually improve. This playbook processes the survery responses. It updates that the employee responded to the survey and what their health status is. If necessary, it opens IT or HR incidents, and updates the process survey tracker." diff --git a/Packs/CrisisManagement/README.md b/Packs/CrisisManagement/README.md index e69de29bb2d..133daa25285 100644 --- a/Packs/CrisisManagement/README.md +++ b/Packs/CrisisManagement/README.md @@ -0,0 +1 @@ +[![Crisis Management in Cortex XSOAR](https://img.youtube.com/vi/J6DcD5y5B_U/0.jpg)](https://www.youtube.com/watch?v=J6DcD5y5B_U "Crisis Management in Cortex XSOAR") \ No newline at end of file diff --git a/Packs/CrisisManagement/ReleaseNotes/1_1_0.md b/Packs/CrisisManagement/ReleaseNotes/1_1_0.md index 93a9477ab5b..1ee969dd62e 100644 --- a/Packs/CrisisManagement/ReleaseNotes/1_1_0.md +++ b/Packs/CrisisManagement/ReleaseNotes/1_1_0.md @@ -1,3 +1,3 @@ - \ No newline at end of file diff --git a/Packs/CrisisManagement/ReleaseNotes/1_1_1.md b/Packs/CrisisManagement/ReleaseNotes/1_1_1.md new file mode 100644 index 00000000000..58dfda4719c --- /dev/null +++ b/Packs/CrisisManagement/ReleaseNotes/1_1_1.md @@ -0,0 +1,5 @@ + \ No newline at end of file diff --git a/Packs/CrisisManagement/pack_metadata.json b/Packs/CrisisManagement/pack_metadata.json index 5e2814a9ab4..73c1b1d04d4 100644 --- a/Packs/CrisisManagement/pack_metadata.json +++ b/Packs/CrisisManagement/pack_metadata.json @@ -1,25 +1,23 @@ -{ - "name": "Crisis Management", - "description": "Manage crises such as pandemics or other events that would change the conditions under which employees would normally work. Note: This is a beta pack, which lets you implement and test pre-release software. Since the pack is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.", - "support": "xsoar", - "certification": "", - "currentVersion": "1.1.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "categories": [ - "Case Management" - ], - "tags": [ - "Crisis", - "Pandemic", - "Remote Work", - "COVID-19" - ], - "created": "2020-05-06T08:54:47Z", - "updated": "2020-05-06T08:54:47Z", - "useCases": [ - "Crisis Management" - ], - "keywords": [] +{ + "name": "Crisis Management", + "description": "Manage crises such as pandemics or other events that would change the conditions under which employees would normally work. Note: This is a beta pack, which lets you implement and test pre-release software. Since the pack is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.", + "support": "xsoar", + "currentVersion": "1.1.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "categories": [ + "Case Management" + ], + "tags": [ + "Crisis", + "Pandemic", + "Remote Work", + "COVID-19" + ], + "created": "2020-05-06T08:54:47Z", + "useCases": [ + "Crisis Management" + ], + "keywords": [] } \ No newline at end of file diff --git a/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py b/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py index 6a7ec846692..6270a173fa4 100644 --- a/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py +++ b/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py @@ -1267,7 +1267,7 @@ def upload_file_command(): response, file_name = upload_file(entry_id, description) - return create_entry_object(contents=response, hr=f'File was uploaded successfully') + return create_entry_object(contents=response, hr='File was uploaded successfully') def delete_file_command(): diff --git a/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.yml b/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.yml index caeda834f47..39931071c95 100644 --- a/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.yml +++ b/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.yml @@ -689,7 +689,7 @@ script: - contextPath: CrowdStrike.Command.FullCommand description: The full command. type: String - dockerimage: demisto/python3:3.7.2.200 + dockerimage: demisto/python3:3.8.3.8715 isfetch: true longRunning: false longRunningPort: false diff --git a/Packs/CrowdStrikeFalcon/ReleaseNotes/1_0_1.md b/Packs/CrowdStrikeFalcon/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..80d58df2543 --- /dev/null +++ b/Packs/CrowdStrikeFalcon/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### CrowdstrikeFalcon +- Internal code improvements. diff --git a/Packs/CrowdStrikeFalcon/pack_metadata.json b/Packs/CrowdStrikeFalcon/pack_metadata.json index 0774e76f11a..ce464ffaef3 100644 --- a/Packs/CrowdStrikeFalcon/pack_metadata.json +++ b/Packs/CrowdStrikeFalcon/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "CrowdStrike Falcon", - "description": "The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Endpoint" - ], - "tags": [], - "useCases": [], - "keywords": [] -} + "name": "CrowdStrike Falcon", + "description": "The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Endpoint" + ], + "tags": [], + "useCases": [], + "keywords": [] +} \ No newline at end of file diff --git a/Packs/CrowdStrikeHost/.pack-ignore b/Packs/CrowdStrikeHost/.pack-ignore index e69de29bb2d..f6a6e9d9282 100644 --- a/Packs/CrowdStrikeHost/.pack-ignore +++ b/Packs/CrowdStrikeHost/.pack-ignore @@ -0,0 +1,5 @@ +[file:playbook-Search_Endpoints_By_Hash_-_CrowdStrike.yml] +ignore=BA101 + +[file:playbook-CrowdStrike_Endpoint_Enrichment.yml] +ignore=BA101 diff --git a/Packs/CrowdStrikeHost/Playbooks/playbook-CrowdStrike_Rapid_IOC_Hunting_v2.yml b/Packs/CrowdStrikeHost/Playbooks/playbook-CrowdStrike_Rapid_IOC_Hunting_v2.yml new file mode 100644 index 00000000000..dd4dd518c05 --- /dev/null +++ b/Packs/CrowdStrikeHost/Playbooks/playbook-CrowdStrike_Rapid_IOC_Hunting_v2.yml @@ -0,0 +1,568 @@ +id: CrowdStrike Rapid IOC Hunting v2 +version: -1 +name: CrowdStrike Rapid IOC Hunting v2 +description: Hunt for endpoint activity involving hash and domain IOCs using Crowdstrike + Falcon Host.\nAlso use AnalystEmail label to determine where to send an email alert + if something is found. +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: e4894164-409a-4adc-87bc-96a530ba8a27 + type: start + task: + id: e4894164-409a-4adc-87bc-96a530ba8a27 + version: -1 + name: "" + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "16" + separatecontext: false + view: |- + { + "position": { + "x": 1062.5, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + "1": + id: "1" + taskid: 295e9ac6-c665-4a4e-8d23-a0903a666143 + type: condition + task: + id: 295e9ac6-c665-4a4e-8d23-a0903a666143 + version: -1 + name: Are there domains to hunt? + description: Check if a context key is set. Can also optionally provide a value + argument to compare against context data for this key. + scriptName: Exists + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "9" + "yes": + - "5" + scriptarguments: + value: + simple: ${Domain} + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 515 + } + } + note: false + timertriggers: [] + ignoreworker: false + "2": + id: "2" + taskid: ddaf36d8-5125-4b61-8f48-190aee2586f0 + type: condition + task: + id: ddaf36d8-5125-4b61-8f48-190aee2586f0 + version: -1 + name: Are there MD5s to hunt? + description: Check if a context key is set. Can also optionally provide a value + argument to compare against context data for this key. + scriptName: Exists + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "9" + "yes": + - "6" + scriptarguments: + value: + simple: ${File.MD5} + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 500, + "y": 515 + } + } + note: false + timertriggers: [] + ignoreworker: false + "3": + id: "3" + taskid: ca2f470d-41dd-4d21-8c26-98a5169bc0cd + type: condition + task: + id: ca2f470d-41dd-4d21-8c26-98a5169bc0cd + version: -1 + name: Are there SHA1s to hunt? + description: Check if a context key is set. Can also optionally provide a value + argument to compare against context data for this key. + scriptName: Exists + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "9" + "yes": + - "7" + scriptarguments: + value: + simple: ${File.SHA1} + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 950, + "y": 515 + } + } + note: false + timertriggers: [] + ignoreworker: false + "4": + id: "4" + taskid: 0f812845-70a9-4408-83cf-74c92d1915a2 + type: condition + task: + id: 0f812845-70a9-4408-83cf-74c92d1915a2 + version: -1 + name: Are there SHA256s to hunt? + description: Check if a context key is set. Can also optionally provide a value + argument to compare against context data for this key. + scriptName: Exists + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "9" + "yes": + - "8" + scriptarguments: + value: + simple: ${File.SHA256} + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 1400, + "y": 515 + } + } + note: false + timertriggers: [] + ignoreworker: false + "5": + id: "5" + taskid: 892f37be-8fb0-493f-8c86-b64fedf6b049 + type: regular + task: + id: 892f37be-8fb0-493f-8c86-b64fedf6b049 + version: -1 + name: Hunt for devices accessing bad domains + description: Returns a list of device IDs on which an indicator ran. + script: FalconHost|||cs-device-ran-on + type: regular + iscommand: true + brand: FalconHost + nexttasks: + '#none#': + - "9" + scriptarguments: + type: + simple: domain + value: + simple: ${Domain.Name} + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 162.5, + "y": 690 + } + } + note: false + timertriggers: [] + ignoreworker: false + "6": + id: "6" + taskid: 79c5b224-634c-4ea7-8604-a94bd0637419 + type: regular + task: + id: 79c5b224-634c-4ea7-8604-a94bd0637419 + version: -1 + name: Hunt for devices running MD5 + description: | + Returns a list of device IDs on which an indicator ran. + script: FalconHost|||cs-device-ran-on + type: regular + iscommand: true + brand: FalconHost + nexttasks: + '#none#': + - "9" + scriptarguments: + type: + simple: md5 + value: + simple: ${File.MD5} + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 612.5, + "y": 690 + } + } + note: false + timertriggers: [] + ignoreworker: false + "7": + id: "7" + taskid: f42da4b9-e44a-47f7-8bd3-58ebc367fd29 + type: regular + task: + id: f42da4b9-e44a-47f7-8bd3-58ebc367fd29 + version: -1 + name: Hunt for devices accessing SHA1 + description: Returns a list of device IDs on which an indicator ran. + script: FalconHost|||cs-device-ran-on + type: regular + iscommand: true + brand: FalconHost + nexttasks: + '#none#': + - "9" + scriptarguments: + type: + simple: sha1 + value: + simple: ${File.SHA1} + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 1062.5, + "y": 690 + } + } + note: false + timertriggers: [] + ignoreworker: false + "8": + id: "8" + taskid: 85fdaa12-b5f9-44c3-81e9-029353b53de2 + type: regular + task: + id: 85fdaa12-b5f9-44c3-81e9-029353b53de2 + version: -1 + name: Hunt for devices accessing SHA256 + description: Returns a list of device IDs on which an indicator ran. + script: FalconHost|||cs-device-ran-on + type: regular + iscommand: true + brand: FalconHost + nexttasks: + '#none#': + - "9" + scriptarguments: + type: + simple: sha256 + value: + simple: ${File.SHA256} + continueonerror: true + separatecontext: false + view: |- + { + "position": { + "x": 1512.5, + "y": 690 + } + } + note: false + timertriggers: [] + ignoreworker: false + "9": + id: "9" + taskid: fee08a36-3893-425d-8329-77cea06d0d53 + type: title + task: + id: fee08a36-3893-425d-8329-77cea06d0d53 + version: -1 + name: Get device details and email + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "14" + separatecontext: false + view: |- + { + "position": { + "x": 725, + "y": 865 + } + } + note: false + timertriggers: [] + ignoreworker: false + "11": + id: "11" + taskid: ee1c2ef3-3993-4227-8e33-cd0baedeff6a + type: regular + task: + id: ee1c2ef3-3993-4227-8e33-cd0baedeff6a + version: -1 + name: Get device details + script: FalconHost|||cs-device-search + type: regular + iscommand: true + brand: FalconHost + description: Enrcich device information. + nexttasks: + '#none#': + - "12" + scriptarguments: + filter: {} + limit: {} + offset: {} + query: + simple: ${FalconHostDevices} + value: + simple: ${FalconHostDevices} + separatecontext: false + view: |- + { + "position": { + "x": 1512.5, + "y": 1185 + } + } + note: false + timertriggers: [] + ignoreworker: false + "12": + id: "12" + taskid: ace027f2-ca97-4786-8085-f2b98e47f964 + type: regular + task: + id: ace027f2-ca97-4786-8085-f2b98e47f964 + version: -1 + name: Notify analyst to review information + description: Sends an email using EWS. + script: '|||send-mail' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "13" + scriptarguments: + attachCIDs: {} + attachIDs: {} + attachNames: {} + bcc: {} + body: + simple: 'Hello,\nPlease review Cortex XSOAR incident "${incident.name} # ${incident.id} + " - results are waiting for you.' + cc: {} + htmlBody: {} + replyTo: {} + subject: + simple: 'Cortex XSOAR incident ${incident.name} # ${incident.id}' + to: + simple: ${incident.labels.AnalystEmail} + separatecontext: false + view: |- + { + "position": { + "x": 1512.5, + "y": 1360 + } + } + note: false + timertriggers: [] + ignoreworker: false + "13": + id: "13" + taskid: 4fde6e6e-c916-4a95-83e0-d716d9e58435 + type: regular + task: + id: 4fde6e6e-c916-4a95-83e0-d716d9e58435 + version: -1 + name: Analyst - review information + type: regular + iscommand: false + description: Review incident information + brand: "" + nexttasks: + '#none#': + - "15" + separatecontext: false + view: |- + { + "position": { + "x": 1512.5, + "y": 1535 + } + } + note: false + timertriggers: [] + ignoreworker: false + "14": + id: "14" + taskid: 6275c1bc-a359-444b-89aa-c6baf47db456 + type: condition + task: + id: 6275c1bc-a359-444b-89aa-c6baf47db456 + version: -1 + name: Found any devices? + scriptName: Exists + type: condition + iscommand: false + brand: "" + description: Conditional task to verify if devices found with suspicious indicator + nexttasks: + '#default#': + - "15" + "yes": + - "11" + scriptarguments: + value: + simple: ${FalconHostDevices} + separatecontext: false + view: |- + { + "position": { + "x": 725, + "y": 1010 + } + } + note: false + timertriggers: [] + ignoreworker: false + "15": + id: "15" + taskid: 063c114f-096a-476d-894c-18f3d802fc0f + type: title + task: + id: 063c114f-096a-476d-894c-18f3d802fc0f + version: -1 + name: Done + type: title + iscommand: false + brand: "" + description: '' + separatecontext: false + view: |- + { + "position": { + "x": 1175, + "y": 1710 + } + } + note: false + timertriggers: [] + ignoreworker: false + "16": + id: "16" + taskid: 9ba5d50c-d454-4b3e-8149-847fdfff135c + type: condition + task: + id: 9ba5d50c-d454-4b3e-8149-847fdfff135c + version: -1 + name: Is FalconHost enabled? + description: Check if a given value exists in the context. Will return 'no' + for empty empty arrays. To be used mostly with DQ and selectors. + scriptName: Exists + type: condition + iscommand: false + brand: "" + nexttasks: + '#default#': + - "15" + "yes": + - "17" + scriptarguments: + value: + simple: ${modules(val.brand == 'FalconHost' && val.state == 'active')} + separatecontext: false + view: |- + { + "position": { + "x": 1062.5, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + "17": + id: "17" + taskid: 06bbd1d4-24bf-4daa-8a57-b1925c9426ae + type: title + task: + id: 06bbd1d4-24bf-4daa-8a57-b1925c9426ae + version: -1 + name: Hunt for indicators + type: title + iscommand: false + brand: "" + description: '' + nexttasks: + '#none#': + - "1" + - "2" + - "3" + - "4" + separatecontext: false + view: |- + { + "position": { + "x": 725, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false +view: |- + { + "linkLabelsPosition": { + "14_11_yes": 0.55, + "4_8_yes": 0.56 + }, + "paper": { + "dimensions": { + "height": 1725, + "width": 1842.5, + "x": 50, + "y": 50 + } + } + } +inputs: [] +outputs: [] +fromversion: 5.0.0 +tests: +- No tests (auto formatted) diff --git a/Packs/CrowdStrikeHost/Playbooks/playbook-CrowdStrike_Rapid_IOC_Hunting_v2_README.md b/Packs/CrowdStrikeHost/Playbooks/playbook-CrowdStrike_Rapid_IOC_Hunting_v2_README.md new file mode 100644 index 00000000000..0619b5381f5 --- /dev/null +++ b/Packs/CrowdStrikeHost/Playbooks/playbook-CrowdStrike_Rapid_IOC_Hunting_v2_README.md @@ -0,0 +1,30 @@ +Hunt for endpoint activity involving hash and domain IOCs using Crowdstrike Falcon Host.\nAlso use AnalystEmail label to determine where to send an email alert if something is found. + +## Dependencies +This playbook uses the following sub-playbooks, integrations, and scripts. + +### Sub-playbooks +This playbook does not use any sub-playbooks. + +### Integrations +* FalconHost + +### Scripts +* Exists + +### Commands +* cs-device-search +* cs-device-ran-on +* send-mail + +## Playbook Inputs +--- +There are no inputs for this playbook. + +## Playbook Outputs +--- +There are no outputs for this playbook. + +## Playbook Image +--- +![CrowdStrike Rapid IOC Hunting v2](Insert the link to your image here) \ No newline at end of file diff --git a/Packs/CrowdStrikeHost/ReleaseNotes/1_1_1.md b/Packs/CrowdStrikeHost/ReleaseNotes/1_1_1.md new file mode 100644 index 00000000000..4e2a233ff31 --- /dev/null +++ b/Packs/CrowdStrikeHost/ReleaseNotes/1_1_1.md @@ -0,0 +1,9 @@ + +#### Integrations +- __FalconHost__ +Added support for 3 commands from the Threat graph API: + - ***cs-threatgraph-summary*** + - ***cs-threatgraph-processes*** + - ***cs-threatgraph-detections*** +#### Playbooks + - Added rapid ioc hunting v2 playbook and replaced deprecated scripts. diff --git a/Packs/CrowdStrikeHost/doc_files/CrowdStrike_Rapid_IOC_Hunting_v2.png b/Packs/CrowdStrikeHost/doc_files/CrowdStrike_Rapid_IOC_Hunting_v2.png new file mode 100644 index 00000000000..d9523028cb7 Binary files /dev/null and b/Packs/CrowdStrikeHost/doc_files/CrowdStrike_Rapid_IOC_Hunting_v2.png differ diff --git a/Packs/CrowdStrikeHost/pack_metadata.json b/Packs/CrowdStrikeHost/pack_metadata.json index c4877138592..360a7365ffc 100644 --- a/Packs/CrowdStrikeHost/pack_metadata.json +++ b/Packs/CrowdStrikeHost/pack_metadata.json @@ -2,7 +2,7 @@ "name": "FalconHost", "description": "Crowdstrike IOCs and detections API", "support": "xsoar", - "currentVersion": "1.1.0", + "currentVersion": "1.1.1", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Cylance_Protect/.pack-ignore b/Packs/Cylance_Protect/.pack-ignore index e69de29bb2d..2ed8f7a8013 100644 --- a/Packs/Cylance_Protect/.pack-ignore +++ b/Packs/Cylance_Protect/.pack-ignore @@ -0,0 +1,2 @@ +[file:playbook-Get_File_Sample_By_Hash_-_Cylance_Protect.yml] +ignore=BA101 diff --git a/Packs/DeveloperTools/TestPlaybooks/playbook-RegPathReputationBasicLists_test.yml b/Packs/D2/TestPlaybooks/playbook-RegPathReputationBasicLists_test.yml similarity index 100% rename from Packs/DeveloperTools/TestPlaybooks/playbook-RegPathReputationBasicLists_test.yml rename to Packs/D2/TestPlaybooks/playbook-RegPathReputationBasicLists_test.yml diff --git a/Packs/DeepInstinct/pack_metadata.json b/Packs/DeepInstinct/pack_metadata.json index 9e1fac9cf73..b8860b65828 100644 --- a/Packs/DeepInstinct/pack_metadata.json +++ b/Packs/DeepInstinct/pack_metadata.json @@ -2,7 +2,6 @@ "name": "DeepInstinct", "description": "At Deep Instinct, we prevent what others can’t find.", "support": "partner", - "serverMinVersion": "5.0.0", "currentVersion": "1.0.0", "author": "Deep Instinct", "url": "", @@ -14,11 +13,6 @@ "DeepInstinct" ], "created": "2020-04-13T09:41:59Z", - "updated": "2020-04-13T09:41:59Z", - "beta": false, - "deprecated": false, "useCases": [], - "keywords": [], - "price": "0", - "dependencies": {} + "keywords": [] } diff --git a/Packs/DefaultPlaybook/pack_metadata.json b/Packs/DefaultPlaybook/pack_metadata.json index dbd3945e3b9..1b804b1d536 100644 --- a/Packs/DefaultPlaybook/pack_metadata.json +++ b/Packs/DefaultPlaybook/pack_metadata.json @@ -14,5 +14,15 @@ "default" ], "useCases": [], - "keywords": [] + "keywords": [], + "dependencies": { + "CommonPlaybooks": { + "mandatory": true, + "display_name": "Common Playbooks" + }, + "CommonScripts": { + "mandatory": true, + "display_name": "Common Scripts" + } + } } \ No newline at end of file diff --git a/Packs/DemistoLocking/pack_metadata.json b/Packs/DemistoLocking/pack_metadata.json index f16ab6f87ed..56f9b71d330 100644 --- a/Packs/DemistoLocking/pack_metadata.json +++ b/Packs/DemistoLocking/pack_metadata.json @@ -1,16 +1,17 @@ { - "name": "Demisto Lock", - "description": "Locking mechanism that prevents concurrent execution of different tasks", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Utilities" - ], - "tags": [], - "useCases": [], - "keywords": [] + "name": "Demisto Lock", + "description": "Locking mechanism that prevents concurrent execution of different tasks", + "support": "xsoar", + "currentVersion": "1.0.0", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Utilities" + ], + "tags": [], + "useCases": [], + "keywords": [], + "dependencies": {} } \ No newline at end of file diff --git a/Packs/DemistoRESTAPI/pack_metadata.json b/Packs/DemistoRESTAPI/pack_metadata.json index 667855a28a3..a328006394d 100644 --- a/Packs/DemistoRESTAPI/pack_metadata.json +++ b/Packs/DemistoRESTAPI/pack_metadata.json @@ -12,5 +12,6 @@ ], "tags": [], "useCases": [], - "keywords": [] + "keywords": [], + "dependencies": {} } \ No newline at end of file diff --git a/Packs/DeprecatedContent/.pack-ignore b/Packs/DeprecatedContent/.pack-ignore index bae33f5d39e..fef8dc5d6af 100644 --- a/Packs/DeprecatedContent/.pack-ignore +++ b/Packs/DeprecatedContent/.pack-ignore @@ -150,3 +150,12 @@ ignore=BA101 [file:playbook-PhishingAutomated.yml] ignore=BA101 + +[file:Access_Investigation_-_Generic.yml] +ignore=BA101 + +[file:playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response.yml] +ignore=BA101 + +[file:playbook-Search_Endpoints_By_Hash_-_Generic_4_5.yml] +ignore=BA101 diff --git a/Packs/DeprecatedContent/.secrets-ignore b/Packs/DeprecatedContent/.secrets-ignore index b6cf9166530..88b253c9d73 100644 --- a/Packs/DeprecatedContent/.secrets-ignore +++ b/Packs/DeprecatedContent/.secrets-ignore @@ -2,3 +2,11 @@ 216.58.195.78 172.31.39.63 test@email.com +166.111.32.179 +172.31.38.209 +152.195.133.1 +10.11.48.7 +52.8.8.48 +157.240.1.18 +192.168.200.5 +52.221.242.53 diff --git a/Packs/DeprecatedContent/Integrations/PaloAltoNetworksCortex/README.md b/Packs/DeprecatedContent/Integrations/PaloAltoNetworksCortex/README.md index 0b90940315e..e911b89c7dd 100644 --- a/Packs/DeprecatedContent/Integrations/PaloAltoNetworksCortex/README.md +++ b/Packs/DeprecatedContent/Integrations/PaloAltoNetworksCortex/README.md @@ -805,7 +805,7 @@ }
Human Readable Output
-

+

5. Query traffic logs

Searches the Cortex panw.traffic table, which is the traffic logs table for PAN-OS and Panorama.

diff --git a/Packs/DeprecatedContent/Integrations/PaloAltoNetworksCortex/doc_files/mceclip0.png b/Packs/DeprecatedContent/Integrations/PaloAltoNetworksCortex/doc_files/mceclip0.png new file mode 100644 index 00000000000..7e302f0bd79 Binary files /dev/null and b/Packs/DeprecatedContent/Integrations/PaloAltoNetworksCortex/doc_files/mceclip0.png differ diff --git a/Packs/EWS/Integrations/integration-Office_EWS.yml b/Packs/DeprecatedContent/Integrations/integration-Office_EWS.yml similarity index 100% rename from Packs/EWS/Integrations/integration-Office_EWS.yml rename to Packs/DeprecatedContent/Integrations/integration-Office_EWS.yml diff --git a/Packs/Hunting/Playbooks/playbook-Hunt_Extracted_Hashes.yml b/Packs/DeprecatedContent/Playbooks/playbook-Hunt_Extracted_Hashes.yml similarity index 97% rename from Packs/Hunting/Playbooks/playbook-Hunt_Extracted_Hashes.yml rename to Packs/DeprecatedContent/Playbooks/playbook-Hunt_Extracted_Hashes.yml index d6777da148f..b357425d695 100644 --- a/Packs/Hunting/Playbooks/playbook-Hunt_Extracted_Hashes.yml +++ b/Packs/DeprecatedContent/Playbooks/playbook-Hunt_Extracted_Hashes.yml @@ -1,7 +1,7 @@ id: Hunt Extracted Hashes version: -1 name: Hunt Extracted Hashes -description: "This playbook extracts IOCs from the incident details and attached\ +description: "Deprecated. Use the Hunt Extracted Hashes V2 playbook instead. This playbook extracts IOCs from the incident details and attached\ \ files using regular expressions and then hunts for hashes on endpoints in the organization\ \ using available tools.\nThe playbook supports multiple types of attachments. For\ \ the full supported attachments list, refer to \"Extract Indicators From\ diff --git a/Packs/Hunting/Playbooks/playbook-Hunt_Extracted_Hashes_CHANGELOG.md b/Packs/DeprecatedContent/Playbooks/playbook-Hunt_Extracted_Hashes_CHANGELOG.md similarity index 87% rename from Packs/Hunting/Playbooks/playbook-Hunt_Extracted_Hashes_CHANGELOG.md rename to Packs/DeprecatedContent/Playbooks/playbook-Hunt_Extracted_Hashes_CHANGELOG.md index e15cfa78a55..7c7ffc1f12c 100644 --- a/Packs/Hunting/Playbooks/playbook-Hunt_Extracted_Hashes_CHANGELOG.md +++ b/Packs/DeprecatedContent/Playbooks/playbook-Hunt_Extracted_Hashes_CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +- Deprecated. Use the Hunt Extracted Hashes V2 instead. ## [20.5.0] - 2020-05-12 #### New Playbook diff --git a/Packs/Hunting/Playbooks/playbook-Hunt_Extracted_Hashes_README.md b/Packs/DeprecatedContent/Playbooks/playbook-Hunt_Extracted_Hashes_README.md similarity index 78% rename from Packs/Hunting/Playbooks/playbook-Hunt_Extracted_Hashes_README.md rename to Packs/DeprecatedContent/Playbooks/playbook-Hunt_Extracted_Hashes_README.md index da1e3e2f04a..0f20a792dc3 100644 --- a/Packs/Hunting/Playbooks/playbook-Hunt_Extracted_Hashes_README.md +++ b/Packs/DeprecatedContent/Playbooks/playbook-Hunt_Extracted_Hashes_README.md @@ -1,4 +1,4 @@ -This playbook extracts IOCs from the incident details and attached files using regular expressions and then hunts for hashes on endpoints in the organization using available tools. +Deprecated. Use the Hunt Extracted Hashes V2 instead. This playbook extracts IOCs from the incident details and attached files using regular expressions and then hunts for hashes on endpoints in the organization using available tools. The playbook supports multiple types of attachments. For the full supported attachments list, refer to "Extract Indicators From File - Generic v2". ## Dependencies diff --git a/Packs/Legacy/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response.yml b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response.yml similarity index 97% rename from Packs/Legacy/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response.yml rename to Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response.yml index ab129a1413c..f2ab33025bb 100644 --- a/Packs/Legacy/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response.yml +++ b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response.yml @@ -3,7 +3,7 @@ fromversion: 3.5.0 system: true version: -1 name: Search Endpoints By Hash - Carbon Black Response -description: Hunt for malicious indicators using Carbon Black +description: Deprecated. Use the Search Search Endpoints By Hash - Carbon Black Response V2 playbook instead. Hunt for malicious indicators using Carbon Black. starttaskid: "0" tasks: "0": @@ -286,4 +286,4 @@ outputs: description: The endpoint type: unknown tests: - - no test \ No newline at end of file + - no test diff --git a/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_CHANGELOG.md b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_CHANGELOG.md new file mode 100644 index 00000000000..c28dde49ec3 --- /dev/null +++ b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +- Deprecated. Use the Search Search Endpoints By Hash - Carbon Black Response V2 instead. \ No newline at end of file diff --git a/Packs/Legacy/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_README.md b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_README.md similarity index 86% rename from Packs/Legacy/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_README.md rename to Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_README.md index 5b905bfbc3e..1375cbeb0e2 100644 --- a/Packs/Legacy/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_README.md +++ b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Carbon_Black_Response_README.md @@ -1,4 +1,4 @@ -Hunts for malicious indicators using Carbon Black. +Deprecated. Use the Search Search Endpoints By Hash - Carbon Black Response V2 instead. Hunts for malicious indicators using Carbon Black. ## Dependencies This playbook uses the following sub-playbooks, integrations, and scripts. diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5.yml b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5.yml similarity index 98% rename from Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5.yml rename to Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5.yml index edced6df2d1..1c7cdf3ea9e 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5.yml +++ b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5.yml @@ -3,7 +3,7 @@ version: -1 name: Search Endpoints By Hash - Generic fromversion: 4.5.0 system: true -description: Hunt using available tools +description: Deprecated. Use the Search Endpoints By Hash - Generic V2 playbook instead. Hunt using available tools starttaskid: "0" tasks: "0": diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_CHANGELOG.md b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_CHANGELOG.md similarity index 59% rename from Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_CHANGELOG.md rename to Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_CHANGELOG.md index e1df6b3d942..bd5606da344 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_CHANGELOG.md +++ b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +- Deprecated. Use the Search Endpoints By Hash - Generic V2 playbook instead. ## [20.5.2] - 2020-05-26 - diff --git a/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_README.md b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_README.md similarity index 92% rename from Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_README.md rename to Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_README.md index 6c319d601a2..82025b20461 100644 --- a/Packs/CommonPlaybooks/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_README.md +++ b/Packs/DeprecatedContent/Playbooks/playbook-Search_Endpoints_By_Hash_-_Generic_4_5_README.md @@ -1,4 +1,4 @@ -Hunts using available tools. +Deprecated. Use the Search Endpoints By Hash - Generic V2 playbook instead. Hunts using available tools. ## Dependencies This playbook uses the following sub-playbooks, integrations, and scripts. diff --git a/Packs/DeprecatedContent/Playbooks/playbook-malware.yml b/Packs/DeprecatedContent/Playbooks/playbook-malware.yml index 28321bf4dbf..0d8eed399b5 100644 --- a/Packs/DeprecatedContent/Playbooks/playbook-malware.yml +++ b/Packs/DeprecatedContent/Playbooks/playbook-malware.yml @@ -4,7 +4,7 @@ system: true fromversion: 2.5.0 name: Malware Playbook - Manual description: |- - Master playbook for investigating suspected malware presence on an endpoint. + DEPRECATED. Use "Malware Investigation - Manual" playbook instead. Master playbook for investigating suspected malware presence on an endpoint. Labels: - System: the hostname for the endpoint being investigated tags: diff --git a/Packs/DeprecatedContent/ReleaseNotes/1_2_0.md b/Packs/DeprecatedContent/ReleaseNotes/1_2_0.md new file mode 100644 index 00000000000..2c02da05927 --- /dev/null +++ b/Packs/DeprecatedContent/ReleaseNotes/1_2_0.md @@ -0,0 +1,4 @@ + +#### Playbooks +##### Malware Playbook - Manual +- DEPRECATED. Use "Malware Investigation - Manual" playbook instead. diff --git a/Packs/Base/TestPlaybooks/playbook-Dedup_-_Generic_-_Test.yml b/Packs/DeprecatedContent/TestPlaybooks/playbook-Dedup_-_Generic_-_Test.yml similarity index 100% rename from Packs/Base/TestPlaybooks/playbook-Dedup_-_Generic_-_Test.yml rename to Packs/DeprecatedContent/TestPlaybooks/playbook-Dedup_-_Generic_-_Test.yml diff --git a/Packs/Base/TestPlaybooks/playbook-Dedup_-_Generic_-_Test_CHANGELOG.md b/Packs/DeprecatedContent/TestPlaybooks/playbook-Dedup_-_Generic_-_Test_CHANGELOG.md similarity index 100% rename from Packs/Base/TestPlaybooks/playbook-Dedup_-_Generic_-_Test_CHANGELOG.md rename to Packs/DeprecatedContent/TestPlaybooks/playbook-Dedup_-_Generic_-_Test_CHANGELOG.md diff --git a/Packs/DeprecatedContent/pack_metadata.json b/Packs/DeprecatedContent/pack_metadata.json index 68101c6c015..afd3604e0c2 100644 --- a/Packs/DeprecatedContent/pack_metadata.json +++ b/Packs/DeprecatedContent/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Deprecated Content", "description": "Deprecated Cortex XSOAR content pack.", "support": "xsoar", - "currentVersion": "1.1.4", + "currentVersion": "1.2.0", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Base/TestPlaybooks/playbook-TestCommonPython.yml b/Packs/DeveloperTools/TestPlaybooks/playbook-TestCommonPython.yml similarity index 100% rename from Packs/Base/TestPlaybooks/playbook-TestCommonPython.yml rename to Packs/DeveloperTools/TestPlaybooks/playbook-TestCommonPython.yml diff --git a/Packs/DigitalGuardian/pack_metadata.json b/Packs/DigitalGuardian/pack_metadata.json index 2bfbffe049b..217a3adf562 100644 --- a/Packs/DigitalGuardian/pack_metadata.json +++ b/Packs/DigitalGuardian/pack_metadata.json @@ -2,7 +2,6 @@ "name": "Digital Guardian", "description": "Digital Guardian ARC Watchlist Integration", "support": "partner", - "serverMinVersion": "5.0.0", "currentVersion": "1.0.0", "author": "Digital Guardian", "url": "https://digitalguardian.com", diff --git a/Packs/Digital_Defense_FrontlineVM/Playbooks/playbook-Digital_Defense_FrontlineVM_-_PAN-OS_block_assets.yml b/Packs/Digital_Defense_FrontlineVM/Playbooks/playbook-Digital_Defense_FrontlineVM_-_PAN-OS_block_assets.yml index 73fb1619900..79259476c20 100644 --- a/Packs/Digital_Defense_FrontlineVM/Playbooks/playbook-Digital_Defense_FrontlineVM_-_PAN-OS_block_assets.yml +++ b/Packs/Digital_Defense_FrontlineVM/Playbooks/playbook-Digital_Defense_FrontlineVM_-_PAN-OS_block_assets.yml @@ -247,7 +247,9 @@ tasks: id: 963529eb-2f34-4072-801f-9eed161669d1 version: -1 name: PAN-OS - Block IP and URL - External Dynamic List - description: '' + description: |- + This playbook blocks IP addresses and URLs using PAN-OS External Dynamic Lists. + It checks if the EDL configuration is in place with the 'PAN-OS EDL Setup' sub-playbook (otherwise the list will be configured), and adds the input IPs and URLs to the relevant lists. playbookName: PAN-OS - Block IP and URL - External Dynamic List type: playbook iscommand: false @@ -276,7 +278,7 @@ tasks: view: |- { "position": { - "x": 50, + "x": -130, "y": 1790 } } @@ -407,8 +409,10 @@ tasks: iscommand: false brand: '' nexttasks: - 'Yes': - - '11' + "No": + - "20" + "Yes": + - "11" separatecontext: false view: |- { @@ -437,8 +441,35 @@ tasks: retriesinterval: 360 completeafterreplies: 1 replyOptions: - - 'Yes' - - 'No' + - "Yes" + - "No" + skipunavailable: false + quietmode: 0 + "20": + id: "20" + taskid: c7f0e8e6-a289-4533-8027-f11b67c15bf7 + type: title + task: + description: Playbook is done + id: c7f0e8e6-a289-4533-8027-f11b67c15bf7 + version: -1 + name: done + type: title + iscommand: false + brand: "" + separatecontext: false + view: |- + { + "position": { + "x": 290, + "y": 1805 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 view: |- { "linkLabelsPosition": { @@ -447,8 +478,8 @@ view: |- "paper": { "dimensions": { "height": 1835, - "width": 810, - "x": 50, + "width": 990, + "x": -130, "y": 50 } } @@ -456,4 +487,4 @@ view: |- inputs: [] outputs: [] tests: - - No test - manual task \ No newline at end of file + - No test - manual task diff --git a/Packs/Digital_Defense_FrontlineVM/ReleaseNotes/1_0_1.md b/Packs/Digital_Defense_FrontlineVM/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..cf1d06f3482 --- /dev/null +++ b/Packs/Digital_Defense_FrontlineVM/ReleaseNotes/1_0_1.md @@ -0,0 +1,5 @@ + diff --git a/Packs/Digital_Defense_FrontlineVM/pack_metadata.json b/Packs/Digital_Defense_FrontlineVM/pack_metadata.json index fe6cf1c6d92..e8ad933441f 100644 --- a/Packs/Digital_Defense_FrontlineVM/pack_metadata.json +++ b/Packs/Digital_Defense_FrontlineVM/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "Digital Defense Frontline VM", - "description": "Use the Digital Defense Frontline VM to identify and evaluate the security and business risks of network devices and applications deployed as premise, cloud, or hybrid network-based implementations.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Vulnerability Management" - ], - "tags": [], - "useCases": [], - "keywords": [] -} + "name": "Digital Defense Frontline VM", + "description": "Use the Digital Defense Frontline VM to identify and evaluate the security and business risks of network devices and applications deployed as premise, cloud, or hybrid network-based implementations.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Vulnerability Management" + ], + "tags": [], + "useCases": [], + "keywords": [] +} \ No newline at end of file diff --git a/Packs/DomainTools/pack_metadata.json b/Packs/DomainTools/pack_metadata.json index 74eb210b1cb..0efa7fb7e96 100644 --- a/Packs/DomainTools/pack_metadata.json +++ b/Packs/DomainTools/pack_metadata.json @@ -1,11 +1,11 @@ { "name": "DomainTools", "description": "Domain name, DNS and Internet OSINT-based cyber threat intelligence and cybercrime forensics products and data", - "support": "xsoar", + "support": "partner", "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", + "author": "DomainTools", + "url": "https://www.domaintools.com/support/", + "email": "memberservices@domaintools.com", "created": "2020-04-14T00:00:00Z", "categories": [ "Data Enrichment & Threat Intelligence" diff --git a/Packs/DuoAdminApi/TestPlaybooks/playbook-DuoAdminaAPITest.yml b/Packs/DuoAdminApi/TestPlaybooks/playbook-DuoAdminaAPITest.yml index 888ad65f56a..cc67ae51c1b 100644 --- a/Packs/DuoAdminApi/TestPlaybooks/playbook-DuoAdminaAPITest.yml +++ b/Packs/DuoAdminApi/TestPlaybooks/playbook-DuoAdminaAPITest.yml @@ -2,6 +2,7 @@ id: DuoAdmin API test playbook version: -1 name: DuoAdmin API test playbook starttaskid: "0" +description: Test playbook for DuoAdmin Integration tasks: "0": id: "0" @@ -13,6 +14,7 @@ tasks: name: "" iscommand: false brand: "" + description: '' nexttasks: '#none#': - "13" @@ -20,8 +22,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": -160 + "x": 50, + "y": 50 } } note: false @@ -44,15 +46,12 @@ tasks: nexttasks: '#none#': - "16" - - "17" - - "19" - - "30" separatecontext: false view: |- { "position": { - "x": 450, - "y": 120 + "x": 50, + "y": 370 } } note: false @@ -85,8 +84,8 @@ tasks: view: |- { "position": { - "x": 970, - "y": 470 + "x": 1200, + "y": 1390 } } note: false @@ -105,6 +104,7 @@ tasks: type: title iscommand: false brand: "" + description: '' nexttasks: '#none#': - "40" @@ -112,8 +112,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 1500 + "x": 890, + "y": 1905 } } note: false @@ -147,8 +147,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": -40 + "x": 50, + "y": 195 } } note: false @@ -169,7 +169,7 @@ tasks: brand: "" nexttasks: "yes": - - "9" + - "30" separatecontext: false conditions: - label: "yes" @@ -184,8 +184,8 @@ tasks: view: |- { "position": { - "x": 970, - "y": 910 + "x": 1200, + "y": 1565 } } note: false @@ -204,6 +204,7 @@ tasks: type: title iscommand: false brand: "" + description: '' nexttasks: '#none#': - "36" @@ -211,8 +212,8 @@ tasks: view: |- { "position": { - "x": -100, - "y": 315 + "x": 50, + "y": 545 } } note: false @@ -231,6 +232,7 @@ tasks: type: title iscommand: false brand: "" + description: '' nexttasks: '#none#': - "3" @@ -238,8 +240,8 @@ tasks: view: |- { "position": { - "x": 970, - "y": 315 + "x": 1200, + "y": 1230 } } note: false @@ -258,6 +260,7 @@ tasks: type: title iscommand: false brand: "" + description: '' nexttasks: '#none#': - "20" @@ -265,8 +268,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 315 + "x": 650, + "y": 1230 } } note: false @@ -293,8 +296,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 470 + "x": 650, + "y": 1390 } } note: false @@ -315,7 +318,7 @@ tasks: brand: "" nexttasks: "yes": - - "9" + - "17" separatecontext: false conditions: - label: "yes" @@ -347,8 +350,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 920 + "x": 650, + "y": 1565 } } note: false @@ -378,8 +381,8 @@ tasks: view: |- { "position": { - "x": -100, - "y": 635 + "x": 50, + "y": 865 } } note: false @@ -435,8 +438,8 @@ tasks: view: |- { "position": { - "x": -100, - "y": 800 + "x": 50, + "y": 1040 } } note: false @@ -466,8 +469,8 @@ tasks: view: |- { "position": { - "x": -100, - "y": 1140 + "x": 50, + "y": 1390 } } note: false @@ -499,8 +502,8 @@ tasks: view: |- { "position": { - "x": -100, - "y": 980 + "x": 50, + "y": 1215 } } note: false @@ -521,7 +524,7 @@ tasks: brand: "" nexttasks: "no": - - "9" + - "19" separatecontext: false conditions: - label: "no" @@ -556,8 +559,8 @@ tasks: view: |- { "position": { - "x": -100, - "y": 1330 + "x": 50, + "y": 1565 } } note: false @@ -576,6 +579,7 @@ tasks: type: title iscommand: false brand: "" + description: '' nexttasks: '#none#': - "31" @@ -583,8 +587,8 @@ tasks: view: |- { "position": { - "x": 1410, - "y": 315 + "x": 1740, + "y": 1230 } } note: false @@ -618,8 +622,8 @@ tasks: view: |- { "position": { - "x": 1410, - "y": 470 + "x": 1750, + "y": 1390 } } note: false @@ -677,8 +681,8 @@ tasks: view: |- { "position": { - "x": 1410, - "y": 635 + "x": 1750, + "y": 1565 } } note: false @@ -735,8 +739,8 @@ tasks: view: |- { "position": { - "x": 1410, - "y": 860 + "x": 1750, + "y": 1765 } } note: false @@ -792,8 +796,8 @@ tasks: view: |- { "position": { - "x": 1410, - "y": 1235 + "x": 1750, + "y": 2170 } } note: false @@ -827,8 +831,8 @@ tasks: view: |- { "position": { - "x": 1410, - "y": 1055 + "x": 1750, + "y": 1970 } } note: false @@ -860,8 +864,8 @@ tasks: view: |- { "position": { - "x": -100, - "y": 470 + "x": 50, + "y": 690 } } note: false @@ -897,8 +901,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 1650 + "x": 890, + "y": 2075 } } note: false @@ -917,12 +921,13 @@ tasks: type: title iscommand: false brand: "" + description: '' separatecontext: false view: |- { "position": { - "x": 450, - "y": 2030 + "x": 890, + "y": 2640 } } note: false @@ -966,8 +971,8 @@ tasks: view: |- { "position": { - "x": 450, - "y": 1830 + "x": 890, + "y": 2265 } } note: false @@ -999,8 +1004,8 @@ tasks: view: |- { "position": { - "x": 940, - "y": 1920 + "x": 650, + "y": 2460 } } note: false @@ -1008,17 +1013,21 @@ tasks: ignoreworker: false skipunavailable: false quietmode: 0 +system: true view: |- { - "linkLabelsPosition": {}, + "linkLabelsPosition": { + "29_19_no": 0.68 + }, "paper": { "dimensions": { - "height": 2255, - "width": 1890, - "x": -100, - "y": -160 + "height": 2655, + "width": 2080, + "x": 50, + "y": 50 } } } inputs: [] outputs: [] +fromversion: 5.0.0 diff --git a/Packs/EDL/pack_metadata.json b/Packs/EDL/pack_metadata.json index 385e9d2ca71..35e98d322a9 100644 --- a/Packs/EDL/pack_metadata.json +++ b/Packs/EDL/pack_metadata.json @@ -11,11 +11,7 @@ ], "tags": [], "created": "2020-04-14T00:00:00Z", - "updated": "2020-03-14T00:00:00Z", - "beta": false, - "deprecated": false, "useCases": [], "keywords": [], - "dependencies": {}, - "displayedImages": [] + "dependencies": {} } diff --git a/Packs/EWS/.pack-ignore b/Packs/EWS/.pack-ignore index fd509604faf..1e14a456dbb 100644 --- a/Packs/EWS/.pack-ignore +++ b/Packs/EWS/.pack-ignore @@ -1,2 +1,5 @@ [file:playbook-Search_And_Delete_Emails_-_EWS.yml] ignore=BA101 + +[file:playbook-Process_Email_-_EWS.yml] +ignore=BA101 diff --git a/Packs/EWS/.secrets-ignore b/Packs/EWS/.secrets-ignore index ed3dd016074..5dcba5d3360 100644 --- a/Packs/EWS/.secrets-ignore +++ b/Packs/EWS/.secrets-ignore @@ -26,3 +26,19 @@ https://docs..com test@dev.on.com https:// https://docs +2603:10a6:20b:6e:cafe::20 +10.152.3.80 +2603:10a6:10:72::46 +CALOVw6vw2eOojGdALXwyz_McutDOuDfs_qecQSkph0yxwY_5tg@mail.gmail.com +2603:10a6:20b:6e::48 +209.85.161.69 +2002:a05:6808:106:: +67.231.156.123 +2603:10a6:20b:f0::25 +2603:10a6:20b:2e::32 +2603:10a6:803:d4::19 +2603:10a6:10:72:cafe::cb +8.16.0.42 +CALOVw6uFpJ2pBoehvve4TwavOUe0BY-KRXnDkwbBh2hKEyQeYg@mail.gmail.com +2603:10a6:20b:6c::19 +10.152.4.255 diff --git a/Packs/EWS/Integrations/EWSO365/CHANGELOG.md b/Packs/EWS/Integrations/EWSO365/CHANGELOG.md new file mode 100644 index 00000000000..1ed0ad7fa4f --- /dev/null +++ b/Packs/EWS/Integrations/EWSO365/CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +- New Integration EWS O365 diff --git a/Packs/EWS/Integrations/EWSO365/EWSO365.py b/Packs/EWS/Integrations/EWSO365/EWSO365.py new file mode 100644 index 00000000000..671502a070e --- /dev/null +++ b/Packs/EWS/Integrations/EWSO365/EWSO365.py @@ -0,0 +1,2081 @@ +from typing import Dict + +import demistomock as demisto +from CommonServerPython import * +from CommonServerUserPython import * + +import sys +import traceback +import json +import os +import hashlib +from datetime import timedelta +from io import StringIO +import logging +import warnings +import email +from requests.exceptions import ConnectionError +from collections import deque + +from multiprocessing import Process +import exchangelib +from exchangelib.errors import ( + ErrorItemNotFound, + ResponseMessageError, + RateLimitError, + ErrorInvalidIdMalformed, + ErrorFolderNotFound, + ErrorMailboxStoreUnavailable, + ErrorMailboxMoveInProgress, + ErrorNameResolutionNoResults, + MalformedResponseError, +) +from exchangelib.items import Item, Message, Contact +from exchangelib.services.common import EWSService, EWSAccountService +from exchangelib.util import create_element, add_xml_child, MNS, TNS +from exchangelib import ( + IMPERSONATION, + Account, + EWSDateTime, + EWSTimeZone, + Configuration, + FileAttachment, + Version, + Folder, + HTMLBody, + Body, + ItemAttachment, + OAUTH2, + OAuth2AuthorizationCodeCredentials, + Identity, +) +from oauthlib.oauth2 import OAuth2Token +from exchangelib.version import EXCHANGE_O365 +from exchangelib.protocol import BaseProtocol, NoVerifyHTTPAdapter + +# Ignore warnings print to stdout +warnings.filterwarnings("ignore") + +""" Constants """ + +APP_NAME = "ms-ews-o365" +FOLDER_ID_LEN = 120 +MAX_INCIDENTS_PER_FETCH = 50 + +# move results +MOVED_TO_MAILBOX = "movedToMailbox" +MOVED_TO_FOLDER = "movedToFolder" + +# item types +FILE_ATTACHMENT_TYPE = "FileAttachment" +ITEM_ATTACHMENT_TYPE = "ItemAttachment" +ATTACHMENT_TYPE = "attachmentType" + +TOIS_PATH = "/root/Top of Information Store/" + +# context keys +ATTACHMENT_ID = "attachmentId" +ATTACHMENT_ORIGINAL_ITEM_ID = "originalItemId" +NEW_ITEM_ID = "newItemId" +MESSAGE_ID = "messageId" +ITEM_ID = "itemId" +ACTION = "action" +MAILBOX = "mailbox" +MAILBOX_ID = "mailboxId" +FOLDER_ID = "id" + +# context paths +CONTEXT_UPDATE_EWS_ITEM = "EWS.Items(val.{0} === obj.{0} || (val.{1} && obj.{1} && val.{1} === obj.{1}))".format( + ITEM_ID, MESSAGE_ID +) +CONTEXT_UPDATE_EWS_ITEM_FOR_ATTACHMENT = "EWS.Items(val.{0} == obj.{1})".format( + ITEM_ID, ATTACHMENT_ORIGINAL_ITEM_ID +) +CONTEXT_UPDATE_ITEM_ATTACHMENT = ".ItemAttachments(val.{0} == obj.{0})".format( + ATTACHMENT_ID +) +CONTEXT_UPDATE_FILE_ATTACHMENT = ".FileAttachments(val.{0} == obj.{0})".format( + ATTACHMENT_ID +) +CONTEXT_UPDATE_FOLDER = "EWS.Folders(val.{0} == obj.{0})".format(FOLDER_ID) + +# fetch params +LAST_RUN_TIME = "lastRunTime" +LAST_RUN_IDS = "ids" +LAST_RUN_FOLDER = "folderName" +ERROR_COUNTER = "errorCounter" + +# headers +ITEMS_RESULTS_HEADERS = [ + "sender", + "subject", + "hasAttachments", + "datetimeReceived", + "receivedBy", + "author", + "toRecipients", + "textBody", +] + +""" Classes """ + + +class ProxyAdapter(requests.adapters.HTTPAdapter): + """ + Proxy Adapter used to add PROXY to requests + """ + def send(self, *args, **kwargs): + kwargs['proxies'] = handle_proxy() + return super().send(*args, **kwargs) + + +class InsecureProxyAdapter(NoVerifyHTTPAdapter): + """ + Insecure Proxy Adapter used to add PROXY and INSECURE to requests + NoVerifyHTTPAdapter is a built-in insecure HTTPAdapter class + """ + def send(self, *args, **kwargs): + kwargs['proxies'] = handle_proxy() + return super().send(*args, **kwargs) + + +class EWSClient: + def __init__( + self, + default_target_mailbox, + client_id, + client_secret, + tenant_id, + folder="Inbox", + is_public_folder=False, + request_timeout="120", + max_fetch=MAX_INCIDENTS_PER_FETCH, + self_deployed=True, + insecure=True, + proxy=False, + **kwargs, + ): + """ + Client used to communicate with EWS + :param default_target_mailbox: Email address from which to fetch incidents + :param client_id: Application client ID + :param client_secret: Application client secret + :param folder: Name of the folder from which to fetch incidents + :param is_public_folder: Public Folder flag + :param request_timeout: Timeout (in seconds) for HTTP requests to Exchange Server + :param max_fetch: Max incidents per fetch + :param insecure: Trust any certificate (not secure) + """ + BaseProtocol.TIMEOUT = int(request_timeout) + self.ews_server = "https://outlook.office365.com/EWS/Exchange.asmx/" + self.ms_client = MicrosoftClient( + tenant_id=tenant_id, + auth_id=client_id, + enc_key=client_secret, + app_name=APP_NAME, + base_url=self.ews_server, + verify=not insecure, + proxy=proxy, + self_deployed=self_deployed, + scope="https://outlook.office.com/.default", + ) + self.folder_name = folder + self.is_public_folder = is_public_folder + self.access_type = kwargs.get('access_type') or IMPERSONATION + self.max_fetch = min(MAX_INCIDENTS_PER_FETCH, int(max_fetch)) + self.last_run_ids_queue_size = 500 + self.client_id = client_id + self.client_secret = client_secret + self.account_email = default_target_mailbox + self.config = self.__prepare(insecure) + self.protocol = BaseProtocol(self.config) + + def __prepare(self, insecure): + """ + Prepares the client PROTOCOL, CREDENTIALS and CONFIGURATION + :param insecure: Trust any certificate (not secure) + :return: OAuth 2 Configuration + """ + BaseProtocol.HTTP_ADAPTER_CLS = InsecureProxyAdapter if insecure else ProxyAdapter + access_token = self.ms_client.get_access_token() + oauth2_token = OAuth2Token({"access_token": access_token}) + self.credentials = credentials = OAuth2AuthorizationCodeCredentials( + client_id=self.client_id, + client_secret=self.client_secret, + access_token=oauth2_token, + ) + # need to add identity for protocol OAuth header + self.credentials.identity = Identity(upn=self.account_email) + config_args = { + "credentials": credentials, + "auth_type": OAUTH2, + "version": Version(EXCHANGE_O365), + "service_endpoint": "https://outlook.office365.com/EWS/Exchange.asmx", + } + + return Configuration(**config_args) + + def get_account(self, target_mailbox=None): + """ + Request an account from EWS + :param (Optional) target_mailbox: Mailbox associated with the requested account + :return: exchangelib Account + """ + if not target_mailbox: + target_mailbox = self.account_email + return Account( + primary_smtp_address=target_mailbox, + autodiscover=False, + config=self.config, + access_type=self.access_type, + ) + + def get_items_from_mailbox(self, account, item_ids): + """ + Request specific items from a mailbox associated with an account + :param account: EWS account or target_mailbox associated with that account + :param item_ids: item_ids of the requested items + :return: list of exchangelib Items + """ + # allow user to pass target_mailbox as account + if isinstance(account, str): + account = self.get_account(account) + else: + account = self.get_account(self.account_email) + if type(item_ids) is not list: + item_ids = [item_ids] + items = [Item(id=x) for x in item_ids] + result = list(account.fetch(ids=items)) + result = [x for x in result if not isinstance(x, ErrorItemNotFound)] + if len(result) != len(item_ids): + raise Exception( + "One or more items were not found. Check the input item ids" + ) + return result + + def get_item_from_mailbox(self, account, item_id): + """ + Request a single item from a mailbox associated with an account + :param account: EWS account or target_mailbox associated with that account + :param item_id: item_id of the requested item + :return: exchangelib Item + """ + result = self.get_items_from_mailbox(account, [item_id]) + if len(result) == 0: + raise Exception(f"ItemId {str(item_id)} not found") + return result[0] + + def get_attachments_for_item(self, item_id, account, attachment_ids=None): + """ + Request attachments for an item + :param item_id: item_id of the item to retrieve attachments from + :param account: EWS account or target_mailbox associated with that account + :param (Optional) attachment_ids: attachment_ids: attachment_ids to retrieve + :return: list of exchangelib Item.attachments + """ + item = self.get_item_from_mailbox(account, item_id) + attachments = [] + attachment_ids = argToList(attachment_ids) + if item: + if item.attachments: + for attachment in item.attachments: + if ( + attachment_ids + and attachment.attachment_id.id not in attachment_ids + ): + continue + attachments.append(attachment) + + else: + raise Exception("Message item not found: " + item_id) + + if attachment_ids and len(attachments) < len(attachment_ids): + raise Exception( + "Some attachment id did not found for message:" + str(attachment_ids) + ) + + return attachments + + def is_default_folder(self, folder_path, is_public=None): + """ + Is the given folder_path public + :param folder_path: folder path to check if is public + :param is_public: (Optional) if provided, will return this value + :return: Boolean + """ + if is_public is not None: + return is_public + + if folder_path == self.folder_name: + return self.is_public_folder + + return False + + def get_folder_by_path(self, path, account=None, is_public=False): + """ + Retrieve folder by path + :param path: path of the folder + :param account: account associated with the requested path + :param is_public: is the requested folder public + :return: exchangelib Folder + """ + if account is None: + account = self.get_account() + # handle exchange folder id + if len(path) == FOLDER_ID_LEN: + folders_map = account.root._folders_map + if path in folders_map: + return account.root._folders_map[path] + if is_public: + folder_result = account.public_folders_root + elif path == "AllItems": + folder_result = account.root + else: + folder_result = account.inbox.parent # Top of Information Store + path = path.replace("/", "\\") + path = path.split("\\") + for sub_folder_name in path: + folder_filter_by_name = [ + x + for x in folder_result.children + if x.name.lower() == sub_folder_name.lower() + ] + if len(folder_filter_by_name) == 0: + raise Exception(f"No such folder {path}") + folder_result = folder_filter_by_name[0] + + return folder_result + + +class MarkAsJunk(EWSAccountService): + """ + EWSAccountService class used for marking items as junk + """ + SERVICE_NAME = "MarkAsJunk" + + def call(self, item_id, move_item): + elements = list( + self._get_elements( + payload=self.get_payload(item_id=item_id, move_item=move_item) + ) + ) + for element in elements: + if isinstance(element, ResponseMessageError): + return str(element) + return "Success" + + def get_payload(self, item_id, move_item): + junk = create_element( + f"m:{self.SERVICE_NAME}", + {"IsJunk": "true", "MoveItem": "true" if move_item else "false"}, + ) + + items_list = create_element("m:ItemIds") + item_element = create_element("t:ItemId", {"Id": item_id}) + items_list.append(item_element) + junk.append(items_list) + + return junk + + +class GetSearchableMailboxes(EWSService): + """ + EWSAccountService class used for getting Searchable Mailboxes + """ + SERVICE_NAME = "GetSearchableMailboxes" + element_container_name = f"{{{MNS}}}SearchableMailboxes" + + @staticmethod + def parse_element(element): + return { + MAILBOX: element.find(f"{{{TNS}}}PrimarySmtpAddress").text + if element.find(f"{{{TNS}}}PrimarySmtpAddress") is not None + else None, + MAILBOX_ID: element.find(f"{{{TNS}}}ReferenceId").text + if element.find(f"{{{TNS}}}ReferenceId") is not None + else None, + "displayName": element.find(f"{{{TNS}}}DisplayName").text + if element.find(f"{{{TNS}}}DisplayName") is not None + else None, + "isExternal": element.find(f"{{{TNS}}}IsExternalMailbox").text + if element.find(f"{{{TNS}}}IsExternalMailbox") is not None + else None, + "externalEmailAddress": element.find(f"{{{TNS}}}ExternalEmailAddress").text + if element.find(f"{{{TNS}}}ExternalEmailAddress") is not None + else None, + } + + def call(self): + elements = self._get_elements(payload=self.get_payload()) + return [ + self.parse_element(x) + for x in elements + if x.find(f"{{{TNS}}}ReferenceId").text + ] + + def get_payload(self): + element = create_element(f"m:{self.SERVICE_NAME}") + return element + + +class ExpandGroup(EWSService): + """ + EWSAccountService class used for expanding groups + """ + SERVICE_NAME = "ExpandDL" + element_container_name = f"{{{MNS}}}DLExpansion" + + @staticmethod + def parse_element(element): + return { + MAILBOX: element.find(f"{{{TNS}}}EmailAddress").text + if element.find(f"{{{TNS}}}EmailAddress") is not None + else None, + "displayName": element.find(f"{{{TNS}}}Name").text + if element.find(f"{{{TNS}}}Name") is not None + else None, + "mailboxType": element.find(f"{{{TNS}}}MailboxType").text + if element.find(f"{{{TNS}}}MailboxType") is not None + else None, + } + + def call(self, email_address, recursive_expansion=False): + try: + if recursive_expansion == "True": + group_members: Dict = {} + self.expand_group_recursive(email_address, group_members) + return list(group_members.values()) + else: + return self.expand_group(email_address) + except ErrorNameResolutionNoResults: + demisto.results("No results were found.") + sys.exit() + + def get_payload(self, email_address): + element = create_element(f"m:{self.SERVICE_NAME}") + mailbox_element = create_element("m:Mailbox") + add_xml_child(mailbox_element, "t:EmailAddress", email_address) + element.append(mailbox_element) + return element + + def expand_group(self, email_address): + """ + Expand given group + :param email_address: email address of the group to expand + :return: list dict with parsed expanded group data + """ + elements = self._get_elements(payload=self.get_payload(email_address)) + return [self.parse_element(x) for x in elements] + + def expand_group_recursive(self, email_address, non_dl_emails, dl_emails=None): + """ + Expand group recursively + :param email_address: email address of the group to expand + :param non_dl_emails: non distribution only emails + :param dl_emails: (Optional) distribution only emails + :return: Set of dl emails and non dl emails (returned via reference) + """ + if dl_emails is None: + dl_emails = set() + if email_address in non_dl_emails or email_address in dl_emails: + return None + dl_emails.add(email_address) + + for member in self.expand_group(email_address): + if ( + member["mailboxType"] == "PublicDL" + or member["mailboxType"] == "PrivateDL" + ): + self.expand_group_recursive(member.get("mailbox"), non_dl_emails, dl_emails) + else: + if member["mailbox"] not in non_dl_emails: + non_dl_emails[member["mailbox"]] = member + + +# If you are modifying this probably also need to modify in other files +def exchangelib_cleanup(): + key_protocols = list(exchangelib.protocol.CachingProtocol._protocol_cache.items()) + try: + exchangelib.close_connections() + except Exception as ex: + demisto.error("Error was found in exchangelib cleanup, ignoring: {}".format(ex)) + for key, protocol in key_protocols: + try: + if "thread_pool" in protocol.__dict__: + demisto.debug( + "terminating thread pool key{} id: {}".format( + key, id(protocol.thread_pool) + ) + ) + protocol.thread_pool.terminate() + del protocol.__dict__["thread_pool"] + else: + demisto.info( + "Thread pool not found (ignoring terminate) in protcol dict: {}".format( + dir(protocol.__dict__) + ) + ) + except Exception as ex: + demisto.error("Error with thread_pool.terminate, ignoring: {}".format(ex)) + + +""" LOGGING """ + +log_stream = None +log_handler = None + + +def start_logging(): + global log_stream + global log_handler + logging.raiseExceptions = False + if log_stream is None: + log_stream = StringIO() + log_handler = logging.StreamHandler(stream=log_stream) + log_handler.setFormatter(logging.Formatter(logging.BASIC_FORMAT)) + logger = logging.getLogger() + logger.addHandler(log_handler) + logger.setLevel(logging.DEBUG) + + +""" Helper Functions """ + + +def get_attachment_name(attachment_name): + """ + Retrieve attachment name or error string if none is provided + :param attachment_name: attachment name to retrieve + :return: string + """ + if attachment_name is None or attachment_name == "": + return "demisto_untitled_attachment" + return attachment_name + + +def get_entry_for_object(title, context_key, obj, headers=None): + """ + Create an entry for a given object + :param title: Title of the human readable + :param context_key: Context key used for entry context + :param obj: Object to create entry for + :param headers: (Optional) headers used in the tableToMarkDown + :return: Entry object to be used with demisto.results() + """ + if len(obj) == 0: + return "There is no output results" + if headers and isinstance(obj, dict): + headers = list(set(headers).intersection(set(obj.keys()))) + + return { + "Type": entryTypes["note"], + "Contents": obj, + "ContentsFormat": formats["json"], + "ReadableContentsFormat": formats["markdown"], + "HumanReadable": tableToMarkdown(title, obj, headers), + "EntryContext": {context_key: obj}, + } + + +def prepare_args(args): + """ + Prepare arguments to be used as the API expects it + :param args: demisto args + :return: transformed args + """ + args = dict((k.replace("-", "_"), v) for k, v in list(args.items())) + if "is_public" in args: + args["is_public"] = args["is_public"] == "True" + return args + + +def get_limited_number_of_messages_from_qs(qs, limit): + """ + Retrieve a limited number of messages from query search + :param qs: query search to execute + :param limit: limit on number of items to retrieve from search + :return: list of exchangelib.Message + """ + count = 0 + results = [] + for item in qs: + if count == limit: + break + if isinstance(item, Message): + count += 1 + results.append(item) + return results + + +def keys_to_camel_case(value): + """ + Transform keys from snake to camel case (does nothing if no snakes are found) + :param value: value to transform + :return: transformed value + """ + def str_to_camel_case(snake_str): + components = snake_str.split("_") + return components[0] + "".join(x.title() for x in components[1:]) + + if value is None: + return None + if isinstance(value, (list, set)): + return list(map(keys_to_camel_case, value)) + if isinstance(value, dict): + return dict( + ( + keys_to_camel_case(k), + keys_to_camel_case(v) if isinstance(v, (list, dict)) else v, + ) + for (k, v) in list(value.items()) + ) + + return str_to_camel_case(value) + + +def get_last_run(client: EWSClient, last_run=None): + """ + Retrieve the last run time + :param client: EWS Client + :param last_run: (Optional) last run object + :return: last run dict + """ + if not last_run or last_run.get(LAST_RUN_FOLDER) != client.folder_name: + last_run = { + LAST_RUN_TIME: None, + LAST_RUN_FOLDER: client.folder_name, + LAST_RUN_IDS: [], + } + if LAST_RUN_TIME in last_run and last_run[LAST_RUN_TIME] is not None: + last_run[LAST_RUN_TIME] = EWSDateTime.from_string(last_run[LAST_RUN_TIME]) + + # In case we have existing last_run data + if last_run.get(LAST_RUN_IDS) is None: + last_run[LAST_RUN_IDS] = [] + + return last_run + + +def email_ec(item): + """ + Create entry context for an email + :param item: exchangelib.Item + :return: entry context dict + """ + return { + "CC": None + if not item.cc_recipients + else [mailbox.email_address for mailbox in item.cc_recipients], + "BCC": None + if not item.bcc_recipients + else [mailbox.email_address for mailbox in item.bcc_recipients], + "To": None + if not item.to_recipients + else [mailbox.email_address for mailbox in item.to_recipients], + "From": item.author.email_address, + "Subject": item.subject, + "Text": item.text_body, + "HTML": item.body, + "HeadersMap": {header.name: header.value for header in item.headers}, + } + + +def parse_item_as_dict(item, email_address=None, camel_case=False, compact_fields=False): + """ + Parses an exchangelib item as a dict + :param item: exchangelib.Item to parse + :param (Optional) email_address: string mailbox + :param (Optional) camel_case: Is camel case + :param (Optional) compact_fields: Is compact fields + :return: Item as a dict + """ + def parse_object_as_dict(obj): + raw_dict = {} + if obj is not None: + for field in obj.FIELDS: + raw_dict[field.name] = getattr(obj, field.name, None) + return raw_dict + + def parse_folder_as_json(folder): + raw_dict = parse_object_as_dict(folder) + if "parent_folder_id" in raw_dict: + raw_dict["parent_folder_id"] = parse_folder_as_json( + raw_dict["parent_folder_id"] + ) + if "effective_rights" in raw_dict: + raw_dict["effective_rights"] = parse_object_as_dict( + raw_dict["effective_rights"] + ) + return raw_dict + + raw_dict = {} + for field, value in item._field_vals(): + if type(value) in [str, str, int, float, bool, Body, HTMLBody, None]: + raw_dict[field] = value + raw_dict["id"] = item.id + if getattr(item, "attachments", None): + raw_dict["attachments"] = [ + parse_attachment_as_dict(item.id, x) for x in item.attachments + ] + + for time_field in [ + "datetime_sent", + "datetime_created", + "datetime_received", + "last_modified_time", + "reminder_due_by", + ]: + value = getattr(item, time_field, None) + if value: + raw_dict[time_field] = value.ewsformat() + + for dict_field in [ + "effective_rights", + "parent_folder_id", + "conversation_id", + "author", + "extern_id", + "received_by", + "received_representing", + "reply_to", + "sender", + "folder", + ]: + value = getattr(item, dict_field, None) + if value: + raw_dict[dict_field] = parse_object_as_dict(value) + + for list_dict_field in ["headers", "cc_recipients", "to_recipients"]: + value = getattr(item, list_dict_field, None) + if value: + raw_dict[list_dict_field] = [parse_object_as_dict(x) for x in value] + + if getattr(item, "folder", None): + raw_dict["folder"] = parse_folder_as_json(item.folder) + folder_path = ( + item.folder.absolute[len(TOIS_PATH):] + if item.folder.absolute.startswith(TOIS_PATH) + else item.folder.absolute + ) + raw_dict["folder_path"] = folder_path + + if compact_fields: + new_dict = {} + # noinspection PyListCreation + fields_list = [ + "datetime_created", + "datetime_received", + "datetime_sent", + "sender", + "has_attachments", + "importance", + "message_id", + "last_modified_time", + "size", + "subject", + "text_body", + "headers", + "body", + "folder_path", + "is_read", + ] + + if "id" in raw_dict: + new_dict["itemId"] = raw_dict["id"] + fields_list.append("itemId") + + for field in fields_list: + if field in raw_dict: + new_dict[field] = raw_dict.get(field) + for field in ["received_by", "author", "sender"]: + if field in raw_dict: + new_dict[field] = raw_dict.get(field, {}).get("email_address") + for field in ["to_recipients"]: + if field in raw_dict: + new_dict[field] = [x.get("email_address") for x in raw_dict[field]] + attachments = raw_dict.get("attachments") + if attachments and len(attachments) > 0: + file_attachments = [ + x for x in attachments if x[ATTACHMENT_TYPE] == FILE_ATTACHMENT_TYPE + ] + if len(file_attachments) > 0: + new_dict["FileAttachments"] = file_attachments + item_attachments = [ + x for x in attachments if x[ATTACHMENT_TYPE] == ITEM_ATTACHMENT_TYPE + ] + if len(item_attachments) > 0: + new_dict["ItemAttachments"] = item_attachments + + raw_dict = new_dict + + if camel_case: + raw_dict = keys_to_camel_case(raw_dict) + + if email_address: + raw_dict[MAILBOX] = email_address + return raw_dict + + +def get_entry_for_file_attachment(item_id, attachment): + """ + Creates a file entry for an attachment + :param item_id: item_id of the attachment + :param attachment: attachment dict + :return: file entry dict for attachment + """ + entry = fileResult(get_attachment_name(attachment.name), attachment.content) + entry["EntryContext"] = { + CONTEXT_UPDATE_EWS_ITEM_FOR_ATTACHMENT + + CONTEXT_UPDATE_FILE_ATTACHMENT: parse_attachment_as_dict(item_id, attachment) + } + return entry + + +def parse_attachment_as_dict(item_id, attachment): + """ + Creates a note entry for an attachment + :param item_id: item_id of the attachment + :param attachment: attachment dict + :return: note entry dict for attachment + """ + try: + attachment_content = ( + attachment.content + if isinstance(attachment, FileAttachment) + else attachment.item.mime_content + ) + return { + ATTACHMENT_ORIGINAL_ITEM_ID: item_id, + ATTACHMENT_ID: attachment.attachment_id.id, + "attachmentName": get_attachment_name(attachment.name), + "attachmentSHA256": hashlib.sha256(attachment_content).hexdigest() + if attachment_content + else None, + "attachmentContentType": attachment.content_type, + "attachmentContentId": attachment.content_id, + "attachmentContentLocation": attachment.content_location, + "attachmentSize": attachment.size, + "attachmentLastModifiedTime": attachment.last_modified_time.ewsformat(), + "attachmentIsInline": attachment.is_inline, + ATTACHMENT_TYPE: FILE_ATTACHMENT_TYPE + if isinstance(attachment, FileAttachment) + else ITEM_ATTACHMENT_TYPE, + } + except TypeError as e: + if str(e) != "must be string or buffer, not None": + raise + return { + ATTACHMENT_ORIGINAL_ITEM_ID: item_id, + ATTACHMENT_ID: attachment.attachment_id.id, + "attachmentName": get_attachment_name(attachment.name), + "attachmentSHA256": None, + "attachmentContentType": attachment.content_type, + "attachmentContentId": attachment.content_id, + "attachmentContentLocation": attachment.content_location, + "attachmentSize": attachment.size, + "attachmentLastModifiedTime": attachment.last_modified_time.ewsformat(), + "attachmentIsInline": attachment.is_inline, + ATTACHMENT_TYPE: FILE_ATTACHMENT_TYPE + if isinstance(attachment, FileAttachment) + else ITEM_ATTACHMENT_TYPE, + } + + +def get_entry_for_item_attachment(item_id, attachment, target_email): + """ + Creates a note entry for an item attachment + :param item_id: Item id + :param attachment: exchangelib attachment + :param target_email: target email + :return: note entry dict for item attachment + """ + item = attachment.item + dict_result = parse_attachment_as_dict(item_id, attachment) + dict_result.update( + parse_item_as_dict(item, target_email, camel_case=True, compact_fields=True) + ) + title = f'EWS get attachment got item for "{target_email}", "{get_attachment_name(attachment.name)}"' + + return get_entry_for_object( + title, + CONTEXT_UPDATE_EWS_ITEM_FOR_ATTACHMENT + CONTEXT_UPDATE_ITEM_ATTACHMENT, + dict_result, + ) + + +""" Command Functions """ + + +def get_expanded_group(client: EWSClient, email_address, recursive_expansion=False): + """ + Retrieve expanded group command + :param client: EWS Client + :param email_address: Email address of the group to expand + :param (Optional) recursive_expansion: Whether to enable recursive expansion. Default is "False". + :return: Expanded groups output tuple + """ + group_members = ExpandGroup(protocol=client.protocol).call( + email_address, recursive_expansion + ) + group_details = {"name": email_address, "members": group_members} + output = {"EWS.ExpandGroup": group_details} + readable_output = tableToMarkdown("Group Members", group_members) + return readable_output, output, group_details + + +def get_searchable_mailboxes(client: EWSClient): + """ + Retrieve searchable mailboxes command + :param client: EWS Client + :return: Searchable mailboxes output tuple + """ + searchable_mailboxes = GetSearchableMailboxes(protocol=client.protocol).call() + readable_output = tableToMarkdown( + "Searchable mailboxes", searchable_mailboxes, headers=["displayName", "mailbox"] + ) + output = {"EWS.Mailboxes": searchable_mailboxes} + return readable_output, output, searchable_mailboxes + + +def delete_attachments_for_message( + client: EWSClient, item_id, target_mailbox=None, attachment_ids=None +): + """ + Deletes attachments for a given message + :param client: EWS Client + :param item_id: item id + :param (Optional) target_mailbox: target mailbox + :param (Optional) attachment_ids: attachment ids to delete + :return: entries that were delted + """ + attachments = client.get_attachments_for_item( + item_id, target_mailbox, attachment_ids + ) + deleted_file_attachments = [] + deleted_item_attachments = [] # type: ignore + for attachment in attachments: + attachment_deleted_action = { + ATTACHMENT_ID: attachment.attachment_id.id, + ACTION: "deleted", + } + if isinstance(attachment, FileAttachment): + deleted_file_attachments.append(attachment_deleted_action) + else: + deleted_item_attachments.append(attachment_deleted_action) + attachment.detach() + + entries = [] + if len(deleted_file_attachments) > 0: + entry = get_entry_for_object( + "Deleted file attachments", + "EWS.Items" + CONTEXT_UPDATE_FILE_ATTACHMENT, + deleted_file_attachments, + ) + entries.append(entry) + if len(deleted_item_attachments) > 0: + entry = get_entry_for_object( + "Deleted item attachments", + "EWS.Items" + CONTEXT_UPDATE_ITEM_ATTACHMENT, + deleted_item_attachments, + ) + entries.append(entry) + + return entries + + +def fetch_attachments_for_message( + client: EWSClient, item_id, target_mailbox=None, attachment_ids=None +): + """ + Fetches attachments for a message + :param client: EWS Client + :param item_id: item id + :param (Optional) target_mailbox: target mailbox + :param (Optional) attachment_ids: attachment ids + :return: list of parsed entries + """ + account = client.get_account(target_mailbox) + attachments = client.get_attachments_for_item(item_id, account, attachment_ids) + entries = [] + for attachment in attachments: + if isinstance(attachment, FileAttachment): + try: + if attachment.content: + entries.append(get_entry_for_file_attachment(item_id, attachment)) + except TypeError as e: + if str(e) != "must be string or buffer, not None": + raise + else: + entries.append( + get_entry_for_item_attachment( + item_id, attachment, account.primary_smtp_address + ) + ) + if attachment.item.mime_content: + entries.append( + fileResult( + get_attachment_name(attachment.name) + ".eml", + attachment.item.mime_content, + ) + ) + + return entries + + +def move_item_between_mailboxes( + client: EWSClient, + item_id, + destination_mailbox, + destination_folder_path, + source_mailbox=None, + is_public=None, +): + """ + Moves item between mailboxes + :param client: EWS Client + :param item_id: item id + :param destination_mailbox: destination mailbox + :param destination_folder_path: destination folder path + :param (Optional) source_mailbox: source mailbox + :param (Optional) is_public: is the destination folder public + :return: Output tuple + """ + source_account = client.get_account(source_mailbox) + destination_account = client.get_account(destination_mailbox) + is_public = client.is_default_folder(destination_folder_path, is_public) + destination_folder = client.get_folder_by_path( + destination_folder_path, destination_account, is_public + ) + item = client.get_item_from_mailbox(source_account, item_id) + + exported_items = source_account.export([item]) + destination_account.upload([(destination_folder, exported_items[0])]) + source_account.bulk_delete([item]) + + move_result = { + MOVED_TO_MAILBOX: destination_mailbox, + MOVED_TO_FOLDER: destination_folder_path, + } + readable_output = "Item was moved successfully." + output = {f"EWS.Items(val.itemId === '{item_id}')": move_result} + return readable_output, output, move_result + + +def move_item( + client: EWSClient, item_id, target_folder_path, target_mailbox=None, is_public=None +): + """ + Moves an item within the same mailbox + :param client: EWS Client + :param item_id: item id + :param target_folder_path: target folder path + :param (Optional) target_mailbox: mailbox containing the item + :param (Optional) is_public: is the destination folder public + :return: Output tuple + """ + account = client.get_account(target_mailbox) + is_public = client.is_default_folder(target_folder_path, is_public) + target_folder = client.get_folder_by_path(target_folder_path, is_public=is_public) + item = client.get_item_from_mailbox(account, item_id) + if isinstance(item, ErrorInvalidIdMalformed): + raise Exception("Item not found") + item.move(target_folder) + move_result = { + NEW_ITEM_ID: item.id, + ITEM_ID: item_id, + MESSAGE_ID: item.message_id, + ACTION: "moved", + } + readable_output = tableToMarkdown("Moved items", move_result) + output = {CONTEXT_UPDATE_EWS_ITEM: move_result} + return readable_output, output, move_result + + +def delete_items(client: EWSClient, item_ids, delete_type, target_mailbox=None): + """ + Delete items in a mailbox + :param client: EWS Client + :param item_ids: items ids to delete + :param delete_type: delte type soft/hard + :param (Optional) target_mailbox: mailbox containinf the items + :return: Output tuple + """ + deleted_items = [] + item_ids = argToList(item_ids) + items = client.get_items_from_mailbox(target_mailbox, item_ids) + delete_type = delete_type.lower() + + for item in items: + item_id = item.id + if delete_type == "trash": + item.move_to_trash() + elif delete_type == "soft": + item.soft_delete() + elif delete_type == "hard": + item.delete() + else: + raise Exception( + f'invalid delete type: {delete_type}. Use "trash" \\ "soft" \\ "hard"' + ) + deleted_items.append( + { + ITEM_ID: item_id, + MESSAGE_ID: item.message_id, + ACTION: f"{delete_type}-deleted", + } + ) + + readable_output = tableToMarkdown( + f"Deleted items ({delete_type} delete type)", deleted_items + ) + output = {CONTEXT_UPDATE_EWS_ITEM: deleted_items} + return readable_output, output, deleted_items + + +def search_items_in_mailbox( + client: EWSClient, + query=None, + message_id=None, + folder_path="", + limit=100, + target_mailbox=None, + is_public=None, + selected_fields="all", +): + """ + Search items in mailbox + :param client: EWS Client + :param (Optional) query: query to execute + :param (Optional) message_id: message ids to search + :param (Optional) folder_path: folder path to search + :param (Optional) limit: max amount of items to fetch + :param (Optional) target_mailbox: mailbox containing the items + :param (Optional) is_public: is the targeted folder public + :param (Optional) selected_fields: Selected fields + :return: Output tuple + """ + if not query and not message_id: + return_error("Missing required argument. Provide query or message-id") + + if message_id and message_id[0] != "<" and message_id[-1] != ">": + message_id = "<{}>".format(message_id) + + account = client.get_account(target_mailbox) + limit = int(limit) + if folder_path.lower() == "inbox": + folders = [account.inbox] + elif folder_path: + is_public = client.is_default_folder(folder_path, is_public) + folders = [client.get_folder_by_path(folder_path, account, is_public)] + else: + folders = account.inbox.parent.walk() # pylint: disable=E1101 + + items = [] # type: ignore + selected_all_fields = selected_fields == "all" + + if selected_all_fields: + restricted_fields = list([x.name for x in Message.FIELDS]) # type: ignore + else: + restricted_fields = set(argToList(selected_fields)) # type: ignore + restricted_fields.update(["id", "message_id"]) # type: ignore + + for folder in folders: + if Message not in folder.supported_item_models: + continue + if query: + items_qs = folder.filter(query).only(*restricted_fields) + else: + items_qs = folder.filter(message_id=message_id).only(*restricted_fields) + items += get_limited_number_of_messages_from_qs(items_qs, limit) + if len(items) >= limit: + break + + items = items[:limit] + searched_items_result = [ + parse_item_as_dict( + item, + account.primary_smtp_address, + camel_case=True, + compact_fields=selected_all_fields, + ) + for item in items + ] + + if not selected_all_fields: + searched_items_result = [ + {k: v for (k, v) in i.items() if k in keys_to_camel_case(restricted_fields)} + for i in searched_items_result + ] + + for item in searched_items_result: + item["itemId"] = item.pop("id", "") + + readable_output = tableToMarkdown( + "Searched items", + searched_items_result, + headers=ITEMS_RESULTS_HEADERS if selected_all_fields else None, + ) + output = {CONTEXT_UPDATE_EWS_ITEM: searched_items_result} + return readable_output, output, searched_items_result + + +def get_out_of_office_state(client: EWSClient, target_mailbox=None): + """ + Retrieve get out of office state of the targeted mailbox + :param client: EWS Client + :param (Optional) target_mailbox: target mailbox + :return: Output tuple + """ + account = client.get_account(target_mailbox) + oof = account.oof_settings + oof_dict = { + "state": oof.state, # pylint: disable=E1101 + "externalAudience": getattr(oof, "external_audience", None), + "start": oof.start.ewsformat() if oof.start else None, # pylint: disable=E1101 + "end": oof.end.ewsformat() if oof.end else None, # pylint: disable=E1101 + "internalReply": getattr(oof, "internal_replay", None), + "externalReply": getattr(oof, "external_replay", None), + MAILBOX: account.primary_smtp_address, + } + readable_output = tableToMarkdown( + f"Out of office state for {account.primary_smtp_address}", oof_dict + ) + output = {f"Account.Email(val.Address == obj.{MAILBOX}).OutOfOffice": oof_dict} + return readable_output, output, oof_dict + + +def recover_soft_delete_item( + client: EWSClient, + message_ids, + target_folder_path="Inbox", + target_mailbox=None, + is_public=None, +): + """ + Recovers soft deleted items + :param client: EWS Client + :param message_ids: Message ids to recover + :param (Optional) target_folder_path: target folder path + :param (Optional) target_mailbox: target mailbox + :param (Optional) is_public: is the target folder public + :return: + """ + account = client.get_account(target_mailbox) + is_public = client.is_default_folder(target_folder_path, is_public) + target_folder = client.get_folder_by_path(target_folder_path, account, is_public) + recovered_messages = [] + message_ids = argToList(message_ids) + + items_to_recover = account.recoverable_items_deletions.filter( # pylint: disable=E1101 + message_id__in=message_ids + ).all() # pylint: disable=E1101 + + recovered_items = set() + for item in items_to_recover: + recovered_items.add(item) + if len(recovered_items) != len(message_ids): + missing_items = set(message_ids).difference(recovered_items) + raise Exception( + f"Some message ids are missing in recoverable items directory: {missing_items}" + ) + + for item in recovered_items: + item.move(target_folder) + recovered_messages.append( + {ITEM_ID: item.id, MESSAGE_ID: item.message_id, ACTION: "recovered"} + ) + + readable_output = tableToMarkdown("Recovered messages", recovered_messages) + output = {CONTEXT_UPDATE_EWS_ITEM: recovered_messages} + return readable_output, output, recovered_messages + + +def get_contacts(client: EWSClient, limit, target_mailbox=None): + """ + Retrieve contacts of the target mailbox or client mailbox + :param client: EWS Client + :param limit: max amount of contacts to retrieve + :param (Optional) target_mailbox: Target mailbox + :return: + """ + def parse_physical_address(address): + result = {} + for attr in ["city", "country", "label", "state", "street", "zipcode"]: + result[attr] = getattr(address, attr, None) + return result + + def parse_phone_number(phone_number): + result = {} + for attr in ["label", "phone_number"]: + result[attr] = getattr(phone_number, attr, None) + return result + + def parse_contact(contact): + contact_dict = dict( + (k, v if not isinstance(v, EWSDateTime) else v.ewsformat()) + for k, v in list(contact._field_vals()) + if isinstance(v, str) or isinstance(v, EWSDateTime) + ) + if isinstance(contact, Contact) and contact.physical_addresses: + contact_dict["physical_addresses"] = list( + map(parse_physical_address, contact.physical_addresses) + ) + if isinstance(contact, Contact) and contact.phone_numbers: + contact_dict["phone_numbers"] = list( + map(parse_phone_number, contact.phone_numbers) + ) + if ( + isinstance(contact, Contact) + and contact.email_addresses + and len(contact.email_addresses) > 0 + ): + contact_dict["emailAddresses"] = [x.email for x in contact.email_addresses] + contact_dict = keys_to_camel_case(contact_dict) + contact_dict = dict((k, v) for k, v in list(contact_dict.items()) if v) + contact_dict.pop("mimeContent", None) + contact_dict["originMailbox"] = target_mailbox + return contact_dict + + account = client.get_account(target_mailbox) + contacts = [] + + for contact in account.contacts.all()[: int(limit)]: # pylint: disable=E1101 + contacts.append(parse_contact(contact)) + readable_output = tableToMarkdown(f"Email contacts for {target_mailbox}", contacts) + output = {"Account.Email(val.Address == obj.originMailbox).EwsContacts": contacts} + return readable_output, output, contacts + + +def create_folder(client: EWSClient, new_folder_name, folder_path, target_mailbox=None): + """ + Creates a folder in the target mailbox or the client mailbox + :param client: EWS Client + :param new_folder_name: new folder name + :param folder_path: path of the new folder + :param (Optional) target_mailbox: target mailbox + :return: Output tuple + """ + account = client.get_account(target_mailbox) + full_path = os.path.join(folder_path, new_folder_name) + try: + if client.get_folder_by_path(full_path, account): + return f"Folder {full_path} already exists", + except Exception: + pass + parent_folder = client.get_folder_by_path(folder_path, account) + f = Folder(parent=parent_folder, name=new_folder_name) + f.save() + client.get_folder_by_path(full_path, account) + return f"Folder {full_path} created successfully", + + +def find_folders(client: EWSClient, target_mailbox=None): + """ + Finds folders in the mailbox + :param client: EWS Client + :param (Optional) target_mailbox: target mailbox + :return: Output tuple + """ + account = client.get_account(target_mailbox) + root = account.root + if client.is_public_folder: + root = account.public_folders_root + folders = [] + for f in root.walk(): # pylint: disable=E1101 + folder = folder_to_context_entry(f) + folders.append(folder) + folders_tree = root.tree() # pylint: disable=E1101 + readable_output = folders_tree + output = {"EWS.Folders(val.id == obj.id)": folders} + return readable_output, output, folders + + +def mark_item_as_junk(client: EWSClient, item_id, move_items, target_mailbox=None): + """ + Marks item as junk in the target mailbox or client mailbox + :param client: EWS Client + :param item_id: item ids to mark as junk + :param move_items: "yes" or "no" - to move or not to move to trash + :param (Optional) target_mailbox: target mailbox + :return: + """ + account = client.get_account(target_mailbox) + move_items = move_items.lower() == "yes" + ews_result = MarkAsJunk(account=account).call(item_id=item_id, move_item=move_items) + mark_as_junk_result = { + ITEM_ID: item_id, + } + if ews_result == "Success": + mark_as_junk_result[ACTION] = "marked-as-junk" + else: + raise Exception("Failed mark-item-as-junk with error: " + ews_result) + + readable_output = tableToMarkdown("Mark item as junk", mark_as_junk_result) + output = {CONTEXT_UPDATE_EWS_ITEM: mark_as_junk_result} + return readable_output, output, mark_as_junk_result + + +def get_items_from_folder( + client: EWSClient, + folder_path, + limit=100, + target_mailbox=None, + is_public=None, + get_internal_item="no", +): + """ + Retrieve items from folder path + :param client: EWS Client + :param folder_path: folder path + :param (Optional) limit: max amount of items to retrieve + :param (Optional) target_mailbox: target mailbox + :param (Optional) is_public: is the folder public + :param (Optional) get_internal_item: should also retrieve internal items ("no" by default) + :return: Output tuple + """ + account = client.get_account(target_mailbox) + limit = int(limit) + get_internal_item = get_internal_item == "yes" + is_public = client.is_default_folder(folder_path, is_public) + folder = client.get_folder_by_path(folder_path, account, is_public) + qs = folder.filter().order_by("-datetime_created")[:limit] + items = get_limited_number_of_messages_from_qs(qs, limit) + items_result = [] + + for item in items: + item_attachment = parse_item_as_dict( + item, account.primary_smtp_address, camel_case=True, compact_fields=True + ) + for attachment in item.attachments: + if ( + get_internal_item + and isinstance(attachment, ItemAttachment) + and isinstance(attachment.item, Message) + ): + # if found item attachment - switch item to the attchment + item_attachment = parse_item_as_dict( + attachment.item, + account.primary_smtp_address, + camel_case=True, + compact_fields=True, + ) + break + items_result.append(item_attachment) + + hm_headers = [ + "sender", + "subject", + "hasAttachments", + "datetimeReceived", + "receivedBy", + "author", + "toRecipients", + "id", + ] + readable_output = tableToMarkdown( + "Items in folder " + folder_path, items_result, headers=hm_headers + ) + output = {CONTEXT_UPDATE_EWS_ITEM: items_result} + return readable_output, output, items_result + + +def get_items(client: EWSClient, item_ids, target_mailbox=None): + """ + Get items from target mailbox or client mailbox + :param client: EWS Client + :param item_ids: item ids to retrieve + :param (Optional) target_mailbox: target mailbox to retrieve items from + :return: + """ + item_ids = argToList(item_ids) + account = client.get_account(target_mailbox) + items = client.get_items_from_mailbox(account, item_ids) + items = [x for x in items if isinstance(x, Message)] + items_as_incidents = [parse_incident_from_item(x) for x in items] + items_to_context = [ + parse_item_as_dict(x, account.primary_smtp_address, True, True) for x in items + ] + readable_output = tableToMarkdown( + "Get items", items_to_context, ITEMS_RESULTS_HEADERS + ) + output = { + CONTEXT_UPDATE_EWS_ITEM: items_to_context, + "Email": [email_ec(item) for item in items], + } + return readable_output, output, items_as_incidents + + +def get_folder(client: EWSClient, folder_path, target_mailbox=None, is_public=None): + """ + Retrieve a folder from the target mailbox or client mailbox + :param client: EWS Client + :param folder_path: folder path to retrieve + :param (Optional) target_mailbox: target mailbox + :param (Optional) is_public: is the folder public + :return: + """ + account = client.get_account(target_mailbox) + is_public = client.is_default_folder(folder_path, is_public) + folder = folder_to_context_entry( + client.get_folder_by_path(folder_path, account=account, is_public=is_public) + ) + readable_output = tableToMarkdown(f"Folder {folder_path}", folder) + output = {CONTEXT_UPDATE_FOLDER: folder} + return readable_output, output, folder + + +def folder_to_context_entry(f): + """ + Create a context entry from a folder response + :param f: folder response + :return: dict context entry + """ + try: + f_entry = { + "name": f.name, + "totalCount": f.total_count, + "id": f.id, + "childrenFolderCount": f.child_folder_count, + "changeKey": f.changekey, + } + + if "unread_count" in [x.name for x in Folder.FIELDS]: + f_entry["unreadCount"] = f.unread_count + return f_entry + except AttributeError: + if isinstance(f, dict): + return { + "name": f.get("name"), + "totalCount": f.get("total_count"), + "id": f.get("id"), + "childrenFolderCount": f.get("child_folder_count"), + "changeKey": f.get("changekey"), + "unreadCount": f.get("unread_count"), + } + + +def mark_item_as_read( + client: EWSClient, item_ids, operation="read", target_mailbox=None +): + """ + Marks item as read + :param client: EWS Client + :param item_ids: items ids to mark as read + :param (Optional) operation: operation to execute + :param (Optional) target_mailbox: target mailbox + :return: Output tuple + """ + marked_items = [] + item_ids = argToList(item_ids) + items = client.get_items_from_mailbox(target_mailbox, item_ids) + items = [x for x in items if isinstance(x, Message)] + + for item in items: + item.is_read = operation == "read" + item.save() + + marked_items.append( + { + ITEM_ID: item.id, + MESSAGE_ID: item.message_id, + ACTION: "marked-as-{}".format(operation), + } + ) + + readable_output = tableToMarkdown( + f"Marked items ({operation} marked operation)", marked_items + ) + output = {CONTEXT_UPDATE_EWS_ITEM: marked_items} + return readable_output, output, marked_items + + +def get_item_as_eml(client: EWSClient, item_id, target_mailbox=None): + """ + Retrieve item as an eml + :param client: EWS Client + :param item_id: Item id to retrieve + :param (Optional) target_mailbox: target mailbox + :return: Output tuple + """ + account = client.get_account(target_mailbox) + item = client.get_item_from_mailbox(account, item_id) + + if item.mime_content: + mime_content = item.mime_content + if isinstance(mime_content, bytes): + email_content = email.message_from_bytes(mime_content) + else: + email_content = email.message_from_string(mime_content) + if item.headers: + attached_email_headers = [ + (h, " ".join(map(str.strip, v.split("\r\n")))) + for (h, v) in list(email_content.items()) + ] + for header in item.headers: + if ( + header.name, + header.value, + ) not in attached_email_headers and header.name != "Content-Type": + email_content.add_header(header.name, header.value) + + eml_name = item.subject if item.subject else "demisto_untitled_eml" + file_result = fileResult(eml_name + ".eml", email_content.as_string()) + file_result = ( + file_result if file_result else "Failed uploading eml file to war room" + ) + + return file_result + + +def parse_incident_from_item(item): + """ + Parses an incident from an item + :param item: item to parse + :return: Parsed item + """ + incident = {} + labels = [] + + try: + incident["details"] = item.text_body or item.body + except AttributeError: + incident["details"] = item.body + incident["name"] = item.subject + labels.append({"type": "Email/subject", "value": item.subject}) + incident["occurred"] = item.datetime_created.ewsformat() + + # handle recipients + if item.to_recipients: + for recipient in item.to_recipients: + labels.append({"type": "Email", "value": recipient.email_address}) + + # handle cc + if item.cc_recipients: + for recipient in item.cc_recipients: + labels.append({"type": "Email/cc", "value": recipient.email_address}) + # handle email from + if item.sender: + labels.append({"type": "Email/from", "value": item.sender.email_address}) + + # email format + email_format = "" + try: + if item.text_body: + labels.append({"type": "Email/text", "value": item.text_body}) + email_format = "text" + except AttributeError: + pass + if item.body: + labels.append({"type": "Email/html", "value": item.body}) + email_format = "HTML" + labels.append({"type": "Email/format", "value": email_format}) + + # handle attachments + if item.attachments: + incident["attachment"] = [] + for attachment in item.attachments: + file_result = None + label_attachment_type = None + label_attachment_id_type = None + if isinstance(attachment, FileAttachment): + try: + if attachment.content: + # file attachment + label_attachment_type = "attachments" + label_attachment_id_type = "attachmentId" + + # save the attachment + file_name = get_attachment_name(attachment.name) + file_result = fileResult(file_name, attachment.content) + + # check for error + if file_result["Type"] == entryTypes["error"]: + demisto.error(file_result["Contents"]) + raise Exception(file_result["Contents"]) + + # save attachment to incident + incident["attachment"].append( + { + "path": file_result["FileID"], + "name": get_attachment_name(attachment.name), + } + ) + except TypeError as e: + if str(e) != "must be string or buffer, not None": + raise + continue + else: + # other item attachment + label_attachment_type = "attachmentItems" + label_attachment_id_type = "attachmentItemsId" + + # save the attachment + if attachment.item.mime_content: + attached_email = email.message_from_string( + attachment.item.mime_content + ) + if attachment.item.headers: + attached_email_headers = [ + (h, " ".join(map(str.strip, v.split("\r\n")))) + for (h, v) in list(attached_email.items()) + ] + for header in attachment.item.headers: + if ( + (header.name, header.value) + not in attached_email_headers + and header.name != "Content-Type" + ): + attached_email.add_header(header.name, header.value) + + file_result = fileResult( + get_attachment_name(attachment.name) + ".eml", + attached_email.as_string(), + ) + + if file_result: + # check for error + if file_result["Type"] == entryTypes["error"]: + demisto.error(file_result["Contents"]) + raise Exception(file_result["Contents"]) + + # save attachment to incident + incident["attachment"].append( + { + "path": file_result["FileID"], + "name": get_attachment_name(attachment.name) + ".eml", + } + ) + + labels.append( + { + "type": label_attachment_type, + "value": get_attachment_name(attachment.name), + } + ) + labels.append( + {"type": label_attachment_id_type, "value": attachment.attachment_id.id} + ) + + # handle headers + if item.headers: + headers = [] + for header in item.headers: + labels.append( + { + "type": "Email/Header/{}".format(header.name), + "value": str(header.value), + } + ) + headers.append("{}: {}".format(header.name, header.value)) + labels.append({"type": "Email/headers", "value": "\r\n".join(headers)}) + + # handle item id + if item.message_id: + labels.append({"type": "Email/MessageId", "value": str(item.message_id)}) + + if item.id: + labels.append({"type": "Email/ID", "value": item.id}) + labels.append({"type": "Email/itemId", "value": item.id}) + + # handle conversion id + if item.conversation_id: + labels.append({"type": "Email/ConversionID", "value": item.conversation_id.id}) + + incident["labels"] = labels + incident["rawJSON"] = json.dumps(parse_item_as_dict(item, None), ensure_ascii=False) + + return incident + + +def fetch_emails_as_incidents(client: EWSClient, last_run): + """ + Fetch incidents + :param client: EWS Client + :param last_run: last run dict + :return: + """ + last_run = get_last_run(client, last_run) + + try: + last_emails = fetch_last_emails( + client, + client.folder_name, + last_run.get(LAST_RUN_TIME), + last_run.get(LAST_RUN_IDS), + ) + + ids = deque( + last_run.get(LAST_RUN_IDS, []), maxlen=client.last_run_ids_queue_size + ) + incidents = [] + incident: Dict[str, str] = {} + for item in last_emails: + if item.message_id: + ids.append(item.message_id) + incident = parse_incident_from_item(item) + incidents.append(incident) + + if len(incidents) >= client.max_fetch: + break + + last_run_time = incident.get("occurred", last_run.get(LAST_RUN_TIME)) + if isinstance(last_run_time, EWSDateTime): + last_run_time = last_run_time.ewsformat() + + new_last_run = { + LAST_RUN_TIME: last_run_time, + LAST_RUN_FOLDER: client.folder_name, + LAST_RUN_IDS: list(ids), + ERROR_COUNTER: 0, + } + + demisto.setLastRun(new_last_run) + return incidents + + except RateLimitError: + if LAST_RUN_TIME in last_run: + last_run[LAST_RUN_TIME] = last_run[LAST_RUN_TIME].ewsformat() + if ERROR_COUNTER not in last_run: + last_run[ERROR_COUNTER] = 0 + last_run[ERROR_COUNTER] += 1 + demisto.setLastRun(last_run) + if last_run[ERROR_COUNTER] > 2: + raise + return [] + + +def fetch_last_emails( + client: EWSClient, folder_name="Inbox", since_datetime=None, exclude_ids=None +): + """ + Fetches last emails + :param client: EWS client + :param (Optional) folder_name: folder name to pull from + :param (Optional) since_datetime: items will be searched after this datetime + :param (Optional) exclude_ids: exclude ids from fetch + :return: list of exchangelib.Items + """ + qs = client.get_folder_by_path(folder_name, is_public=client.is_public_folder) + if since_datetime: + qs = qs.filter(datetime_received__gte=since_datetime) + else: + last_10_min = EWSDateTime.now(tz=EWSTimeZone.timezone("UTC")) - timedelta( + minutes=10 + ) + qs = qs.filter(last_modified_time__gte=last_10_min) + qs = qs.filter().only(*[x.name for x in Message.FIELDS]) + qs = qs.filter().order_by("datetime_received") + + result = qs.all() + result = [x for x in result if isinstance(x, Message)] + if exclude_ids and len(exclude_ids) > 0: + exclude_ids = set(exclude_ids) + result = [x for x in result if x.message_id not in exclude_ids] + return result + + +def test_module(client: EWSClient, max_fetch): + """ + test-module + * Max incidents per fetch <= MAX_INCIDENTS_PER_FETCH + * Account can be retrieved + * Account has read rights + * Test access to fetch folder + :param client: EWS Client + :param max_fetch: Max fetches per incident + :return: "ok" + """ + try: + if int(max_fetch) > MAX_INCIDENTS_PER_FETCH: + return_error(f'Error - Max incidents per fetch cannot be greater than {MAX_INCIDENTS_PER_FETCH}. ' + f'You provided: {max_fetch}') + account = client.get_account() + if not account.root.effective_rights.read: # pylint: disable=E1101 + raise Exception( + "Success to authenticate, but user has no permissions to read from the mailbox. " + "Need to delegate the user permissions to the mailbox - " + "please read integration documentation and follow the instructions" + ) + client.get_folder_by_path( + client.folder_name, account, client.is_public_folder + ).test_access() + except ErrorFolderNotFound as e: + if "Top of Information Store" in str(e): + raise Exception( + "Success to authenticate, but user probably has no permissions to read from the specific folder." + "Check user permissions. You can try !ews-find-folders command to " + "get all the folders structure that the user has permissions to" + ) + + return "ok" + + +def sub_main(): + is_test_module = False + params = demisto.params() + client = EWSClient(**params) + args = prepare_args(demisto.args()) + start_logging() + try: + command = demisto.command() + # commands that return a single note result + normal_commands = { + "ews-get-searchable-mailboxes": get_searchable_mailboxes, + "ews-move-item-between-mailboxes": move_item_between_mailboxes, + "ews-move-item": move_item, + "ews-delete-items": delete_items, + "ews-search-mailbox": search_items_in_mailbox, + "ews-get-contacts": get_contacts, + "ews-get-out-of-office": get_out_of_office_state, + "ews-recover-messages": recover_soft_delete_item, + "ews-create-folder": create_folder, + "ews-mark-item-as-junk": mark_item_as_junk, + "ews-find-folders": find_folders, + "ews-get-items-from-folder": get_items_from_folder, + "ews-get-items": get_items, + "ews-get-folder": get_folder, + "ews-expand-group": get_expanded_group, + "ews-mark-items-as-read": mark_item_as_read, + } + + # commands that may return multiple results or non-note result + special_output_commands = { + "ews-get-attachment": fetch_attachments_for_message, + "ews-delete-attachment": delete_attachments_for_message, + "ews-get-items-as-eml": get_item_as_eml, + } + # system commands: + if command == "test-module": + is_test_module = True + demisto.results(test_module(client, params.get('max_fetch'))) + elif command == "fetch-incidents": + last_run = demisto.getLastRun() + incidents = fetch_emails_as_incidents(client, last_run) + demisto.incidents(incidents) + + # special outputs commands + elif command in special_output_commands: + demisto.results(special_output_commands[command](client, **args)) # type: ignore[operator] + + # normal commands + else: + output = normal_commands[command](client, **args) # type: ignore[operator] + return_outputs(*output) + + except Exception as e: + start_logging() + debug_log = log_stream.getvalue() # type: ignore[union-attr] + error_message_simple = "" + + # Office365 regular maintenance case + if isinstance(e, ErrorMailboxStoreUnavailable) or isinstance( + e, ErrorMailboxMoveInProgress + ): + log_message = ( + "Office365 is undergoing load balancing operations. " + "As a result, the service is temporarily unavailable." + ) + if demisto.command() == "fetch-incidents": + demisto.info(log_message) + demisto.incidents([]) + sys.exit(0) + if is_test_module: + demisto.results( + log_message + " Please retry the instance configuration test." + ) + sys.exit(0) + error_message_simple = log_message + " Please retry your request." + + if isinstance(e, ConnectionError): + error_message_simple = ( + "Could not connect to the server.\n" + f"Additional information: {str(e)}" + ) + else: + if is_test_module and isinstance(e, MalformedResponseError): + error_message_simple = ( + "Got invalid response from the server.\n" + ) + + # Legacy error handling + if "Status code: 401" in debug_log: + error_message_simple = ( + "Got unauthorized from the server. " + ) + + if "Status code: 503" in debug_log: + error_message_simple = ( + "Got timeout from the server. " + "Probably the server is not reachable with the current settings. " + ) + + if not error_message_simple: + error_message = error_message_simple = str(e) + else: + error_message = error_message_simple + "\n" + str(e) + + stacktrace = traceback.format_exc() + if stacktrace: + error_message += "\nFull stacktrace:\n" + stacktrace + + if debug_log: + error_message += "\nFull debug log:\n" + debug_log + + if demisto.command() == "fetch-incidents": + raise + if demisto.command() == "ews-search-mailbox" and isinstance(e, ValueError): + return_error( + message="Selected invalid field, please specify valid field name.", + error=e, + ) + if is_test_module: + demisto.results(error_message_simple) + else: + demisto.results( + { + "Type": entryTypes["error"], + "ContentsFormat": formats["text"], + "Contents": error_message_simple, + } + ) + demisto.error(f"{e.__class__.__name__}: {error_message}") + finally: + exchangelib_cleanup() + if log_stream: + try: + logging.getLogger().removeHandler(log_handler) # type: ignore + log_stream.close() + except Exception as ex: + demisto.error( + "EWS: unexpected exception when trying to remove log handler: {}".format( + ex + ) + ) + + +def process_main(): + """setup stdin to fd=0 so we can read from the server""" + sys.stdin = os.fdopen(0, "r") + sub_main() + + +def main(): + # When running big queries, like 'ews-search-mailbox' the memory might not freed by the garbage + # collector. `separate_process` flag will run the integration on a separate process that will prevent + # memory leakage. + separate_process = demisto.params().get("separate_process", False) + demisto.debug("Running as separate_process: {}".format(separate_process)) + if separate_process: + try: + p = Process(target=process_main) + p.start() + p.join() + except Exception as ex: + demisto.error("Failed starting Process: {}".format(ex)) + else: + sub_main() + + +from MicrosoftApiModule import * # noqa: E402 + +if __name__ in ("__main__", "__builtin__", "builtins"): + main() diff --git a/Packs/EWS/Integrations/EWSO365/EWSO365.yml b/Packs/EWS/Integrations/EWSO365/EWSO365.yml new file mode 100644 index 00000000000..dc99373365a --- /dev/null +++ b/Packs/EWS/Integrations/EWSO365/EWSO365.yml @@ -0,0 +1,1051 @@ +category: Messaging +commonfields: + id: EWSO365 + version: -1 +configuration: +- additionalinfo: ID can be received from the admin consent procedure - see Detailed Instructions. + display: ID / Application ID + name: client_id + required: true + type: 4 +- additionalinfo: Token can be received from the admin consent procedure - see Detailed Instructions. + display: Token / Tenant ID + name: tenant_id + required: true + type: 4 +- additionalinfo: Key can be received from the admin consent procedure - see Detailed Instructions. + display: Key / Application Secret + name: client_secret + required: true + type: 4 +- additionalinfo: Mailbox to run commands on and to fetch incidents from. + display: Email Address + name: default_target_mailbox + required: true + type: 0 +- additionalinfo: Supports Exchange Folder ID and sub-folders e.g. Inbox/Phishing. + defaultvalue: Inbox + display: Name of the folder from which to fetch incidents + name: folder + required: true + type: 0 +- defaultvalue: 'false' + display: Public Folder + name: is_public_folder + required: false + type: 8 +- display: Fetch incidents + name: isFetch + required: false + type: 8 +- display: Incident type + name: incidentType + required: false + type: 13 +- defaultvalue: '50' + display: Max incidents per fetch (up to 50) + name: max_fetch + required: false + type: 0 +- defaultvalue: '120' + display: Timeout (in seconds) for HTTP requests to Exchange Server + name: request_timeout + required: false + type: 0 +- display: Trust any certificate (not secure) + name: insecure + required: false + type: 8 +- defaultvalue: 'false' + display: Use system proxy settings + name: proxy + required: false + type: 8 +- defaultvalue: 'false' + display: Run as a separate process (protects against memory depletion) + name: separate_process + required: false + type: 8 +- display: Use a self deployed Azure Application + hidden: false + name: self_deployed + required: false + type: 8 +description: Exchange Web Services and Office 365 (mail) +display: EWS O365 +name: EWSO365 +script: + commands: + - arguments: + - default: false + description: The ID of the email message for which to get the attachments. + isArray: false + name: item-id + required: true + secret: false + - default: false + description: The mailbox in which this attachment was found. If empty, the default + mailbox is used. Otherwise the user might require impersonation rights to + this mailbox. + isArray: false + name: target-mailbox + required: false + secret: false + - default: false + description: The attachments ids to get. If none - all attachments will be retrieve + from the message. Support multiple attachments with comma-separated value + or array. + isArray: true + name: attachment-ids + required: false + secret: false + deprecated: false + description: Retrieves the actual attachments from an item (email message). To + get all attachments for a message, only specify the item-id argument. + execution: false + name: ews-get-attachment + outputs: + - contextPath: EWS.Items.FileAttachments.attachmentId + description: The attachment ID. Used for file attachments only. + type: string + - contextPath: EWS.Items.FileAttachments.attachmentName + description: The attachment name. Used for file attachments only. + type: string + - contextPath: EWS.Items.FileAttachments.attachmentSHA256 + description: The SHA256 hash of the attached file. + type: string + - contextPath: EWS.Items.FileAttachments.attachmentLastModifiedTime + description: The attachment last modified time. Used for file attachments only. + type: date + - contextPath: EWS.Items.ItemAttachments.datetimeCreated + description: The created time of the attached email. + type: date + - contextPath: EWS.Items.ItemAttachments.datetimeReceived + description: The received time of the attached email. + type: date + - contextPath: EWS.Items.ItemAttachments.datetimeSent + description: The sent time of the attached email. + type: date + - contextPath: EWS.Items.ItemAttachments.receivedBy + description: The received by address of the attached email. + type: string + - contextPath: EWS.Items.ItemAttachments.subject + description: The subject of the attached email. + type: string + - contextPath: EWS.Items.ItemAttachments.textBody + description: The body of the attached email (as text). + type: string + - contextPath: EWS.Items.ItemAttachments.headers + description: The headers of the attached email. + type: Unknown + - contextPath: EWS.Items.ItemAttachments.hasAttachments + description: Whether the attached email has attachments. + type: boolean + - contextPath: EWS.Items.ItemAttachments.itemId + description: The attached email item ID. + type: string + - contextPath: EWS.Items.ItemAttachments.toRecipients + description: A list of recipient email addresses for the attached email. + type: Unknown + - contextPath: EWS.Items.ItemAttachments.body + description: The body of the attached email (as HTML). + type: string + - contextPath: EWS.Items.ItemAttachments.attachmentSHA256 + description: The SHA256 hash of the attached email (as EML file). + type: string + - contextPath: EWS.Items.ItemAttachments.FileAttachments.attachmentSHA256 + description: SHA256 hash of the attached files inside of the attached email. + type: string + - contextPath: EWS.Items.ItemAttachments.ItemAttachments.attachmentSHA256 + description: SHA256 hash of the attached emails inside of the attached email. + type: string + - contextPath: EWS.Items.ItemAttachments.isRead + description: The read status of the attachment. + type: String + - arguments: + - default: false + description: The ID of the email message for which to delete attachments. + isArray: false + name: item-id + required: true + secret: false + - default: false + description: The mailbox in which this attachment was found. If empty, the default + mailbox is used. Otherwise the user might require impersonation rights to + this mailbox. + isArray: false + name: target-mailbox + required: false + secret: false + - default: false + description: A comma-separated list (or array) of attachment IDs to delete. If empty, all + attachments will be deleted from the message. + isArray: true + name: attachment-ids + required: false + secret: false + deprecated: false + description: Deletes the attachments of an item (email message). + execution: false + name: ews-delete-attachment + outputs: + - contextPath: EWS.Items.FileAttachments.attachmentId + description: The ID of the deleted attachment, in case of file attachment. + type: string + - contextPath: EWS.Items.ItemAttachments.attachmentId + description: The ID of the deleted attachment, in case of other attachment (for + example, "email"). + type: string + - contextPath: EWS.Items.FileAttachments.action + description: 'The deletion action in case of file attachment. This is a constant + value: ''deleted''.' + type: string + - contextPath: EWS.Items.ItemAttachments.action + description: 'The deletion action in case of other attachment (for example, + "email"). This is a constant value: ''deleted''.' + type: string + - deprecated: false + description: Returns a list of searchable mailboxes. This command requires eDiscovery + permissions to the Exchange Server. For more information, see the EWSv2 integration + documentation. + execution: false + name: ews-get-searchable-mailboxes + outputs: + - contextPath: EWS.Mailboxes.mailbox + description: Addresses of the searchable mailboxes. + type: string + - contextPath: EWS.Mailboxes.mailboxId + description: IDs of the searchable mailboxes. + type: string + - contextPath: EWS.Mailboxes.displayName + description: The email display name. + type: string + - contextPath: EWS.Mailboxes.isExternal + description: Whether the mailbox is external. + type: boolean + - contextPath: EWS.Mailboxes.externalEmailAddress + description: The external email address. + type: string + - arguments: + - default: false + description: The ID of the item to move. + isArray: false + name: item-id + required: true + secret: false + - default: false + description: The path to the folder to which to move the item. Complex paths + are supported, for example, "Inbox\Phishing". + isArray: false + name: target-folder-path + required: true + secret: false + - default: false + description: The mailbox on which to run the command. + isArray: false + name: target-mailbox + required: false + secret: false + - auto: PREDEFINED + default: false + description: Whether the target folder is a public folder. Can be "True" or "False". + isArray: false + name: is-public + predefined: + - 'True' + - 'False' + required: false + secret: false + deprecated: false + description: Move an item to different folder in the mailbox. + execution: false + name: ews-move-item + outputs: + - contextPath: EWS.Items.newItemID + description: The item ID after move. + type: string + - contextPath: EWS.Items.messageID + description: The item message ID. + type: string + - contextPath: EWS.Items.itemId + description: The original item ID. + type: string + - contextPath: EWS.Items.action + description: The action taken. The value will be "moved". + type: string + - arguments: + - default: false + description: The item IDs to delete. + isArray: false + name: item-ids + required: true + secret: false + - default: false + defaultValue: soft + description: Deletion type. Can be "trash", "soft", or "hard". + isArray: false + name: delete-type + required: true + secret: false + - default: false + description: The mailbox on which to run the command. + isArray: false + name: target-mailbox + required: false + secret: false + deprecated: false + description: Delete items from mailbox. + execution: false + name: ews-delete-items + outputs: + - contextPath: EWS.Items.itemId + description: The deleted item ID. + type: string + - contextPath: EWS.Items.messageId + description: The deleted message ID. + type: string + - contextPath: EWS.Items.action + description: The deletion action. Can be 'trash-deleted', 'soft-deleted', or + 'hard-deleted'. + type: string + - arguments: + - default: false + description: 'The search query string. For more information about the query + syntax, see the Microsoft documentation: https://msdn.microsoft.com/en-us/library/ee693615.aspx' + isArray: false + name: query + required: false + secret: false + - default: false + description: The folder path in which to search. If empty, searches all + folders in the mailbox. + isArray: false + name: folder-path + required: false + secret: false + - default: false + defaultValue: '50' + description: Maximum number of results to return. The default is 50. + isArray: false + name: limit + required: false + secret: false + - default: false + description: The mailbox on which to apply the search. + isArray: false + name: target-mailbox + required: false + secret: false + - auto: PREDEFINED + default: false + description: Whether the folder is a public folder. Can be "True" or "False". + isArray: false + name: is-public + predefined: + - 'True' + - 'False' + required: false + secret: false + - default: false + description: The message ID of the email. This will be ignored if a query argument + is provided. + isArray: false + name: message-id + required: false + secret: false + - default: false + defaultValue: all + description: A comma-separated list of fields to retrieve. + isArray: true + name: selected-fields + predefined: + - '' + required: false + secret: false + deprecated: false + description: Searches for items in the specified mailbox. Specific permissions + are needed for this operation to search in a target mailbox other than the default. + execution: false + name: ews-search-mailbox + outputs: + - contextPath: EWS.Items.itemId + description: The email item ID. + type: string + - contextPath: EWS.Items.hasAttachments + description: Whether the email has attachments. + type: boolean + - contextPath: EWS.Items.datetimeReceived + description: Received time of the email. + type: date + - contextPath: EWS.Items.datetimeSent + description: Sent time of the email. + type: date + - contextPath: EWS.Items.headers + description: Email headers (list). + type: Unknown + - contextPath: EWS.Items.sender + description: Sender email address of the email. + type: string + - contextPath: EWS.Items.subject + description: Subject of the email. + type: string + - contextPath: EWS.Items.textBody + description: Body of the email (as text). + type: string + - contextPath: EWS.Items.size + description: Email size. + type: number + - contextPath: EWS.Items.toRecipients + description: List of email recipients addresses. + type: Unknown + - contextPath: EWS.Items.receivedBy + description: Received by address of the email. + type: Unknown + - contextPath: EWS.Items.messageId + description: Email message ID. + type: string + - contextPath: EWS.Items.body + description: Body of the email (as HTML). + type: string + - contextPath: EWS.Items.FileAttachments.attachmentId + description: Attachment ID of the file attachment. + type: unknown + - contextPath: EWS.Items.ItemAttachments.attachmentId + description: Attachment ID of the item attachment. + type: unknown + - contextPath: EWS.Items.FileAttachments.attachmentName + description: Attachment name of the file attachment. + type: unknown + - contextPath: EWS.Items.ItemAttachments.attachmentName + description: Attachment name of the item attachment. + type: unknown + - contextPath: EWS.Items.isRead + description: The read status of the email. + type: String + - arguments: + - default: false + description: The mailbox for which to retrieve the contacts. + isArray: false + name: target-mailbox + required: false + secret: false + - default: false + defaultValue: '50' + description: Maximum number of results to return. The default is 50. + isArray: false + name: limit + required: false + secret: false + deprecated: false + description: Retrieves contacts for a specified mailbox. + execution: false + name: ews-get-contacts + outputs: + - contextPath: Account.Email.EwsContacts.displayName + description: The contact name. + type: Unknown + - contextPath: Account.Email.EwsContacts.lastModifiedTime + description: The time that the contact was last modified. + type: Unknown + - contextPath: Account.Email.EwsContacts.emailAddresses + description: Phone numbers of the contact. + type: Unknown + - contextPath: Account.Email.EwsContacts.physicalAddresses + description: Physical addresses of the contact. + type: Unknown + - contextPath: Account.Email.EwsContacts.phoneNumbers.phoneNumber + description: Email addresses of the contact. + type: Unknown + - arguments: + - default: false + description: The mailbox for which to get the out-of-office status. + isArray: false + name: target-mailbox + required: true + secret: false + deprecated: false + description: Retrieves the out-of-office status for a specified mailbox. + execution: false + name: ews-get-out-of-office + outputs: + - contextPath: Account.Email.OutOfOffice.state + description: 'Out-of-office state. Result can be: Enabled, Scheduled, Disabled.' + type: Unknown + - contextPath: Account.Email.OutOfOffice.externalAudience + description: Out-of-office external audience. Can be "None", "Known", or "All". + type: Unknown + - contextPath: Account.Email.OutOfOffice.start + description: Out-of-office start date. + type: Unknown + - contextPath: Account.Email.OutOfOffice.end + description: Out-of-office end date. + type: Unknown + - contextPath: Account.Email.OutOfOffice.internalReply + description: Out-of-office internal reply. + type: Unknown + - contextPath: Account.Email.OutOfOffice.externalReply + description: Out-of-office external reply. + type: Unknown + - contextPath: Account.Email.OutOfOffice.mailbox + description: Out-of-office mailbox. + type: Unknown + - arguments: + - default: false + description: A comma-separated list of message IDs. Run the py-ews-delete-items command + to retrieve the message IDs + isArray: false + name: message-ids + required: true + secret: false + - default: false + defaultValue: Inbox + description: The folder path to recover the messages to. + isArray: false + name: target-folder-path + required: true + secret: false + - default: false + description: The mailbox in which the messages found. If empty, will use the + default mailbox. If you specify a different mailbox, you might need impersonation + rights to the mailbox. + isArray: false + name: target-mailbox + required: false + secret: false + - auto: PREDEFINED + default: false + description: Whether the target folder is a Public Folder. Can be "True" or "False". + isArray: false + name: is-public + predefined: + - 'True' + - 'False' + required: false + secret: false + deprecated: false + description: Recovers messages that were soft-deleted. + execution: false + name: ews-recover-messages + outputs: + - contextPath: EWS.Items.itemId + description: The item ID of the recovered item. + type: Unknown + - contextPath: EWS.Items.messageId + description: The message ID of the recovered item. + type: Unknown + - contextPath: EWS.Items.action + description: The action taken on the item. The value will be 'recovered'. + type: Unknown + - arguments: + - default: false + description: The name of the new folder. + isArray: false + name: new-folder-name + required: true + secret: false + - default: false + defaultValue: Inbox + description: Path to locate the new folder. Exchange folder ID is also supported. + isArray: false + name: folder-path + required: true + secret: false + - default: false + description: The mailbox in which to create the folder. + isArray: false + name: target-mailbox + required: false + secret: false + deprecated: false + description: Creates a new folder in a specified mailbox. + execution: false + name: ews-create-folder + - arguments: + - default: false + description: The item ID to mark as junk. + isArray: false + name: item-id + required: true + secret: false + - auto: PREDEFINED + default: false + defaultValue: 'yes' + description: Whether to move the item from the original folder to the junk folder. Can be "yes" or "no". The default is "yes". + isArray: false + name: move-items + predefined: + - 'yes' + - 'no' + required: false + secret: false + - default: false + description: If empty, will use the default mailbox. If you specify a different + mailbox, you might need impersonation rights to the mailbox. + isArray: false + name: target-mailbox + required: false + secret: false + deprecated: false + description: 'Marks an item as junk. This is commonly used to block an email address. + For more information, see the Microsoft documentation: https://msdn.microsoft.com/en-us/library/office/dn481311(v=exchg.150).aspx' + execution: false + name: ews-mark-item-as-junk + - arguments: + - default: false + description: The mailbox on which to apply the command. + isArray: false + name: target-mailbox + required: false + secret: false + deprecated: false + description: Retrieves information for folders for a specified mailbox. Only folders + with read permissions will be returned. Your visual folders on the mailbox, + such as "Inbox", are under the folder "Top of Information Store". + execution: false + name: ews-find-folders + outputs: + - contextPath: EWS.Folders.name + description: Folder name. + type: string + - contextPath: EWS.Folders.id + description: Folder ID. + type: string + - contextPath: EWS.Folders.totalCount + description: Number of items in the folder. + type: Unknown + - contextPath: EWS.Folders.unreadCount + description: Number of unread items in the folder. + type: number + - contextPath: EWS.Folders.changeKey + description: Folder change key. + type: number + - contextPath: EWS.Folders.childrenFolderCount + description: Number of sub-folders. + type: number + - arguments: + - default: false + description: The folder path from which to get the items. + isArray: false + name: folder-path + required: true + secret: false + - default: false + defaultValue: '50' + description: Maximum number of items to return. The default is 50. + isArray: false + name: limit + required: false + secret: false + - default: false + description: The mailbox to on which to apply the command. + isArray: false + name: target-mailbox + required: false + secret: false + - auto: PREDEFINED + default: false + description: Whether the folder is a public folder. Can be "True" or "False". The default is "False". + isArray: false + name: is-public + predefined: + - 'True' + - 'False' + required: false + secret: false + - auto: PREDEFINED + default: false + defaultValue: 'no' + description: If the email item contains another email as an attachment (EML + or MSG file), whether to retrieve the EML/MSG file attachment. Can be "yes" + or "no". The default is "no". + isArray: false + name: get-internal-item + predefined: + - 'yes' + - 'no' + required: false + secret: false + deprecated: false + description: Retrieves items from a specified folder in a mailbox. The items are + order by the item created time, most recent is first. + execution: false + name: ews-get-items-from-folder + outputs: + - contextPath: EWS.Items.itemId + description: The item ID of the email. + type: string + - contextPath: EWS.Items.hasAttachments + description: Whether the email has attachments. + type: boolean + - contextPath: EWS.Items.datetimeReceived + description: Received time of the email. + type: date + - contextPath: EWS.Items.datetimeSent + description: Sent time of the email. + type: date + - contextPath: EWS.Items.headers + description: Email headers (list). + type: Unknown + - contextPath: EWS.Items.sender + description: Sender mail address of the email. + type: string + - contextPath: EWS.Items.subject + description: Subject of the email. + type: string + - contextPath: EWS.Items.textBody + description: Body of the email (as text). + type: string + - contextPath: EWS.Items.size + description: Email size. + type: number + - contextPath: EWS.Items.toRecipients + description: Email recipients addresses (list). + type: Unknown + - contextPath: EWS.Items.receivedBy + description: Received by address of the email. + type: Unknown + - contextPath: EWS.Items.messageId + description: Email message ID. + type: string + - contextPath: EWS.Items.body + description: Body of the email (as HTML). + type: string + - contextPath: EWS.Items.FileAttachments.attachmentId + description: Attachment ID of file attachment. + type: unknown + - contextPath: EWS.Items.ItemAttachments.attachmentId + description: Attachment ID of the item attachment. + type: unknown + - contextPath: EWS.Items.FileAttachments.attachmentName + description: Attachment name of the file attachment. + type: unknown + - contextPath: EWS.Items.ItemAttachments.attachmentName + description: Attachment name of the item attachment. + type: unknown + - contextPath: EWS.Items.isRead + description: The read status of the email. + type: String + - arguments: + - default: false + description: A comma-separated list if item IDs. + isArray: true + name: item-ids + required: true + secret: false + - default: false + description: The mailbox on which to run the command. + isArray: false + name: target-mailbox + required: false + secret: false + deprecated: false + description: Retrieves items by item ID. + execution: false + name: ews-get-items + outputs: + - contextPath: EWS.Items.itemId + description: The email item ID. + type: string + - contextPath: EWS.Items.hasAttachments + description: Whether the email has attachments. + type: boolean + - contextPath: EWS.Items.datetimeReceived + description: Received time of the email. + type: date + - contextPath: EWS.Items.datetimeSent + description: Sent time of the email. + type: date + - contextPath: EWS.Items.headers + description: Email headers (list). + type: Unknown + - contextPath: EWS.Items.sender + description: Sender mail address of the email. + type: string + - contextPath: EWS.Items.subject + description: Subject of the email. + type: string + - contextPath: EWS.Items.textBody + description: Body of the email (as text). + type: string + - contextPath: EWS.Items.size + description: Email size. + type: number + - contextPath: EWS.Items.toRecipients + description: Email recipients addresses (list). + type: Unknown + - contextPath: EWS.Items.receivedBy + description: Received by address of the email. + type: Unknown + - contextPath: EWS.Items.messageId + description: Email message ID. + type: string + - contextPath: EWS.Items.body + description: Body of the email (as HTML). + type: string + - contextPath: EWS.Items.FileAttachments.attachmentId + description: Attachment ID of the file attachment. + type: unknown + - contextPath: EWS.Items.ItemAttachments.attachmentId + description: Attachment ID of the item attachment. + type: unknown + - contextPath: EWS.Items.FileAttachments.attachmentName + description: Attachment name of the file attachment. + type: unknown + - contextPath: EWS.Items.ItemAttachments.attachmentName + description: Attachment name of the item attachment. + type: unknown + - contextPath: EWS.Items.isRead + description: The read status of the email. + type: String + - contextPath: Email.CC + description: Email addresses CC'ed to the email. + type: String + - contextPath: Email.BCC + description: Email addresses BCC'ed to the email. + type: String + - contextPath: Email.To + description: The recipient of the email. + type: String + - contextPath: Email.From + description: The sender of the email. + type: String + - contextPath: Email.Subject + description: The subject of the email. + type: String + - contextPath: Email.Text + description: The plain-text version of the email. + type: String + - contextPath: Email.HTML + description: The HTML version of the email. + type: String + - contextPath: Email.HeadersMap + description: The headers of the email. + type: String + - arguments: + - default: false + description: The item ID to move. + isArray: false + name: item-id + required: true + secret: false + - default: false + description: The folder in the destination mailbox to which to move the item. + You can specify a complex path, for example, "Inbox\Phishing". + isArray: false + name: destination-folder-path + required: true + secret: false + - default: false + description: The mailbox to which to move the item. + isArray: false + name: destination-mailbox + required: true + secret: false + - default: false + description: The mailbox from which to move the item (conventionally called + the "target-mailbox", the target mailbox on which to run the command). + isArray: false + name: source-mailbox + required: false + secret: false + - auto: PREDEFINED + default: false + description: Whether the destination folder is a Public Folder. Can be "True" or "False". Default is "False". + isArray: false + name: is-public + predefined: + - 'True' + - 'False' + required: false + secret: false + deprecated: false + description: Moves an item from one mailbox to different mailbox. + execution: false + name: ews-move-item-between-mailboxes + outputs: + - contextPath: EWS.Items.movedToMailbox + description: The mailbox wo which the item was moved. + type: string + - contextPath: EWS.Items.movedToFolder + description: The folder to which the item was moved. + type: string + - contextPath: EWS.Items.action + description: The action taken on the item. The value will be "moved". + type: string + - arguments: + - default: false + description: The mailbox on which to run the search. + isArray: false + name: target-mailbox + required: false + secret: false + - default: true + defaultValue: AllItems + description: The path of the folder to retrieve. If empty, will retrieve the + folder "AllItems". + isArray: false + name: folder-path + required: false + secret: false + - auto: PREDEFINED + default: false + description: Whether the folder is a Public Folder. Default is "False". + isArray: false + name: is-public + predefined: + - 'True' + - 'False' + required: false + secret: false + deprecated: false + description: Retrieves a single folder. + execution: false + name: ews-get-folder + outputs: + - contextPath: EWS.Folders.id + description: Folder ID. + type: string + - contextPath: EWS.Folders.name + description: Folder name. + type: string + - contextPath: EWS.Folders.changeKey + description: Folder change key. + type: string + - contextPath: EWS.Folders.totalCount + description: Total number of emails in the folder. + type: number + - contextPath: EWS.Folders.childrenFolderCount + description: Number of sub-folders. + type: number + - contextPath: EWS.Folders.unreadCount + description: Number of unread emails in the folder. + type: number + - arguments: + - default: false + description: Email address of the group to expand. + isArray: false + name: email-address + required: true + secret: false + - auto: PREDEFINED + default: false + defaultValue: 'False' + description: Whether to enable recursive expansion. Can be "True" or "False". Default is "False". + isArray: false + name: recursive-expansion + predefined: + - 'True' + - 'False' + required: false + secret: false + deprecated: false + description: Expands a distribution list to display all members. By default, expands + only first layer of the distribution list. If recursive-expansion is "True", + the command expands nested distribution lists and returns all members. + execution: false + name: ews-expand-group + - arguments: + - default: false + description: A comma-separated list of item IDs. + isArray: true + name: item-ids + required: true + secret: false + - auto: PREDEFINED + default: false + defaultValue: read + description: How to mark the item. Can be "read" or "unread". Default is "read". + isArray: false + name: operation + predefined: + - read + - unread + required: false + secret: false + - default: false + description: The mailbox on which to run the command. If empty, the command + will be applied on the default mailbox. + isArray: false + name: target-mailbox + required: false + secret: false + deprecated: false + description: Marks items as read or unread. + execution: false + name: ews-mark-items-as-read + outputs: + - contextPath: EWS.Items.action + description: The action that was performed on item. + type: String + - contextPath: EWS.Items.itemId + description: The ID of the item. + type: String + - contextPath: EWS.Items.messageId + description: The message ID of the item. + type: String + - arguments: + - default: false + description: The item ID of item to upload as and EML file. + isArray: false + name: item-id + required: true + secret: false + - default: false + description: The mailbox in which this email was found. If empty, the default + mailbox is used. Otherwise the user might require impersonation rights to + this mailbox. + isArray: false + name: target-mailbox + required: false + secret: false + deprecated: false + description: Retrieves items by item ID and uploads its content as an EML file. + execution: false + name: ews-get-items-as-eml + outputs: + - contextPath: File.Size + description: The size of the file. + type: String + - contextPath: File.SHA1 + description: The SHA1 hash of the file. + type: String + - contextPath: File.SHA256 + description: The SHA256 hash of the file. + type: String + - contextPath: File.SHA512 + description: The SHA512 hash of the file. + type: String + - contextPath: File.Name + description: The name of the file. + type: String + - contextPath: File.SSDeep + description: The SSDeep hash of the file. + type: String + - contextPath: File.EntryID + description: EntryID of the file + type: String + - contextPath: File.Info + description: Information about the file. + type: String + - contextPath: File.Type + description: The file type. + type: String + - contextPath: File.MD5 + description: The MD5 hash of the file. + type: String + - contextPath: File.Extension + description: The extension of the file. + type: String + dockerimage: demisto/py3ews:1.0.0.8854 + feed: false + isfetch: true + longRunning: false + longRunningPort: false + runonce: false + script: '-' + subtype: python3 + type: python +tests: +- pyEWS_Test +- EWS search-mailbox test +fromversion: 5.0.0 diff --git a/Packs/EWS/Integrations/EWSO365/EWSO365_description.md b/Packs/EWS/Integrations/EWSO365/EWSO365_description.md new file mode 100644 index 00000000000..1b3079c5a6a --- /dev/null +++ b/Packs/EWS/Integrations/EWSO365/EWSO365_description.md @@ -0,0 +1,6 @@ +To allow access to EWS O365, an administrator has to approve the Demisto app using an admin consent flow, by clicking on the following [link](https://oproxy.demisto.ninja/ms-ews-o365). +After authorizing the Demisto app, you will get an ID, Token, and Key, which needs to be added to the integration instance configuration's corresponding fields. + +### Required Permissions for self deployed Azure Application: +#### Exchange +* **full_access_as_app** - Application diff --git a/Packs/EWS/Integrations/EWSO365/EWSO365_image.png b/Packs/EWS/Integrations/EWSO365/EWSO365_image.png new file mode 100644 index 00000000000..97612d231c0 Binary files /dev/null and b/Packs/EWS/Integrations/EWSO365/EWSO365_image.png differ diff --git a/Packs/EWS/Integrations/EWSO365/EWSO365_test.py b/Packs/EWS/Integrations/EWSO365/EWSO365_test.py new file mode 100644 index 00000000000..2d1c4688ac4 --- /dev/null +++ b/Packs/EWS/Integrations/EWSO365/EWSO365_test.py @@ -0,0 +1,148 @@ +import json + +from EWSO365 import ( + find_folders, + get_searchable_mailboxes, + GetSearchableMailboxes, + ExpandGroup, + get_expanded_group, +) + +with open("test_data/commands_outputs.json", "r") as f: + COMMAND_OUTPUTS = json.load(f) +with open("test_data/raw_responses.json", "r") as f: + RAW_RESPONSES = json.load(f) + + +class TestNormalCommands: + """ + The test class checks the following normal_commands: + * ews-find-folders + """ + + class MockClient: + class MockAccount: + def __init__(self): + self.root = self + self.walk_res = [] + self.all_res = "" + self.contacts = self + + def walk(self): + return self.walk_res + + def tree(self): + return "" + + def all(self): + return self.all_res + + def __init__(self): + self.default_target_mailbox = "" + self.client_id = "" + self.client_secret = "" + self.tenant_id = "" + self.folder = "" + self.is_public_folder = "" + self.request_timeout = "" + self.max_fetch = "" + self.self_deployed = "" + self.insecure = "" + self.proxy = "" + self.account = self.MockAccount() + self.protocol = "" + + def get_account(self, target_mailbox=None, access_type=None): + return self.account + + def get_items_from_mailbox(self, account, item_ids): + return "" + + def get_item_from_mailbox(self, account, item_id): + return "" + + def get_attachments_for_item(self, item_id, account, attachment_ids=None): + return "" + + def is_default_folder(self, folder_path, is_public): + return "" + + def get_folder_by_path(self, path, account=None, is_public=False): + return "" + + def test_ews_find_folders(self): + """ + This test checks the following normal_command: + * ews-find-folders + Using this method: + Given: + - command name is ews-find-folders + - client function name to mock + - expected raw result + - expected command result + When: + - we want to execute the command function + Then: + - the expected result will be the same as the entry context + """ + command_name = "ews-find-folders" + + raw_response = RAW_RESPONSES[command_name] + expected = COMMAND_OUTPUTS[command_name] + client = self.MockClient() + client.account.walk_res = raw_response + res = find_folders(client) + actual_ec = res[1] + assert expected == actual_ec + + def test_get_searchable_mailboxes(self, mocker): + """ + This test checks the following normal_command: + * ews-get-searchable-mailboxes + Using this method: + Given: + - command name is ews-get-searchable-mailboxes + - client function name to mock + - expected raw result + - expected command result + When: + - we want to execute the command function + Then: + - the expected result will be the same as the entry context + """ + command_name = "ews-get-searchable-mailboxes" + expected = COMMAND_OUTPUTS[command_name] + raw_response = RAW_RESPONSES["ews-get-searchable-mailboxes"] + mocker.patch.object(GetSearchableMailboxes, "__init__", return_value=None) + mocker.patch.object(GetSearchableMailboxes, "call", return_value=raw_response) + client = self.MockClient() + res = get_searchable_mailboxes(client) + actual_ec = res[1] + assert expected == actual_ec + + def test_expand_group(self, mocker): + """ + This test checks the following normal_command: + * ews-expand-group + Using this method: + Given: + - command name is ews-expand-group + - client function name to mock + - expected raw result + - expected command result + When: + - we want to execute the command function + Then: + - the expected result will be the same as the entry context + """ + command_name = "ews-expand-group" + expected = COMMAND_OUTPUTS[command_name] + raw_response = RAW_RESPONSES[command_name] + mocker.patch.object(ExpandGroup, "__init__", return_value=None) + mocker.patch.object(ExpandGroup, "call", return_value=raw_response) + client = self.MockClient() + res = get_expanded_group( + client, email_address="testgroup-1@demistodev.onmicrosoft.com" + ) + actual_ec = res[1] + assert expected == actual_ec diff --git a/Packs/EWS/Integrations/EWSO365/Pipfile b/Packs/EWS/Integrations/EWSO365/Pipfile new file mode 100644 index 00000000000..3523d3b6b93 --- /dev/null +++ b/Packs/EWS/Integrations/EWSO365/Pipfile @@ -0,0 +1,18 @@ +[[source]] +name = "pypi" +url = "https://pypi.org/simple" +verify_ssl = true + +[dev-packages] +pylint = "*" +pytest = "==5.0.1" +pytest-mock = "*" +requests-mock = "*" +pytest-asyncio = "*" + +[packages] +pytest = "*" +requests = "*" + +[requires] +python_version = "3.7" diff --git a/Packs/EWS/Integrations/EWSO365/Pipfile.lock b/Packs/EWS/Integrations/EWSO365/Pipfile.lock new file mode 100644 index 00000000000..6bdb9313414 --- /dev/null +++ b/Packs/EWS/Integrations/EWSO365/Pipfile.lock @@ -0,0 +1,369 @@ +{ + "_meta": { + "hash": { + "sha256": "278db815bec49c11262633d34305f9b33f09432a223bedd5329a04f758f78b55" + }, + "pipfile-spec": 6, + "requires": { + "python_version": "3.7" + }, + "sources": [ + { + "name": "pypi", + "url": "https://pypi.org/simple", + "verify_ssl": true + } + ] + }, + "default": { + "atomicwrites": { + "hashes": [ + "sha256:03472c30eb2c5d1ba9227e4c2ca66ab8287fbfbbda3888aa93dc2e28fc6811b4", + "sha256:75a9445bac02d8d058d5e1fe689654ba5a6556a1dfd8ce6ec55a0ed79866cfa6" + ], + "version": "==1.3.0" + }, + "attrs": { + "hashes": [ + "sha256:69c0dbf2ed392de1cb5ec704444b08a5ef81680a61cb899dc08127123af36a79", + "sha256:f0b870f674851ecbfbbbd364d6b5cbdff9dcedbc7f3f5e18a6891057f21fe399" + ], + "version": "==19.1.0" + }, + "certifi": { + "hashes": [ + "sha256:e4f3620cfea4f83eedc95b24abd9cd56f3c4b146dd0177e83a21b4eb49e21e50", + "sha256:fd7c7c74727ddcf00e9acd26bba8da604ffec95bf1c2144e67aff7a8b50e6cef" + ], + "version": "==2019.9.11" + }, + "chardet": { + "hashes": [ + "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae", + "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691" + ], + "version": "==3.0.4" + }, + "idna": { + "hashes": [ + "sha256:c357b3f628cf53ae2c4c05627ecc484553142ca23264e593d327bcde5e9c3407", + "sha256:ea8b7f6188e6fa117537c3df7da9fc686d485087abf6ac197f9c46432f7e4a3c" + ], + "version": "==2.8" + }, + "importlib-metadata": { + "hashes": [ + "sha256:652234b6ab8f2506ae58e528b6fbcc668831d3cc758e1bc01ef438d328b68cdb", + "sha256:6f264986fb88042bc1f0535fa9a557e6a376cfe5679dc77caac7fe8b5d43d05f" + ], + "markers": "python_version < '3.8'", + "version": "==0.22" + }, + "more-itertools": { + "hashes": [ + "sha256:409cd48d4db7052af495b09dec721011634af3753ae1ef92d2b32f73a745f832", + "sha256:92b8c4b06dac4f0611c0729b2f2ede52b2e1bac1ab48f089c7ddc12e26bb60c4" + ], + "version": "==7.2.0" + }, + "packaging": { + "hashes": [ + "sha256:a7ac867b97fdc07ee80a8058fe4435ccd274ecc3b0ed61d852d7d53055528cf9", + "sha256:c491ca87294da7cc01902edbe30a5bc6c4c28172b5138ab4e4aa1b9d7bfaeafe" + ], + "version": "==19.1" + }, + "pluggy": { + "hashes": [ + "sha256:0db4b7601aae1d35b4a033282da476845aa19185c1e6964b25cf324b5e4ec3e6", + "sha256:fa5fa1622fa6dd5c030e9cad086fa19ef6a0cf6d7a2d12318e10cb49d6d68f34" + ], + "version": "==0.13.0" + }, + "py": { + "hashes": [ + "sha256:64f65755aee5b381cea27766a3a147c3f15b9b6b9ac88676de66ba2ae36793fa", + "sha256:dc639b046a6e2cff5bbe40194ad65936d6ba360b52b3c3fe1d08a82dd50b5e53" + ], + "version": "==1.8.0" + }, + "pyparsing": { + "hashes": [ + "sha256:6f98a7b9397e206d78cc01df10131398f1c8b8510a2f4d97d9abd82e1aacdd80", + "sha256:d9338df12903bbf5d65a0e4e87c2161968b10d2e489652bb47001d82a9b028b4" + ], + "version": "==2.4.2" + }, + "pytest": { + "hashes": [ + "sha256:95d13143cc14174ca1a01ec68e84d76ba5d9d493ac02716fd9706c949a505210", + "sha256:b78fe2881323bd44fd9bd76e5317173d4316577e7b1cddebae9136a4495ec865" + ], + "index": "pypi", + "version": "==5.1.2" + }, + "requests": { + "hashes": [ + "sha256:11e007a8a2aa0323f5a921e9e6a2d7e4e67d9877e85773fba9ba6419025cbeb4", + "sha256:9cf5292fcd0f598c671cfc1e0d7d1a7f13bb8085e9a590f48c010551dc6c4b31" + ], + "index": "pypi", + "version": "==2.22.0" + }, + "six": { + "hashes": [ + "sha256:3350809f0555b11f552448330d0b52d5f24c91a322ea4a15ef22629740f3761c", + "sha256:d16a0141ec1a18405cd4ce8b4613101da75da0e9a7aec5bdd4fa804d0e0eba73" + ], + "version": "==1.12.0" + }, + "urllib3": { + "hashes": [ + "sha256:b246607a25ac80bedac05c6f282e3cdaf3afb65420fd024ac94435cabe6e18d1", + "sha256:dbe59173209418ae49d485b87d1681aefa36252ee85884c31346debd19463232" + ], + "version": "==1.25.3" + }, + "wcwidth": { + "hashes": [ + "sha256:3df37372226d6e63e1b1e1eda15c594bca98a22d33a23832a90998faa96bc65e", + "sha256:f4ebe71925af7b40a864553f761ed559b43544f8f71746c2d756c7fe788ade7c" + ], + "version": "==0.1.7" + }, + "zipp": { + "hashes": [ + "sha256:3718b1cbcd963c7d4c5511a8240812904164b7f381b647143a89d3b98f9bcd8e", + "sha256:f06903e9f1f43b12d371004b4ac7b06ab39a44adc747266928ae6debfa7b3335" + ], + "version": "==0.6.0" + } + }, + "develop": { + "astroid": { + "hashes": [ + "sha256:6560e1e1749f68c64a4b5dee4e091fce798d2f0d84ebe638cf0e0585a343acf4", + "sha256:b65db1bbaac9f9f4d190199bb8680af6f6f84fd3769a5ea883df8a91fe68b4c4" + ], + "version": "==2.2.5" + }, + "atomicwrites": { + "hashes": [ + "sha256:03472c30eb2c5d1ba9227e4c2ca66ab8287fbfbbda3888aa93dc2e28fc6811b4", + "sha256:75a9445bac02d8d058d5e1fe689654ba5a6556a1dfd8ce6ec55a0ed79866cfa6" + ], + "version": "==1.3.0" + }, + "attrs": { + "hashes": [ + "sha256:69c0dbf2ed392de1cb5ec704444b08a5ef81680a61cb899dc08127123af36a79", + "sha256:f0b870f674851ecbfbbbd364d6b5cbdff9dcedbc7f3f5e18a6891057f21fe399" + ], + "version": "==19.1.0" + }, + "certifi": { + "hashes": [ + "sha256:e4f3620cfea4f83eedc95b24abd9cd56f3c4b146dd0177e83a21b4eb49e21e50", + "sha256:fd7c7c74727ddcf00e9acd26bba8da604ffec95bf1c2144e67aff7a8b50e6cef" + ], + "version": "==2019.9.11" + }, + "chardet": { + "hashes": [ + "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae", + "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691" + ], + "version": "==3.0.4" + }, + "idna": { + "hashes": [ + "sha256:c357b3f628cf53ae2c4c05627ecc484553142ca23264e593d327bcde5e9c3407", + "sha256:ea8b7f6188e6fa117537c3df7da9fc686d485087abf6ac197f9c46432f7e4a3c" + ], + "version": "==2.8" + }, + "importlib-metadata": { + "hashes": [ + "sha256:652234b6ab8f2506ae58e528b6fbcc668831d3cc758e1bc01ef438d328b68cdb", + "sha256:6f264986fb88042bc1f0535fa9a557e6a376cfe5679dc77caac7fe8b5d43d05f" + ], + "markers": "python_version < '3.8'", + "version": "==0.22" + }, + "isort": { + "hashes": [ + "sha256:54da7e92468955c4fceacd0c86bd0ec997b0e1ee80d97f67c35a78b719dccab1", + "sha256:6e811fcb295968434526407adb8796944f1988c5b65e8139058f2014cbe100fd" + ], + "version": "==4.3.21" + }, + "lazy-object-proxy": { + "hashes": [ + "sha256:02b260c8deb80db09325b99edf62ae344ce9bc64d68b7a634410b8e9a568edbf", + "sha256:18f9c401083a4ba6e162355873f906315332ea7035803d0fd8166051e3d402e3", + "sha256:1f2c6209a8917c525c1e2b55a716135ca4658a3042b5122d4e3413a4030c26ce", + "sha256:2f06d97f0ca0f414f6b707c974aaf8829c2292c1c497642f63824119d770226f", + "sha256:616c94f8176808f4018b39f9638080ed86f96b55370b5a9463b2ee5c926f6c5f", + "sha256:63b91e30ef47ef68a30f0c3c278fbfe9822319c15f34b7538a829515b84ca2a0", + "sha256:77b454f03860b844f758c5d5c6e5f18d27de899a3db367f4af06bec2e6013a8e", + "sha256:83fe27ba321e4cfac466178606147d3c0aa18e8087507caec78ed5a966a64905", + "sha256:84742532d39f72df959d237912344d8a1764c2d03fe58beba96a87bfa11a76d8", + "sha256:874ebf3caaf55a020aeb08acead813baf5a305927a71ce88c9377970fe7ad3c2", + "sha256:9f5caf2c7436d44f3cec97c2fa7791f8a675170badbfa86e1992ca1b84c37009", + "sha256:a0c8758d01fcdfe7ae8e4b4017b13552efa7f1197dd7358dc9da0576f9d0328a", + "sha256:a4def978d9d28cda2d960c279318d46b327632686d82b4917516c36d4c274512", + "sha256:ad4f4be843dace866af5fc142509e9b9817ca0c59342fdb176ab6ad552c927f5", + "sha256:ae33dd198f772f714420c5ab698ff05ff900150486c648d29951e9c70694338e", + "sha256:b4a2b782b8a8c5522ad35c93e04d60e2ba7f7dcb9271ec8e8c3e08239be6c7b4", + "sha256:c462eb33f6abca3b34cdedbe84d761f31a60b814e173b98ede3c81bb48967c4f", + "sha256:fd135b8d35dfdcdb984828c84d695937e58cc5f49e1c854eb311c4d6aa03f4f1" + ], + "version": "==1.4.2" + }, + "mccabe": { + "hashes": [ + "sha256:ab8a6258860da4b6677da4bd2fe5dc2c659cff31b3ee4f7f5d64e79735b80d42", + "sha256:dd8d182285a0fe56bace7f45b5e7d1a6ebcbf524e8f3bd87eb0f125271b8831f" + ], + "version": "==0.6.1" + }, + "more-itertools": { + "hashes": [ + "sha256:409cd48d4db7052af495b09dec721011634af3753ae1ef92d2b32f73a745f832", + "sha256:92b8c4b06dac4f0611c0729b2f2ede52b2e1bac1ab48f089c7ddc12e26bb60c4" + ], + "version": "==7.2.0" + }, + "packaging": { + "hashes": [ + "sha256:a7ac867b97fdc07ee80a8058fe4435ccd274ecc3b0ed61d852d7d53055528cf9", + "sha256:c491ca87294da7cc01902edbe30a5bc6c4c28172b5138ab4e4aa1b9d7bfaeafe" + ], + "version": "==19.1" + }, + "pluggy": { + "hashes": [ + "sha256:0db4b7601aae1d35b4a033282da476845aa19185c1e6964b25cf324b5e4ec3e6", + "sha256:fa5fa1622fa6dd5c030e9cad086fa19ef6a0cf6d7a2d12318e10cb49d6d68f34" + ], + "version": "==0.13.0" + }, + "py": { + "hashes": [ + "sha256:64f65755aee5b381cea27766a3a147c3f15b9b6b9ac88676de66ba2ae36793fa", + "sha256:dc639b046a6e2cff5bbe40194ad65936d6ba360b52b3c3fe1d08a82dd50b5e53" + ], + "version": "==1.8.0" + }, + "pylint": { + "hashes": [ + "sha256:5d77031694a5fb97ea95e828c8d10fc770a1df6eb3906067aaed42201a8a6a09", + "sha256:723e3db49555abaf9bf79dc474c6b9e2935ad82230b10c1138a71ea41ac0fff1" + ], + "index": "pypi", + "version": "==2.3.1" + }, + "pyparsing": { + "hashes": [ + "sha256:6f98a7b9397e206d78cc01df10131398f1c8b8510a2f4d97d9abd82e1aacdd80", + "sha256:d9338df12903bbf5d65a0e4e87c2161968b10d2e489652bb47001d82a9b028b4" + ], + "version": "==2.4.2" + }, + "pytest": { + "hashes": [ + "sha256:95d13143cc14174ca1a01ec68e84d76ba5d9d493ac02716fd9706c949a505210", + "sha256:b78fe2881323bd44fd9bd76e5317173d4316577e7b1cddebae9136a4495ec865" + ], + "index": "pypi", + "version": "==5.1.2" + }, + "pytest-asyncio": { + "hashes": [ + "sha256:9fac5100fd716cbecf6ef89233e8590a4ad61d729d1732e0a96b84182df1daaf", + "sha256:d734718e25cfc32d2bf78d346e99d33724deeba774cc4afdf491530c6184b63b" + ], + "index": "pypi", + "version": "==0.10.0" + }, + "pytest-mock": { + "hashes": [ + "sha256:43ce4e9dd5074993e7c021bb1c22cbb5363e612a2b5a76bc6d956775b10758b7", + "sha256:5bf5771b1db93beac965a7347dc81c675ec4090cb841e49d9d34637a25c30568" + ], + "index": "pypi", + "version": "==1.10.4" + }, + "requests": { + "hashes": [ + "sha256:11e007a8a2aa0323f5a921e9e6a2d7e4e67d9877e85773fba9ba6419025cbeb4", + "sha256:9cf5292fcd0f598c671cfc1e0d7d1a7f13bb8085e9a590f48c010551dc6c4b31" + ], + "index": "pypi", + "version": "==2.22.0" + }, + "requests-mock": { + "hashes": [ + "sha256:510df890afe08d36eca5bb16b4aa6308a6f85e3159ad3013bac8b9de7bd5a010", + "sha256:88d3402dd8b3c69a9e4f9d3a73ad11b15920c6efd36bc27bf1f701cf4a8e4646" + ], + "index": "pypi", + "version": "==1.7.0" + }, + "six": { + "hashes": [ + "sha256:3350809f0555b11f552448330d0b52d5f24c91a322ea4a15ef22629740f3761c", + "sha256:d16a0141ec1a18405cd4ce8b4613101da75da0e9a7aec5bdd4fa804d0e0eba73" + ], + "version": "==1.12.0" + }, + "typed-ast": { + "hashes": [ + "sha256:18511a0b3e7922276346bcb47e2ef9f38fb90fd31cb9223eed42c85d1312344e", + "sha256:262c247a82d005e43b5b7f69aff746370538e176131c32dda9cb0f324d27141e", + "sha256:2b907eb046d049bcd9892e3076c7a6456c93a25bebfe554e931620c90e6a25b0", + "sha256:354c16e5babd09f5cb0ee000d54cfa38401d8b8891eefa878ac772f827181a3c", + "sha256:4e0b70c6fc4d010f8107726af5fd37921b666f5b31d9331f0bd24ad9a088e631", + "sha256:630968c5cdee51a11c05a30453f8cd65e0cc1d2ad0d9192819df9978984529f4", + "sha256:66480f95b8167c9c5c5c87f32cf437d585937970f3fc24386f313a4c97b44e34", + "sha256:71211d26ffd12d63a83e079ff258ac9d56a1376a25bc80b1cdcdf601b855b90b", + "sha256:95bd11af7eafc16e829af2d3df510cecfd4387f6453355188342c3e79a2ec87a", + "sha256:bc6c7d3fa1325a0c6613512a093bc2a2a15aeec350451cbdf9e1d4bffe3e3233", + "sha256:cc34a6f5b426748a507dd5d1de4c1978f2eb5626d51326e43280941206c209e1", + "sha256:d755f03c1e4a51e9b24d899561fec4ccaf51f210d52abdf8c07ee2849b212a36", + "sha256:d7c45933b1bdfaf9f36c579671fec15d25b06c8398f113dab64c18ed1adda01d", + "sha256:d896919306dd0aa22d0132f62a1b78d11aaf4c9fc5b3410d3c666b818191630a", + "sha256:ffde2fbfad571af120fcbfbbc61c72469e72f550d676c3342492a9dfdefb8f12" + ], + "markers": "implementation_name == 'cpython'", + "version": "==1.4.0" + }, + "urllib3": { + "hashes": [ + "sha256:b246607a25ac80bedac05c6f282e3cdaf3afb65420fd024ac94435cabe6e18d1", + "sha256:dbe59173209418ae49d485b87d1681aefa36252ee85884c31346debd19463232" + ], + "version": "==1.25.3" + }, + "wcwidth": { + "hashes": [ + "sha256:3df37372226d6e63e1b1e1eda15c594bca98a22d33a23832a90998faa96bc65e", + "sha256:f4ebe71925af7b40a864553f761ed559b43544f8f71746c2d756c7fe788ade7c" + ], + "version": "==0.1.7" + }, + "wrapt": { + "hashes": [ + "sha256:565a021fd19419476b9362b05eeaa094178de64f8361e44468f9e9d7843901e1" + ], + "version": "==1.11.2" + }, + "zipp": { + "hashes": [ + "sha256:3718b1cbcd963c7d4c5511a8240812904164b7f381b647143a89d3b98f9bcd8e", + "sha256:f06903e9f1f43b12d371004b4ac7b06ab39a44adc747266928ae6debfa7b3335" + ], + "version": "==0.6.0" + } + } +} diff --git a/Packs/EWS/Integrations/EWSO365/README.md b/Packs/EWS/Integrations/EWSO365/README.md new file mode 100644 index 00000000000..d9a5c5f446d --- /dev/null +++ b/Packs/EWS/Integrations/EWSO365/README.md @@ -0,0 +1,1354 @@ +Exchange Web Services (EWS) provides the functionality to enable client applications to communicate with the Exchange server. EWS provides access to much of the same data that is made available through Microsoft OfficeOutlook. + +The EWS O365 integration implants EWS leading services. The integration allows getting information on emails and activities in a target mailbox, and some active operations on the mailbox such as deleting emails and attachments or moving emails from folder to folder. + +## EWS O365 Playbook + +* Office 365 Search and Delete +* Search And Delete Emails - EWS +* Get Original Email - EWS +* Process Email - EWS + +## Use Cases + +The EWS integration can be used for the following use cases. + +* Monitor a specific email account and create incidents from incoming emails to the defined folder. + Follow the instructions in the Fetched Incidents Data section. + +* Search for an email message across mailboxes and folders. + This can be achieved in the following ways: + + 1. Use the `ews-search-mailboxes` command to search for all emails in a specific scope of mailboxes. + Use the filter argument to narrow the search for emails sent from a specific account and more. + 2. Use the `ews-search-mailbox` command to search for all emails in a specific folder within the target mailbox. + Use the query argument to narrow the search for emails sent from a specific account and more. + * Both of these commands retrieve the _ItemID_ field for each email item listed in the results. The `ItemID` can be used in the `ews-get-items` command in order to get more information about the email item itself. + * For instance, use the `ews-search-mailboxes` command to hunt for emails that were marked as malicious in prior investigations, across organization mailboxes. Focus your hunt on emails sent from a specific mail account, emails with a specific subject and more. +* Get email attachment information. + Use the `ews-get-attachment` command to retrieve information on one attachment or all attachments of a message at once. It supports both file attachments and item attachments (e.g., email messages). + +* Delete email items from a mailbox. + First, make sure you obtain the email item ID. The item ID can be obtained with one of the integration’s search commands. + Use the `ews-delete-items` command to delete one or more items from the target mailbox in a single action. + A less common use case is to remove emails that were marked as malicious from a user’s mailbox. + You can delete the items permanently (hard delete), or delete the items (soft delete), so they can be recovered by running the `ews-recover-messages` command. + +## Configure EWS O365 on Demisto + +1. Navigate to **Settings** > **Integrations** > **Servers & Services**. +2. Search for EWS O365. +3. Click **Add instance** to create and configure a new integration instance. + * **Name**: a textual name for the integration instance. + * **ID / Application ID**: ID recieved from https://oproxy.demisto.ninja/ms-ews-o365 app registration, or a self deployed Application ID. + * **Token / Tenant ID**: Token recieved from https://oproxy.demisto.ninja/ms-ews-o365 app registration, or a self deployed Application Tenant ID. + * **Key / Application Secret**: Key recieved from https://oproxy.demisto.ninja/ms-ews-o365 app registration, or a self deployed Application Secret. + * **Email Address**: Mailbox to run commands on, and to fetch incidents from. This argument can take various user accounts in your organization. Usually is used as phishing mailbox. + Note: To use this functionality, your account must have impersonation rights or delegation for the account specified. For more information on impersonation rights see ‘Additional Information’ section below. + * **Name of the folder from which to fetch incidents**: Supports Exchange Folder ID and sub-folders e.g. Inbox/Phishing. Please note, if Exchange is configured with an international flavor `Inbox` will be named according to the configured language. + * **Public Folder** + * **Use system proxy settings** + * **Trust any certificate (not secure)** + * **Timeout (in seconds) for HTTP requests to Exchange Server** + * **Use a self deployed Azure Application** +4. Click **Test** to validate the URLs, token, and connection. + +## Use a Self-Deployed Azure Application + +To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal. To add the registration, refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app) +
The Tenant ID, Client ID, and Client secret are required for the integration. +* ID - Application (Client) ID +* Token - Tenant ID +* Key - Application (Client) Secret + +## Fetched Incidents Data + +The integration imports email messages from the destination folder in the target mailbox as incidents. If the message contains any attachments, they are uploaded to the War Room as files. If the attachment is an email, Demisto fetches information about the attached email and downloads all of its attachments (if there are any) as files. + +To use Fetch incidents, configure a new instance and select the `Fetches incidents` option in the instance settings. + +IMPORTANT: The initial fetch interval is the previous 10 minutes. If no emails were fetched before from the destination folder- all emails from 10 minutes prior to the instance configuration and up to the current time will be fetched. + +Pay special attention to the following fields in the instance settings: + +`Email Address` – mailbox to fetch incidents from. +`Name of the folder from which to fetch incidents` – use this field to configure the destination folder from where emails should be fetched. The default is Inbox folder. Please note, if Exchange is configured with an international flavor `Inbox` will be named according to the configured language. + +## Commands + +You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details. + +1. [Get the attachments of an item: ews-get-attachment](#h_22ec0bbb-12b3-4f1c-9159-b1a4daa114c7) +2. [Delete the attachments of an item: ews-delete-attachment](#h_cae18768-1dd5-4cd1-b2c9-abfd0e7787f3) +3. [Get a list of searchable mailboxes: ews-get-searchable-mailboxes](#h_7bdec9fe-e3d9-4645-8da4-337ee3798a84) +5. [Move an item to a different folder: ews-move-item](#h_0661f657-850a-430a-8fe1-aacf7e3ce40b) +6. [Delete an item from a mailbox: ews-delete-items](#h_712791a3-5937-4641-8e02-1fd773ab3211) +7. [Search a single mailbox: ews-search-mailbox](#h_2b4fd205-165c-489f-b58c-3bb77a86acfc) +8. [Get the contacts for a mailbox: ews-get-contacts](#h_3b6dc53b-4c1a-4479-a529-0ff3300dc4f5) +9. [Get the out-of-office status for a mailbox: ews-get-out-of-office](#h_b592e5fe-af2a-4d3c-90aa-b933e69a7526) +10. [Recover soft-deleted messages: ews-recover-messages](#h_212102bb-4ad8-4bb8-9c05-1b1197e2a9c9) +11. [Create a folder: ews-create-folder](#h_4ab168b9-21e9-4ce1-b18c-56bc22c0e0bd) +12. [Mark an item as junk: ews-mark-item-as-junk](#h_01b093ea-bc1c-46a3-b694-8cd45effeaa0) +13. [Search for folders: ews-find-folders](#h_3f9e1f1e-e634-4f92-b2a2-cdca5ca662eb) +14. [Get items of a folder: ews-get-items-from-folder](#h_0035899d-fdd0-43b7-bf7b-11a38a2e575a) +15. [Get items: ews-get-items](#h_e8f449a2-aecf-4d65-8d04-a38c6d4bfe62) +16. [Move an item to a different mailbox: ews-move-item-between-mailboxes](#h_88c0edd5-09b0-42a1-a671-b36b73772898) +17. [Get a folder: ews-get-folder](#h_87ca72d4-d98a-462e-9829-c940321663c2) +18. [Expand a distribution list: ews-expand-group](#h_d91ca450-7004-4a19-a88d-840389b21556) +19. [Mark items as read: ews-mark-items-as-read](#h_e278dc88-b4b0-4330-b849-3069b770e5ba) + +### 1\. Get the attachments of an item + +* * * + +Retrieves the actual attachments from an item (email message). To get all attachments for a message, only specify the item-id argument. + +##### Required Permissions + +Impersonation rights required. In order to perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-get-attachment` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|item-id|The ID of the email message for which to get the attachments.|Required| +|target-mailbox|The mailbox in which this attachment was found. If empty, the default mailbox is used. Otherwise, the user might require impersonation rights to this mailbox.|Optional| +|attachment-ids|The attachments ids to get. If none - all attachments will be retrieved from the message. Support multiple attachments with comma-separated value or array.|Optional| + + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Items.FileAttachments.attachmentId|string|The attachment ID. Used for file attachments only.| +|EWS.Items.FileAttachments.attachmentName|string|The attachment name. Used for file attachments only.| +|EWS.Items.FileAttachments.attachmentSHA256|string|The SHA256 hash of the attached file.| +|EWS.Items.FileAttachments.attachmentLastModifiedTime|date|The attachment last modified time. Used for file attachments only.| +|EWS.Items.ItemAttachments.datetimeCreated|date|The created time of the attached email.| +|EWS.Items.ItemAttachments.datetimeReceived|date|The received time of the attached email.| +|EWS.Items.ItemAttachments.datetimeSent|date|The sent time of the attached email.| +|EWS.Items.ItemAttachments.receivedBy|string|The received by address of the attached email.| +|EWS.Items.ItemAttachments.subject|string|The subject of the attached email.| +|EWS.Items.ItemAttachments.textBody|string|The body of the attached email (as text).| +|EWS.Items.ItemAttachments.headers|Unknown|The headers of the attached email.| +|EWS.Items.ItemAttachments.hasAttachments|boolean|Whether the attached email has attachments.| +|EWS.Items.ItemAttachments.itemId|string|The attached email item ID.| +|EWS.Items.ItemAttachments.toRecipients|Unknown|A list of recipient email addresses for the attached email.| +|EWS.Items.ItemAttachments.body|string|The body of the attached email (as HTML).| +|EWS.Items.ItemAttachments.attachmentSHA256|string|SHA256 hash of the attached email (as EML file).| +|EWS.Items.ItemAttachments.FileAttachments.attachmentSHA256|string|SHA256 hash of the attached files inside of the attached email.| +|EWS.Items.ItemAttachments.ItemAttachments.attachmentSHA256|string|SHA256 hash of the attached emails inside of the attached email.| +|EWS.Items.ItemAttachments.isRead|String|The read status of the attachment.| + + +##### Command Example + +``` +!ews-get-attachment item-id=BBFDShfdafFSDF3FADR3434DFASDFADAFDADFADFCJebinpkUAAAfxuiVAAA= target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Context Example + +``` +{ + "EWS": { + "Items": { + "ItemAttachments": { + "originalItemId": "BBFDShfdafFSDF3FADR3434DFASDFADAFDADFADFCJebinpkUAAAfxuiVAAA=", + "attachmentSize": 2956, + "receivedBy": "test@demistodev.onmicrosoft.com", + "size": 28852, + "author": "test2@demistodev.onmicrosoft.com", + "attachmentLastModifiedTime": "2019-08-11T15:01:30+00:00", + "subject": "Moving Email between mailboxes", + "body": "Some text inside", + "datetimeCreated": "2019-08-11T15:01:47Z", + "importance": "Normal", + "attachmentType": "ItemAttachment", + "toRecipients": [ + "test@demistodev.onmicrosoft.com" + ], + "mailbox": "test@demistodev.onmicrosoft.com", + "isRead": false, + "attachmentIsInline": false, + "datetimeSent": "2019-08-07T12:50:19Z", + "lastModifiedTime": "2019-08-11T15:01:30Z", + "sender": "test2@demistodev.onmicrosoft.com", + "attachmentName": "Moving Email between mailboxes", + "datetimeReceived": "2019-08-07T12:50:20Z", + "attachmentSHA256": "119e27b28dc81bdfd4f498d44bd7a6d553a74ee03bdc83e6255a53", + "hasAttachments": false, + "headers": [ + { + "name": "Subject", + "value": "Moving Email between mailboxes" + } + ... + ], + "attachmentId": "BBFDShfdafFSDF3FADR3434DFASDFADAFDADFADFCJebinpkUAAAfxuiVAAABEgAQAOpEfpzDB4dFkZ+/K4XSj44=", + "messageId": "message_id" + } + } + } + +``` + +### 2\. Delete the attachments of an item + +* * * + +Deletes the attachments of an item (email message). + +##### Required Permissions + +Impersonation rights required. In order to perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-delete-attachment` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|item-id|The ID of the email message for which to delete attachments.|Required| +|target-mailbox|The mailbox in which this attachment was found. If empty, the default mailbox is used. Otherwise, the user might require impersonation rights to this mailbox.|Optional| +|attachment-ids|A CSV list (or array) of attachment IDs to delete. If empty, all attachments will be deleted from the message.|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Items.FileAttachments.attachmentId|string|The ID of the deleted attachment, in case of file attachment.| +|EWS.Items.ItemAttachments.attachmentId|string|The ID of the deleted attachment, in case of other attachment (for example, "email").| +|EWS.Items.FileAttachments.action|string|The deletion action in case of file attachment. This is a constant value: 'deleted'.| +|EWS.Items.ItemAttachments.action|string|The deletion action in case of other attachment (for example, "email"). This is a constant value: 'deleted'.| + +##### Command Example + +``` +!ews-delete-attachment item-id=AAMkADQ0NmwBGAAAAAAA4kxh+ed3JTJPMPXU3wX3aBwCyyVyFtlsUQZfBJjfaljfAFDVSDinpkUAAAfxxd9AAA= target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +|action|attachmentId| +|--- |--- | +|deleted|AAMkADQ0NmwBGAAAAAAA4kxh+ed3JTJPMPXU3wX3aBwCyyVyFtlsUQZfBJjfaljfAFDVSDinpkUAAAfxxd9AAABEgAQAIUht2vrOdErec33=| + +### Context Example + +``` +{ + "EWS": { + "Items": { + "FileAttachments": { + "action": "deleted", + "attachmentId": "AAMkADQ0NmwBGAAAAAAA4kxh+ed3JTJPMPXU3wX3aBwCyyVyFtlsUQZfBJjfaljfAFDVSDinpkUAAAfxxd9AAABEgAQAIUht2vrOdErec33=" + } + } + } +} + +``` + +### 3\. Get a list of searchable mailboxes + +* * * + +Returns a list of searchable mailboxes. + +##### Required Permissions + +Requires eDiscovery permissions to the Exchange Server. For more information see the [Microsoft documentation](https://technet.microsoft.com/en-us/library/dd298059(v=exchg.160).aspx). + +##### Base Command + +`ews-get-searchable-mailboxes` + +##### Input + +There are no input arguments for this command. + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Mailboxes.mailbox|string|Addresses of the searchable mailboxes.| +|EWS.Mailboxes.mailboxId|string|IDs of the searchable mailboxes.| +|EWS.Mailboxes.displayName|string|The email display name.| +|EWS.Mailboxes.isExternal|boolean|Whether the mailbox is external.| +|EWS.Mailboxes.externalEmailAddress|string|The external email address.| + +##### Command Example + +``` +!ews-get-searchable-mailboxes +``` + +##### Human Readable Output + +|displayName|isExternal|mailbox|mailboxId| +|--- |--- |--- |--- | +|test|false|test@demistodev.onmicrosoft.com|/o=Exchange***/ou=Exchange Administrative Group ()/cn=**/cn=**-**| + +##### Context Example + +``` +{ + "EWS": { + "Mailboxes": [ + { + "mailbox": "test@demistodev.onmicrosoft.com", + "displayName": "test", + "mailboxId": "/o=Exchange***/ou=Exchange Administrative Group ()/cn=**/cn=**-**", + "isExternal": "false" + } + ... + ] + } +} + +``` + +### 4\. Move an item to a different folder + +* * * + +Move an item to a different folder in the mailbox. + +##### Required Permissions + +Impersonation rights required. In order to perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-move-item` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|item-id|The ID of the item to move.|Required| +|target-folder-path|The path to the folder to which to move the item. Complex paths are supported, for example, "Inbox\Phishing".|Required| +|target-mailbox|The mailbox on which to run the command.|Optional| +|is-public|Whether the target folder is a public folder.|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Items.newItemID|string|The item ID after the move.| +|EWS.Items.messageID|string|The item message ID.| +|EWS.Items.itemId|string|The original item ID.| +|EWS.Items.action|string|The action taken. The value will be "moved".| + +##### Command Example + +``` +!ews-move-item item-id=VDAFNTZjNTMxNwBGAAAAAAA4kxh+ed3JTJPMPXU34cSCSSSfBJebinpkUAAAAAAEMAACyyVyFtlsUQZfBJebinpkUAAAfxuiRAAA= target-folder-path=Moving target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +|action|itemId|messageId|newItemId| +|--- |--- |--- |--- | +|moved|VDAFNTZjNTMxNwBGAAAAAAA4kxh+ed3JTJPMPXU34cSCSSSfBJebinpkUAAAAAAEMAACyyVyFtlsUQZfBJebinpkUAAAfxuiRAAA||AAVAAAVN2NkLThmZjdmNTZjNTMxFFFFJTJPMPXU3wX3aBwCyyVyFtlsUQZfBJebinpkUAAAa2bUBAACyyVfafainpkUAAAfxxd+AAA=| + +##### Context Example + + { + "EWS": { + "Items": { + "action": "moved", + "itemId": "VDAFNTZjNTMxNwBGAAAAAAA4kxh+ed3JTJPMPXU34cSCSSSfBJebinpkUAAAAAAEMAACyyVyFtlsUQZfBJebinpkUAAAfxuiRAAA", + "newItemId": "AAVAAAVN2NkLThmZjdmNTZjNTMxFFFFJTJPMPXU3wX3aBwCyyVyFtlsUQZfBJebinpkUAAAa2bUBAACyyVfafainpkUAAAfxxd+AAA=", + "messageId": "" + } + } + } + +### 5\. Delete an item from a mailbox + +* * * + +Delete items from mailbox. + +##### Required Permissions + +Impersonation rights required. In order to perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-delete-items` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|item-ids|The item IDs to delete.|Required| +|delete-type|Deletion type. Can be "trash", "soft", or "hard".|Required| +|target-mailbox|The mailbox on which to run the command.|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Items.itemId|string|The deleted item ID.| +|EWS.Items.messageId|string|The deleted message ID.| +|EWS.Items.action|string|The deletion action. Can be 'trash-deleted', 'soft-deleted', or 'hard-deleted'.| + +##### Command Example + +``` +!ews-delete-items item-ids=VWAFA3hmZjdmNTZjNTMxNwBGAAAAAAA4kxh+ed3JTJPMPXU3wX3aBwCyyVyFtlsUQZfBJebinpkUAAABjKMGAACyw+kAAA= delete-type=soft target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +|action|itemId|messageId| +|--- |--- |--- | +|soft-deleted|VWAFA3hmZjdmNTZjNTMxNwBGAAAAAAA4kxh+ed3JTJPMPXU3wX3aBwCyyVyFtlsUQZfBJebinpkUAAABjKMGAACyw+kAAA=|| + +##### Context Example + +``` +{ + "EWS": { + "Items": { + "action": "soft-deleted", + "itemId": "VWAFA3hmZjdmNTZjNTMxNwBGAAAAAAA4kxh+ed3JTJPMPXU3wX3aBwCyyVyFtlsUQZfBJebinpkUAAABjKMGAACyw+kAAA=", + "messageId": "messaage_id" + } + } +} + +``` + +### 6\. Search a single mailbox + +* * * + +Searches for items in the specified mailbox. Specific permissions are needed for this operation to search in a target mailbox other than the default. + +##### Required Permissions + +Impersonation rights required. To perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-search-mailbox` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|query|The search query string. For more information about the query syntax, see the [Microsoft documentation](https://msdn.microsoft.com/en-us/library/ee693615.aspx).|Optional| +|folder-path|The folder path in which to search. If empty, searches all the folders in the mailbox.|Optional| +|limit|Maximum number of results to return.|Optional| +|target-mailbox|The mailbox on which to apply the search.|Optional| +|is-public|Whether the folder is a Public Folder?|Optional| +|message-id|The message ID of the email. This will be ignored if a query argument is provided.|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Items.itemId|string|The email item ID.| +|EWS.Items.hasAttachments|boolean|Whether the email has attachments.| +|EWS.Items.datetimeReceived|date|Received time of the email.| +|EWS.Items.datetimeSent|date|Sent time of the email.| +|EWS.Items.headers|Unknown|Email headers (list).| +|EWS.Items.sender|string|Sender email address of the email.| +|EWS.Items.subject|string|Subject of the email.| +|EWS.Items.textBody|string|Body of the email (as text).| +|EWS.Items.size|number|Email size.| +|EWS.Items.toRecipients|Unknown|List of email recipients addresses.| +|EWS.Items.receivedBy|Unknown|Email received by address.| +|EWS.Items.messageId|string|Email message ID.| +|EWS.Items.body|string|Body of the email (as HTML).| +|EWS.Items.FileAttachments.attachmentId|unknown|Attachment ID of the file attachment.| +|EWS.Items.ItemAttachments.attachmentId|unknown|Attachment ID of the item attachment.| +|EWS.Items.FileAttachments.attachmentName|unknown|Attachment name of the file attachment.| +|EWS.Items.ItemAttachments.attachmentName|unknown|Attachment name of the item attachment.| +|EWS.Items.isRead|String|The read status of the email.| + +##### Command Example + +``` +!ews-search-mailbox query="subject:"Get Attachment Email" target-mailbox=test@demistodev.onmicrosoft.com limit=1 +``` + +##### Human Readable Output + +|sender|subject|hasAttachments|datetimeReceived|receivedBy|author|toRecipients| +|--- |--- |--- |--- |--- |--- |--- | +|test2@demistodev.onmicrosoft.com|Get Attachment Email|true|2019-08-11T10:57:37Z|test@demistodev.onmicrosoft.com|test2@demistodev.onmicrosoft.com|test@demistodev.onmicrosoft.com| + +##### Context Example + +``` +{ + "EWS": { + "Items": { + "body": "\r\n\r\n\r\n\r\n\r\n\r\n
\r\n

Some text inside email

\r\n
\r\n\r\n\r\n", + "itemId": "AAMkADQ0NmFFijer3FFmNTZjNTMxNwBGAAAAAAFSAAfxw+jAAA=", + "toRecipients": [ + "test@demistodev.onmicrosoft.com" + ], + "datetimeCreated": "2019-08-11T10:57:37Z", + "datetimeReceived": "2019-08-11T10:57:37Z", + "author": "test2@demistodev.onmicrosoft.com", + "hasAttachments": true, + "size": 30455, + "subject": "Get Attachment Email", + "FileAttachments": [ + { + "attachmentName": "atta1.rtf", + "attachmentSHA256": "csfd81097bc049fbcff6e637ade0407a00308bfdfa339e31a44a1c4e98f28ce36e4f", + "attachmentType": "FileAttachment", + "attachmentSize": 555, + "attachmentId": "AAMkADQ0NmFkODFkLWQ4MDEtNDE4Mi1hN2NkLThmZjdmNTZjNTMxNwBGAAAAAAA4kxh+ed3JTJPMPXU3wX3aBwCyyVyFtlsUQZfBJebinpkUAAABjKMGAACyyVyFtlsUQZfBJebinpkUAAAfxw+jAAABEgAQAEyq1TB2nKBLpKUiFUJ5Geg=", + "attachmentIsInline": false, + "attachmentLastModifiedTime": "2019-08-11T11:06:02+00:00", + "attachmentContentLocation": null, + "attachmentContentType": "text/rtf", + "originalItemId": "AAMkADQ0NmFFijer3FFmNTZjNTMxNwBGAAAAAAFSAAfxw+jAAA=", + "attachmentContentId": null + } + ], + "headers": [ + { + "name": "Subject", + "value": "Get Attachment Email" + }, + ... + ], + "isRead": true, + "messageId": "", + "receivedBy": "test@demistodev.onmicrosoft.com", + "datetimeSent": "2019-08-11T10:57:36Z", + "lastModifiedTime": "2019-08-11T11:13:59Z", + "mailbox": "test@demistodev.onmicrosoft.com", + "importance": "Normal", + "textBody": "Some text inside email\r\n", + "sender": "test2@demistodev.onmicrosoft.com" + } + } +} + +``` + +### 7\. Get the contacts for a mailbox + +* * * + +Retrieves contacts for a specified mailbox. + +##### Required Permissions + +Impersonation rights required. In order to perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-get-contacts` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|target-mailbox|The mailbox for which to retrieve the contacts.|Optional| +|limit|Maximum number of results to return.|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|Account.Email.EwsContacts.displayName|Unknown|The contact name.| +|Account.Email.EwsContacts.lastModifiedTime|Unknown|The time that the contact was last modified.| +|Account.Email.EwsContacts.emailAddresses|Unknown|Phone numbers of the contact.| +|Account.Email.EwsContacts.physicalAddresses|Unknown|Physical addresses of the contact.| +|Account.Email.EwsContacts.phoneNumbers.phoneNumber|Unknown|Email addresses of the contact.| + +##### Command Example + +``` +!ews-get-contacts limit="1" +``` + +##### Human Readable Output + +|changekey|culture|datetimeCreated|datetimeReceived|datetimeSent|displayName|emailAddresses|fileAs|fileAsMapping|givenName|id|importance|itemClass|lastModifiedName|lastModifiedTime|postalAddressIndex|sensitivity|subject|uniqueBody|webClientReadFormQueryString| +|--- |--- |--- |--- |--- |--- |--- |--- |--- |--- |--- |--- |--- |--- |--- |--- |--- |--- |--- |--- | +|EABYACAADcsxRwRjq/zTrN6vWSzKAK1Dl3N|en-US|2019-08-05T12:35:36Z|2019-08-05T12:35:36Z|2019-08-05T12:35:36Z|Contact Name|some@dev.microsoft.com|Contact Name|LastCommaFirst|Contact Name|AHSNNK3NQNcasnc3SAS/zTrN6vWSzK4OWAAAAAAEOAADrxRwRjq/zTrNFSsfsfVWAAK1KsF3AAA=|Normal|IPM.Contact|John Smith|2019-08-05T12:35:36Z|None|Normal|Contact Name||https://outlook.office365.com/owa/?ItemID=***| + +##### Context Example + +``` +{ + "Account.Email": [ + { + "itemClass": "IPM.Contact", + "lastModifiedName": "John Smith", + "displayName": "Contact Name", + "datetimeCreated": "2019-08-05T12:35:36Z", + "datetimeReceived": "2019-08-05T12:35:36Z", + "fileAsMapping": "LastCommaFirst", + "importance": "Normal", + "sensitivity": "Normal", + "postalAddressIndex": "None", + "webClientReadFormQueryString": "https://outlook.office365.com/owa/?ItemID=***", + "uniqueBody": "", + "fileAs": "Contact Name", + "culture": "en-US", + "changekey": "EABYACAADcsxRwRjq/zTrN6vWSzKAK1Dl3N", + "lastModifiedTime": "2019-08-05T12:35:36Z", + "datetimeSent": "2019-08-05T12:35:36Z", + "emailAddresses": [ + "some@dev.microsoft.com" + ], + "givenName": "Contact Name", + "id": "AHSNNK3NQNcasnc3SAS/zTrN6vWSzK4OWAAAAAAEOAADrxRwRjq/zTrNFSsfsfVWAAK1KsF3AAA=", + "subject": "Contact Name" + } + ] +} + +``` + +### 8\. Get the out-of-office status for a mailbox + +* * * + +Retrieves the out-of-office status for a specified mailbox. + +##### Required Permissions + +Impersonation rights are required. To perform actions on the target mailbox of other users, the service account must be part the ApplicationImpersonation role. + +##### Base Command + +`ews-get-out-of-office` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|target-mailbox|The mailbox for which to get the out-of-office status.|Required| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|Account.Email.OutOfOffice.state|Unknown|Out-of-office state. The result can be: "Enabled", "Scheduled", or "Disabled".| +|Account.Email.OutOfOffice.externalAudience|Unknown|Out-of-office external audience. Can be "None", "Known", or "All".| +|Account.Email.OutOfOffice.start|Unknown|Out-of-office start date.| +|Account.Email.OutOfOffice.end|Unknown|Out-of-office end date.| +|Account.Email.OutOfOffice.internalReply|Unknown|Out-of-office internal reply.| +|Account.Email.OutOfOffice.externalReply|Unknown|Out-of-office external reply.| +|Account.Email.OutOfOffice.mailbox|Unknown|Out-of-office mailbox.| + +##### Command Example + +``` +!ews-get-out-of-office target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +|end|externalAudience|mailbox|start|state| +|--- |--- |--- |--- |--- | +|2019-08-12T13:00:00Z|All|test@demistodev.onmicrosoft.com|2019-08-11T13:00:00Z|Disabled| + +##### Context Example + +``` +{ + "Account": { + "Email": { + "OutOfOffice": { + "start": "2019-08-11T13:00:00Z", + "state": "Disabled", + "mailbox": "test@demistodev.onmicrosoft.com", + "end": "2019-08-12T13:00:00Z", + "externalAudience": "All" + } + } + } +} + +``` + +### 9\. Recover soft-deleted messages + +* * * + +Recovers messages that were soft-deleted. + +##### Required Permissions + +Impersonation rights are required. To perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-recover-messages` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|message-ids|A CSV list of message IDs. Run the py-ews-delete-items command to retrieve the message IDs|Required| +|target-folder-path|The folder path to recover the messages to.|Required| +|target-mailbox|The mailbox in which the messages found. If empty, will use the default mailbox. If you specify a different mailbox, you might need impersonation rights to the mailbox.|Optional| +|is-public|Whether the target folder is a Public Folder.|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Items.itemId|Unknown|The item ID of the recovered item.| +|EWS.Items.messageId|Unknown|The message ID of the recovered item.| +|EWS.Items.action|Unknown|The action taken on the item. The value will be 'recovered'.| + +##### Command Example + +``` +!ews-recover-messages message-ids= target-folder-path=Moving target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +|action|itemId|messageId| +|--- |--- |--- | +|recovered|AAVCSVS1hN2NkLThmZjdmNTZjNTMxNwBGAAAAAAA4kxh+ed33wX3aBwCyyVyFtlsUQZfBJebinpkUAAAa2bUBAACyyVyFtlscfxxd/AAA=|| + +##### Context Example + +``` +{ + "EWS": { + "Items": { + "action": "recovered", + "itemId": "AAVCSVS1hN2NkLThmZjdmNTZjNTMxNwBGAAAAAAA4kxh+ed33wX3aBwCyyVyFtlsUQZfBJebinpkUAAAa2bUBAACyyVyFtlscfxxd/AAA=", + "messageId": "" + } + } +} + +``` + +### 10\. Create a folder + +* * * + +Creates a new folder in a specified mailbox. + +##### Required Permissions + +Impersonation rights are required. To perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-create-folder` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|new-folder-name|The name of the new folder.|Required| +|folder-path|Path to locate the new folder. Exchange folder ID is also supported.|Required| +|target-mailbox|The mailbox in which to create the folder.|Optional| + +##### Context Output + +There is no context output for this command. + +##### Command Example + +``` +!ews-create-folder folder-path=Inbox new-folder-name="Created Folder" target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +Folder Inbox\Created Folder created successfully + +### 11\. Mark an item as junk + +* * * + +Marks an item as junk. This is commonly used to block an email address. For more information, see the [Microsoft documentation](https://msdn.microsoft.com/en-us/library/office/dn481311(v=exchg.150).aspx). + +##### Required Permissions + +Impersonation rights are required. To perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-mark-item-as-junk` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|item-id|The item ID to mark as junk.|Required| +|move-items|Whether to move the item from the original folder to the junk folder.|Optional| +|target-mailbox|If empty, will use the default mailbox. If you specify a different mailbox, you might need impersonation rights to the mailbox.|Optional| + +##### Context Output + +There is no context output for this command. + +##### Command Example + +``` +!ews-mark-item-as-junk item-id=AAMkcSQ0NmFkOhmZjdmNTZjNTMxNwBGAAAAAAA4kxh+ed3JTJPMPXU3wX3aBwCyyVyFtlsUcsBJebinpkUAAAAAAEMASFDkUAAAfxuiSAAA= move-items=yes target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +|action|itemId| +|--- |--- | +|marked-as-junk|AAMkcSQ0NmFkOhmZjdmNTZjNTMxNwBGAAAAAAA4kxh+ed3JTJPMPXU3wX3aBwCyyVyFtlsUcsBJebinpkUAAAAAAEMASFDkUAAAfxuiSAAA=| + +##### Context Example + +``` +{ + "EWS": { + "Items": { + "action": "marked-as-junk", + "itemId": "AAMkcSQ0NmFkOhmZjdmNTZjNTMxNwBGAAAAAAA4kxh+ed3JTJPMPXU3wX3aBwCyyVyFtlsUcsBJebinpkUAAAAAAEMASFDkUAAAfxuiSAAA=" + } + } +} + +``` + +### 12\. Search for folders + +* * * + +Retrieves information for the folders of the specified mailbox. Only folders with read permissions will be returned. Your visual folders on the mailbox, such as "Inbox", are under the folder "Top of Information Store". + +##### Required Permissions + +Impersonation rights are required. To perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-find-folders` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|target-mailbox|The mailbox on which to apply the command.|Optional| +|is-public|Whether to find Public Folders.|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Folders.name|string|Folder name.| +|EWS.Folders.id|string|Folder ID.| +|EWS.Folders.totalCount|Unknown|Number of items in the folder.| +|EWS.Folders.unreadCount|number|Number of unread items in the folder.| +|EWS.Folders.changeKey|number|Folder change key.| +|EWS.Folders.childrenFolderCount|number|Number of sub-folders.| + +##### Command Example + +``` +!ews-find-folders target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +``` +root +├── AllContacts +├── AllItems +├── Common Views +├── Deferred Action +├── ExchangeSyncData +├── Favorites +├── Freebusy Data +├── Location +├── MailboxAssociations +├── My Contacts +├── MyContactsExtended +├── People I Know +├── PeopleConnect +├── Recoverable Items +│ ├── Calendar Logging +│ ├── Deletions +│ ── Purges +│ └── Versions +├── Reminders +├── Schedule +├── Sharing +├── Shortcuts +├── Spooler Queue +├── System +├── To-Do Search +├── Top of Information Store +│ ├── Calendar +│ ├── Contacts +│ │ ├── GAL Contacts +│ │ ├── Recipient Cache +│ ├── Conversation Action Settings +│ ├── Deleted Items +│ │ └── Create1 +│ ├── Drafts +│ ├── Inbox +... + +``` + +##### Context Example + +``` +{ + "EWS": { + "Folders": [ + { + "unreadCount": 1, + "name": "Inbox", + "childrenFolderCount": 1, + "totalCount": 44, + "changeKey": "**********fefsduQi0", + "id": "*******VyFtlFDSAFDSFDAAA=" + } + ... + ] + } +} + +``` + +### 13\. Get items of a folder + +* * * + +Retrieves items from a specified folder in a mailbox. The items are ordered by the item created time, most recent is first. + +##### Required Permissions + +Impersonation rights are required. To perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-get-items-from-folder` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|folder-path|The folder path from which to get the items.|Required| +|limit|Maximum number of items to return.|Optional| +|target-mailbox|The mailbox on which to apply the command.|Optional| +|is-public|Whether the folder is a Public Folder. Default is 'False'.|Optional| +|get-internal-items|If the email item contains another email as an attachment (EML or MSG file), whether to retrieve the EML/MSG file attachment. Can be "yes" or "no". Default is "no".|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Items.itemId|string|The item ID of the email.| +|EWS.Items.hasAttachments|boolean|Whether the email has attachments.| +|EWS.Items.datetimeReceived|date|Received time of the email.| +|EWS.Items.datetimeSent|date|Sent time of the email.| +|EWS.Items.headers|Unknown|Email headers (list).| +|EWS.Items.sender|string|Sender mail address of the email.| +|EWS.Items.subject|string|Subject of the email.| +|EWS.Items.textBody|string|Body of the email (as text).| +|EWS.Items.size|number|Email size.| +|EWS.Items.toRecipients|Unknown|Email recipients addresses (list).| +|EWS.Items.receivedBy|Unknown|Received by address of the email.| +|EWS.Items.messageId|string|Email message ID.| +|EWS.Items.body|string|Body of the email (as HTML).| +|EWS.Items.FileAttachments.attachmentId|unknown|Attachment ID of file attachment.| +|EWS.Items.ItemAttachments.attachmentId|unknown|Attachment ID of the item attachment.| +|EWS.Items.FileAttachments.attachmentName|unknown|Attachment name of the file attachment.| +|EWS.Items.ItemAttachments.attachmentName|unknown|Attachment name of the item attachment.| +|Email.Items.ItemAttachments.attachmentName|unknown|Attachment name of the item attachment.| +|EWS.Items.isRead|String|The read status of the email.| + +##### Command Example + +``` +!ews-get-items-from-folder folder-path=Test target-mailbox=test@demistodev.onmicrosoft.com limit=1 +``` + +##### Human Readable Output + +|sender|subject|hasAttachments|datetimeReceived|receivedBy|author|toRecipients|itemId| +|--- |--- |--- |--- |--- |--- |--- |--- | +|test2@demistodev.onmicrosoft.com|Get Attachment Email|true|2019-08-11T10:57:37Z|test@demistodev.onmicrosoft.com|test2@demistodev.onmicrosoft.com|test@demistodev.onmicrosoft.com|AAFSFSFFtlsUQZfBJebinpkUAAABjKMGAACyyVyFtlsUQZfBJebinpkUAAAsfw+jAAA=| + +##### Context Example + +``` +{ + "EWS": { + "Items": { + "body": "\r\n\r\n\r\n\r\n\r\n\r\n
\r\n

Some text inside email

\r\n
\r\n\r\n\r\n", + "itemId": "AAFSFSFFtlsUQZfBJebinpkUAAABjKMGAACyyVyFtlsUQZfBJebinpkUAAAsfw+jAAA=", + "toRecipients": [ + "test@demistodev.onmicrosoft.com" + ], + "datetimeCreated": "2019-08-11T10:57:37Z", + "datetimeReceived": "2019-08-11T10:57:37Z", + "author": "test2@demistodev.onmicrosoft.com", + "hasAttachments": true, + "size": 21435, + "subject": "Get Attachment Email", + "FileAttachments": [ + { + "attachmentName": "atta1.rtf", + "attachmentSHA256": "cd81097bcvdiojf3407a00308b48039e31a44a1c4fdnfkdknce36e4f", + "attachmentType": "FileAttachment", + "attachmentSize": 535, + "attachmentId": "AAFSFSFFtlsUQZfBJebinpkUAAABjKMGAACyyVyFtlsUQZfBJebinpkUAAAsfw+jAAABEgAQAEyq1TB2nKBLpKUiFUJ5Geg=", + "attachmentIsInline": false, + "attachmentLastModifiedTime": "2019-08-11T11:06:02+00:00", + "attachmentContentLocation": null, + "attachmentContentType": "text/rtf", + "originalItemId": "AAFSFSFFtlsUQZfBJebinpkUAAABjKMGAACyyVyFtlsUQZfBJebinpkUAAAsfw+jAAA=", + "attachmentContentId": null + } + ], + "headers": [ + { + "name": "Subject", + "value": "Get Attachment Email" + }, + ... + ], + "isRead": true, + "messageId": "", + "receivedBy": "test@demistodev.onmicrosoft.com", + "datetimeSent": "2019-08-11T10:57:36Z", + "lastModifiedTime": "2019-08-11T11:13:59Z", + "mailbox": "test@demistodev.onmicrosoft.com", + "importance": "Normal", + "textBody": "Some text inside email\r\n", + "sender": "test2@demistodev.onmicrosoft.com" + } + } +} + +``` + +### 14\. Get items + +* * * + +Retrieves items by item ID. + +##### Required Permissions + +Impersonation rights are required. To perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-get-items` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|item-ids|A CSV list of item IDs.|Required| +|target-mailbox|The mailbox on which to run the command on.|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Items.itemId|string|The email item ID.| +|EWS.Items.hasAttachments|boolean|Whether the email has attachments.| +|EWS.Items.datetimeReceived|date|Received time of the email.| +|EWS.Items.datetimeSent|date|Sent time of the email.| +|EWS.Items.headers|Unknown|Email headers (list).| +|EWS.Items.sender|string|Sender mail address of the email.| +|EWS.Items.subject|string|Subject of the email.| +|EWS.Items.textBody|string|Body of the email (as text).| +|EWS.Items.size|number|Email size.| +|EWS.Items.toRecipients|Unknown|Email recipients addresses (list).| +|EWS.Items.receivedBy|Unknown|Received by address of the email.| +|EWS.Items.messageId|string|Email message ID.| +|EWS.Items.body|string|Body of the email (as HTML).| +|EWS.Items.FileAttachments.attachmentId|unknown|Attachment ID of the file attachment.| +|EWS.Items.ItemAttachments.attachmentId|unknown|Attachment ID of the item attachment.| +|EWS.Items.FileAttachments.attachmentName|unknown|Attachment name of the file attachment.| +|EWS.Items.ItemAttachments.attachmentName|unknown|Attachment name of the item attachment.| +|EWS.Items.isRead|String|The read status of the email.| +|Email.CC|String|Email addresses CC'ed to the email.| +|Email.BCC|String|Email addresses BCC'ed to the email.| +|Email.To|String|The recipient of the email.| +|Email.From|String|The sender of the email.| +|Email.Subject|String|The subject of the email.| +|Email.Text|String|The plain-text version of the email.| +|Email.HTML|String|The HTML version of the email.| +|Email.HeadersMap|String|The headers of the email.| + +##### Command Example + +``` +!ews-get-items item-ids=AAMkADQ0NmFkODFkLWQ4MDEtNDFDFZjNTMxNwBGAAAAAAA4kxhFFAfxw+jAAA= target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +Identical outputs to `ews-get-items-from-folder` command. + +### 15\. Move an item to a different mailbox + +* * * + +Moves an item from one mailbox to a different mailbox. + +##### Required Permissions + +Impersonation rights are required. To perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-move-item-between-mailboxes` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|item-id|The item ID to move.|Required| +|destination-folder-path|The folder in the destination mailbox to which to move the item. You can specify a complex path, for example, "Inbox\Phishing".|Required| +|destination-mailbox|The mailbox to which to move the item.|Required| +|source-mailbox|The mailbox from which to move the item (conventionally called the "target-mailbox", the target mailbox on which to run the command).|Optional| +|is-public|Whether the destination folder is a Public Folder. Default is "False".|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Items.movedToMailbox|string|The mailbox to which the item was moved.| +|EWS.Items.movedToFolder|string|The folder to which the item was moved.| +|EWS.Items.action|string|The action taken on the item. The value will be "moved".| + +##### Command Example + +``` +!ews-move-item-between-mailboxes item-id=AAMkAGY3OTQyMzMzLWYxNjktNDE0My05NFSFSyNzBkNABGAAAAAACYCKjWAjq/zTrN6vWSzK4OWAAK2ISFSA= destination-folder-path=Moving destination-mailbox=test@demistodev.onmicrosoft.com source-mailbox=test2@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +Item was moved successfully. + +##### Context Example + +``` +{ + "EWS": { + "Items": { + "movedToMailbox": "test@demistodev.onmicrosoft.com", + "movedToFolder": "Moving" + } + } +} + +``` + +### 16\. Get a folder + +* * * + +Retrieves a single folder. + +##### Required Permissions + +Impersonation rights are required. To perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-get-folder` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|target-mailbox|The mailbox on which to apply the search.|Optional| +|folder-path|The path of the folder to retrieve. If empty, will retrieve the folder "AllItems".|Optional| +|is-public|Whether the folder is a Public Folder. Default is "False".|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Folders.id|string|Folder ID.| +|EWS.Folders.name|string|Folder name.| +|EWS.Folders.changeKey|string|Folder change key.| +|EWS.Folders.totalCount|number|Total number of emails in the folder.| +|EWS.Folders.childrenFolderCount|number|Number of sub-folders.| +|EWS.Folders.unreadCount|number|Number of unread emails in the folder.| + +##### Command Example + +``` +!ews-get-folder folder-path=demistoEmail target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +|changeKey|childrenFolderCount|id|name|totalCount|unreadCount| +|--- |--- |--- |--- |--- |--- | +|***yFtCdJSH|0|AAMkADQ0NmFkODFkLWQ4MDEtNDE4Mi1hN2NlsjflsjfSF=|demistoEmail|1|0| + +##### Context Example + +``` +{ + "EWS": { + "Folders": { + "unreadCount": 0, + "name": "demistoEmail", + "childrenFolderCount": 0, + "totalCount": 1, + "changeKey": "***yFtCdJSH", + "id": "AAMkADQ0NmFkODFkLWQ4MDEtNDE4Mi1hN2NlsjflsjfSF=" + } + } +} + +``` + +### 17\. Expand a distribution list + +* * * + +Expands a distribution list to display all members. By default, expands only the first layer of the distribution list. If recursive-expansion is "True", the command expands nested distribution lists and returns all members. + +##### Required Permissions + +Impersonation rights required. In order to perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-expand-group` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|email-address|Email address of the group to expand.|Required| +|recursive-expansion|Whether to enable recursive expansion. Default is "False".|Optional| + +##### Context Output + +There is no context output for this command. + +##### Command Example + +``` +!ews-expand-group email-address="TestPublic" recursive-expansion="False" +``` + +##### Human Readable Output + +|displayName|mailbox|mailboxType| +|--- |--- |--- | +|John Wick|john@wick.com|Mailbox| + +##### Context Example + +``` +{ + "EWS.ExpandGroup": { + "name": "TestPublic", + "members": [ + { + "mailboxType": "Mailbox", + "displayName": "John Wick", + "mailbox": "john@wick.com" + } + ] + } +} + +``` + +### 18\. Mark items as read + +* * * + +Marks items as read or unread. + +##### Required Permissions + +Impersonation rights are required. To perform actions on the target mailbox of other users, the service account must be part of the ApplicationImpersonation role. + +##### Base Command + +`ews-mark-items-as-read` + +##### Input + +|**Argument Name**|**Description**|**Required**| +|--- |--- |--- | +|item-ids|A CSV list of item IDs.|Required| +|operation|How to mark the item. Can be "read" or "unread". Default is "read".|Optional| +|target-mailbox|The mailbox on which to run the command. If empty, the command will be applied on the default mailbox.|Optional| + +##### Context Output + +|**Path**|**Type**|**Description**| +|--- |--- |--- | +|EWS.Items.action|String|The action that was performed on the item.| +|EWS.Items.itemId|String|The ID of the item.| +|EWS.Items.messageId|String|The message ID of the item.| + +##### Command Example + +``` +!ews-mark-items-as-read item-ids=AAMkADQ0NFSffU3wX3aBwCyyVyFtlsUQZfBJebinpkUAAABjKMnpkUAAAfxw+jAAA= operation=read target-mailbox=test@demistodev.onmicrosoft.com +``` + +##### Human Readable Output + +|action|itemId|messageId| +|--- |--- |--- | +|marked-as-read|AAMkADQ0NFSffU3wX3aBwCyyVyFtlsUQZfBJebinpkUAAABjKMnpkUAAAfxw+jAAA=|| + +##### Context Example + +``` +{ + "EWS": { + "Items": { + "action": "marked-as-read", + "itemId": "AAMkADQ0NFSffU3wX3aBwCyyVyFtlsUQZfBJebinpkUAAABjKMnpkUAAAfxw+jAAA= ", + "messageId": "message_id" + } + } +} + +``` + +## Additional Information + +* * * + +#### EWS Permissions + +To perform actions on mailboxes of other users, and to execute searches on the Exchange server, you need specific permissions. For a comparison between Delegate and Impersonation permissions, see the [Microsoft documentation](https://blogs.msdn.microsoft.com/exchangedev/2009/06/15/exchange-impersonation-vs-delegate-access/). + +|Permission|Use Case|How to Configure| +|--- |--- |--- | +|Delegate|One-to-one relationship between users.|Read more [here](https://docs.microsoft.com/en-us/exchange/client-developer/exchange-web-services/delegate-access-and-ews-in-exchange).| +|Impersonation|A single account needs to access multiple mailboxes.|Read more [here](https://docs.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-configure-impersonation).| +|eDiscovery|Search the Exchange server.|Read more [here](https://docs.microsoft.com/en-us/Exchange/policy-and-compliance/ediscovery/assign-permissions?view=exchserver-2019).| +|Compliance Search|Perform searches across mailboxes and get an estimate of the results.|Read more [here](https://docs.microsoft.com/en-us/office365/securitycompliance/permissions-in-the-security-and-compliance-center).| diff --git a/Packs/EWS/Integrations/EWSO365/test_data/commands_outputs.json b/Packs/EWS/Integrations/EWSO365/test_data/commands_outputs.json new file mode 100644 index 00000000000..b7e7fa4daa9 --- /dev/null +++ b/Packs/EWS/Integrations/EWSO365/test_data/commands_outputs.json @@ -0,0 +1,2441 @@ +{ + "ews-get-searchable-mailboxes": { + "EWS.Mailboxes": [ + { + "mailbox": "aaaaa@demistodev.onmicrosoft.com", + "mailboxId": "/o=ExchangeLabs/ou=Exchange Administrative Group", + "displayName": "aaaa", + "isExternal": "false", + "externalEmailAddress": null + } + ] + }, + "ews-find-folders": { + "EWS.Folders(val.id == obj.id)": [ + { + "name": "Favorites", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Top of Information Store", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 19, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Calendar", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 2, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "Birthdays", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "United States holidays", + "totalCount": 175, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "Contacts", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 7, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "{A9E2BC46-B3A0-4243-B315-60D991004455}", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "{06967759-274D-40B2-A3EB-D7F9E73727D7}", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "Recipient Cache", + "totalCount": 21, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "Companies", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "GAL Contacts", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "Organizational Contacts", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "PeopleCentricConversation Buddies", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "Conversation History", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Team Chat", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Deleted Items", + "totalCount": 7, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Drafts", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Inbox", + "totalCount": 6, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 5 + }, + { + "name": "Journal", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Junk Email", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Notes", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Outbox", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Sent Items", + "totalCount": 7, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Tasks", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Archive", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Conversation Action Settings", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ExternalContacts", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "Files", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "PersonMetadata", + "totalCount": 21, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": null + }, + { + "name": "Test", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Test1", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Yammer Root", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 3, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Feeds", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Inbound", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Outbound", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "My Contacts", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "PeopleConnect", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Recoverable Items", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 5, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Deletions", + "totalCount": 12, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 1 + }, + { + "name": "Purges", + "totalCount": 7, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 1 + }, + { + "name": "Versions", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Audits", + "totalCount": 14, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Calendar Logging", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Finder", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 3, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Voice Mail", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "OwaFV15.1AllFocusedAQMkAGZiODc1MGY3LTBiODEtNDQAN2QtOWM3Yy1lZGI4YjIxZTE5NTAALgAAA3ge9qbo93dKqujtIHDxPSgBAOP1fdDThA5Nh/9sF3X5QNkAAAIBDAAAAA==", + "totalCount": 6, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 5 + }, + { + "name": "OwaFV15.1AllOtherAQMkAGZiODc1MGY3LTBiODEtNDQAN2QtOWM3Yy1lZGI4YjIxZTE5NTAALgAAA3ge9qbo93dKqujtIHDxPSgBAOP1fdDThA5Nh/9sF3X5QNkAAAIBDAAAAA==", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "To-Do Search", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "System", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "AllCategorizedItems", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "AllContacts", + "totalCount": 21, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "AllItems", + "totalCount": 237, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 5 + }, + { + "name": "AllPersonMetadata", + "totalCount": 21, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ApplicationDataRoot", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 23, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "00000002-0000-0ff1-ce00-000000000000", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 3, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "13937bba-652e-4c46-b222-3003f4d1ff97", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateContextData", + "totalCount": 11, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "1caee58f-eb14-4a6b-9339-1fe2ddf6692b", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 2, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Recent", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Settings", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "2a486b53-dbd2-49c0-a2bc-278bdfc30833", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "PersonalGrammars", + "totalCount": 5, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "32d4b5e5-7d33-4e7f-b073-f8cffbbb47a1", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "outlookfavorites", + "totalCount": 3, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "35d54a08-36c9-4847-9018-93934c62740c", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "PeoplePredictions.profile", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "394866fc-eedb-4f01-8536-3ff84b16be2a", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "InsightInstancesActions", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "3b2e5a14-128d-48aa-b581-482aac616d32", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "3c896ded-22c5-450f-91f6-3d1ef0848f6e", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 20, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ActivitiesDaily", + "totalCount": 61, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ActivitiesWeekly", + "totalCount": 9, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "AfterHoursEmailImpact", + "totalCount": 54, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "AutomaticRepliesHistory", + "totalCount": 20, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ChatsInterruptionStatistics", + "totalCount": 53, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ComputeLogs", + "totalCount": 22, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "CumulativeNetworkSnapshot", + "totalCount": 3, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "CumulativeOutOfOfficeClustering", + "totalCount": 108, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "DailyAppointments", + "totalCount": 86, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "DailyInteractions", + "totalCount": 54, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "DailyNetworkSnapshot", + "totalCount": 54, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "DetailedMeetings", + "totalCount": 54, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "EmailActionStatistics", + "totalCount": 54, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "HeterogeneousItems", + "totalCount": 11, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ImportantContact", + "totalCount": 5, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ManagementOperationExecutionRecords", + "totalCount": 4, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "MeetingActionStatistics", + "totalCount": 9, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "OutOfOffice", + "totalCount": 47, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "WeeklyInteractions", + "totalCount": 7, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "WeeklyOutOfOfficeAndWorkingDay", + "totalCount": 7, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "441509e5-a165-4363-8ee7-bcf0b7d26739", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 9, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "GenericWorkflowProcessor.SessionManager.Data", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Idf", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "IdfMeeting", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SimpleAcronymsIndex", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "UserDocKpeStats", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "UserDocWithKpes", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "UserKpes", + "totalCount": 2, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "UserKpeState", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "UserStatistics", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "48af08dc-f6d2-435f-b2a7-069abd99c086", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "InsightsProvidersSettings", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "49499048-0129-47f5-b95e-f9d315b861a6", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "OutlookAccountCloudSettings", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "4e445925-163e-42ca-b801-9073bfa46d17", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "NewsSubscriptionSourcesv2", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "644c1b11-f63f-45fa-826b-a9d2801db711", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 3, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "_PolicyContainer", + "totalCount": 2, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "dGVzdGJveEBkZW1pc3RvZGV2Lm9ubWljcm9zb2Z0LmNvbQ==_LabelFile", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "dGVzdGJveEBkZW1pc3RvZGV2Lm9ubWljcm9zb2Z0LmNvbQ==_PolicyContainer", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "66a88757-258c-4c72-893c-3e8bed4d6899", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 15, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.CalendarEvents", + "totalCount": 2, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.EmailEntities", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.EmailTokens", + "totalCount": 22, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.FreshHistory", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.GroupsRoomsMiscIndex", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.People", + "totalCount": 6, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.PeopleIndex", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.SearchHistory.Main", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.SearchHistoryBootstrapStateV2", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.SearchHistoryState", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.SharePointDocuments", + "totalCount": 3, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.SsaSessionManager", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.TeamsAndChannels", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.TeamsChats", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateSearch.TeamsEntities", + "totalCount": 3, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "766ef332-38e5-4cb4-920c-baa478e39fd9", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "CrawlerExecutionInfoCollection", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "7ae974c5-1af7-4923-af3a-fb1fd14dcb7e", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 5, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "GetStartedStore", + "totalCount": 15, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "lightning", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "LightningSharedStore", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "LightningStore", + "totalCount": 44, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "WhatsNewStore", + "totalCount": 34, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "80723a00-368e-4d64-8281-210e49e593a8", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ActivityFeed_201905", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "8c22b648-ee54-4ece-a4ca-3015b6d24f8e", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 2, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Images", + "totalCount": 2, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Profiles", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ae8e128e-080f-4086-b0e3-4c19301ada69", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Scheduling", + "totalCount": 2, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "b669c6ea-1adf-453f-b8bc-6d526592b419", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "FocusedInboxMailboxData", + "totalCount": 2, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "d71dfe16-1070-48f3-bd3a-c3ec919d34e7", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 2, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "TxpAutoblocking", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "TxpUserSettings", + "totalCount": 10, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "e69932cd-f814-4087-8ab1-5ab3f1ad18eb", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 3, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "PhishingBootstrap", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "BrokerSubscriptions", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "BulkActions", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "CalendarItemSnapshots", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "CalendarSharingCacheCollection", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Common Views", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ComplianceMetadata", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Connectors", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ConnectorConfigurations", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "CrawlerData", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "DefaultFoldersChangeHistory", + "totalCount": 389, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Deferred Action", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Document Centric Conversations", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ExchangeODataSyncData", + "totalCount": 36, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ExchangeSyncData", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "FileCollectionCache", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Folder Memberships", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Freebusy Data", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "FreeBusyLocalCache", + "totalCount": 2, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "FreeBusyLocalCacheSubscriptions", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "GraphFilesAndWorkingSetSearchFolder", + "totalCount": 3, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "GraphStore", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 6, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "GraphEdges", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "GraphNodes", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "GraphNonSecureDrafts", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "GraphNonSecureTransactions", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "GraphRelations", + "totalCount": 4, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Inference", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Location", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "MailboxAssociations", + "totalCount": 3, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "MeetingSapces", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "MergedViewFolderCollection", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "MessageIngestion", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Yammer", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "O365 Suite Notifications", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "O365 Suite Storage", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "OneDriveRoot", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Orion Notes", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "PACE", + "totalCount": 2, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "DelveNotifications", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ParkedMessages", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Pass-Through Search Results", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "PdpProfile", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "PdpProfileV2", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "People I Know", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "PeopleInsights", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "PeoplePublicData", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "QuarantinedEmail", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 1, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "QuarantinedEmailDefaultCategory", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 4, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "QedcDefaultRetention", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "QedcLongRetention", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "QedcMediumRetention", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "QedcShortRetention", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "RelevantContacts", + "totalCount": 21, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Reminders", + "totalCount": 12, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Schedule", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ShardRelevancyFolder", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SharedFilesSearchFolder", + "totalCount": 3, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SharePointNotifications", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Sharing", + "totalCount": 1, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Shortcuts", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SkypeSpacesData", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 2, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SkypeMessages", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "TeamsMeetings", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SmsAndChatsSync", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Spooler Queue", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SpoolsSearchFolder", + "totalCount": 9, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SubstrateFiles", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 3, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "ClassicAttachments", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "GraphWorkingSet", + "totalCount": 3, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SPOOLS", + "totalCount": 9, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SuggestedUserGroupAssociations", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "SwssItems", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 3, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "TeamChatHistory", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "TeamsMessagesData", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "TemporarySaves", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "UserCuratedContacts", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "UserSocialActivityNotifications", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "Views", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "XrmActivityClientInstrumentation", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "XrmActivityServerInstrumentation", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "XrmActivityStream", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "XrmActivityStreamSearch", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "XrmCompanySearch", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "XrmDealSearch", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "XrmDeletedItems", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "XrmInsights", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "XrmProjects", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "XrmSearch", + "totalCount": 21, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + }, + { + "name": "YammerData", + "totalCount": 0, + "id": "id", + "childrenFolderCount": 0, + "changeKey": "changekey", + "unreadCount": 0 + } + ] + }, + "ews-search-mailbox": { + "EWS.Items(val.itemId === obj.itemId || (val.messageId && obj.messageId && val.messageId === obj.messageId))": [ + { + "itemId": "itemId", + "datetimeCreated": "2020-05-21T12:36:24Z", + "datetimeReceived": "2020-05-21T12:36:25Z", + "datetimeSent": "2020-05-21T12:35:18Z", + "sender": "darbel@paloaltonetworks.com", + "hasAttachments": false, + "importance": "Normal", + "messageId": "messageId", + "lastModifiedTime": "2020-05-24T10:30:33Z", + "size": 57321, + "subject": "test with attachment", + "textBody": "\r\nDean Arbel\r\nStaff Software Engineer, Content Team, Demisto\r\nEmail: darbel@paloaltonetworks.com\r\nPhone: +972.54.7209916\r\n[https://go.demisto.com/hubfs/Demisto-Full%20Color-Logo.png]\r\n", + "headers": [ + { + "name": "Received", + "value": "from VI1PR07MB5728.eurprd07.prod.outlook.com (2603:10a6:20b:f0::25) by AM5PR0701MB2388.eurprd07.prod.outlook.com with HTTPS via AM6PR04CA0048.EURPRD04.PROD.OUTLOOK.COM; Thu, 21 May 2020 12:36:24 +0000" + }, + { + "name": "Received", + "value": "from AM6PR02CA0035.eurprd02.prod.outlook.com (2603:10a6:20b:6e::48) by VI1PR07MB5728.eurprd07.prod.outlook.com (2603:10a6:803:d4::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.13; Thu, 21 May 2020 12:36:23 +0000" + }, + { + "name": "Received", + "value": "from VE1EUR01FT047.eop-EUR01.prod.protection.outlook.com (2603:10a6:20b:6e:cafe::20) by AM6PR02CA0035.outlook.office365.com (2603:10a6:20b:6e::48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.26 via Frontend Transport; Thu, 21 May 2020 12:36:22 +0000" + }, + { + "name": "Received", + "value": "from mx0b-00169c01.pphosted.com (67.231.156.123) by VE1EUR01FT047.mail.protection.outlook.com (10.152.3.80) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.23 via Frontend Transport; Thu, 21 May 2020 12:36:21 +0000" + }, + { + "name": "Received", + "value": "from pps.filterd (m0048188.ppops.net [127.0.0.1])\tby mx0b-00169c01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 04LCYwj1030495\tfor ; Thu, 21 May 2020 05:36:20 -0700" + }, + { + "name": "Received", + "value": "from mail-oo1-f69.google.com (mail-oo1-f69.google.com [209.85.161.69])\tby mx0b-00169c01.pphosted.com with ESMTP id 312j0ajtmj-1\t(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)\tfor ; Thu, 21 May 2020 05:36:20 -0700" + }, + { + "name": "Received", + "value": "by mail-oo1-f69.google.com with SMTP id l21so3325823oos.22 for ; Thu, 21 May 2020 05:36:20 -0700 (PDT)" + }, + { + "name": "Authentication-Results", + "value": "spf=pass (sender IP is 67.231.156.123) smtp.mailfrom=paloaltonetworks.com; demistodev.onmicrosoft.com; dkim=pass (signature was verified) header.d=paloaltonetworks.com;demistodev.onmicrosoft.com; dmarc=pass action=none header.from=paloaltonetworks.com;compauth=pass reason=100" + }, + { + "name": "Received-SPF", + "value": "Pass (protection.outlook.com: domain of paloaltonetworks.com designates 67.231.156.123 as permitted sender) receiver=protection.outlook.com; client-ip=67.231.156.123; helo=mx0b-00169c01.pphosted.com;" + }, + { + "name": "DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks.com; h=mime-version : from : date : message-id : subject : to : content-type; s=PPS12012017; bh=3V1MY5tIy0u3WVuB2TCXSM7iWtDLNm025KA+8pHonYQ=; b=YGiaV+dbdkA2+ttEOBtgdPSwPLUmr/EQRS+oBQ+Z7eEA56HF7aEQ48DYSpJhNKa5nTMW FiJ0bEWi9XmA2+dKy0A0ZtyJrodqpY1W8xnWRVKaO4MIsvVTyUTJSfJKDBVw6clv652/ Q9NagmlnQf6lfSF/0h/rc0BvFQoWlQ23ApabaSz2agtfWLFsvf36l14UqNCHfrwoQHcY YIDEofGu37O29lDwnDky+VJTg0jKN5BguRctMd4cFPe0xbo3M0RMijzsqCrKKTtRVF7O IcP3llqEigi5wEtawxMb4NQlZbvL6VP1G5aSdYDallFtZm5qj7aFyNpjOKyNffN6oVxX qg== " + }, + { + "name": "DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=3V1MY5tIy0u3WVuB2TCXSM7iWtDLNm025KA+8pHonYQ=; b=2Dtn+BoifCZ57s/MHyQJwITiYpW2HRGC8rx9kFP+/8I9Sa55DrjlSrupAqKFkmgi2e hUq56LW6PXK20T02gOFjkf6ja+f9x8/F3VoBG4ADX7rLAgbWc7YXbLjOfUohau+1UITd aMWswug+4rY7L8QTdpeQiEj8nfCB5t+/RNCoLCMV4zwvjeKQ8Nkg6sWuU/LSb+t4W5l+ 67Fq4osfFUQPwbXPBeAKhpmi4NYldZKc54MTOKi1sHyaXzADB475VZ0b9d7D++8ulxXb E3qTeWi7KYySygm45+sMZ/4AYNlgjiT6Gmx4SkQGTmvN/VqjlXLpWLs0Q3xDxNW+Ggsh M47Q==" + }, + { + "name": "X-Google-DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=3V1MY5tIy0u3WVuB2TCXSM7iWtDLNm025KA+8pHonYQ=; b=B+AzxBw/moiaMpD/h5HMIwigEukmQdzOVjIEAuFpRW1V1FdKQinxprXMalv39PQlDD WUJlmAQYCvvifA5VaUkkAuYUETq++2yVLaVSd6YW0jKwcm+yvQp10MpatmEVBBPwuRfr 8YF3L9Qhzd8bSlcg0v6UTLTs/j18jHFceBI7UNasFpsag5yVAdAiF4HTYLAO4FV8syif Ee/EaO8/qRyzzxdnqT4WyksZF1dFcgBj3Ii8E3QnbpEkElsrcOo8yFhtgiKWesQxilyK bt5y+BdwYB9dAKzAw3yxxuBYQBuJ0VPVW585moHfUJ5YvjLHsIGkag2PmRPyKpmSPUJk A6+A==" + }, + { + "name": "X-Gm-Message-State", + "value": "AOAM533KzEt3TBZth3vp/FoX67aS/igSrt7HFh+PVgZkcp1b8+Ro1jD0\tURWuKgm2VcXOnOHyWyiWgpl3L3JwGXAqFtrnEG7z6nReZEzWeyjNLm0zEXFArNjNdu5cf01PGec\tS7r8Rn5VIPtO+4Cejj6uuuZ06XpMLXmWhT8xRG54CGvL6vSZ/" + }, + { + "name": "X-Received", + "value": "by 2002:a05:6808:106:: with SMTP id b6mr6740225oie.142.1590064579748; Thu, 21 May 2020 05:36:19 -0700 (PDT)" + }, + { + "name": "X-Received", + "value": "by 2002:a05:6808:106:: with SMTP id b6mr6740179oie.142.1590064578767; Thu, 21 May 2020 05:36:18 -0700 (PDT)" + }, + { + "name": "X-Google-Smtp-Source", + "value": "ABdhPJycyvGbCUwXro6NGtBzPoJPyFIRPmnnjz60CS0xnuEXr6ubn//2nkXr6vikUMIWmI5gZY7fW0EQD1/Wo//8eeQ=" + }, + { + "name": "MIME-Version", + "value": "1.0" + }, + { + "name": "Date", + "value": "Thu, 21 May 2020 15:35:18 +0300" + }, + { + "name": "Message-ID", + "value": "" + }, + { + "name": "Subject", + "value": "test with attachment" + }, + { + "name": "Content-Type", + "value": "multipart/mixed" + }, + { + "name": "X-Proofpoint-Virus-Version", + "value": "vendor=fsecure engine=2.50.10434:6.0.216,18.0.676 definitions=2020-05-21_06:2020-05-21,2020-05-21 signatures=0" + }, + { + "name": "X-Proofpoint-Spam-Details", + "value": "rule=outbound_spam_notspam policy=outbound_spam score=0 malwarescore=0 priorityscore=1501 bulkscore=0 cotscore=-2147483648 phishscore=0 spamscore=0 clxscore=1011 adultscore=0 mlxlogscore=438 mlxscore=0 suspectscore=0 lowpriorityscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2005210093" + }, + { + "name": "Return-Path", + "value": "darbel@paloaltonetworks.com" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationStartTime", + "value": "21 May 2020 12:36:22.4651 (UTC)" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationStartTimeReason", + "value": "OriginalSubmit" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationInterval", + "value": "1:00:00:00.0000000" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationIntervalReason", + "value": "OriginalSubmit" + }, + { + "name": "X-MS-Exchange-Organization-Network-Message-Id", + "value": "33e1ab54-578d-45ad-6123-08d7fd8391c9" + }, + { + "name": "X-EOPAttributedMessage", + "value": "0" + }, + { + "name": "X-EOPTenantAttributedMessage", + "value": "ebac1a16-81bf-449b-8d43-5732c3c1d999:0" + }, + { + "name": "X-MS-Exchange-Organization-MessageDirectionality", + "value": "Incoming" + }, + { + "name": "X-Forefront-Antispam-Report", + "value": "CIP:67.231.156.123;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mx0b-00169c01.pphosted.com;PTR:mx0b-00169c01.pphosted.com;CAT:NONE;SFTY:;SFS:(4636009)(564344004)(86362001)(7636003)(42186006)(22186003)(33964004)(356005)(26005)(336012)(7596003)(3480700007)(7116003)(9686003)(8676002)(2160300002)(5660300002)(1096003)(6916009)(55446002)(58800400005)(133083001);DIR:INB;SFP:;" + }, + { + "name": "X-MS-PublicTrafficType", + "value": "Email" + }, + { + "name": "X-MS-Exchange-Organization-AuthSource", + "value": "VE1EUR01FT047.eop-EUR01.prod.protection.outlook.com" + }, + { + "name": "X-MS-Exchange-Organization-AuthAs", + "value": "Anonymous" + }, + { + "name": "X-MS-Office365-Filtering-Correlation-Id", + "value": "33e1ab54-578d-45ad-6123-08d7fd8391c9" + }, + { + "name": "X-MS-TrafficTypeDiagnostic", + "value": "VI1PR07MB5728:" + }, + { + "name": "X-MS-Exchange-AtpMessageProperties", + "value": "SA" + }, + { + "name": "X-MS-Oob-TLC-OOBClassifiers", + "value": "OLM:1728;" + }, + { + "name": "X-MS-Exchange-Organization-SCL", + "value": "1" + }, + { + "name": "X-Microsoft-Antispam", + "value": "BCL:0;" + }, + { + "name": "X-MS-Exchange-CrossTenant-OriginalArrivalTime", + "value": "21 May 2020 12:36:21.9939 (UTC)" + }, + { + "name": "X-MS-Exchange-CrossTenant-Network-Message-Id", + "value": "33e1ab54-578d-45ad-6123-08d7fd8391c9" + }, + { + "name": "X-MS-Exchange-CrossTenant-Id", + "value": "ebac1a16-81bf-449b-8d43-5732c3c1d999" + }, + { + "name": "X-MS-Exchange-CrossTenant-FromEntityHeader", + "value": "Internet" + }, + { + "name": "X-MS-Exchange-Transport-CrossTenantHeadersStamped", + "value": "VI1PR07MB5728" + }, + { + "name": "X-MS-Exchange-Transport-EndToEndLatency", + "value": "00:00:02.6143909" + }, + { + "name": "X-MS-Exchange-Processed-By-BccFoldering", + "value": "15.20.3021.019" + }, + { + "name": "X-Microsoft-Antispam-Mailbox-Delivery", + "value": "ucf:0;jmr:0;auth:0;dest:I;ENG:(20160514016)(750128)(520011016)(944506383)(944626604);" + }, + { + "name": "X-Microsoft-Antispam-Message-Info", + "value": "GYMxyfjbkGHsUpWSD/+/zAqqyIHrTe+HHUexgZpYTm2UkhmvRqDi9kkwrPOItdlPtZe+zWuoZ9Dvl5I0jxgdawDRZH0/67UGmNlGddyF/PIYT6LdJsV3CBqK7h4PMRref2rqtG6LO401erigCiu8DdIxE6ikgqOkTJ9TB7/qiyNh5RcBLQqW9WKQ0wJb0HhebecR1qOIYMqSkJO11n8jv+/yAtFGpj17XsDuotY/vZVMFZWiUaQVPkqReO2Dwz6XWNsQtI5F5omzCdxpf60/MHVVDA/A1qcZI+a1Xj+ipeFYUalyzXkK5rUKXaAZtlcfY7muB2a0R+m+M0IDfEW99Fj0r0xC9ncQ5QZxoMxWBEjMhkNRXPt1YikazW7TKA43FGxow2K0PGSzZjeffQ+RgAcsnIp4+BEJBdpQK1zE4MHmlhgZ/WJPFi43qUZX0vL51H2dae8hlPHKcjogRTlecqsqhjSYujN46pKgbZ849S5negxD+yoFN1HAn9hjcban05Wz0n8SdK9eevySMrbobjBWvSKb+ZMNYLVD8UwAatsYm+5+tzgZEdxO6OOatf9Mx8/g5+/Q8F6Z859doJDTJ2oZptzvQjbVfhPw0+Hv777s6kzbUydnBxaDxQh+X95RCFcDXHurOhS+sch65hmJqkjR5IsoEmiukpsZNeHfBwmZq7KpqUE74nbTcSwfxLZvP1Wzd+1Hc0Qrq0IPQQsgdgUlgdeEZPZ7SciSXE2em++/9BnU36rFKOimEp/DQokD/1e0qsZG5FkFIifpgc9ghpROWkUMHj5sAuhq6lbs8RADc7ErAjKIppfJBMJzYu+RiTvyvxfLm0bxVQsl9ONXgfMqvJk2+Nliu8tkotPgz9SMEztVkS4kinhDrnjhF0LPZoBeJEPHVM/k1g7A4i1kEEevvJJdnmaLQ8JKNTKMFqPryQc2Tch8jDzUCEkxCrIiHVqLzHfUfGfeGx1sVLLoVjTUq2jY100+s9DCkEOsFemtxYduN32OR5rPBl2ruwqyhBnpPrEbCwSZySoZ+CK+PKdnTr6U1OQEAVvIdI/QjnqvYaoExUC2cu8whC+q/VlKk46P0DxPQHEmrlbvU2BTAlNfMBeReIJ1qKZ+Mw9rpeHbxOYi9F+zJ08COmcWqfaIeCBQxA3bnARzYBwFLbQCWBPiTTunLlZhHDl8BAaFb4qhaShjtAKaFILg1V/jJNi5uPOpazmhHCTgrQGN6BX8nQ==" + } + ], + "body": "\r\n

Dean Arbel

Staff Software Engineer, Content Team, Demisto

Email: darbel@paloaltonetworks.com

Phone: +972.54.7209916


", + "isRead": true, + "receivedBy": "testbox@demistodev.onmicrosoft.com", + "author": "darbel@paloaltonetworks.com", + "toRecipients": [ + "testbox@demistodev.onmicrosoft.com" + ], + "mailbox": "testbox@demistodev.onmicrosoft.com" + } + ] + }, + "ews-get-contacts": { + "Account.Email(val.Address == obj.originMailbox).EwsContacts": [ + { + "itemClass": "IPM.Contact", + "subject": "Avishai Brandeis", + "sensitivity": "Normal", + "textBody": "\r\n\r\n", + "body": "\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
 
\r\n
 
\r\n\r\n\r\n\r\n", + "datetimeReceived": "2019-10-19T14:38:51Z", + "importance": "Normal", + "datetimeSent": "2019-10-19T14:38:51Z", + "datetimeCreated": "2019-10-19T14:38:53Z", + "culture": "en-US", + "lastModifiedName": "Avishai Brandeis", + "lastModifiedTime": "2019-10-19T14:42:54Z", + "webClientReadFormQueryString": "webClientReadFormQueryString", + "uniqueBody": "", + "fileAs": "Brandeis, Avishai", + "fileAsMapping": "LastCommaFirst", + "displayName": "Avishai Brandeis", + "givenName": "Avishai", + "initials": "A.B.", + "jobTitle": "test", + "postalAddressIndex": "None", + "surname": "Brandeis", + "emailAddresses": [ + "avishai@demistodev.onmicrosoft.com" + ], + "originMailbox": null + } + ] + }, + "ews-get-items-from-folder": { + "EWS.Items(val.itemId === obj.itemId || (val.messageId && obj.messageId && val.messageId === obj.messageId))": [ + { + "itemId": "itemId", + "datetimeCreated": "2020-05-24T12:05:22Z", + "datetimeReceived": "2020-05-24T12:05:23Z", + "datetimeSent": "2020-05-24T12:04:16Z", + "sender": "darbel@paloaltonetworks.com", + "hasAttachments": true, + "importance": "Normal", + "messageId": "messageId", + "lastModifiedTime": "2020-05-24T12:05:23Z", + "size": 96501, + "subject": "second fetch", + "textBody": "\r\nDean Arbel\r\nStaff Software Engineer, Content Team, Demisto\r\nEmail: darbel@paloaltonetworks.com\r\nPhone: +972.54.7209916\r\n[https://go.demisto.com/hubfs/Demisto-Full%20Color-Logo.png]\r\n", + "headers": [ + { + "name": "Received", + "value": "from AM6PR07MB5256.eurprd07.prod.outlook.com (2603:10a6:20b:2e::32) by AM5PR0701MB2388.eurprd07.prod.outlook.com with HTTPS via AM6PR05CA0019.EURPRD05.PROD.OUTLOOK.COM; Sun, 24 May 2020 12:05:22 +0000" + }, + { + "name": "Received", + "value": "from DB7PR03CA0105.eurprd03.prod.outlook.com (2603:10a6:10:72::46) by AM6PR07MB5256.eurprd07.prod.outlook.com (2603:10a6:20b:6c::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3045.8; Sun, 24 May 2020 12:05:21 +0000" + }, + { + "name": "Received", + "value": "from DB5EUR01FT016.eop-EUR01.prod.protection.outlook.com (2603:10a6:10:72:cafe::cb) by DB7PR03CA0105.outlook.office365.com (2603:10a6:10:72::46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.26 via Frontend Transport; Sun, 24 May 2020 12:05:21 +0000" + }, + { + "name": "Received", + "value": "from mx0b-00169c01.pphosted.com (67.231.156.123) by DB5EUR01FT016.mail.protection.outlook.com (10.152.4.255) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.23 via Frontend Transport; Sun, 24 May 2020 12:05:20 +0000" + }, + { + "name": "Received", + "value": "from pps.filterd (m0048188.ppops.net [127.0.0.1])\tby mx0b-00169c01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 04OC5DAh017336\tfor ; Sun, 24 May 2020 05:05:20 -0700" + }, + { + "name": "Received", + "value": "from mail-oo1-f69.google.com (mail-oo1-f69.google.com [209.85.161.69])\tby mx0b-00169c01.pphosted.com with ESMTP id 316ygbt5we-1\t(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)\tfor ; Sun, 24 May 2020 05:05:19 -0700" + }, + { + "name": "Received", + "value": "by mail-oo1-f69.google.com with SMTP id z190so8178136ooa.19 for ; Sun, 24 May 2020 05:05:19 -0700 (PDT)" + }, + { + "name": "Authentication-Results", + "value": "spf=pass (sender IP is 67.231.156.123) smtp.mailfrom=paloaltonetworks.com; demistodev.onmicrosoft.com; dkim=pass (signature was verified) header.d=paloaltonetworks.com;demistodev.onmicrosoft.com; dmarc=pass action=none header.from=paloaltonetworks.com;compauth=pass reason=100" + }, + { + "name": "Received-SPF", + "value": "Pass (protection.outlook.com: domain of paloaltonetworks.com designates 67.231.156.123 as permitted sender) receiver=protection.outlook.com; client-ip=67.231.156.123; helo=mx0b-00169c01.pphosted.com;" + }, + { + "name": "DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks.com; h=mime-version : from : date : message-id : subject : to : content-type; s=PPS12012017; bh=oKMkuNMg4AOkAcDm/TJAqh+DBFvZo76l5u80led3OuQ=; b=nX2L66T91eUzH+H2NOmbtH7OvFR8SPAkHv3HkC9nIgHkHBhP+0y75T9tnswbcngJ1YH4 1t1GpME1af9yXTZvlHZ33aP446gH2cai/OSYh0AyMmSJ/gcMKnfvvYB55IOofGm29UVB UQax0+RRUdAsplVfjOKp90w9ZOMC3iMfs7DNLzc3mYuwfzmDgqaoxdW9LYsva+D47Jh6 PUIvNaQtJ5gnBTRM3dS/HOj8/8qOtk1BFiQrlfSdrUlyf/YW1zA7Rgjr9camjFpRO/ug +ohq7uxL1XBbuQGGHHATOIcT1/Utb130VABe5NMOhaSaaMv6SUw4D9CMzThKJMmPwKT3 Og== " + }, + { + "name": "DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=oKMkuNMg4AOkAcDm/TJAqh+DBFvZo76l5u80led3OuQ=; b=zhHz86wU6AlPStMpUoctv8sqwn6RPVSqTXUR4l2o47CTg3JTG8Zzg8zPx+SEJ7TCQo 2P4XzUOgy8FwjlMmKub6YRb0MRKSV//MArs1rRpuprvEk7cPVddvVhNlq39Z2G9g0bkC I8V0yHNkK0g1PnCi16K+zkEvIniGu9Z4XTc+Gtrqte33NyrcIcQHaSDIt+rx6FA3wjqq DCuLh+QLLLLZQ0blCMIrUQndZKtqgy8TKvxAAE6lA+o4MrqKQCSNWLR8It8lfD1/kACi 56u8993bfz+ygncyZKoJnvOnN1xYMwtjReMrTGPE7DQaV9dT/8OnZMalAoPpgZJsV2c4 pnYA==" + }, + { + "name": "X-Google-DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=oKMkuNMg4AOkAcDm/TJAqh+DBFvZo76l5u80led3OuQ=; b=mqyRLna0nlMpWHgCGcSnUQQJwYwLGfVLcsefOEwHpNFCALI2axWh/g2R/bNNSnCbht YKPRSfwjnnMV7R29v+URpaFsfUIYGtvktYyA/Gpgk6UBpoqOvOTgziFxPDptPjXFUXqH 3tF5zK6Httt2C4hv3uJ7szNY2bnu21966L4Oq0OAJDJpJWt116ebwVyrtH8L95a0a+WK ymjTh7VFrWgSxvtuFGBIkpdEgbcz4Nwf6LmZ3d9QkDM4V3BE1LLdQyMr54BqesB2ZwW5 TQZ3Sy1PjbA3oAc7ClajCyuHk9vJ2TonYimF2EBsopDxrrB2x4ZC45bnllRswFsvPXJm u/AA==" + }, + { + "name": "X-Gm-Message-State", + "value": "AOAM530mhUfg9mbd/vLieicJ0PorcrLLS01V62u9nuJ96XD4gPIwHiF2\tE65GOXDh+NjlrqQTRpFCeU1EwMrkJPlRkRa+Zdb6YDwfg7T9ZRmi48TeVHS45ws3UeofplUK/H+\t/BwKWU0i7NmgwdJty+kdaAdKXVfABBAKyQ0a0FKYDv7Yeqjnt" + }, + { + "name": "X-Received", + "value": "by 2002:a05:6808:106:: with SMTP id b6mr8634827oie.142.1590321918013; Sun, 24 May 2020 05:05:18 -0700 (PDT)" + }, + { + "name": "X-Received", + "value": "by 2002:a05:6808:106:: with SMTP id b6mr8634794oie.142.1590321917402; Sun, 24 May 2020 05:05:17 -0700 (PDT)" + }, + { + "name": "X-Google-Smtp-Source", + "value": "ABdhPJyd3hDsiXnVW3uD+Am05+DCdgZ5nYUWSas3oQpGK7s6UXHxeEiBT58TFD7hfNvVejB0M8kUPg29m+om6RSsjAA=" + }, + { + "name": "MIME-Version", + "value": "1.0" + }, + { + "name": "Date", + "value": "Sun, 24 May 2020 15:04:16 +0300" + }, + { + "name": "Message-ID", + "value": "" + }, + { + "name": "Subject", + "value": "second fetch" + }, + { + "name": "Content-Type", + "value": "multipart/mixed" + }, + { + "name": "X-Proofpoint-Virus-Version", + "value": "vendor=fsecure engine=2.50.10434:6.0.216,18.0.676 definitions=2020-05-24_02:2020-05-22,2020-05-24 signatures=0" + }, + { + "name": "X-Proofpoint-Spam-Details", + "value": "rule=outbound_spam_notspam policy=outbound_spam score=0 malwarescore=0 bulkscore=0 priorityscore=1501 spamscore=0 mlxscore=0 suspectscore=0 mlxlogscore=479 lowpriorityscore=0 adultscore=0 phishscore=0 impostorscore=0 cotscore=-2147483648 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2005240103" + }, + { + "name": "Return-Path", + "value": "darbel@paloaltonetworks.com" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationStartTime", + "value": "24 May 2020 12:05:21.3150 (UTC)" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationStartTimeReason", + "value": "OriginalSubmit" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationInterval", + "value": "1:00:00:00.0000000" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationIntervalReason", + "value": "OriginalSubmit" + }, + { + "name": "X-MS-Exchange-Organization-Network-Message-Id", + "value": "04736eb5-a8f0-4eca-aa89-08d7ffdabbb1" + }, + { + "name": "X-EOPAttributedMessage", + "value": "0" + }, + { + "name": "X-EOPTenantAttributedMessage", + "value": "ebac1a16-81bf-449b-8d43-5732c3c1d999:0" + }, + { + "name": "X-MS-Exchange-Organization-MessageDirectionality", + "value": "Incoming" + }, + { + "name": "X-Forefront-Antispam-Report", + "value": "CIP:67.231.156.123;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mx0b-00169c01.pphosted.com;PTR:mx0b-00169c01.pphosted.com;CAT:NONE;SFTY:;SFS:(4636009)(336012)(564344004)(55446002)(356005)(5660300002)(8676002)(2160300002)(3480700007)(1096003)(42186006)(7596003)(26005)(33964004)(6666004)(86362001)(7636003)(9686003)(6916009)(7116003);DIR:INB;SFP:;" + }, + { + "name": "X-MS-PublicTrafficType", + "value": "Email" + }, + { + "name": "X-MS-Exchange-Organization-AuthSource", + "value": "DB5EUR01FT016.eop-EUR01.prod.protection.outlook.com" + }, + { + "name": "X-MS-Exchange-Organization-AuthAs", + "value": "Anonymous" + }, + { + "name": "X-MS-Office365-Filtering-Correlation-Id", + "value": "04736eb5-a8f0-4eca-aa89-08d7ffdabbb1" + }, + { + "name": "X-MS-TrafficTypeDiagnostic", + "value": "AM6PR07MB5256:" + }, + { + "name": "X-MS-Exchange-AtpMessageProperties", + "value": "SA" + }, + { + "name": "X-MS-Oob-TLC-OOBClassifiers", + "value": "OLM:1728;" + }, + { + "name": "X-MS-Exchange-Organization-SCL", + "value": "1" + }, + { + "name": "X-Microsoft-Antispam", + "value": "BCL:0;" + }, + { + "name": "X-MS-Exchange-CrossTenant-OriginalArrivalTime", + "value": "24 May 2020 12:05:20.9502 (UTC)" + }, + { + "name": "X-MS-Exchange-CrossTenant-Network-Message-Id", + "value": "04736eb5-a8f0-4eca-aa89-08d7ffdabbb1" + }, + { + "name": "X-MS-Exchange-CrossTenant-Id", + "value": "ebac1a16-81bf-449b-8d43-5732c3c1d999" + }, + { + "name": "X-MS-Exchange-CrossTenant-FromEntityHeader", + "value": "Internet" + }, + { + "name": "X-MS-Exchange-Transport-CrossTenantHeadersStamped", + "value": "AM6PR07MB5256" + }, + { + "name": "X-MS-Exchange-Transport-EndToEndLatency", + "value": "00:00:01.7736787" + }, + { + "name": "X-MS-Exchange-Processed-By-BccFoldering", + "value": "15.20.3045.009" + }, + { + "name": "X-Microsoft-Antispam-Mailbox-Delivery", + "value": "ucf:0;jmr:0;auth:0;dest:I;ENG:(20160514016)(750128)(520011016)(944506383)(944626604);" + }, + { + "name": "X-Microsoft-Antispam-Message-Info", + "value": "8W3SISohCZB2jQsUVcqhQbQIXqqgocGxEoacfDww85zYoebJ4CFEHyfPsjUv+LWjYSozYrGJD2/XqethtTTJJW6GWACydYyIZsou4z883d0qB1DF7GfQQfgrAupBUcIj89jZALyqlQso/er4YUyuYWcW+5pUomBty6xvEErGMJYS7fxrR/7/Yt5pUoh8ZA77zrvssAXTcVkTw3kQwzzVYyvNwbAf0v4gKAoDzFaxij+5Agi89r8g9TTgz/V2b5uozJjCaJGdF8OOTEuZynKMlIv1PvIMBbZk+ODD3N+BfGPgIrRGtzDh8+mq95cFJL88feiiZk6WzkEDdmKa2UdxnZ/WWHIqUtqpukSXt7V7jxpl49ZxSU0gKeZ7O9SKBRsMtLtsCyg2lSr49/pZhIh08i0cQ05etP6iRnfI3LZyOMLKrb/MklGtS0YpnYO6fLUpUDcXZOaHkdnN5G981RHyh0SX5fZlApq90HPhgSWtNVC2Oa3P4v033t8YWR0w7SiQu4F1rYG6f0b7P7AlKLfBnNNhN7LFFEbJ6Dx/3TXZSm6Ayxmh2McwOGGTnBOBnJ5uBSXFtn7SZ83I13G1IK7YvSH0E4OpvNsZR/IlBmypFSZu9d/6/fO4IIDbn0xtGeFz0mw0gRQEKkoqYWjFNQAUQUKUoDJRV4zbBKaQrzoCHlEzcWaLURomBTq4DToNt6CC6mEqEy2//FDOAqmUgmkscmJyUYRWGvuH/rWL40IYzwULxK+sUxj7wyv2zYMFiRE0rygZn417GM9tNG1IKdxV+70QMLaNu/d2POwIEdth+yUMnnP9PCDoaQlwhIYSUlaVJM7LBHXatKf5wpu/SQQdkq5GAf6bXjowjBdrxSZqAxuI1hoCjhx4FipRCfseqyhKqBcBSKTH4fh3+xGbarFdcWnklgvya4m6ydpbg5yyXQclOOcB1hjuLL5P9/UM1jI/4EPYRHPfzC2hhO+Ncn3mznUJSuJksNz9Yw13wHynU509CyTRBbLNRxwnCzrrpYjTROeOWgP1SfhaoX5q+JPDbXeuPK+oYyXzVZeLuOuBt15euPvxeNR0Sqnhc+sQy8BRhBZcTfcKbS4RZ/tFTrmsknkaGp3wXycjVdYRGgNWv5iRBMXtpHHYly9BRqY2FXNE2F4B5Xx75VLtBQfyWaIORB7nI/tG0AbriXC/mFfE/us=" + } + ], + "body": "\r\n

Dean Arbel

Staff Software Engineer, Content Team, Demisto

Email: darbel@paloaltonetworks.com

Phone: +972.54.7209916


", + "isRead": false, + "receivedBy": "testbox@demistodev.onmicrosoft.com", + "author": "darbel@paloaltonetworks.com", + "toRecipients": [ + "testbox@demistodev.onmicrosoft.com" + ], + "FileAttachments": [ + { + "originalItemId": "originalItemId", + "attachmentId": "attachmentId", + "attachmentName": "anar (1).jpeg", + "attachmentSHA256": "afc8f82063b4985b57292f07682c3010eef0d3cf3132482d418ad47df2993cca", + "attachmentContentType": "image/jpeg", + "attachmentContentId": "f_kal0kd8h0", + "attachmentContentLocation": null, + "attachmentSize": 31555, + "attachmentLastModifiedTime": "2020-05-24T15:05:22+03:00", + "attachmentIsInline": false, + "attachmentType": "FileAttachment" + } + ], + "mailbox": "testbox@demistodev.onmicrosoft.com" + } + ] + }, + "ews-expand-group": { + "EWS.ExpandGroup": { + "name": "testgroup-1@demistodev.onmicrosoft.com", + "members": [ + { + "mailbox": "avishai@demistodev.onmicrosoft.com", + "displayName": "Avishai Brandeis", + "mailboxType": "Mailbox" + }, + { + "mailbox": "testbox@demistodev.onmicrosoft.com", + "displayName": "test box", + "mailboxType": "Mailbox" + } + ] + } + } +} diff --git a/Packs/EWS/Integrations/EWSO365/test_data/raw_responses.json b/Packs/EWS/Integrations/EWSO365/test_data/raw_responses.json new file mode 100644 index 00000000000..ae8c52b62e7 --- /dev/null +++ b/Packs/EWS/Integrations/EWSO365/test_data/raw_responses.json @@ -0,0 +1,2426 @@ +{ + "ews-get-searchable-mailboxes": [ + { + "mailbox": "aaaaa@demistodev.onmicrosoft.com", + "mailboxId": "/o=ExchangeLabs/ou=Exchange Administrative Group", + "displayName": "aaaa", + "isExternal": "false", + "externalEmailAddress": null + } + ], + "ews-find-folders": [ + { + "name": "Favorites", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Top of Information Store", + "total_count": 0, + "id": "id", + "child_folder_count": 19, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Calendar", + "total_count": 0, + "id": "id", + "child_folder_count": 2, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "Birthdays", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "United States holidays", + "total_count": 175, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "Contacts", + "total_count": 0, + "id": "id", + "child_folder_count": 7, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "{A9E2BC46-B3A0-4243-B315-60D991004455}", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "{06967759-274D-40B2-A3EB-D7F9E73727D7}", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "Recipient Cache", + "total_count": 21, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "Companies", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "GAL Contacts", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "Organizational Contacts", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "PeopleCentricConversation Buddies", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "Conversation History", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Team Chat", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Deleted Items", + "total_count": 7, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Drafts", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Inbox", + "total_count": 6, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 5 + }, + { + "name": "Journal", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Junk Email", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Notes", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Outbox", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Sent Items", + "total_count": 7, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Tasks", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Archive", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Conversation Action Settings", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ExternalContacts", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "Files", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "PersonMetadata", + "total_count": 21, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": null + }, + { + "name": "Test", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Test1", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Yammer Root", + "total_count": 0, + "id": "id", + "child_folder_count": 3, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Feeds", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Inbound", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Outbound", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "My Contacts", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "PeopleConnect", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Recoverable Items", + "total_count": 0, + "id": "id", + "child_folder_count": 5, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Deletions", + "total_count": 12, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 1 + }, + { + "name": "Purges", + "total_count": 7, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 1 + }, + { + "name": "Versions", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Audits", + "total_count": 14, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Calendar Logging", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Finder", + "total_count": 0, + "id": "id", + "child_folder_count": 3, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Voice Mail", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "OwaFV15.1AllFocusedAQMkAGZiODc1MGY3LTBiODEtNDQAN2QtOWM3Yy1lZGI4YjIxZTE5NTAALgAAA3ge9qbo93dKqujtIHDxPSgBAOP1fdDThA5Nh/9sF3X5QNkAAAIBDAAAAA==", + "total_count": 6, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 5 + }, + { + "name": "OwaFV15.1AllOtherAQMkAGZiODc1MGY3LTBiODEtNDQAN2QtOWM3Yy1lZGI4YjIxZTE5NTAALgAAA3ge9qbo93dKqujtIHDxPSgBAOP1fdDThA5Nh/9sF3X5QNkAAAIBDAAAAA==", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "To-Do Search", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "System", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "AllCategorizedItems", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "AllContacts", + "total_count": 21, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "AllItems", + "total_count": 237, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 5 + }, + { + "name": "AllPersonMetadata", + "total_count": 21, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ApplicationDataRoot", + "total_count": 0, + "id": "id", + "child_folder_count": 23, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "00000002-0000-0ff1-ce00-000000000000", + "total_count": 0, + "id": "id", + "child_folder_count": 3, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "13937bba-652e-4c46-b222-3003f4d1ff97", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateContextData", + "total_count": 11, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "1caee58f-eb14-4a6b-9339-1fe2ddf6692b", + "total_count": 0, + "id": "id", + "child_folder_count": 2, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Recent", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Settings", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "2a486b53-dbd2-49c0-a2bc-278bdfc30833", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "PersonalGrammars", + "total_count": 5, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "32d4b5e5-7d33-4e7f-b073-f8cffbbb47a1", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "outlookfavorites", + "total_count": 3, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "35d54a08-36c9-4847-9018-93934c62740c", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "PeoplePredictions.profile", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "394866fc-eedb-4f01-8536-3ff84b16be2a", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "InsightInstancesActions", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "3b2e5a14-128d-48aa-b581-482aac616d32", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "3c896ded-22c5-450f-91f6-3d1ef0848f6e", + "total_count": 0, + "id": "id", + "child_folder_count": 20, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ActivitiesDaily", + "total_count": 61, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ActivitiesWeekly", + "total_count": 9, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "AfterHoursEmailImpact", + "total_count": 54, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "AutomaticRepliesHistory", + "total_count": 20, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ChatsInterruptionStatistics", + "total_count": 53, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ComputeLogs", + "total_count": 22, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "CumulativeNetworkSnapshot", + "total_count": 3, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "CumulativeOutOfOfficeClustering", + "total_count": 108, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "DailyAppointments", + "total_count": 86, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "DailyInteractions", + "total_count": 54, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "DailyNetworkSnapshot", + "total_count": 54, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "DetailedMeetings", + "total_count": 54, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "EmailActionStatistics", + "total_count": 54, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "HeterogeneousItems", + "total_count": 11, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ImportantContact", + "total_count": 5, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ManagementOperationExecutionRecords", + "total_count": 4, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "MeetingActionStatistics", + "total_count": 9, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "OutOfOffice", + "total_count": 47, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "WeeklyInteractions", + "total_count": 7, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "WeeklyOutOfOfficeAndWorkingDay", + "total_count": 7, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "441509e5-a165-4363-8ee7-bcf0b7d26739", + "total_count": 0, + "id": "id", + "child_folder_count": 9, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "GenericWorkflowProcessor.SessionManager.Data", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Idf", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "IdfMeeting", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SimpleAcronymsIndex", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "UserDocKpeStats", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "UserDocWithKpes", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "UserKpes", + "total_count": 2, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "UserKpeState", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "UserStatistics", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "48af08dc-f6d2-435f-b2a7-069abd99c086", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "InsightsProvidersSettings", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "49499048-0129-47f5-b95e-f9d315b861a6", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "OutlookAccountCloudSettings", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "4e445925-163e-42ca-b801-9073bfa46d17", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "NewsSubscriptionSourcesv2", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "644c1b11-f63f-45fa-826b-a9d2801db711", + "total_count": 0, + "id": "id", + "child_folder_count": 3, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "_PolicyContainer", + "total_count": 2, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "dGVzdGJveEBkZW1pc3RvZGV2Lm9ubWljcm9zb2Z0LmNvbQ==_LabelFile", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "dGVzdGJveEBkZW1pc3RvZGV2Lm9ubWljcm9zb2Z0LmNvbQ==_PolicyContainer", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "66a88757-258c-4c72-893c-3e8bed4d6899", + "total_count": 0, + "id": "id", + "child_folder_count": 15, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.CalendarEvents", + "total_count": 2, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.EmailEntities", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.EmailTokens", + "total_count": 22, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.FreshHistory", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.GroupsRoomsMiscIndex", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.People", + "total_count": 6, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.PeopleIndex", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.SearchHistory.Main", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.SearchHistoryBootstrapStateV2", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.SearchHistoryState", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.SharePointDocuments", + "total_count": 3, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.SsaSessionManager", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.TeamsAndChannels", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.TeamsChats", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateSearch.TeamsEntities", + "total_count": 3, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "766ef332-38e5-4cb4-920c-baa478e39fd9", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "CrawlerExecutionInfoCollection", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "7ae974c5-1af7-4923-af3a-fb1fd14dcb7e", + "total_count": 0, + "id": "id", + "child_folder_count": 5, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "GetStartedStore", + "total_count": 15, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "lightning", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "LightningSharedStore", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "LightningStore", + "total_count": 44, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "WhatsNewStore", + "total_count": 34, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "80723a00-368e-4d64-8281-210e49e593a8", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ActivityFeed_201905", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "8c22b648-ee54-4ece-a4ca-3015b6d24f8e", + "total_count": 0, + "id": "id", + "child_folder_count": 2, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Images", + "total_count": 2, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Profiles", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ae8e128e-080f-4086-b0e3-4c19301ada69", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Scheduling", + "total_count": 2, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "b669c6ea-1adf-453f-b8bc-6d526592b419", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "FocusedInboxMailboxData", + "total_count": 2, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "d71dfe16-1070-48f3-bd3a-c3ec919d34e7", + "total_count": 0, + "id": "id", + "child_folder_count": 2, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "TxpAutoblocking", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "TxpUserSettings", + "total_count": 10, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "e69932cd-f814-4087-8ab1-5ab3f1ad18eb", + "total_count": 0, + "id": "id", + "child_folder_count": 3, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "PhishingBootstrap", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "BrokerSubscriptions", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "BulkActions", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "CalendarItemSnapshots", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "CalendarSharingCacheCollection", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Common Views", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ComplianceMetadata", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Connectors", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ConnectorConfigurations", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "CrawlerData", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "DefaultFoldersChangeHistory", + "total_count": 389, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Deferred Action", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Document Centric Conversations", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ExchangeODataSyncData", + "total_count": 36, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ExchangeSyncData", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "FileCollectionCache", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Folder Memberships", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Freebusy Data", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "FreeBusyLocalCache", + "total_count": 2, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "FreeBusyLocalCacheSubscriptions", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "GraphFilesAndWorkingSetSearchFolder", + "total_count": 3, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "GraphStore", + "total_count": 0, + "id": "id", + "child_folder_count": 6, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "GraphEdges", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "GraphNodes", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "GraphNonSecureDrafts", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "GraphNonSecureTransactions", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "GraphRelations", + "total_count": 4, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Inference", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Location", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "MailboxAssociations", + "total_count": 3, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "MeetingSapces", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "MergedViewFolderCollection", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "MessageIngestion", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Yammer", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "O365 Suite Notifications", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "O365 Suite Storage", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "OneDriveRoot", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Orion Notes", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "PACE", + "total_count": 2, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "DelveNotifications", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ParkedMessages", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Pass-Through Search Results", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "PdpProfile", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "PdpProfileV2", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "People I Know", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "PeopleInsights", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "PeoplePublicData", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "QuarantinedEmail", + "total_count": 0, + "id": "id", + "child_folder_count": 1, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "QuarantinedEmailDefaultCategory", + "total_count": 0, + "id": "id", + "child_folder_count": 4, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "QedcDefaultRetention", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "QedcLongRetention", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "QedcMediumRetention", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "QedcShortRetention", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "RelevantContacts", + "total_count": 21, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Reminders", + "total_count": 12, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Schedule", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ShardRelevancyFolder", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SharedFilesSearchFolder", + "total_count": 3, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SharePointNotifications", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Sharing", + "total_count": 1, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Shortcuts", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SkypeSpacesData", + "total_count": 0, + "id": "id", + "child_folder_count": 2, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SkypeMessages", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "TeamsMeetings", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SmsAndChatsSync", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Spooler Queue", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SpoolsSearchFolder", + "total_count": 9, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SubstrateFiles", + "total_count": 0, + "id": "id", + "child_folder_count": 3, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "ClassicAttachments", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "GraphWorkingSet", + "total_count": 3, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SPOOLS", + "total_count": 9, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SuggestedUserGroupAssociations", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "SwssItems", + "total_count": 0, + "id": "id", + "child_folder_count": 3, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "TeamChatHistory", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "TeamsMessagesData", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "TemporarySaves", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "UserCuratedContacts", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "UserSocialActivityNotifications", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "Views", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "XrmActivityClientInstrumentation", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "XrmActivityServerInstrumentation", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "XrmActivityStream", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "XrmActivityStreamSearch", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "XrmCompanySearch", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "XrmDealSearch", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "XrmDeletedItems", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "XrmInsights", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "XrmProjects", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "XrmSearch", + "total_count": 21, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + }, + { + "name": "YammerData", + "total_count": 0, + "id": "id", + "child_folder_count": 0, + "changekey": "changekey", + "unread_count": 0 + } + ], + "ews-search-mailbox": [ + { + "itemId": "itemId", + "datetimeCreated": "2020-05-21T12:36:24Z", + "datetimeReceived": "2020-05-21T12:36:25Z", + "datetimeSent": "2020-05-21T12:35:18Z", + "sender": "darbel@paloaltonetworks.com", + "hasAttachments": false, + "importance": "Normal", + "messageId": "messageId", + "lastModifiedTime": "2020-05-24T10:30:33Z", + "size": 57321, + "subject": "test with attachment", + "textBody": "\r\nDean Arbel\r\nStaff Software Engineer, Content Team, Demisto\r\nEmail: darbel@paloaltonetworks.com\r\nPhone: +972.54.7209916\r\n[https://go.demisto.com/hubfs/Demisto-Full%20Color-Logo.png]\r\n", + "headers": [ + { + "name": "Received", + "value": "from VI1PR07MB5728.eurprd07.prod.outlook.com (2603:10a6:20b:f0::25) by AM5PR0701MB2388.eurprd07.prod.outlook.com with HTTPS via AM6PR04CA0048.EURPRD04.PROD.OUTLOOK.COM; Thu, 21 May 2020 12:36:24 +0000" + }, + { + "name": "Received", + "value": "from AM6PR02CA0035.eurprd02.prod.outlook.com (2603:10a6:20b:6e::48) by VI1PR07MB5728.eurprd07.prod.outlook.com (2603:10a6:803:d4::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.13; Thu, 21 May 2020 12:36:23 +0000" + }, + { + "name": "Received", + "value": "from VE1EUR01FT047.eop-EUR01.prod.protection.outlook.com (2603:10a6:20b:6e:cafe::20) by AM6PR02CA0035.outlook.office365.com (2603:10a6:20b:6e::48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.26 via Frontend Transport; Thu, 21 May 2020 12:36:22 +0000" + }, + { + "name": "Received", + "value": "from mx0b-00169c01.pphosted.com (67.231.156.123) by VE1EUR01FT047.mail.protection.outlook.com (10.152.3.80) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.23 via Frontend Transport; Thu, 21 May 2020 12:36:21 +0000" + }, + { + "name": "Received", + "value": "from pps.filterd (m0048188.ppops.net [127.0.0.1])\tby mx0b-00169c01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 04LCYwj1030495\tfor ; Thu, 21 May 2020 05:36:20 -0700" + }, + { + "name": "Received", + "value": "from mail-oo1-f69.google.com (mail-oo1-f69.google.com [209.85.161.69])\tby mx0b-00169c01.pphosted.com with ESMTP id 312j0ajtmj-1\t(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)\tfor ; Thu, 21 May 2020 05:36:20 -0700" + }, + { + "name": "Received", + "value": "by mail-oo1-f69.google.com with SMTP id l21so3325823oos.22 for ; Thu, 21 May 2020 05:36:20 -0700 (PDT)" + }, + { + "name": "Authentication-Results", + "value": "spf=pass (sender IP is 67.231.156.123) smtp.mailfrom=paloaltonetworks.com; demistodev.onmicrosoft.com; dkim=pass (signature was verified) header.d=paloaltonetworks.com;demistodev.onmicrosoft.com; dmarc=pass action=none header.from=paloaltonetworks.com;compauth=pass reason=100" + }, + { + "name": "Received-SPF", + "value": "Pass (protection.outlook.com: domain of paloaltonetworks.com designates 67.231.156.123 as permitted sender) receiver=protection.outlook.com; client-ip=67.231.156.123; helo=mx0b-00169c01.pphosted.com;" + }, + { + "name": "DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks.com; h=mime-version : from : date : message-id : subject : to : content-type; s=PPS12012017; bh=3V1MY5tIy0u3WVuB2TCXSM7iWtDLNm025KA+8pHonYQ=; b=YGiaV+dbdkA2+ttEOBtgdPSwPLUmr/EQRS+oBQ+Z7eEA56HF7aEQ48DYSpJhNKa5nTMW FiJ0bEWi9XmA2+dKy0A0ZtyJrodqpY1W8xnWRVKaO4MIsvVTyUTJSfJKDBVw6clv652/ Q9NagmlnQf6lfSF/0h/rc0BvFQoWlQ23ApabaSz2agtfWLFsvf36l14UqNCHfrwoQHcY YIDEofGu37O29lDwnDky+VJTg0jKN5BguRctMd4cFPe0xbo3M0RMijzsqCrKKTtRVF7O IcP3llqEigi5wEtawxMb4NQlZbvL6VP1G5aSdYDallFtZm5qj7aFyNpjOKyNffN6oVxX qg== " + }, + { + "name": "DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=3V1MY5tIy0u3WVuB2TCXSM7iWtDLNm025KA+8pHonYQ=; b=2Dtn+BoifCZ57s/MHyQJwITiYpW2HRGC8rx9kFP+/8I9Sa55DrjlSrupAqKFkmgi2e hUq56LW6PXK20T02gOFjkf6ja+f9x8/F3VoBG4ADX7rLAgbWc7YXbLjOfUohau+1UITd aMWswug+4rY7L8QTdpeQiEj8nfCB5t+/RNCoLCMV4zwvjeKQ8Nkg6sWuU/LSb+t4W5l+ 67Fq4osfFUQPwbXPBeAKhpmi4NYldZKc54MTOKi1sHyaXzADB475VZ0b9d7D++8ulxXb E3qTeWi7KYySygm45+sMZ/4AYNlgjiT6Gmx4SkQGTmvN/VqjlXLpWLs0Q3xDxNW+Ggsh M47Q==" + }, + { + "name": "X-Google-DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=3V1MY5tIy0u3WVuB2TCXSM7iWtDLNm025KA+8pHonYQ=; b=B+AzxBw/moiaMpD/h5HMIwigEukmQdzOVjIEAuFpRW1V1FdKQinxprXMalv39PQlDD WUJlmAQYCvvifA5VaUkkAuYUETq++2yVLaVSd6YW0jKwcm+yvQp10MpatmEVBBPwuRfr 8YF3L9Qhzd8bSlcg0v6UTLTs/j18jHFceBI7UNasFpsag5yVAdAiF4HTYLAO4FV8syif Ee/EaO8/qRyzzxdnqT4WyksZF1dFcgBj3Ii8E3QnbpEkElsrcOo8yFhtgiKWesQxilyK bt5y+BdwYB9dAKzAw3yxxuBYQBuJ0VPVW585moHfUJ5YvjLHsIGkag2PmRPyKpmSPUJk A6+A==" + }, + { + "name": "X-Gm-Message-State", + "value": "AOAM533KzEt3TBZth3vp/FoX67aS/igSrt7HFh+PVgZkcp1b8+Ro1jD0\tURWuKgm2VcXOnOHyWyiWgpl3L3JwGXAqFtrnEG7z6nReZEzWeyjNLm0zEXFArNjNdu5cf01PGec\tS7r8Rn5VIPtO+4Cejj6uuuZ06XpMLXmWhT8xRG54CGvL6vSZ/" + }, + { + "name": "X-Received", + "value": "by 2002:a05:6808:106:: with SMTP id b6mr6740225oie.142.1590064579748; Thu, 21 May 2020 05:36:19 -0700 (PDT)" + }, + { + "name": "X-Received", + "value": "by 2002:a05:6808:106:: with SMTP id b6mr6740179oie.142.1590064578767; Thu, 21 May 2020 05:36:18 -0700 (PDT)" + }, + { + "name": "X-Google-Smtp-Source", + "value": "ABdhPJycyvGbCUwXro6NGtBzPoJPyFIRPmnnjz60CS0xnuEXr6ubn//2nkXr6vikUMIWmI5gZY7fW0EQD1/Wo//8eeQ=" + }, + { + "name": "MIME-Version", + "value": "1.0" + }, + { + "name": "Date", + "value": "Thu, 21 May 2020 15:35:18 +0300" + }, + { + "name": "Message-ID", + "value": "" + }, + { + "name": "Subject", + "value": "test with attachment" + }, + { + "name": "Content-Type", + "value": "multipart/mixed" + }, + { + "name": "X-Proofpoint-Virus-Version", + "value": "vendor=fsecure engine=2.50.10434:6.0.216,18.0.676 definitions=2020-05-21_06:2020-05-21,2020-05-21 signatures=0" + }, + { + "name": "X-Proofpoint-Spam-Details", + "value": "rule=outbound_spam_notspam policy=outbound_spam score=0 malwarescore=0 priorityscore=1501 bulkscore=0 cotscore=-2147483648 phishscore=0 spamscore=0 clxscore=1011 adultscore=0 mlxlogscore=438 mlxscore=0 suspectscore=0 lowpriorityscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2005210093" + }, + { + "name": "Return-Path", + "value": "darbel@paloaltonetworks.com" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationStartTime", + "value": "21 May 2020 12:36:22.4651 (UTC)" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationStartTimeReason", + "value": "OriginalSubmit" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationInterval", + "value": "1:00:00:00.0000000" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationIntervalReason", + "value": "OriginalSubmit" + }, + { + "name": "X-MS-Exchange-Organization-Network-Message-Id", + "value": "33e1ab54-578d-45ad-6123-08d7fd8391c9" + }, + { + "name": "X-EOPAttributedMessage", + "value": "0" + }, + { + "name": "X-EOPTenantAttributedMessage", + "value": "ebac1a16-81bf-449b-8d43-5732c3c1d999:0" + }, + { + "name": "X-MS-Exchange-Organization-MessageDirectionality", + "value": "Incoming" + }, + { + "name": "X-Forefront-Antispam-Report", + "value": "CIP:67.231.156.123;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mx0b-00169c01.pphosted.com;PTR:mx0b-00169c01.pphosted.com;CAT:NONE;SFTY:;SFS:(4636009)(564344004)(86362001)(7636003)(42186006)(22186003)(33964004)(356005)(26005)(336012)(7596003)(3480700007)(7116003)(9686003)(8676002)(2160300002)(5660300002)(1096003)(6916009)(55446002)(58800400005)(133083001);DIR:INB;SFP:;" + }, + { + "name": "X-MS-PublicTrafficType", + "value": "Email" + }, + { + "name": "X-MS-Exchange-Organization-AuthSource", + "value": "VE1EUR01FT047.eop-EUR01.prod.protection.outlook.com" + }, + { + "name": "X-MS-Exchange-Organization-AuthAs", + "value": "Anonymous" + }, + { + "name": "X-MS-Office365-Filtering-Correlation-Id", + "value": "33e1ab54-578d-45ad-6123-08d7fd8391c9" + }, + { + "name": "X-MS-TrafficTypeDiagnostic", + "value": "VI1PR07MB5728:" + }, + { + "name": "X-MS-Exchange-AtpMessageProperties", + "value": "SA" + }, + { + "name": "X-MS-Oob-TLC-OOBClassifiers", + "value": "OLM:1728;" + }, + { + "name": "X-MS-Exchange-Organization-SCL", + "value": "1" + }, + { + "name": "X-Microsoft-Antispam", + "value": "BCL:0;" + }, + { + "name": "X-MS-Exchange-CrossTenant-OriginalArrivalTime", + "value": "21 May 2020 12:36:21.9939 (UTC)" + }, + { + "name": "X-MS-Exchange-CrossTenant-Network-Message-Id", + "value": "33e1ab54-578d-45ad-6123-08d7fd8391c9" + }, + { + "name": "X-MS-Exchange-CrossTenant-Id", + "value": "ebac1a16-81bf-449b-8d43-5732c3c1d999" + }, + { + "name": "X-MS-Exchange-CrossTenant-FromEntityHeader", + "value": "Internet" + }, + { + "name": "X-MS-Exchange-Transport-CrossTenantHeadersStamped", + "value": "VI1PR07MB5728" + }, + { + "name": "X-MS-Exchange-Transport-EndToEndLatency", + "value": "00:00:02.6143909" + }, + { + "name": "X-MS-Exchange-Processed-By-BccFoldering", + "value": "15.20.3021.019" + }, + { + "name": "X-Microsoft-Antispam-Mailbox-Delivery", + "value": "ucf:0;jmr:0;auth:0;dest:I;ENG:(20160514016)(750128)(520011016)(944506383)(944626604);" + }, + { + "name": "X-Microsoft-Antispam-Message-Info", + "value": "GYMxyfjbkGHsUpWSD/+/zAqqyIHrTe+HHUexgZpYTm2UkhmvRqDi9kkwrPOItdlPtZe+zWuoZ9Dvl5I0jxgdawDRZH0/67UGmNlGddyF/PIYT6LdJsV3CBqK7h4PMRref2rqtG6LO401erigCiu8DdIxE6ikgqOkTJ9TB7/qiyNh5RcBLQqW9WKQ0wJb0HhebecR1qOIYMqSkJO11n8jv+/yAtFGpj17XsDuotY/vZVMFZWiUaQVPkqReO2Dwz6XWNsQtI5F5omzCdxpf60/MHVVDA/A1qcZI+a1Xj+ipeFYUalyzXkK5rUKXaAZtlcfY7muB2a0R+m+M0IDfEW99Fj0r0xC9ncQ5QZxoMxWBEjMhkNRXPt1YikazW7TKA43FGxow2K0PGSzZjeffQ+RgAcsnIp4+BEJBdpQK1zE4MHmlhgZ/WJPFi43qUZX0vL51H2dae8hlPHKcjogRTlecqsqhjSYujN46pKgbZ849S5negxD+yoFN1HAn9hjcban05Wz0n8SdK9eevySMrbobjBWvSKb+ZMNYLVD8UwAatsYm+5+tzgZEdxO6OOatf9Mx8/g5+/Q8F6Z859doJDTJ2oZptzvQjbVfhPw0+Hv777s6kzbUydnBxaDxQh+X95RCFcDXHurOhS+sch65hmJqkjR5IsoEmiukpsZNeHfBwmZq7KpqUE74nbTcSwfxLZvP1Wzd+1Hc0Qrq0IPQQsgdgUlgdeEZPZ7SciSXE2em++/9BnU36rFKOimEp/DQokD/1e0qsZG5FkFIifpgc9ghpROWkUMHj5sAuhq6lbs8RADc7ErAjKIppfJBMJzYu+RiTvyvxfLm0bxVQsl9ONXgfMqvJk2+Nliu8tkotPgz9SMEztVkS4kinhDrnjhF0LPZoBeJEPHVM/k1g7A4i1kEEevvJJdnmaLQ8JKNTKMFqPryQc2Tch8jDzUCEkxCrIiHVqLzHfUfGfeGx1sVLLoVjTUq2jY100+s9DCkEOsFemtxYduN32OR5rPBl2ruwqyhBnpPrEbCwSZySoZ+CK+PKdnTr6U1OQEAVvIdI/QjnqvYaoExUC2cu8whC+q/VlKk46P0DxPQHEmrlbvU2BTAlNfMBeReIJ1qKZ+Mw9rpeHbxOYi9F+zJ08COmcWqfaIeCBQxA3bnARzYBwFLbQCWBPiTTunLlZhHDl8BAaFb4qhaShjtAKaFILg1V/jJNi5uPOpazmhHCTgrQGN6BX8nQ==" + } + ], + "body": "\r\n

Dean Arbel

Staff Software Engineer, Content Team, Demisto

Email: darbel@paloaltonetworks.com

Phone: +972.54.7209916


", + "isRead": true, + "receivedBy": "testbox@demistodev.onmicrosoft.com", + "author": "darbel@paloaltonetworks.com", + "toRecipients": [ + "testbox@demistodev.onmicrosoft.com" + ], + "mailbox": "testbox@demistodev.onmicrosoft.com" + } + ], + "ews-get-contacts": [ + { + "itemClass": "IPM.Contact", + "subject": "Avishai Brandeis", + "sensitivity": "Normal", + "textBody": "\r\n\r\n", + "body": "\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
 
\r\n
 
\r\n\r\n\r\n\r\n", + "datetimeReceived": "2019-10-19T14:38:51Z", + "importance": "Normal", + "datetimeSent": "2019-10-19T14:38:51Z", + "datetimeCreated": "2019-10-19T14:38:53Z", + "culture": "en-US", + "lastModifiedName": "Avishai Brandeis", + "lastModifiedTime": "2019-10-19T14:42:54Z", + "webClientReadFormQueryString": "webClientReadFormQueryString", + "uniqueBody": "", + "fileAs": "Brandeis, Avishai", + "fileAsMapping": "LastCommaFirst", + "displayName": "Avishai Brandeis", + "givenName": "Avishai", + "initials": "A.B.", + "jobTitle": "test", + "postalAddressIndex": "None", + "surname": "Brandeis", + "emailAddresses": [ + "avishai@demistodev.onmicrosoft.com" + ], + "originMailbox": null + } + ], + "ews-get-items-from-folder": [ + { + "itemId": "itemId", + "datetimeCreated": "2020-05-24T12:05:22Z", + "datetimeReceived": "2020-05-24T12:05:23Z", + "datetimeSent": "2020-05-24T12:04:16Z", + "sender": "darbel@paloaltonetworks.com", + "hasAttachments": true, + "importance": "Normal", + "messageId": "messageId", + "lastModifiedTime": "2020-05-24T12:05:23Z", + "size": 96501, + "subject": "second fetch", + "textBody": "\r\nDean Arbel\r\nStaff Software Engineer, Content Team, Demisto\r\nEmail: darbel@paloaltonetworks.com\r\nPhone: +972.54.7209916\r\n[https://go.demisto.com/hubfs/Demisto-Full%20Color-Logo.png]\r\n", + "headers": [ + { + "name": "Received", + "value": "from AM6PR07MB5256.eurprd07.prod.outlook.com (2603:10a6:20b:2e::32) by AM5PR0701MB2388.eurprd07.prod.outlook.com with HTTPS via AM6PR05CA0019.EURPRD05.PROD.OUTLOOK.COM; Sun, 24 May 2020 12:05:22 +0000" + }, + { + "name": "Received", + "value": "from DB7PR03CA0105.eurprd03.prod.outlook.com (2603:10a6:10:72::46) by AM6PR07MB5256.eurprd07.prod.outlook.com (2603:10a6:20b:6c::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3045.8; Sun, 24 May 2020 12:05:21 +0000" + }, + { + "name": "Received", + "value": "from DB5EUR01FT016.eop-EUR01.prod.protection.outlook.com (2603:10a6:10:72:cafe::cb) by DB7PR03CA0105.outlook.office365.com (2603:10a6:10:72::46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.26 via Frontend Transport; Sun, 24 May 2020 12:05:21 +0000" + }, + { + "name": "Received", + "value": "from mx0b-00169c01.pphosted.com (67.231.156.123) by DB5EUR01FT016.mail.protection.outlook.com (10.152.4.255) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.23 via Frontend Transport; Sun, 24 May 2020 12:05:20 +0000" + }, + { + "name": "Received", + "value": "from pps.filterd (m0048188.ppops.net [127.0.0.1])\tby mx0b-00169c01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 04OC5DAh017336\tfor ; Sun, 24 May 2020 05:05:20 -0700" + }, + { + "name": "Received", + "value": "from mail-oo1-f69.google.com (mail-oo1-f69.google.com [209.85.161.69])\tby mx0b-00169c01.pphosted.com with ESMTP id 316ygbt5we-1\t(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)\tfor ; Sun, 24 May 2020 05:05:19 -0700" + }, + { + "name": "Received", + "value": "by mail-oo1-f69.google.com with SMTP id z190so8178136ooa.19 for ; Sun, 24 May 2020 05:05:19 -0700 (PDT)" + }, + { + "name": "Authentication-Results", + "value": "spf=pass (sender IP is 67.231.156.123) smtp.mailfrom=paloaltonetworks.com; demistodev.onmicrosoft.com; dkim=pass (signature was verified) header.d=paloaltonetworks.com;demistodev.onmicrosoft.com; dmarc=pass action=none header.from=paloaltonetworks.com;compauth=pass reason=100" + }, + { + "name": "Received-SPF", + "value": "Pass (protection.outlook.com: domain of paloaltonetworks.com designates 67.231.156.123 as permitted sender) receiver=protection.outlook.com; client-ip=67.231.156.123; helo=mx0b-00169c01.pphosted.com;" + }, + { + "name": "DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks.com; h=mime-version : from : date : message-id : subject : to : content-type; s=PPS12012017; bh=oKMkuNMg4AOkAcDm/TJAqh+DBFvZo76l5u80led3OuQ=; b=nX2L66T91eUzH+H2NOmbtH7OvFR8SPAkHv3HkC9nIgHkHBhP+0y75T9tnswbcngJ1YH4 1t1GpME1af9yXTZvlHZ33aP446gH2cai/OSYh0AyMmSJ/gcMKnfvvYB55IOofGm29UVB UQax0+RRUdAsplVfjOKp90w9ZOMC3iMfs7DNLzc3mYuwfzmDgqaoxdW9LYsva+D47Jh6 PUIvNaQtJ5gnBTRM3dS/HOj8/8qOtk1BFiQrlfSdrUlyf/YW1zA7Rgjr9camjFpRO/ug +ohq7uxL1XBbuQGGHHATOIcT1/Utb130VABe5NMOhaSaaMv6SUw4D9CMzThKJMmPwKT3 Og== " + }, + { + "name": "DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=paloaltonetworks-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=oKMkuNMg4AOkAcDm/TJAqh+DBFvZo76l5u80led3OuQ=; b=zhHz86wU6AlPStMpUoctv8sqwn6RPVSqTXUR4l2o47CTg3JTG8Zzg8zPx+SEJ7TCQo 2P4XzUOgy8FwjlMmKub6YRb0MRKSV//MArs1rRpuprvEk7cPVddvVhNlq39Z2G9g0bkC I8V0yHNkK0g1PnCi16K+zkEvIniGu9Z4XTc+Gtrqte33NyrcIcQHaSDIt+rx6FA3wjqq DCuLh+QLLLLZQ0blCMIrUQndZKtqgy8TKvxAAE6lA+o4MrqKQCSNWLR8It8lfD1/kACi 56u8993bfz+ygncyZKoJnvOnN1xYMwtjReMrTGPE7DQaV9dT/8OnZMalAoPpgZJsV2c4 pnYA==" + }, + { + "name": "X-Google-DKIM-Signature", + "value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=oKMkuNMg4AOkAcDm/TJAqh+DBFvZo76l5u80led3OuQ=; b=mqyRLna0nlMpWHgCGcSnUQQJwYwLGfVLcsefOEwHpNFCALI2axWh/g2R/bNNSnCbht YKPRSfwjnnMV7R29v+URpaFsfUIYGtvktYyA/Gpgk6UBpoqOvOTgziFxPDptPjXFUXqH 3tF5zK6Httt2C4hv3uJ7szNY2bnu21966L4Oq0OAJDJpJWt116ebwVyrtH8L95a0a+WK ymjTh7VFrWgSxvtuFGBIkpdEgbcz4Nwf6LmZ3d9QkDM4V3BE1LLdQyMr54BqesB2ZwW5 TQZ3Sy1PjbA3oAc7ClajCyuHk9vJ2TonYimF2EBsopDxrrB2x4ZC45bnllRswFsvPXJm u/AA==" + }, + { + "name": "X-Gm-Message-State", + "value": "AOAM530mhUfg9mbd/vLieicJ0PorcrLLS01V62u9nuJ96XD4gPIwHiF2\tE65GOXDh+NjlrqQTRpFCeU1EwMrkJPlRkRa+Zdb6YDwfg7T9ZRmi48TeVHS45ws3UeofplUK/H+\t/BwKWU0i7NmgwdJty+kdaAdKXVfABBAKyQ0a0FKYDv7Yeqjnt" + }, + { + "name": "X-Received", + "value": "by 2002:a05:6808:106:: with SMTP id b6mr8634827oie.142.1590321918013; Sun, 24 May 2020 05:05:18 -0700 (PDT)" + }, + { + "name": "X-Received", + "value": "by 2002:a05:6808:106:: with SMTP id b6mr8634794oie.142.1590321917402; Sun, 24 May 2020 05:05:17 -0700 (PDT)" + }, + { + "name": "X-Google-Smtp-Source", + "value": "ABdhPJyd3hDsiXnVW3uD+Am05+DCdgZ5nYUWSas3oQpGK7s6UXHxeEiBT58TFD7hfNvVejB0M8kUPg29m+om6RSsjAA=" + }, + { + "name": "MIME-Version", + "value": "1.0" + }, + { + "name": "Date", + "value": "Sun, 24 May 2020 15:04:16 +0300" + }, + { + "name": "Message-ID", + "value": "" + }, + { + "name": "Subject", + "value": "second fetch" + }, + { + "name": "Content-Type", + "value": "multipart/mixed" + }, + { + "name": "X-Proofpoint-Virus-Version", + "value": "vendor=fsecure engine=2.50.10434:6.0.216,18.0.676 definitions=2020-05-24_02:2020-05-22,2020-05-24 signatures=0" + }, + { + "name": "X-Proofpoint-Spam-Details", + "value": "rule=outbound_spam_notspam policy=outbound_spam score=0 malwarescore=0 bulkscore=0 priorityscore=1501 spamscore=0 mlxscore=0 suspectscore=0 mlxlogscore=479 lowpriorityscore=0 adultscore=0 phishscore=0 impostorscore=0 cotscore=-2147483648 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2005240103" + }, + { + "name": "Return-Path", + "value": "darbel@paloaltonetworks.com" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationStartTime", + "value": "24 May 2020 12:05:21.3150 (UTC)" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationStartTimeReason", + "value": "OriginalSubmit" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationInterval", + "value": "1:00:00:00.0000000" + }, + { + "name": "X-MS-Exchange-Organization-ExpirationIntervalReason", + "value": "OriginalSubmit" + }, + { + "name": "X-MS-Exchange-Organization-Network-Message-Id", + "value": "04736eb5-a8f0-4eca-aa89-08d7ffdabbb1" + }, + { + "name": "X-EOPAttributedMessage", + "value": "0" + }, + { + "name": "X-EOPTenantAttributedMessage", + "value": "ebac1a16-81bf-449b-8d43-5732c3c1d999:0" + }, + { + "name": "X-MS-Exchange-Organization-MessageDirectionality", + "value": "Incoming" + }, + { + "name": "X-Forefront-Antispam-Report", + "value": "CIP:67.231.156.123;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mx0b-00169c01.pphosted.com;PTR:mx0b-00169c01.pphosted.com;CAT:NONE;SFTY:;SFS:(4636009)(336012)(564344004)(55446002)(356005)(5660300002)(8676002)(2160300002)(3480700007)(1096003)(42186006)(7596003)(26005)(33964004)(6666004)(86362001)(7636003)(9686003)(6916009)(7116003);DIR:INB;SFP:;" + }, + { + "name": "X-MS-PublicTrafficType", + "value": "Email" + }, + { + "name": "X-MS-Exchange-Organization-AuthSource", + "value": "DB5EUR01FT016.eop-EUR01.prod.protection.outlook.com" + }, + { + "name": "X-MS-Exchange-Organization-AuthAs", + "value": "Anonymous" + }, + { + "name": "X-MS-Office365-Filtering-Correlation-Id", + "value": "04736eb5-a8f0-4eca-aa89-08d7ffdabbb1" + }, + { + "name": "X-MS-TrafficTypeDiagnostic", + "value": "AM6PR07MB5256:" + }, + { + "name": "X-MS-Exchange-AtpMessageProperties", + "value": "SA" + }, + { + "name": "X-MS-Oob-TLC-OOBClassifiers", + "value": "OLM:1728;" + }, + { + "name": "X-MS-Exchange-Organization-SCL", + "value": "1" + }, + { + "name": "X-Microsoft-Antispam", + "value": "BCL:0;" + }, + { + "name": "X-MS-Exchange-CrossTenant-OriginalArrivalTime", + "value": "24 May 2020 12:05:20.9502 (UTC)" + }, + { + "name": "X-MS-Exchange-CrossTenant-Network-Message-Id", + "value": "04736eb5-a8f0-4eca-aa89-08d7ffdabbb1" + }, + { + "name": "X-MS-Exchange-CrossTenant-Id", + "value": "ebac1a16-81bf-449b-8d43-5732c3c1d999" + }, + { + "name": "X-MS-Exchange-CrossTenant-FromEntityHeader", + "value": "Internet" + }, + { + "name": "X-MS-Exchange-Transport-CrossTenantHeadersStamped", + "value": "AM6PR07MB5256" + }, + { + "name": "X-MS-Exchange-Transport-EndToEndLatency", + "value": "00:00:01.7736787" + }, + { + "name": "X-MS-Exchange-Processed-By-BccFoldering", + "value": "15.20.3045.009" + }, + { + "name": "X-Microsoft-Antispam-Mailbox-Delivery", + "value": "ucf:0;jmr:0;auth:0;dest:I;ENG:(20160514016)(750128)(520011016)(944506383)(944626604);" + }, + { + "name": "X-Microsoft-Antispam-Message-Info", + "value": "8W3SISohCZB2jQsUVcqhQbQIXqqgocGxEoacfDww85zYoebJ4CFEHyfPsjUv+LWjYSozYrGJD2/XqethtTTJJW6GWACydYyIZsou4z883d0qB1DF7GfQQfgrAupBUcIj89jZALyqlQso/er4YUyuYWcW+5pUomBty6xvEErGMJYS7fxrR/7/Yt5pUoh8ZA77zrvssAXTcVkTw3kQwzzVYyvNwbAf0v4gKAoDzFaxij+5Agi89r8g9TTgz/V2b5uozJjCaJGdF8OOTEuZynKMlIv1PvIMBbZk+ODD3N+BfGPgIrRGtzDh8+mq95cFJL88feiiZk6WzkEDdmKa2UdxnZ/WWHIqUtqpukSXt7V7jxpl49ZxSU0gKeZ7O9SKBRsMtLtsCyg2lSr49/pZhIh08i0cQ05etP6iRnfI3LZyOMLKrb/MklGtS0YpnYO6fLUpUDcXZOaHkdnN5G981RHyh0SX5fZlApq90HPhgSWtNVC2Oa3P4v033t8YWR0w7SiQu4F1rYG6f0b7P7AlKLfBnNNhN7LFFEbJ6Dx/3TXZSm6Ayxmh2McwOGGTnBOBnJ5uBSXFtn7SZ83I13G1IK7YvSH0E4OpvNsZR/IlBmypFSZu9d/6/fO4IIDbn0xtGeFz0mw0gRQEKkoqYWjFNQAUQUKUoDJRV4zbBKaQrzoCHlEzcWaLURomBTq4DToNt6CC6mEqEy2//FDOAqmUgmkscmJyUYRWGvuH/rWL40IYzwULxK+sUxj7wyv2zYMFiRE0rygZn417GM9tNG1IKdxV+70QMLaNu/d2POwIEdth+yUMnnP9PCDoaQlwhIYSUlaVJM7LBHXatKf5wpu/SQQdkq5GAf6bXjowjBdrxSZqAxuI1hoCjhx4FipRCfseqyhKqBcBSKTH4fh3+xGbarFdcWnklgvya4m6ydpbg5yyXQclOOcB1hjuLL5P9/UM1jI/4EPYRHPfzC2hhO+Ncn3mznUJSuJksNz9Yw13wHynU509CyTRBbLNRxwnCzrrpYjTROeOWgP1SfhaoX5q+JPDbXeuPK+oYyXzVZeLuOuBt15euPvxeNR0Sqnhc+sQy8BRhBZcTfcKbS4RZ/tFTrmsknkaGp3wXycjVdYRGgNWv5iRBMXtpHHYly9BRqY2FXNE2F4B5Xx75VLtBQfyWaIORB7nI/tG0AbriXC/mFfE/us=" + } + ], + "body": "\r\n

Dean Arbel

Staff Software Engineer, Content Team, Demisto

Email: darbel@paloaltonetworks.com

Phone: +972.54.7209916


", + "isRead": false, + "receivedBy": "testbox@demistodev.onmicrosoft.com", + "author": "darbel@paloaltonetworks.com", + "toRecipients": [ + "testbox@demistodev.onmicrosoft.com" + ], + "FileAttachments": [ + { + "originalItemId": "originalItemId", + "attachmentId": "attachmentId", + "attachmentName": "anar (1).jpeg", + "attachmentSHA256": "afc8f82063b4985b57292f07682c3010eef0d3cf3132482d418ad47df2993cca", + "attachmentContentType": "image/jpeg", + "attachmentContentId": "f_kal0kd8h0", + "attachmentContentLocation": null, + "attachmentSize": 31555, + "attachmentLastModifiedTime": "2020-05-24T15:05:22+03:00", + "attachmentIsInline": false, + "attachmentType": "FileAttachment" + } + ], + "mailbox": "testbox@demistodev.onmicrosoft.com" + } + ], + "ews-expand-group": [ + { + "mailbox": "avishai@demistodev.onmicrosoft.com", + "displayName": "Avishai Brandeis", + "mailboxType": "Mailbox" + }, + { + "mailbox": "testbox@demistodev.onmicrosoft.com", + "displayName": "test box", + "mailboxType": "Mailbox" + } + ] +} diff --git a/Packs/EWS/Integrations/EWSv2/CHANGELOG.md b/Packs/EWS/Integrations/EWSv2/CHANGELOG.md index 8b9ef983762..a05f705f791 100644 --- a/Packs/EWS/Integrations/EWSv2/CHANGELOG.md +++ b/Packs/EWS/Integrations/EWSv2/CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] -- +- Fixed a bug in the **test module** which failed on a delegated mailbox. ## [20.5.0] - 2020-05-12 - Command - "ews-get-items", add Email entry context by demisto standards as an output. diff --git a/Packs/EWS/Integrations/EWSv2/EWSv2.py b/Packs/EWS/Integrations/EWSv2/EWSv2.py index bd1af87aeb5..cfa97752299 100644 --- a/Packs/EWS/Integrations/EWSv2/EWSv2.py +++ b/Packs/EWS/Integrations/EWSv2/EWSv2.py @@ -1983,11 +1983,12 @@ def test_module(): global IS_TEST_MODULE IS_TEST_MODULE = True account = get_account(ACCOUNT_EMAIL) - if not account.root.effective_rights.read: # pylint: disable=E1101 + folder = get_folder_by_path(account, FOLDER_NAME, IS_PUBLIC_FOLDER) + if not folder.effective_rights.read: # pylint: disable=E1101 raise Exception("Success to authenticate, but user has no permissions to read from the mailbox. " "Need to delegate the user permissions to the mailbox - " "please read integration documentation and follow the instructions") - get_folder_by_path(account, FOLDER_NAME, IS_PUBLIC_FOLDER).test_access() + folder.test_access() except ErrorFolderNotFound as e: if "Top of Information Store" in e.message: raise Exception( @@ -2145,7 +2146,7 @@ def sub_main(): error_message += "\nFull debug log:\n" + debug_log if demisto.command() == 'fetch-incidents': - raise + raise Exception(str(e) + traceback.format_exc()) if demisto.command() == 'ews-search-mailbox' and isinstance(e, ValueError): return_error(message="Selected invalid field, please specify valid field name.", error=e) if IS_TEST_MODULE: diff --git a/Packs/EWS/Integrations/EWSv2/README.md b/Packs/EWS/Integrations/EWSv2/README.md index 8f796c7d0fd..25462e28949 100644 --- a/Packs/EWS/Integrations/EWSv2/README.md +++ b/Packs/EWS/Integrations/EWSv2/README.md @@ -72,7 +72,7 @@

To use Fetch incidents, configure a new instance and select the Fetches incidents option in the instance settings.

IMPORTANT: The initial fetch interval is the previous 10 minutes. If no emails were fetched before from the destination folder- all emails from 10 minutes prior to the instance configuration and up to the current time will be fetched. Additionally moving messages manually to the destination folder will not trigger fetch incident. Define rules on phishing/target mailbox instead of moving messages manually.

Pay special attention to the following fields in the instance settings:

-

Email address from which to fetch incidents – mailbox to fetch incidents from.
Name of the folder from which to fetch incidents – use this field to configure the destination folder from where emails should be fetched. The default is Inbox folder.
Has impersonation rights – mark this option if you set the target mailbox to an account different than your personal account. Otherwise Delegation access will be used instead of Impersonation.
Find more information on impersonation or delegation rights at ‘Additional Info’ section below.

+

Email address from which to fetch incidents – mailbox to fetch incidents from.
Name of the folder from which to fetch incidents – use this field to configure the destination folder from where emails should be fetched. The default is Inbox folder. Please note, if Exchange is configured with an international flavor `Inbox` will be named according to the configured language.
Has impersonation rights – mark this option if you set the target mailbox to an account different than your personal account. Otherwise Delegation access will be used instead of Impersonation.
Find more information on impersonation or delegation rights at ‘Additional Info’ section below.

Commands

You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

    @@ -2796,4 +2796,4 @@

     

    New-Compliance Search

    -

    The EWS v2 integration uses remote ps-session to run commands of compliance search as part of Office 365. To check if your account can connect to Office 365 Security & Compliance Center via powershell, check the following steps. New-Compliance search is a long-running task which has no limitation of searched mailboxes and therefore the suggestion is to use Office 365 Search and Deleteplaybook. New-Compliance search returns statistics of matched content search query and doesn't return preview of found emails in contrast to ews-search-mailboxes command.

    \ No newline at end of file +

    The EWS v2 integration uses remote ps-session to run commands of compliance search as part of Office 365. To check if your account can connect to Office 365 Security & Compliance Center via powershell, check the following steps. New-Compliance search is a long-running task which has no limitation of searched mailboxes and therefore the suggestion is to use Office 365 Search and Deleteplaybook. New-Compliance search returns statistics of matched content search query and doesn't return preview of found emails in contrast to ews-search-mailboxes command.

    diff --git a/Packs/EWS/ReleaseNotes/1_1_0.md b/Packs/EWS/ReleaseNotes/1_1_0.md new file mode 100644 index 00000000000..2de5c7d1cf8 --- /dev/null +++ b/Packs/EWS/ReleaseNotes/1_1_0.md @@ -0,0 +1,4 @@ + +#### Integrations +##### __EWSO365__ +The new EWS O365 integration uses OAuth 2.0 protocol and can be used with Exchange Online and Office 365 (mail). diff --git a/Packs/EWS/ReleaseNotes/1_1_1.md b/Packs/EWS/ReleaseNotes/1_1_1.md new file mode 100644 index 00000000000..d0a86d27f83 --- /dev/null +++ b/Packs/EWS/ReleaseNotes/1_1_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### __EWS v2__ +- Fixed a bug in the **test module** which failed on a delegated mailbox. diff --git a/Packs/EWS/ReleaseNotes/1_1_2.md b/Packs/EWS/ReleaseNotes/1_1_2.md new file mode 100644 index 00000000000..6eb618031f7 --- /dev/null +++ b/Packs/EWS/ReleaseNotes/1_1_2.md @@ -0,0 +1,4 @@ + +#### Integrations +##### __EWS v2__ +- Improved handling of errors raised in the incident fetch flow. diff --git a/Packs/EWS/TestPlaybooks/playbook-EWS_O365_test.yml b/Packs/EWS/TestPlaybooks/playbook-EWS_O365_test.yml new file mode 100644 index 00000000000..4bedd091880 --- /dev/null +++ b/Packs/EWS/TestPlaybooks/playbook-EWS_O365_test.yml @@ -0,0 +1,859 @@ +id: EWS_O365_test +version: -1 +name: EWS_O365_test +fromversion: 5.0.0 +description: "" +starttaskid: "0" +tasks: + "0": + id: "0" + taskid: 868b5714-1f56-40ad-8e0b-64e807805489 + type: start + task: + description: "" + id: 868b5714-1f56-40ad-8e0b-64e807805489 + version: -1 + name: "" + iscommand: false + brand: "" + nexttasks: + '#none#': + - "1" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 50 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "1": + id: "1" + taskid: 4aa13052-7a37-4389-83c0-3b103179d59f + type: regular + task: + description: "" + id: 4aa13052-7a37-4389-83c0-3b103179d59f + version: -1 + name: DeleteContext + script: DeleteContext + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "2" + scriptarguments: + all: + simple: "yes" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 195 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "2": + id: "2" + taskid: 140a8a39-d6f0-4a0d-8652-ce4cc7b155b9 + type: regular + task: + description: "" + id: 140a8a39-d6f0-4a0d-8652-ce4cc7b155b9 + version: -1 + name: ews-get-attachment + script: '|||ews-get-attachment' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "3" + scriptarguments: + attachment-ids: {} + item-id: + simple: AAMkAGZiODc1MGY3LTBiODEtNDQ3ZC05YzdjLWVkYjhiMjFlMTk1MABGAAAAAAB4Hvam6Pd3Sqro7SBw8T0oBwDj9X3Q04QOTYf/bBd1+UDZAAAAAAEMAADj9X3Q04QOTYf/bBd1+UDZAAAHclB6AAA= + target-mailbox: {} + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "3": + id: "3" + taskid: e4b0396b-9fd8-481b-8722-e09914b5340f + type: condition + task: + description: "" + id: e4b0396b-9fd8-481b-8722-e09914b5340f + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "6" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: EWS.Items.FileAttachments.attachmentId + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Items.FileAttachments.attachmentName + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Items.FileAttachments.attachmentSHA256 + iscontext: true + view: |- + { + "position": { + "x": 50, + "y": 545 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "6": + id: "6" + taskid: 8e54bd48-8d5c-485f-852d-59793c325221 + type: regular + task: + description: "" + id: 8e54bd48-8d5c-485f-852d-59793c325221 + version: -1 + name: ews-get-searchable-mailboxes + script: '|||ews-get-searchable-mailboxes' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "7" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 720 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "7": + id: "7" + taskid: 4daf91b6-b466-41f3-8b7c-d6b160b086c1 + type: condition + task: + description: "" + id: 4daf91b6-b466-41f3-8b7c-d6b160b086c1 + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "14" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: EWS.Mailboxes.mailbox + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Mailboxes.mailboxId + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Mailboxes.displayName + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Mailboxes.isExternal + iscontext: true + view: |- + { + "position": { + "x": 50, + "y": 895 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "14": + id: "14" + taskid: 04028000-32ce-44b2-84bc-e4e5dad7c7f4 + type: regular + task: + description: "" + id: 04028000-32ce-44b2-84bc-e4e5dad7c7f4 + version: -1 + name: ews-search-mailbox + script: '|||ews-search-mailbox' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "15" + scriptarguments: + folder-path: {} + is-public: {} + limit: {} + message-id: {} + query: + simple: move me + selected-fields: {} + target-mailbox: {} + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 1070 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "15": + id: "15" + taskid: e034e902-096d-451d-8751-44a53b74b098 + type: condition + task: + description: "" + id: e034e902-096d-451d-8751-44a53b74b098 + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "16" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + simple: EWS.Items.itemId + iscontext: true + right: + value: + simple: AAMkAGZiODc1MGY3LTBiODEtNDQ3ZC05YzdjLWVkYjhiMjFlMTk1MABGAAAAAAB4Hvam6Pd3Sqro7SBw8T0oBwDj9X3Q04QOTYf/bBd1+UDZAAAAAAEMAADj9X3Q04QOTYf/bBd1+UDZAAAHclB4AAA= + view: |- + { + "position": { + "x": 50, + "y": 1245 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "16": + id: "16" + taskid: f54e460a-9d04-4fe9-8a06-ad6272af79fb + type: regular + task: + description: "" + id: f54e460a-9d04-4fe9-8a06-ad6272af79fb + version: -1 + name: ews-get-contacts + script: '|||ews-get-contacts' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "18" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 1420 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "18": + id: "18" + taskid: 0d4138c5-30e9-437b-85e4-720d8862d74f + type: regular + task: + description: "" + id: 0d4138c5-30e9-437b-85e4-720d8862d74f + version: -1 + name: ews-get-out-of-office + script: '|||ews-get-out-of-office' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "19" + scriptarguments: + target-mailbox: + simple: avishai@demistodev.onmicrosoft.com + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 1595 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "19": + id: "19" + taskid: 7eb0d117-14c3-4b78-89a1-71dd92f62edf + type: condition + task: + description: "" + id: 7eb0d117-14c3-4b78-89a1-71dd92f62edf + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "24" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isEqualString + left: + value: + simple: Account.Email.OutOfOffice.state + iscontext: true + right: + value: + simple: Disabled + view: |- + { + "position": { + "x": 50, + "y": 1770 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "24": + id: "24" + taskid: 9e3cacfb-f02d-4b5f-8b10-66f150c4c27f + type: regular + task: + description: "" + id: 9e3cacfb-f02d-4b5f-8b10-66f150c4c27f + version: -1 + name: ews-find-folders + script: '|||ews-find-folders' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "25" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 1945 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "25": + id: "25" + taskid: e4c73fb6-9c0f-419b-85f9-116c4e4b69be + type: condition + task: + description: "" + id: e4c73fb6-9c0f-419b-85f9-116c4e4b69be + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "26" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.name + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.id + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.totalCount + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.unreadCount + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.changeKey + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.childrenFolderCount + iscontext: true + view: |- + { + "position": { + "x": 50, + "y": 2120 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "26": + id: "26" + taskid: bfc3bff4-3c18-4d72-8bcf-3a6626b047e6 + type: regular + task: + description: "" + id: bfc3bff4-3c18-4d72-8bcf-3a6626b047e6 + version: -1 + name: ews-get-items-from-folder + script: '|||ews-get-items-from-folder' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "28" + scriptarguments: + folder-path: + simple: AllItems + get-internal-item: {} + is-public: {} + limit: + simple: "5" + target-mailbox: {} + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 2295 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "28": + id: "28" + taskid: 92eb2cdc-6f16-4597-8851-09984d8f2778 + type: regular + task: + description: "" + id: 92eb2cdc-6f16-4597-8851-09984d8f2778 + version: -1 + name: ews-get-items + script: '|||ews-get-items' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "29" + scriptarguments: + item-ids: + simple: AAMkAGZiODc1MGY3LTBiODEtNDQ3ZC05YzdjLWVkYjhiMjFlMTk1MABGAAAAAAB4Hvam6Pd3Sqro7SBw8T0oBwDj9X3Q04QOTYf/bBd1+UDZAAAAAAEMAADj9X3Q04QOTYf/bBd1+UDZAAAHclB6AAA= + target-mailbox: {} + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 2470 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "29": + id: "29" + taskid: 5f7483e1-47b0-4686-8240-bdd61149800a + type: condition + task: + description: "" + id: 5f7483e1-47b0-4686-8240-bdd61149800a + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "32" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: EWS.Items.itemId + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Items.datetimeReceived + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Items.datetimeSent + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Items.headers + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Items.sender + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Items.subject + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Items.size + iscontext: true + view: |- + { + "position": { + "x": 50, + "y": 2645 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "32": + id: "32" + taskid: 0b3e36db-8292-42ad-8789-9cebe311dc1c + type: regular + task: + description: "" + id: 0b3e36db-8292-42ad-8789-9cebe311dc1c + version: -1 + name: ews-get-folder + script: '|||ews-get-folder' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "33" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 2820 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "33": + id: "33" + taskid: cb980652-ce60-461e-82b7-82580cdab17b + type: condition + task: + description: "" + id: cb980652-ce60-461e-82b7-82580cdab17b + version: -1 + name: Verify Outputs + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "34" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.id + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.name + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.changeKey + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.totalCount + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.childrenFolderCount + iscontext: true + - - operator: isNotEmpty + left: + value: + simple: EWS.Folders.unreadCount + iscontext: true + view: |- + { + "position": { + "x": 50, + "y": 2995 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "34": + id: "34" + taskid: 0001331a-66c0-4fa3-8434-71dfee5da637 + type: regular + task: + description: "" + id: 0001331a-66c0-4fa3-8434-71dfee5da637 + version: -1 + name: ews-expand-group + script: '|||ews-expand-group' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "40" + scriptarguments: + email-address: + simple: testgroup-1@demistodev.onmicrosoft.com + recursive-expansion: {} + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 3170 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "39": + id: "39" + taskid: 8ff5c4d0-6f1c-4a82-8e83-cc4a011931a7 + type: title + task: + description: "" + id: 8ff5c4d0-6f1c-4a82-8e83-cc4a011931a7 + version: -1 + name: Test Done + type: title + iscommand: false + brand: "" + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 3695 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "40": + id: "40" + taskid: 9607062f-6cf7-495e-822e-e465eec9d0a3 + type: regular + task: + id: 9607062f-6cf7-495e-822e-e465eec9d0a3 + version: -1 + name: ews-get-items-as-eml + description: Retrieves items by item ID and uploads its content as an EML file. + script: '|||ews-get-items-as-eml' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "41" + scriptarguments: + item-id: + simple: AAMkAGZiODc1MGY3LTBiODEtNDQ3ZC05YzdjLWVkYjhiMjFlMTk1MABGAAAAAAB4Hvam6Pd3Sqro7SBw8T0oBwDj9X3Q04QOTYf/bBd1+UDZAAAAAAEMAADj9X3Q04QOTYf/bBd1+UDZAAAHclB6AAA= + target-mailbox: {} + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 3345 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "41": + id: "41" + taskid: 0e0078d8-7bed-4443-80ff-f12361f6626b + type: regular + task: + id: 0e0078d8-7bed-4443-80ff-f12361f6626b + version: -1 + name: Get public folder + description: Retrieves a single folder. + script: '|||ews-get-folder' + type: regular + iscommand: true + brand: "" + nexttasks: + '#none#': + - "39" + scriptarguments: + folder-path: + simple: test_p + is-public: + simple: "True" + target-mailbox: {} + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 3520 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +view: |- + { + "linkLabelsPosition": {}, + "paper": { + "dimensions": { + "height": 3710, + "width": 380, + "x": 50, + "y": 50 + } + } + } +inputs: [] +outputs: [] diff --git a/TestPlaybooks/NonCircleTests/playbook-Send-Email-To-Recipients-Test.yml b/Packs/EWS/TestPlaybooks/playbook-Send-Email-To-Recipients-Test.yml similarity index 100% rename from TestPlaybooks/NonCircleTests/playbook-Send-Email-To-Recipients-Test.yml rename to Packs/EWS/TestPlaybooks/playbook-Send-Email-To-Recipients-Test.yml diff --git a/Packs/EWS/pack_metadata.json b/Packs/EWS/pack_metadata.json index d4d697d9d1e..9335a270f26 100644 --- a/Packs/EWS/pack_metadata.json +++ b/Packs/EWS/pack_metadata.json @@ -2,7 +2,7 @@ "name": "EWS", "description": "Exchange Web Services and Office 365 (mail)", "support": "Cortex XSOAR", - "currentVersion": "1.0.1", + "currentVersion": "1.1.2", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/TestPlaybooks/playbook-ExifReadTest.yml b/Packs/ExifRead/TestPlaybooks/playbook-ExifReadTest.yml similarity index 100% rename from TestPlaybooks/playbook-ExifReadTest.yml rename to Packs/ExifRead/TestPlaybooks/playbook-ExifReadTest.yml diff --git a/Packs/Expanse/pack_metadata.json b/Packs/Expanse/pack_metadata.json index 017fe4aacd0..16e69431a48 100644 --- a/Packs/Expanse/pack_metadata.json +++ b/Packs/Expanse/pack_metadata.json @@ -12,7 +12,6 @@ ], "tags": [], "useCases": [], - "certification": "certified", "keywords": [ "Expanse" ] diff --git a/Packs/ExportIndicators/Integrations/ExportIndicators/README.md b/Packs/ExportIndicators/Integrations/ExportIndicators/README.md index ea34ecebf1b..368dff31608 100644 --- a/Packs/ExportIndicators/Integrations/ExportIndicators/README.md +++ b/Packs/ExportIndicators/Integrations/ExportIndicators/README.md @@ -47,7 +47,7 @@ To access the Export Indicators service by instance name, make sure ***Instance 1. In Demisto, go to **Settings > About > Troubleshooting**. 2. In the **Server Configuration** section, verify that the ***instance.execute.external*** key is set to *true*. If this key does not exist, click **+ Add Server Configuration** and add the *instance.execute.external* and set the value to *true*. See [this documentation](https://xsoar.pan.dev/docs/integrations/long-running#invoking-http-integrations-via-cortex-xsoar-servers-route-handling) for further information. -3. In a web browser, go to **https://**/instance/execute/**** . +3. In a web browser, go to `https://**/instance/execute/**` . ### Update values in the export indicators service --- @@ -60,17 +60,17 @@ Use the following arguments in the URL to change the request: | **Argument Name** | **Description** | **Example** | | --- | --- | --- | -| n | The maximum number of entries in the output. If no value is provided, will use the value specified in the List Size parameter configured in the instance configuration. | https://{demisto_instance}/instance/execute/{ExportIndicators_instance_name}?n=50 | -| s | The starting entry index from which to export the indicators. | https://{demisto_instance}/instance/execute/{ExportIndicators_instance_name}?s=10&n=50 | -| v | The output format. Supports `text`, `csv`, `json`, `json-seq`,`xsoar-json`, `xsoar-seq`, `xsoar-csv`, `mwg`, `panosurl` and `proxysg` (alias: `bluecoat`). | https://{demisto_instance}/instance/execute/{ExportIndicators_instance_name}?v=json | -| q | The query used to retrieve indicators from the system. | https://{demisto_instance}/instance/execute/{ExportIndicators_instance_name}?q="type:ip and sourceBrand:my_source" | -| t | Only with `mwg` format. The type indicated on the top of the exported list. Supports: string, applcontrol, dimension, category, ip, mediatype, number and regex. | https://{demisto_instance}/instance/execute/{ExportIndicators_instance_name}?v=mwg&t=ip | -| sp | Only with `panosurl` format. If set will strip ports off URLs, otherwise will ignore URLs with ports. | https://{demisto_instance}/instance/execute/{ExportIndicators_instance_name}?v=panosurl&sp | -| di | Only with `panosurl` format. If set will ignore urls which are not compliant with PAN-OS URL format instead of being re-written. | https://{demisto_instance}/instance/execute/{ExportIndicators_instance_name}?v=panosurl&di | -| cd | Only with `proxysg` format. The default category for the exported indicators. | https://{demisto_instance}/instance/execute/{ExportIndicators_instance_name}?v=proxysg&cd=default_category | -| ca | Only with `proxysg` format. The categories which will be exported. Indicators not falling to these categories will be classified as the default category. | https://{demisto_instance}/instance/execute/{ExportIndicators_instance_name}?v=proxysg&ca=category1,category2 | -| tr | Whether to collapse IPs. 0 - to not collapse, 1 - collapse to ranges or 2 - collapse to CIDRs | https://{demisto_instance}/instance/execute/{ExportIndicators_instance_name}?q="type:ip and sourceBrand:my_source"&tr=1 | -| tx | Whether to output `csv` or `xsoar-csv` formats as textual web pages. | https://{demisto_instance}/instance/execute/{ExportIndicators_instance_name}?v=xsoar-csv&tx | +| n | The maximum number of entries in the output. If no value is provided, will use the value specified in the List Size parameter configured in the instance configuration. | `https://{server_host}/instance/execute/{instance_name}?n=50` | +| s | The starting entry index from which to export the indicators. | `https://{server_host}/instance/execute/{instance_name}?s=10&n=50` | +| v | The output format. Supports `text`, `csv`, `json`, `json-seq`,`xsoar-json`, `xsoar-seq`, `xsoar-csv`, `mwg`, `panosurl` and `proxysg` (alias: `bluecoat`). | `https://{server_host}/instance/execute/{instance_name}?v=json` | +| q | The query used to retrieve indicators from the system. | `https://{server_host}/instance/execute/{instance_name}?q="type:ip and sourceBrand:my_source"` | +| t | Only with `mwg` format. The type indicated on the top of the exported list. Supports: string, applcontrol, dimension, category, ip, mediatype, number and regex. | `https://{server_host}/instance/execute/{instance_name}?v=mwg&t=ip` | +| sp | Only with `panosurl` format. If set will strip ports off URLs, otherwise will ignore URLs with ports. | `https://{server_host}/instance/execute/{instance_name}?v=panosurl&sp` | +| di | Only with `panosurl` format. If set will ignore urls which are not compliant with PAN-OS URL format instead of being re-written. | `https://{server_host}/instance/execute/{instance_name}?v=panosurl&di` | +| cd | Only with `proxysg` format. The default category for the exported indicators. | `https://{server_host}/instance/execute/{instance_name}?v=proxysg&cd=default_category` | +| ca | Only with `proxysg` format. The categories which will be exported. Indicators not falling to these categories will be classified as the default category. | `https://{server_host}/instance/execute/{instance_name}?v=proxysg&ca=category1,category2` | +| tr | Whether to collapse IPs. 0 - to not collapse, 1 - collapse to ranges or 2 - collapse to CIDRs | `https://{server_host}/instance/execute/{instance_name}?q="type:ip and sourceBrand:my_source"&tr=1` | +| tx | Whether to output `csv` or `xsoar-csv` formats as textual web pages. | `https://{server_host}/instance/execute/{instance_name}?v=xsoar-csv&tx` | ##### Base Command diff --git a/Packs/ExtraHop/pack_metadata.json b/Packs/ExtraHop/pack_metadata.json index ec5bfa455e4..39e7177b71a 100644 --- a/Packs/ExtraHop/pack_metadata.json +++ b/Packs/ExtraHop/pack_metadata.json @@ -1,11 +1,11 @@ { "name": "ExtraHop Reveal(x)", "description": "Network detection and response. Complete visibility of network communications at enterprise scale, real-time threat detections backed by machine learning, and guided investigation workflows that simplify response.", - "support": "xsoar", + "support": "partner", "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", + "author": "ExtraHop", + "url": "", + "email": "support@extrahop.com", "created": "2020-04-14T00:00:00Z", "categories": [ "Network Security" diff --git a/Packs/FeedAWS/pack_metadata.json b/Packs/FeedAWS/pack_metadata.json index c37c6618dc5..a79ec81d80b 100644 --- a/Packs/FeedAWS/pack_metadata.json +++ b/Packs/FeedAWS/pack_metadata.json @@ -10,7 +10,9 @@ "categories": [ "Data Enrichment & Threat Intelligence" ], - "tags": [], + "tags": [ + "TIM" + ], "useCases": [], "keywords": [ "AWS", diff --git a/Packs/FeedAlienVault/Integrations/FeedAlienVaultOTXTaxii/README.md b/Packs/FeedAlienVault/Integrations/FeedAlienVaultOTXTaxii/README.md index 8ef7c39ac5e..24ef8ff567b 100644 --- a/Packs/FeedAlienVault/Integrations/FeedAlienVaultOTXTaxii/README.md +++ b/Packs/FeedAlienVault/Integrations/FeedAlienVaultOTXTaxii/README.md @@ -69,7 +69,7 @@ There is no context output for this command. ## Video Demo diff --git a/Packs/FeedAlienVault/Integrations/FeedAlienVaultOTXTaxii/doc_files/AlienVault_OTX_Feed_Demo.mp4 b/Packs/FeedAlienVault/Integrations/FeedAlienVaultOTXTaxii/doc_files/AlienVault_OTX_Feed_Demo.mp4 deleted file mode 100644 index b8d8c8dfea6..00000000000 --- a/Packs/FeedAlienVault/Integrations/FeedAlienVaultOTXTaxii/doc_files/AlienVault_OTX_Feed_Demo.mp4 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:b4446ea4054d235b517dd5d72279a2a59d5758b22ba7087a8790b3adb24c686f -size 5836016 diff --git a/Packs/FeedAutofocus/Integrations/FeedAutofocus/README.md b/Packs/FeedAutofocus/Integrations/FeedAutofocus/README.md index 40395aaee3c..8a790821222 100644 --- a/Packs/FeedAutofocus/Integrations/FeedAutofocus/README.md +++ b/Packs/FeedAutofocus/Integrations/FeedAutofocus/README.md @@ -100,7 +100,7 @@ To bring the next batch of indicators run: ## Demo Video diff --git a/Packs/FeedAutofocus/Integrations/FeedAutofocus/demo_video/AutoFocus_Feed_demo.mp4 b/Packs/FeedAutofocus/Integrations/FeedAutofocus/demo_video/AutoFocus_Feed_demo.mp4 deleted file mode 100644 index 846180217fa..00000000000 --- a/Packs/FeedAutofocus/Integrations/FeedAutofocus/demo_video/AutoFocus_Feed_demo.mp4 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:d545c97529202820027aa264de2a811f24f0f6110fee4459816afb6c25c22449 -size 5364646 diff --git a/Packs/FeedAutofocus/pack_metadata.json b/Packs/FeedAutofocus/pack_metadata.json index 29613f49410..eb122ae3e5a 100644 --- a/Packs/FeedAutofocus/pack_metadata.json +++ b/Packs/FeedAutofocus/pack_metadata.json @@ -1,19 +1,20 @@ { - "name": "Autofocus Feed", - "description": "Indicators feed from Autofocus", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-03-09T16:04:45Z", - "categories": [ - "Data Enrichment & Threat Intelligence" - ], - "tags": [], - "useCases": [], - "keywords": [ - "Autofocus", - "Feed" - ] + "name": "Autofocus Feed", + "description": "Indicators feed from Autofocus", + "support": "xsoar", + "currentVersion": "1.0.0", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-03-09T16:04:45Z", + "categories": [ + "Data Enrichment & Threat Intelligence" + ], + "tags": [], + "useCases": [], + "keywords": [ + "Autofocus", + "Feed" + ], + "dependencies": {} } \ No newline at end of file diff --git a/Packs/FeedAzure/Integrations/FeedAzure/FeedAzure.py b/Packs/FeedAzure/Integrations/FeedAzure/FeedAzure.py index 41fd970ad1a..b3233cf3ca4 100644 --- a/Packs/FeedAzure/Integrations/FeedAzure/FeedAzure.py +++ b/Packs/FeedAzure/Integrations/FeedAzure/FeedAzure.py @@ -201,7 +201,7 @@ def build_iterator(self) -> List: except RuntimeError as err: demisto.debug(str(err)) - raise RuntimeError(F'Could not fetch download link from Azure') + raise RuntimeError('Could not fetch download link from Azure') except ValueError as err: demisto.debug(str(err)) diff --git a/Packs/FeedAzure/Integrations/FeedAzure/FeedAzure.yml b/Packs/FeedAzure/Integrations/FeedAzure/FeedAzure.yml index 108ae35582c..0e560fd7d97 100644 --- a/Packs/FeedAzure/Integrations/FeedAzure/FeedAzure.yml +++ b/Packs/FeedAzure/Integrations/FeedAzure/FeedAzure.yml @@ -184,7 +184,7 @@ script: description: Gets indicators from the feed. execution: false name: azure-get-indicators - dockerimage: demisto/python3:3.8.2.6981 + dockerimage: demisto/python3:3.8.3.8715 feed: true isfetch: false longRunning: false diff --git a/Packs/FeedAzure/ReleaseNotes/1_0_1.md b/Packs/FeedAzure/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..a586a88319f --- /dev/null +++ b/Packs/FeedAzure/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AzureFeed +- Internal code improvements. \ No newline at end of file diff --git a/Packs/FeedAzure/pack_metadata.json b/Packs/FeedAzure/pack_metadata.json index f73e298a0ca..b8e06afa6fe 100644 --- a/Packs/FeedAzure/pack_metadata.json +++ b/Packs/FeedAzure/pack_metadata.json @@ -1,19 +1,21 @@ { - "name": "Azure Feed", - "description": "Indicators feed from Azure", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-03-09T16:04:45Z", - "categories": [ - "Data Enrichment & Threat Intelligence" - ], - "tags": [], - "useCases": [], - "keywords": [ - "Azure", - "Feed" - ] + "name": "Azure Feed", + "description": "Indicators feed from Azure", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-03-09T16:04:45Z", + "categories": [ + "Data Enrichment & Threat Intelligence" + ], + "tags": [ + "TIM" + ], + "useCases": [], + "keywords": [ + "Azure", + "Feed" + ] } \ No newline at end of file diff --git a/Packs/Exchange/.pack-ignore b/Packs/FeedAzureADConnectHealth/.pack-ignore similarity index 100% rename from Packs/Exchange/.pack-ignore rename to Packs/FeedAzureADConnectHealth/.pack-ignore diff --git a/Packs/FeedAzureADConnectHealth/.secrets-ignore b/Packs/FeedAzureADConnectHealth/.secrets-ignore new file mode 100644 index 00000000000..bab06396502 --- /dev/null +++ b/Packs/FeedAzureADConnectHealth/.secrets-ignore @@ -0,0 +1,2 @@ +https://sts.contoso.com +https://aka.ms \ No newline at end of file diff --git a/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed.py b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed.py new file mode 100644 index 00000000000..65f3d56460e --- /dev/null +++ b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed.py @@ -0,0 +1,176 @@ +import demistomock as demisto +from CommonServerPython import * + +from typing import Any, Callable, Dict, List, Tuple + +import urllib3 +from bs4 import BeautifulSoup +import re + +# disable insecure warnings +urllib3.disable_warnings() + +INTEGRATION_NAME = 'Microsoft Azure AD Connect Health Feed' + + +class Client(BaseClient): + """ + Client to use in the Microsoft Azure Feed integration. Overrides BaseClient. + """ + + def __init__(self, base_url: str, verify: bool = False, proxy: bool = False): + """ + Implements class for Microsoft Azure feeds. + :param url: the Azure endpoint URL + :verify: boolean, if *false* feed HTTPS server certificate is verified. Default: *false* + :param proxy: boolean, if *false* feed HTTPS server certificate will not use proxies. Default: *false* + """ + super().__init__(base_url, verify=verify, proxy=proxy) + + def build_iterator(self) -> List: + """Retrieves all entries from the feed. + Returns: + A list of objects, containing the indicators. + """ + result = [] + r = self._http_request('GET', url_suffix='', full_url=self._base_url, resp_type='text') + + soup = BeautifulSoup(r, 'html.parser') + + pattern = re.compile("(https?:\/\/|\*\.)(\w+\.|\w+-\w+\.){1,3}\w{2,3}") + scraped_indicators = list(set([pattern.match(cell.text).group(0) for cell in soup.select( # type: ignore # noqa + "tbody tr td li") if pattern.match(cell.text)])) + for indicator in scraped_indicators: + result.append({ + 'value': indicator, + 'type': FeedIndicatorType.DomainGlob if '*' in indicator else FeedIndicatorType.URL, + 'FeedURL': self._base_url + }) + + return result + + +def test_module(client: Client, *_) -> Tuple[str, Dict[Any, Any], Dict[Any, Any]]: + """Builds the iterator to check that the feed is accessible. + Args: + client: Client object. + Returns: + Outputs. + """ + client.build_iterator() + return 'ok', {}, {} + + +def fetch_indicators(client: Client, feed_tags: List = [], limit: int = -1) -> List[Dict]: + """Retrieves indicators from the feed + Args: + client (Client): Client object with request + feed_tags (list): tags to assign fetched indicators + limit (int): limit the results + Returns: + Indicators. + """ + iterator = client.build_iterator() + indicators = [] + if limit > 0: + iterator = iterator[:limit] + for item in iterator: + value = item.get('value') + type_ = item.get('type', FeedIndicatorType.Domain) + raw_data = { + 'value': value, + 'type': type_, + } + for key, val in item.items(): + raw_data.update({key: val}) + indicator_obj = { + 'value': value, + 'type': type_, + 'service': 'Azure AD Connect Health Feed', + 'rawJSON': raw_data, + } + if feed_tags: + indicator_obj['fields'] = { + 'tags': feed_tags + } + indicators.append(indicator_obj) + return indicators + + +def get_indicators_command(client: Client, + params: Dict[str, str], + args: Dict[str, str] + ) -> Tuple[str, Dict[Any, Any], Dict[Any, Any]]: + """Wrapper for retrieving indicators from the feed to the war-room. + Args: + client: Client object with request + params: demisto.params() + args: demisto.args() + Returns: + Outputs. + """ + feed_tags = argToList(params.get('feedTags', '')) + limit = int(args.get('limit', '10')) + indicators = fetch_indicators(client, feed_tags, limit) + human_readable = tableToMarkdown('Indicators from Microsoft Azure Feed:', indicators, + headers=['value', 'type'], removeNull=True) + + return human_readable, {}, {'raw_response': indicators} + + +def fetch_indicators_command(client: Client, params: Dict[str, str]) -> List[Dict]: + """Wrapper for fetching indicators from the feed to the Indicators tab. + Args: + client: Client object with request + params: demisto.params() + Returns: + Indicators. + """ + feed_tags = argToList(params.get('feedTags', '')) + indicators = fetch_indicators(client, feed_tags) + return indicators + + +def main(): + """ + PARSE AND VALIDATE INTEGRATION PARAMS + """ + params = demisto.params() + base_url = params.get('url') + insecure = not params.get('insecure', False) + proxy = params.get('proxy', False) + + command = demisto.command() + demisto.info(f'Command being called in {INTEGRATION_NAME} is {command}') + + try: + client = Client( + base_url=base_url, + verify=insecure, + proxy=proxy, + ) + + commands: Dict[ + str, Callable[[Client, Dict[str, str], Dict[str, str]], Tuple[str, Dict[Any, Any], Dict[Any, Any]]] + ] = { + 'test-module': test_module, + 'azure-ad-health-get-indicators': get_indicators_command + } + if command in commands: + return_outputs(*commands[command](client, demisto.params(), demisto.args())) + + elif command == 'fetch-indicators': + indicators = fetch_indicators_command(client, demisto.params()) + for iter_ in batch(indicators, batch_size=2000): + demisto.createIndicators(iter_) + + else: + raise NotImplementedError(f'Command {command} is not implemented.') + + except Exception as err: + err_msg = f'Error in {INTEGRATION_NAME} Integration. [{err}]' + return_error(err_msg) + + +if __name__ in ['__main__', 'builtin', 'builtins']: + main() diff --git a/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed.yml b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed.yml new file mode 100644 index 00000000000..8529683f0b6 --- /dev/null +++ b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed.yml @@ -0,0 +1,103 @@ +commonfields: + id: Azure AD Connect Health Feed + version: -1 +fromversion: 5.5.0 +name: Azure AD Connect Health Feed +display: Azure AD Connect Health Feed +category: Data Enrichment & Threat Intelligence +description: Use the Microsoft Azure AD Connect Health Feed integration to get indicators + from the feed. +configuration: +- display: Fetch indicators + name: feed + defaultvalue: "true" + type: 8 + required: false +- display: Indicator Reputation + name: feedReputation + defaultvalue: Good + type: 18 + required: false + options: + - None + - Good + - Suspicious + - Bad + additionalinfo: Indicators from this integration instance will be marked with this + reputation +- display: Source Reliability + name: feedReliability + defaultvalue: F - Reliability cannot be judged + type: 15 + required: true + options: + - A - Completely reliable + - B - Usually reliable + - C - Fairly reliable + - D - Not usually reliable + - E - Unreliable + - F - Reliability cannot be judged + additionalinfo: Reliability of the source providing the intelligence data +- display: "" + name: feedExpirationPolicy + defaultvalue: suddenDeath + type: 17 + required: false + options: + - never + - interval + - indicatorType + - suddenDeath +- display: "" + name: feedExpirationInterval + defaultvalue: "20160" + type: 1 + required: false +- display: Feed Fetch Interval + name: feedFetchInterval + defaultvalue: "30" + type: 19 + required: false +- display: The Microsoft Azure endpoint URL + name: url + defaultvalue: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-agent-install#outbound-connectivity-to-the-azure-service-endpoints + type: 0 + required: true +- display: Tags + name: feedTags + defaultvalue: "" + type: 0 + required: false + additionalinfo: Supports CSV values. +- display: Bypass exclusion list + name: feedBypassExclusionList + defaultvalue: "true" + type: 8 + required: false + additionalinfo: When selected, the exclusion list is ignored for indicators from + this feed. This means that if an indicator from this feed is on the exclusion + list, the indicator might still be added to the system. +- display: Trust any certificate (not secure) + name: insecure + defaultvalue: "" + type: 8 + required: false +- display: Use system proxy settings + name: proxy + defaultvalue: "" + type: 8 + required: false +script: + script: '' + type: python + commands: + - name: azure-ad-health-get-indicators + arguments: + - name: limit + description: The maximum number of results to return. The default value is 10. + defaultValue: "0" + description: Gets indicators from the feed. + dockerimage: demisto/btfl-soup:1.0.1.9249 + feed: true + runonce: false + subtype: python3 diff --git a/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed_description.md b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed_description.md new file mode 100644 index 00000000000..26626ccb5c1 --- /dev/null +++ b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed_description.md @@ -0,0 +1,12 @@ +## Microsoft Azure AD Connect Health web scraper: +https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-agent-install#outbound-connectivity-to-the-azure-service-endpoints + +NOTE: As we scrape this page, we can not ensure the integrity of the fetched indicators upon a change in the source webpage. + +Most IT services are moving from on-premise solutions to cloud-based solutions. The public IP addresses, domains, and URLs that function as the endpoints for these solutions are very often not fixed, and the providers of the service publish their details on their websites in a less than ideal format (i.e.: HTML) rather than through a proper REST API (i.e.: JSON). + +This fact makes it very difficult for IT and Security teams to provide these services with an appropriate level of security and automation. Any changes in the HTML schema of the provider website, will break the automation and has the potential to cause serious disruption to the users and the business. The alternative is to compromise on the security posture of the organization. + +One example of these providers is Microsoft, and an example of their services is Microsoft Azure AD Connect Health. + +The goal of this pack is to address this issue by automating the collection of endpoint data in the form of an indicator feed. This will facilitate validation of the indicators before using them in enforcement points, for example firewalls, proxies, and more. diff --git a/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed_image.png b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed_image.png new file mode 100644 index 00000000000..9164d824b4b Binary files /dev/null and b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/AzureADConnectHealthFeed_image.png differ diff --git a/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/FeedAzureADConnectHealth_test.py b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/FeedAzureADConnectHealth_test.py new file mode 100644 index 00000000000..a6c2db613be --- /dev/null +++ b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/FeedAzureADConnectHealth_test.py @@ -0,0 +1,22 @@ +from AzureADConnectHealthFeed import Client + + +URL = 'https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-agent-install#outbound-connectivity-to-the-azure-service-endpoints' # noqa + + +def test_build_iterator(requests_mock): + with open('test_data/Microsoft_endpoint_mock.html', 'r') as file: + response = file.read() + requests_mock.get(URL, text=response) + expected_url = 'https://login.microsoftonline.com' + expected_domain_glob = '*.blob.core.windows.net' + client = Client( + base_url=URL, + verify=False, + proxy=False, + ) + indicators = client.build_iterator() + url_indicators = {indicator['value'] for indicator in indicators if indicator['type'] == 'URL'} + domain_glob_indicators = {indicator['value'] for indicator in indicators if indicator['type'] == 'DomainGlob'} + assert expected_url in url_indicators + assert expected_domain_glob in domain_glob_indicators diff --git a/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/README.md b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/README.md new file mode 100644 index 00000000000..5190f7f2bf4 --- /dev/null +++ b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/README.md @@ -0,0 +1,61 @@ +Use the Microsoft Azure AD Connect Health Feed integration to get indicators from the feed. +This integration was integrated and tested with version 1 of Azure AD Connect Health Feed +## Configure Azure AD Connect Health Feed on Cortex XSOAR + +1. Navigate to **Settings** > **Integrations** > **Servers & Services**. +2. Search for Azure AD Connect Health Feed. +3. Click **Add instance** to create and configure a new integration instance. + +| **Parameter** | **Description** | **Required** | +| --- | --- | --- | +| feed | Fetch indicators | False | +| feedReputation | Indicator Reputation | False | +| feedReliability | Source Reliability | True | +| feedExpirationPolicy | | False | +| feedExpirationInterval | | False | +| feedFetchInterval | Feed Fetch Interval | False | +| url | The Microsoft Azure endpoint URL | True | +| feedTags | Tags | False | +| feedBypassExclusionList | Bypass exclusion list | False | +| insecure | Trust any certificate \(not secure\) | False | +| proxy | Use system proxy settings | False | + +4. Click **Test** to validate the URLs, token, and connection. +## Commands +You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. +After you successfully execute a command, a DBot message appears in the War Room with the command details. +### azure-ad-health-get-indicators +*** +Gets indicators from the feed. + + +#### Base Command + +`azure-ad-health-get-indicators` +#### Input + +| **Argument Name** | **Description** | **Required** | +| --- | --- | --- | +| limit | The maximum number of results to return. The default value is 10. | Optional | + + +#### Context Output + +There is no context output for this command. + +#### Command Example +```!azure-ad-health-get-indicators``` + +#### Context Example +``` +{} +``` + +#### Human Readable Output + +>### Indicators from Microsoft Azure Feed: +>|value|type| +>|---|---| +>| https://login.microsoftonline.com | URL | +>| https://secure.aadcdn.microsoftonline-p.com | URL | +>| https://login.windows.net | URL | diff --git a/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/command_examples.txt b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/command_examples.txt new file mode 100644 index 00000000000..6a77cb5c837 --- /dev/null +++ b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/command_examples.txt @@ -0,0 +1 @@ +!azure-ad-health-get-indicators diff --git a/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/test_data/Microsoft_endpoint_mock.html b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/test_data/Microsoft_endpoint_mock.html new file mode 100644 index 00000000000..715f11d7dc6 --- /dev/null +++ b/Packs/FeedAzureADConnectHealth/Integrations/AzureADConnectHealthFeed/test_data/Microsoft_endpoint_mock.html @@ -0,0 +1,1047 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Azure AD Connect Health Agent installation | Microsoft Docs + + + + + + + + + + + + + + + + +
    + Skip to main content +
    +
    +
    + +
    + +
    + + +
    +
    +
    +
    +
    +
    +
    +
    +
    + +
    + +
    +
    + +
    +
    + + + +
    + +
    +
    +
    + +
    +
    + +
    + +
    + +
    + +
    + +
    +
    + + +
    + +
    + + + +

    Azure AD Connect Health Agent Installation

    + + + + + + +

    This document walks you through installing and configuring the Azure AD Connect Health Agents. You can download the agents from here.

    +

    Requirements

    +

    The following table is a list of requirements for using Azure AD Connect Health.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    RequirementDescription
    Azure AD PremiumAzure AD Connect Health is an Azure AD Premium feature and requires Azure AD Premium.

    For more information, see Getting started with Azure AD Premium
    To start a free 30-day trial, see Start a trial.
    You must be a global administrator of your Azure AD to get started with Azure AD Connect HealthBy default, only the global administrators can install and configure the health agents to get started, access the portal, and perform any operations within Azure AD Connect Health. For more information, see Administering your Azure AD directory.

    Using Role Based Access Control you can allow access to Azure AD Connect Health to other users in your organization. For more information, see Role Based Access Control for Azure AD Connect Health.

    Important: The account used when installing the agents must be a work or school account. It cannot be a Microsoft account. For more information, see Sign up for Azure as an organization
    Azure AD Connect Health Agent is installed on each targeted serverAzure AD Connect Health requires the Health Agents to be installed and configured on targeted servers to receive the data and provide the Monitoring and Analytics capabilities.

    For example, to get data from your AD FS infrastructure, the agent must be installed on the AD FS and Web Application Proxy servers. Similarly, to get data on your on-premises AD DS infrastructure, the agent must be installed on the domain controllers.

    Outbound connectivity to the Azure service endpointsDuring installation and runtime, the agent requires connectivity to Azure AD Connect Health service endpoints. If outbound connectivity is blocked using Firewalls, ensure that the following endpoints are added to the allowed list. See outbound connectivity endpoints
    Outbound connectivity based on IP AddressesFor IP address based filtering on firewalls, refer to the Azure IP Ranges.
    TLS Inspection for outbound traffic is filtered or disabledThe agent registration step or data upload operations may fail if there is TLS inspection or termination for outbound traffic at the network layer. Read more about how to setup TLS inspection
    Firewall ports on the server running the agentThe agent requires the following firewall ports to be open in order for the agent to communicate with the Azure AD Health service endpoints.

  1. TCP port 443
  2. TCP port 5671

    3. Note that port 5671 is no longer required for the latest version of agent. Upgrade to the latest version so only port 443 is required. Read more about enable firewall ports
    Allow the following websites if IE Enhanced Security is enabledIf IE Enhanced Security is enabled, then the following websites must be allowed on the server that is going to have the agent installed.

  3. https://login.microsoftonline.com
  4. https://secure.aadcdn.microsoftonline-p.com
  5. https://login.windows.net
  6. https://aadcdn.msftauth.net
  7. The federation server for your organization trusted by Azure Active Directory. For example: https://sts.contoso.com
    8. Read more about how to configure IE. In case you have a proxy within your network , please see note below.
    Ensure PowerShell v4.0 or newer is installed
  8. Windows Server 2008 R2 ships with PowerShell v2.0, which is insufficient for the agent. Update PowerShell as explained below under Agent installation on Windows Server 2008 R2 Servers.
  9. Windows Server 2012 ships with PowerShell v3.0, which is insufficient for the agent. Update the Windows Management Framework.
  10. Windows Server 2012 R2 and later ship with a sufficiently recent version of PowerShell.
    11. Disable FIPSFIPS is not supported by Azure AD Connect Health agents.
    +
    +

    Note

    +

    If you have a highly locked-down and extremely restricted environment, you would require to whitelist the URLs mentioned in the Service endpoint lists below in addition to the ones listed in the Allowed IE enhanced Security configuration above.

    +
    +

    Outbound connectivity to the Azure service endpoints

    +

    During installation and runtime, the agent requires connectivity to Azure AD Connect Health service endpoints. If outbound connectivity is blocked using Firewalls, make sure that the following URLs are not blocked by default. Do not disable security monitoring or inspection of these URLs, but allow them as you would other internet traffic. They permit communication with Azure AD Connect Health service endpoints. Learn how to check outbound connectivity with Test-AzureADConnectHealthConnectivity.

    + + + + + + + + + + + + + + + + + + + + + +
    Domain EnvironmentRequired Azure service endpoints
    General Public
  11. *.blob.core.windows.net
  12. *.aadconnecthealth.azure.com
  13. *.servicebus.windows.net - Port: 5671
  14. *.adhybridhealth.azure.com/
  15. https://management.azure.com
  16. https://policykeyservice.dc.ad.msft.net/
  17. https://login.windows.net
  18. https://login.microsoftonline.com
  19. https://secure.aadcdn.microsoftonline-p.com
  20. https://www.office.com *this endpoint is only used for discovery purposes during registration.
    21. Azure Germany
  21. *.blob.core.cloudapi.de
  22. *.servicebus.cloudapi.de
  23. *.aadconnecthealth.microsoftazure.de
  24. https://management.microsoftazure.de
  25. https://policykeyservice.aadcdi.microsoftazure.de
  26. https://login.microsoftonline.de
  27. https://secure.aadcdn.microsoftonline-p.de
  28. https://www.office.de *this endpoint is only used for discovery purposes during registration.
    29. Azure Government
  29. *.blob.core.usgovcloudapi.net
  30. *.servicebus.usgovcloudapi.net
  31. *.aadconnecthealth.microsoftazure.us
  32. https://management.usgovcloudapi.net
  33. https://policykeyservice.aadcdi.azure.us
  34. https://login.microsoftonline.us
  35. https://secure.aadcdn.microsoftonline-p.com
  36. https://www.office.com *this endpoint is only used for discovery purposes during registration.
    37. +

    Download and install the Azure AD Connect Health Agent

    + +

    Installing the Azure AD Connect Health Agent for AD FS

    +
    +

    Note

    +

    AD FS server should be different from your Sync server. Do not install AD FS agent to your Sync server.

    +
    +

    Before installation, make sure your AD FS server host name is unique and not present in the AD FS service. +To start the agent installation, double-click the .exe file that you downloaded. On the first screen, click Install.

    +

    Verify Azure AD Connect Health

    +

    Once the installation is finished, click Configure Now.

    +

    Verify Azure AD Connect Health

    +

    This launches a PowerShell window to initiate the agent registration process. When prompted, sign in with an Azure AD account that has access to perform agent registration. By default the Global Admin account has access.

    +

    Verify Azure AD Connect Health

    +

    After signing in, PowerShell will continue. Once it completes, you can close PowerShell and the configuration is complete.

    +

    At this point, the agent services should be started automatically allowing the agent upload the required data to the cloud service in a secure manner.

    +

    If you have not met all the pre-requisites outlined in the previous sections, warnings appear in the PowerShell window. Be sure to complete the requirements before installing the agent. The following screenshot is an example of these errors.

    +

    Verify Azure AD Connect Health

    +

    To verify the agent has been installed, look for the following services on the server. If you completed the configuration, they should already be running. Otherwise, they are stopped until the configuration is complete.

    +
      +
    • Azure AD Connect Health AD FS Diagnostics Service
      • +
    • Azure AD Connect Health AD FS Insights Service
      • +
    • Azure AD Connect Health AD FS Monitoring Service
      • +
    +

    Verify Azure AD Connect Health

    +

    Agent installation on Windows Server 2008 R2 Servers

    +

    Steps for Windows Server 2008 R2 servers:

    +
      +
    1. Ensure that the server is running at Service Pack 1 or higher.
      2. +
    2. Turn off IE ESC for agent installation:
      3. +
    3. Install Windows PowerShell 4.0 on each of the servers ahead of installing the AD Health agent. To install Windows PowerShell 4.0: +
        +
      • Install Microsoft .NET Framework 4.5 using the following link to download the offline installer.
        • +
      • Install PowerShell ISE (From Windows Features)
        • +
      • Install the Windows Management Framework 4.0.
        • +
      • Install Internet Explorer version 10 or above on the server. (Required by the Health Service to authenticate, using your Azure Admin credentials.)
        • +
      +
      4. +
    4. For more information on installing Windows PowerShell 4.0 on Windows Server 2008 R2, see the wiki article here.
      5. +
    +

    Enable Auditing for AD FS

    +
    +

    Note

    +

    This section only applies to AD FS servers. You do not have to follow these steps on the Web Application Proxy Servers.

    +
    +

    In order for the Usage Analytics feature to gather and analyze data, the Azure AD Connect Health agent needs the information in the AD FS Audit Logs. These logs are not enabled by default. Use the following procedures to enable AD FS auditing and to locate the AD FS audit logs, on your AD FS servers.

    +

    To enable auditing for AD FS on Windows Server 2008 R2

    +
      +
    1. Click Start, point to Programs, point to Administrative Tools, and then click Local Security Policy.
      2. +
    2. Navigate to the Security Settings\Local Policies\User Rights Assignment folder, and then double-click Generate security audits.
      3. +
    3. On the Local Security Setting tab, verify that the AD FS 2.0 service account is listed. If it is not present, click Add User or Group and add it to the list, and then click OK.
      4. +
    4. To enable auditing, open a Command Prompt with elevated privileges and run the following command: auditpol.exe /set /subcategory:{0CCE9222-69AE-11D9-BED3-505054503030} /failure:enable /success:enable
      5. +
    5. Close Local Security Policy. +
      -- The following steps are only required for primary AD FS servers. --
      6. +
    6. Open the AD FS Management snap-in. To open the AD FS Management snap-in, click Start, point to Programs, point to Administrative Tools, and then click AD FS 2.0 Management.
      7. +
    7. In the Actions pane, click Edit Federation Service Properties.
      8. +
    8. In the Federation Service Properties dialog box, click the Events tab.
      9. +
    9. Select the Success audits and Failure audits check boxes.
      10. +
    10. Click OK.
      11. +
    +

    To enable auditing for AD FS on Windows Server 2012 R2

    +
      +
    1. Open Local Security Policy by opening Server Manager on the Start screen, or Server Manager in the taskbar on the desktop, then click Tools/Local Security Policy.
      2. +
    2. Navigate to the Security Settings\Local Policies\User Rights Assignment folder, and then double-click Generate security audits.
      3. +
    3. On the Local Security Setting tab, verify that the AD FS service account is listed. If it is not present, click Add User or Group and add it to the list, and then click OK.
      4. +
    4. To enable auditing, open a command prompt with elevated privileges and run the following command: auditpol.exe /set /subcategory:{0CCE9222-69AE-11D9-BED3-505054503030} /failure:enable /success:enable
      5. +
    5. Close Local Security Policy. +
      -- The following steps are only required for primary AD FS servers. --
      6. +
    6. Open the AD FS Management snap-in (in Server Manager, click Tools, and then select AD FS Management).
      7. +
    7. In the Actions pane, click Edit Federation Service Properties.
      8. +
    8. In the Federation Service Properties dialog box, click the Events tab.
      9. +
    9. Select the Success audits and Failure audits check boxes and then click OK.
      10. +
    +

    To enable auditing for AD FS on Windows Server 2016

    +
      +
    1. Open Local Security Policy by opening Server Manager on the Start screen, or Server Manager in the taskbar on the desktop, then click Tools/Local Security Policy.
      2. +
    2. Navigate to the Security Settings\Local Policies\User Rights Assignment folder, and then double-click Generate security audits.
      3. +
    3. On the Local Security Setting tab, verify that the AD FS service account is listed. If it is not present, click Add User or Group and add the AD FS service account to the list, and then click OK.
      4. +
    4. To enable auditing, open a command prompt with elevated privileges and run the following command: auditpol.exe /set /subcategory:{0CCE9222-69AE-11D9-BED3-505054503030} /failure:enable /success:enable
      5. +
    5. Close Local Security Policy. +
      -- The following steps are only required for primary AD FS servers. --
      6. +
    6. Open the AD FS Management snap-in (in Server Manager, click Tools, and then select AD FS Management).
      7. +
    7. In the Actions pane, click Edit Federation Service Properties.
      8. +
    8. In the Federation Service Properties dialog box, click the Events tab.
      9. +
    9. Select the Success audits and Failure audits check boxes and then click OK. This should be enabled by default.
      10. +
    10. Open a PowerShell window and run the following command: Set-AdfsProperties -AuditLevel Verbose.
      11. +
    +

    Note that "basic" audit level is enabled by default. Read more about the AD FS Audit enhancement in Windows Server 2016

    +

    To locate the AD FS audit logs

    +
      +

    1. Open Event Viewer.

      +
      2. +

    2. Go to Windows Logs and select Security.

      +
      3. +

    3. On the right, click Filter Current Logs.

      +
      4. +

    4. Under Event Source, select AD FS Auditing.

      +

      And quick FAQ note for Audit logs.

      +
      5. +
    +

    AD FS audit logs

    +
    +

    Warning

    +

    A group policy can disable AD FS auditing. If AD FS auditing is disabled, usage analytics about login activities are not available. Ensure that you don’t have a group policy that disables AD FS auditing.>

    +
    +

    Installing the Azure AD Connect Health agent for sync

    +

    The Azure AD Connect Health agent for sync is installed automatically in the latest build of Azure AD Connect. To use Azure AD Connect for sync, you need to download the latest version of Azure AD Connect and install it. You can download the latest version here.

    +

    To verify the agent has been installed, look for the following services on the server. If you completed the configuration, they should already be running. Otherwise, they are stopped until the configuration is complete.

    +
      +
    • Azure AD Connect Health Sync Insights Service
      • +
    • Azure AD Connect Health Sync Monitoring Service
      • +
    +

    Verify Azure AD Connect Health for Sync

    +
    +

    Note

    +

    Remember that using Azure AD Connect Health requires Azure AD Premium. If you do not have Azure AD Premium, you are unable to complete the configuration in the Azure portal. For more information, see the requirements page.

    +
    +

    Manual Azure AD Connect Health for Sync registration

    +

    If the Azure AD Connect Health for Sync agent registration fails after successfully installing Azure AD Connect, you can use the following PowerShell command to manually register the agent.

    +
    +

    Important

    +

    Using this PowerShell command is only required if the agent registration fails after installing Azure AD Connect.

    +
    +

    The following PowerShell command is required ONLY when the health agent registration fails even after a successful installation and configuration of Azure AD Connect. The Azure AD Connect Health services will start after the agent has been successfully registered.

    +

    You can manually register the Azure AD Connect Health agent for sync using the following PowerShell command:

    +

    Register-AzureADConnectHealthSyncAgent -AttributeFiltering $false -StagingMode $false

    +

    The command takes following parameters:

    +
      +
    • AttributeFiltering: $true (default) - if Azure AD Connect is not syncing the default attribute set and has been customized to use a filtered attribute set. $false otherwise.
      • +
    • StagingMode: $false (default) - if the Azure AD Connect server is NOT in staging mode, $true if the server is configured to be in staging mode.
      • +
    +

    When prompted for authentication you should use the same global admin account (such as admin@domain.onmicrosoft.com) that was used for configuring Azure AD Connect.

    +

    Installing the Azure AD Connect Health Agent for AD DS

    +

    To start the agent installation, double-click the .exe file that you downloaded. On the first screen, click Install.

    +

    Verify Azure AD Connect Health

    +

    Once the installation is finished, click Configure Now.

    +

    Verify Azure AD Connect Health

    +

    A command prompt is launched, followed by some PowerShell that executes Register-AzureADConnectHealthADDSAgent. When prompted to sign in to Azure, go ahead and sign in.

    +

    Verify Azure AD Connect Health

    +

    After signing in, PowerShell will continue. Once it completes, you can close PowerShell and the configuration is complete.

    +

    At this point, the services should be started automatically allowing the agent to monitor and gather data. If you have not met all the pre-requisites outlined in the previous sections, warnings appear in the PowerShell window. Be sure to complete the requirements before installing the agent. The following screenshot is an example of these errors.

    +

    Verify Azure AD Connect Health for AD DS

    +

    To verify the agent has been installed, look for the following services on the domain controller.

    +
      +
    • Azure AD Connect Health AD DS Insights Service
      • +
    • Azure AD Connect Health AD DS Monitoring Service
      • +
    +

    If you completed the configuration, these services should already be running. Otherwise, they are stopped until the configuration is complete.

    +

    Verify Azure AD Connect Health

    +

    Quick agent installation in multiple servers

    +
      +
    1. Create a user account in Azure AD with a password.
      2. +
    2. Assign the Owner role for this local AAD account in Azure AD Connect Health via the portal. Follow the steps here. Assign the role to all service instances.
      3. +
    3. Download the .exe MSI file in local domain controller for installation.
      4. +
    4. Run the following script to registration. Replace the parameters with the new user account created and its password.
      5. +
    +
    AdHealthAddsAgentSetup.exe /quiet
+Start-Sleep 30
+$userName = "NEWUSER@DOMAIN"
+$secpasswd = ConvertTo-SecureString "PASSWORD" -AsPlainText -Force
+$myCreds = New-Object System.Management.Automation.PSCredential ($userName, $secpasswd)
+import-module "C:\Program Files\Azure Ad Connect Health Adds Agent\PowerShell\AdHealthAdds"
+ 
+Register-AzureADConnectHealthADDSAgent -Credential $myCreds
+
+
    +
      +
    1. Once you are done, you can remove access for the local account by doing one or more of the following: +
        +
      • Remove the role assignment for the local account for AAD Connect Health
        • +
      • Rotate the password for the local account.
        • +
      • Disable the AAD local account
        • +
      • Delete the AAD local account
        • +
      +
      2. +
    +

    Agent Registration using PowerShell

    +

    After installing the appropriate agent setup.exe, you can perform the agent registration step using the following PowerShell commands depending on the role. Open a PowerShell Window and execute the appropriate command:

    +
        Register-AzureADConnectHealthADFSAgent
+    Register-AzureADConnectHealthADDSAgent
+    Register-AzureADConnectHealthSyncAgent
+
+
    +

    These commands accept "Credential" as a parameter to complete the registration in a non-interactive manner or on a Server-Core machine.

    +
      +
    • The Credential can be captured in a PowerShell variable that is passed as a parameter.
      • +
    • You can provide any Azure AD Identity that has access to register the agents and does NOT have MFA enabled.
      • +
    • By default Global Admins have access to perform agent registration. You can also allow other less privileged identities to perform this step. Read more about Role Based Access Control.
      • +
    +
        $cred = Get-Credential
+    Register-AzureADConnectHealthADFSAgent -Credential $cred
+
+
    +

    Configure Azure AD Connect Health Agents to use HTTP Proxy

    +

    You can configure Azure AD Connect Health Agents to work with an HTTP Proxy.

    +
    +

    Note

    +
      +
    • Using “Netsh WinHttp set ProxyServerAddress” is not supported as the agent uses System.Net to make web requests instead of Microsoft Windows HTTP Services.
      • +
    • The configured Http Proxy address is used to pass-through encrypted Https messages.
      • +
    • Authenticated proxies (using HTTPBasic) are not supported.
      • +
    +
    +

    Change Health Agent Proxy Configuration

    +

    You have the following options to configure Azure AD Connect Health Agent to use an HTTP Proxy.

    +
    +

    Note

    +

    All Azure AD Connect Health Agent services must be restarted, in order for the proxy settings to be updated. Run the following command:
    +Restart-Service AzureADConnectHealth*

    +
    +

    Import existing proxy Settings

    +
    Import from Internet Explorer
    +

    Internet Explorer HTTP proxy settings can be imported, to be used by the Azure AD Connect Health Agents. On each of the servers running the Health agent, execute the following PowerShell command:

    +
    Set-AzureAdConnectHealthProxySettings -ImportFromInternetSettings
+
    +
    Import from WinHTTP
    +

    WinHTTP proxy settings can be imported, to be used by the Azure AD Connect Health Agents. On each of the servers running the Health agent, execute the following PowerShell command:

    +
    Set-AzureAdConnectHealthProxySettings -ImportFromWinHttp
+
    +

    Specify Proxy addresses manually

    +

    You can manually specify a proxy server on each of the servers running the Health Agent, by executing the following PowerShell command:

    +
    Set-AzureAdConnectHealthProxySettings -HttpsProxyAddress address:port
+
    +

    Example: Set-AzureAdConnectHealthProxySettings -HttpsProxyAddress myproxyserver: 443

    +
      +
    • "address" can be a DNS resolvable server name or an IPv4 address
      • +
    • "port" can be omitted. If omitted then 443 is chosen as default port.
      • +
    +

    Clear existing proxy configuration

    +

    You can clear the existing proxy configuration by running the following command:

    +
    Set-AzureAdConnectHealthProxySettings -NoProxy
+
    +

    Read current proxy settings

    +

    You can read the currently configured proxy settings by running the following command:

    +
    Get-AzureAdConnectHealthProxySettings
+
    +

    Test Connectivity to Azure AD Connect Health Service

    +

    It is possible that issues may arise that cause the Azure AD Connect Health agent to lose connectivity with the Azure AD Connect Health service. These include network issues, permission issues, or various other reasons.

    +

    If the agent is unable to send data to the Azure AD Connect Health service for longer than two hours, it is indicated with the following alert in the portal: "Health Service data is not up to date." You can confirm if the affected Azure AD Connect Health agent is able to upload data to the Azure AD Connect Health service by running the following PowerShell command:

    +
    Test-AzureADConnectHealthConnectivity -Role ADFS
+
    +

    The role parameter currently takes the following values:

    +
      +
    • ADFS
      • +
    • Sync
      • +
    • ADDS
      • +
    +
    +

    Note

    +

    To use the connectivity tool, you must first complete the agent registration. If you are not able to complete the agent registration, make sure that you have met all the requirements for Azure AD Connect Health. This connectivity test is performed by default during agent registration.

    +
    + + + + + +
    + + + + + + + + +
    + + +
    + + + + + + + + + + + +
    + +
    +
    + + + + +
    + + +
    + + +
    + + +
    + +
    + +
    + +
    + +
    + + diff --git a/Packs/RedLock/README.md b/Packs/FeedAzureADConnectHealth/README.md similarity index 100% rename from Packs/RedLock/README.md rename to Packs/FeedAzureADConnectHealth/README.md diff --git a/Packs/FeedAzureADConnectHealth/TestPlaybooks/FeedAzureADConnectHealth_Test.yml b/Packs/FeedAzureADConnectHealth/TestPlaybooks/FeedAzureADConnectHealth_Test.yml new file mode 100644 index 00000000000..93405d974af --- /dev/null +++ b/Packs/FeedAzureADConnectHealth/TestPlaybooks/FeedAzureADConnectHealth_Test.yml @@ -0,0 +1,96 @@ +id: FeedAzureADConnectHealth_Test +name: FeedAzureADConnectHealth_Test +description: test playbbof for FeedAzureADConnectHealth +version: -1 +fromversion: 5.5.0 +starttaskid: '0' +tasks: + '0': + id: '0' + taskid: '0' + type: start + task: + id: '0' + version: -1 + name: '' + iscommand: false + brand: '' + description: '' + nexttasks: + '#none#': + - '1' + separatecontext: false + view: '{"position": {"x": 50, "y": 50}}' + note: false + timertriggers: [] + ignoreworker: false + "1": + id: "1" + taskid: 66679745-8641-4210-8346-8ee4bddb40c7 + type: regular + task: + id: 66679745-8641-4210-8346-8ee4bddb40c7 + version: -1 + name: DeleteContext + description: '' + script: DeleteContext + type: regular + iscommand: true + brand: '' + nexttasks: + '#none#': + - '2' + scriptarguments: + all: + simple: yes + separatecontext: false + view: '{"position": {"x": 50, "y": 200}}' + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + "2": + id: "2" + taskid: f552224e-3b19-4897-8fe3-0b280e1887ae + type: regular + task: + id: f552224e-3b19-4897-8fe3-0b280e1887ae + version: -1 + name: azure-ad-health-get-indicators + description: '' + script: '|||azure-ad-health-get-indicators' + type: regular + iscommand: true + brand: '' + nexttasks: + '#none#': + - '3' + scriptarguments: {} + separatecontext: false + view: '{"position": {"x": 50, "y": 400}}' + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + "3": + id: "3" + taskid: f522224e-3b19-4897-8fe3-0b280e1887ae + type: title + task: + id: f522224e-3b19-4897-8fe3-0b280e1887ae + version: -1 + name: Test Done + type: title + iscommand: false + brand: '' + description: '' + separatecontext: false + view: '{"position": {"x": 50, "y": 600}}' + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false +view: '{"linkLabelsPosition": {}, "paper": {"dimensions": {"height": 200, "width": + 380, "x": 50, "y": 50}}}' +inputs: [] +outputs: [] diff --git a/Packs/FeedAzureADConnectHealth/pack_metadata.json b/Packs/FeedAzureADConnectHealth/pack_metadata.json new file mode 100644 index 00000000000..4e01b261a04 --- /dev/null +++ b/Packs/FeedAzureADConnectHealth/pack_metadata.json @@ -0,0 +1,19 @@ +{ + "name": "Microsoft Azure AD Connect Health Feed", + "description": "Indicator feed from Microsoft Azure AD Connect Health endpoints, fetching URLs and DomainGlobs used by Azure AD, with which you can create a list (allowlist, EDL, etc.) for your SIEM or firewall service to ingest and apply to its policy rules.", + "support": "xsoar", + "currentVersion": "1.0.0", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-06-04T05:07:23Z", + "categories": [ + "Data Enrichment & Threat Intelligence" + ], + "tags": [], + "useCases": [], + "keywords": [ + "Azure", + "Feed" + ] +} \ No newline at end of file diff --git a/Packs/FeedCSV/Integrations/FeedCSV/FeedCSV.py b/Packs/FeedCSV/Integrations/FeedCSV/FeedCSV.py index 6bbc06bce17..f6003ee829e 100644 --- a/Packs/FeedCSV/Integrations/FeedCSV/FeedCSV.py +++ b/Packs/FeedCSV/Integrations/FeedCSV/FeedCSV.py @@ -1,9 +1,20 @@ +import demistomock as demisto +from CommonServerPython import * + + def main(): + params = demisto.params() + # when auto_detect is not selected + if params.get('auto_detect_type') is False and not params.get('indicator_type'): + return_error('Indicator Type cannot be empty when Auto Detect Indicator Type is unchecked') + # when auto_detect does not exist - for previous integration instances + if params.get('auto_detect_type') is None and not params.get('indicator_type'): + return_error('Indicator Type cannot be empty') feed_main('CSV', prefix='csv') from CSVFeedApiModule import * # noqa: E402 -if __name__ == '__builtin__' or __name__ == 'builtins': +if __name__ in ('__builtin__', 'builtins', '__main__'): main() diff --git a/Packs/FeedCSV/Integrations/FeedCSV/FeedCSV.yml b/Packs/FeedCSV/Integrations/FeedCSV/FeedCSV.yml index 68c527f0076..6d4cec107c1 100644 --- a/Packs/FeedCSV/Integrations/FeedCSV/FeedCSV.yml +++ b/Packs/FeedCSV/Integrations/FeedCSV/FeedCSV.yml @@ -61,7 +61,13 @@ configuration: required: false type: 8 defaultvalue: "" -- additionalinfo: Type of the indicator in the feed. +- additionalinfo: If selected, the indicator type will be auto detected for each indicator. + defaultvalue: 'true' + display: Auto detect indicator type + name: auto_detect_type + required: false + type: 8 +- additionalinfo: Type of the indicator in the feed, If auto-detect is checked then the value set as Indicator Type will be ignored. display: Indicator Type name: indicator_type required: false @@ -143,7 +149,7 @@ script: required: false secret: false - default: false - description: The indicator type. + description: The indicator type. If the configuration parameter 'Auto detect indicator type' is marked true for the integration instance, then this value will be ignored. isArray: false name: indicator_type required: false @@ -162,7 +168,7 @@ script: - contextPath: CSV.Indicator.rawJSON description: The indicator rawJSON value. type: Unknown - dockerimage: demisto/python3:3.8.1.6120 + dockerimage: demisto/jmespath:1.0.0.6980 feed: true isfetch: false longRunning: false diff --git a/Packs/FeedCSV/Integrations/FeedCSV/README.md b/Packs/FeedCSV/Integrations/FeedCSV/README.md index 7030fd18b67..d19487d359d 100644 --- a/Packs/FeedCSV/Integrations/FeedCSV/README.md +++ b/Packs/FeedCSV/Integrations/FeedCSV/README.md @@ -71,7 +71,7 @@ We can use `Set up a new classification rule` using actual data from the feed. ## Demo Video --- \ No newline at end of file diff --git a/Packs/FeedCSV/Integrations/FeedCSV/doc_files/CSVFeed_Video.mp4 b/Packs/FeedCSV/Integrations/FeedCSV/doc_files/CSVFeed_Video.mp4 deleted file mode 100644 index da7abf296a1..00000000000 --- a/Packs/FeedCSV/Integrations/FeedCSV/doc_files/CSVFeed_Video.mp4 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:faac85ccea24e45ceaea56fba081e9f197ea4f5a07b7973a351e62e0ac88cb45 -size 36112836 diff --git a/Packs/FeedCSV/ReleaseNotes/1_0_1.md b/Packs/FeedCSV/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..b7911f081c3 --- /dev/null +++ b/Packs/FeedCSV/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### __CSVFeed__ +- Changed the docker image to support auto-detection function. diff --git a/Packs/FeedCSV/pack_metadata.json b/Packs/FeedCSV/pack_metadata.json index 069df762a52..41be4249c9e 100644 --- a/Packs/FeedCSV/pack_metadata.json +++ b/Packs/FeedCSV/pack_metadata.json @@ -1,19 +1,19 @@ { - "name": "CSV Feed", - "description": "Indicators feed from a CSV file", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-03-09T16:04:45Z", - "categories": [ - "Data Enrichment & Threat Intelligence" - ], - "tags": [], - "useCases": [], - "keywords": [ - "CSV", - "Feed" - ] + "name": "CSV Feed", + "description": "Indicators feed from a CSV file", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-03-09T16:04:45Z", + "categories": [ + "Data Enrichment & Threat Intelligence" + ], + "tags": [], + "useCases": [], + "keywords": [ + "CSV", + "Feed" + ] } \ No newline at end of file diff --git a/Packs/FeedCofense/Integrations/FeedCofense/FeedCofense.py b/Packs/FeedCofense/Integrations/FeedCofense/FeedCofense.py index fd6c2072fa4..0390475a275 100644 --- a/Packs/FeedCofense/Integrations/FeedCofense/FeedCofense.py +++ b/Packs/FeedCofense/Integrations/FeedCofense/FeedCofense.py @@ -104,7 +104,7 @@ def build_iterator( # Call to get all pages. total_pages = data.get("page", {}).get("totalPages") if total_pages is None: - return_error(f'No "totalPages" in response') + return_error('No "totalPages" in response') demisto.debug(f"total_pages set to {total_pages}") threats = data.get("threats", []) diff --git a/Packs/FeedCofense/Integrations/FeedCofense/FeedCofense.yml b/Packs/FeedCofense/Integrations/FeedCofense/FeedCofense.yml index 9300c71b0f7..1dfaebf3f69 100644 --- a/Packs/FeedCofense/Integrations/FeedCofense/FeedCofense.yml +++ b/Packs/FeedCofense/Integrations/FeedCofense/FeedCofense.yml @@ -116,7 +116,7 @@ script: description: Gets indicators from the feed. execution: false name: cofense-get-indicators - dockerimage: demisto/python3:3.8.3.8347 + dockerimage: demisto/python3:3.8.3.8715 feed: true isfetch: false longRunning: false diff --git a/Packs/FeedCofense/ReleaseNotes/1_0_3.md b/Packs/FeedCofense/ReleaseNotes/1_0_3.md new file mode 100644 index 00000000000..4fcbc2e9e2d --- /dev/null +++ b/Packs/FeedCofense/ReleaseNotes/1_0_3.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Cofense Feed +- Internal code improvements. diff --git a/Packs/FeedCofense/pack_metadata.json b/Packs/FeedCofense/pack_metadata.json index 7adc23bb891..555b3907067 100644 --- a/Packs/FeedCofense/pack_metadata.json +++ b/Packs/FeedCofense/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Cofense Feed", "description": "Indicators feed from Cofense", "support": "xsoar", - "currentVersion": "1.0.2", + "currentVersion": "1.0.3", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/FeedElasticsearch/Integrations/FeedElasticsearch/FeedElasticsearch.py b/Packs/FeedElasticsearch/Integrations/FeedElasticsearch/FeedElasticsearch.py index 5885ea33c34..6bcfc5a9388 100644 --- a/Packs/FeedElasticsearch/Integrations/FeedElasticsearch/FeedElasticsearch.py +++ b/Packs/FeedElasticsearch/Integrations/FeedElasticsearch/FeedElasticsearch.py @@ -180,7 +180,7 @@ def fetch_indicators_command(client, feed_type, src_val, src_type, default_type, ioc_enrch_lst: list = [] if FEED_TYPE_GENERIC not in feed_type: # Insight is the name of the indicator object as it's saved into the database - search = get_scan_insight_format(client, now, last_fetch_timestamp) + search = get_scan_insight_format(client, now, last_fetch_timestamp, feed_type) for hit in search.scan(): hit_lst, hit_enrch_lst = extract_indicators_from_insight_hit(hit) ioc_lst.extend(hit_lst) diff --git a/Packs/FeedElasticsearch/Integrations/FeedElasticsearch/FeedElasticsearch.yml b/Packs/FeedElasticsearch/Integrations/FeedElasticsearch/FeedElasticsearch.yml index fc24444a5a1..3f1c53b1e09 100644 --- a/Packs/FeedElasticsearch/Integrations/FeedElasticsearch/FeedElasticsearch.yml +++ b/Packs/FeedElasticsearch/Integrations/FeedElasticsearch/FeedElasticsearch.yml @@ -161,7 +161,7 @@ script: description: Gets indicators available in the configured Elasticsearch database. execution: false name: es-get-indicators - dockerimage: demisto/elasticsearch:1.0.0.6227 + dockerimage: demisto/elasticsearch:1.0.0.8935 feed: true isfetch: false longRunning: false diff --git a/Packs/FeedElasticsearch/ReleaseNotes/1_0_2.md b/Packs/FeedElasticsearch/ReleaseNotes/1_0_2.md new file mode 100644 index 00000000000..3f680854ab3 --- /dev/null +++ b/Packs/FeedElasticsearch/ReleaseNotes/1_0_2.md @@ -0,0 +1,4 @@ + +#### Integrations +##### __ElasticsearchFeed__ +- Fixed an issue where the **Feed Type** was not processed as expected while fetching indicators. diff --git a/Packs/FeedElasticsearch/pack_metadata.json b/Packs/FeedElasticsearch/pack_metadata.json index 656e50e10fb..d994172dc09 100644 --- a/Packs/FeedElasticsearch/pack_metadata.json +++ b/Packs/FeedElasticsearch/pack_metadata.json @@ -2,8 +2,7 @@ "name": "Elasticsearch Feed", "description": "Indicators feed from Elasticsearch database", "support": "xsoar", - "serverMinVersion": "5.5.0", - "currentVersion": "1.0.1", + "currentVersion": "1.0.2", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", @@ -12,16 +11,11 @@ ], "tags": [], "created": "2020-03-09T16:04:45Z", - "updated": "2020-03-09T16:04:45Z", - "beta": false, - "deprecated": false, - "certification": "certified", "useCases": [], "keywords": [ "Elasticsearch", "Feed" ], "price": 0, - "dependencies": {}, - "displayedImages": [] -} + "dependencies": {} +} \ No newline at end of file diff --git a/Packs/FeedJSON/Integrations/FeedJSON/FeedJSON.yml b/Packs/FeedJSON/Integrations/FeedJSON/FeedJSON.yml index d22d011e456..0cf0ec30f43 100644 --- a/Packs/FeedJSON/Integrations/FeedJSON/FeedJSON.yml +++ b/Packs/FeedJSON/Integrations/FeedJSON/FeedJSON.yml @@ -63,8 +63,7 @@ configuration: name: auto_detect_type required: false type: 8 -- additionalinfo: Type of the indicator in the feed. Relevant only if auto detect - is not selected. +- additionalinfo: Type of the indicator in the feed. If auto-detect is checked then the value set as Indicator Type will be ignored. display: Indicator Type name: indicator_type required: false @@ -133,4 +132,4 @@ script: type: python tests: - JSON_Feed_Test -fromversion: 5.5.0 +fromversion: 5.5.0 \ No newline at end of file diff --git a/Packs/FeedJSON/Integrations/FeedJSON/README.md b/Packs/FeedJSON/Integrations/FeedJSON/README.md index f9c26fffab5..16c00d59aa9 100644 --- a/Packs/FeedJSON/Integrations/FeedJSON/README.md +++ b/Packs/FeedJSON/Integrations/FeedJSON/README.md @@ -78,8 +78,8 @@ There is no context output for this command. ## Demo Video diff --git a/Packs/FeedJSON/Integrations/FeedJSON/demo_video/Json_generic_feed_demo.mp4 b/Packs/FeedJSON/Integrations/FeedJSON/demo_video/Json_generic_feed_demo.mp4 deleted file mode 100644 index 92cc8867b48..00000000000 --- a/Packs/FeedJSON/Integrations/FeedJSON/demo_video/Json_generic_feed_demo.mp4 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:108c0155ef79f81a73824e34795b6279c271e8e9b66ef6c90d73fd3ef5c63d7a -size 10326235 diff --git a/Packs/FeedJSON/ReleaseNotes/1_0_1.md b/Packs/FeedJSON/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..abf6e6f4142 --- /dev/null +++ b/Packs/FeedJSON/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### __JSON Feed__ +- updated description of indicator type field. diff --git a/Packs/FeedJSON/pack_metadata.json b/Packs/FeedJSON/pack_metadata.json index 18d243cf75e..22f617a74c3 100644 --- a/Packs/FeedJSON/pack_metadata.json +++ b/Packs/FeedJSON/pack_metadata.json @@ -1,19 +1,19 @@ { - "name": "JSON Feed", - "description": "Indicators feed from a JSON file", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-03-09T16:04:45Z", - "categories": [ - "Data Enrichment & Threat Intelligence" - ], - "tags": [], - "useCases": [], - "keywords": [ - "JSON", - "Feed" - ] + "name": "JSON Feed", + "description": "Indicators feed from a JSON file", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-03-09T16:04:45Z", + "categories": [ + "Data Enrichment & Threat Intelligence" + ], + "tags": [], + "useCases": [], + "keywords": [ + "JSON", + "Feed" + ] } \ No newline at end of file diff --git a/Packs/FeedMitreAttack/ReleaseNotes/1_0_3.md b/Packs/FeedMitreAttack/ReleaseNotes/1_0_3.md new file mode 100644 index 00000000000..e2938522ea4 --- /dev/null +++ b/Packs/FeedMitreAttack/ReleaseNotes/1_0_3.md @@ -0,0 +1,2 @@ +### IndicatorFields +Moved the *mitreexternalreference* field to commonTypes pack. \ No newline at end of file diff --git a/Packs/FeedMitreAttack/pack_metadata.json b/Packs/FeedMitreAttack/pack_metadata.json index 439acc913ff..aa0e5466f17 100644 --- a/Packs/FeedMitreAttack/pack_metadata.json +++ b/Packs/FeedMitreAttack/pack_metadata.json @@ -2,7 +2,7 @@ "name": "MITRE ATT&CK", "description": "Fetches indicators from MITRE ATT&CK.", "support": "xsoar", - "currentVersion": "1.0.2", + "currentVersion": "1.0.3", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/FeedOffice365/Integrations/FeedOffice365/FeedOffice365.yml b/Packs/FeedOffice365/Integrations/FeedOffice365/FeedOffice365.yml index 4a7382936d6..9de482c3712 100644 --- a/Packs/FeedOffice365/Integrations/FeedOffice365/FeedOffice365.yml +++ b/Packs/FeedOffice365/Integrations/FeedOffice365/FeedOffice365.yml @@ -92,7 +92,7 @@ configuration: name: proxy required: false type: 8 -description: Use the Office 365 feed integration to get indicators from the feed. +description: The Office 365 IP Address and URL web service is a read-only API provided by Microsoft to expose the URLs and IPs used by Office 365. The Office 365 Feed integration fetches indicators from the service, with which you can create a list (whitelist, blacklist, EDL, etc.) for your SIEM or firewall service to ingest and apply to its policy rules. display: Office 365 Feed name: Office 365 Feed script: @@ -122,7 +122,7 @@ script: description: Gets indicators from the feed. execution: false name: office365-get-indicators - dockerimage: demisto/python3:3.8.2.6981 + dockerimage: demisto/python3:3.8.3.8715 feed: true isfetch: false longRunning: false diff --git a/Packs/FeedOffice365/Integrations/FeedOffice365/README.md b/Packs/FeedOffice365/Integrations/FeedOffice365/README.md index 189a5e8e71f..3be04b9a2a3 100644 --- a/Packs/FeedOffice365/Integrations/FeedOffice365/README.md +++ b/Packs/FeedOffice365/Integrations/FeedOffice365/README.md @@ -1,5 +1,3 @@ -Use the Office365 feed integration to get indicators from the feed. - The Office 365 IP Address and URL web service is a read-only API provided by Microsoft to expose the URLs and IPs used by Office 365. The Office 365 Feed integration fetches indicators from the service, with which you can create a list (whitelist, blacklist, EDL, etc.) for your SIEM or firewall service to ingest and apply to its policy rules. diff --git a/Packs/FeedOffice365/ReleaseNotes/1_1_1.md b/Packs/FeedOffice365/ReleaseNotes/1_1_1.md new file mode 100644 index 00000000000..336384dfe8c --- /dev/null +++ b/Packs/FeedOffice365/ReleaseNotes/1_1_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### __Office 365 Feed__ +- Updated integration description. diff --git a/Packs/FeedOffice365/pack_metadata.json b/Packs/FeedOffice365/pack_metadata.json index 747aa4dab4b..eb3ab5290bb 100644 --- a/Packs/FeedOffice365/pack_metadata.json +++ b/Packs/FeedOffice365/pack_metadata.json @@ -1,8 +1,8 @@ { "name": "Office 365 Feed", - "description": "Use the Office 365 feed integration to get indicators from the feed.", + "description": "The Office 365 IP Address and URL web service is a read-only API provided by Microsoft to expose the URLs and IPs used by Office 365. The Office 365 Feed integration fetches indicators from the service, with which you can create a list (whitelist, blacklist, EDL, etc.) for your SIEM or firewall service to ingest and apply to its policy rules.", "support": "xsoar", - "currentVersion": "1.1.0", + "currentVersion": "1.1.1", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", @@ -10,7 +10,9 @@ "categories": [ "Data Enrichment & Threat Intelligence" ], - "tags": [], + "tags": [ + "TIM" + ], "useCases": [], "keywords": [] } \ No newline at end of file diff --git a/Packs/FeedPlainText/Integrations/FeedPlainText/FeedPlainText.py b/Packs/FeedPlainText/Integrations/FeedPlainText/FeedPlainText.py index ceb620e49d1..d68f975342b 100644 --- a/Packs/FeedPlainText/Integrations/FeedPlainText/FeedPlainText.py +++ b/Packs/FeedPlainText/Integrations/FeedPlainText/FeedPlainText.py @@ -1,4 +1,15 @@ +import demistomock as demisto +from CommonServerPython import * + + def main(): + params = demisto.params() + # when auto_detect is not selected + if params.get('auto_detect_type') is False and not params.get('indicator_type'): + return_error('Indicator Type cannot be empty when Auto Detect Indicator Type is unchecked') + # when auto_detect does not exist - for previous integration instances + if params.get('auto_detect_type') is None and not params.get('indicator_type'): + return_error('Indicator Type cannot be empty') feed_main('PlainText', prefix='plaintext') diff --git a/Packs/FeedPlainText/Integrations/FeedPlainText/FeedPlainText.yml b/Packs/FeedPlainText/Integrations/FeedPlainText/FeedPlainText.yml index 1e91b035a71..22edb82ca14 100644 --- a/Packs/FeedPlainText/Integrations/FeedPlainText/FeedPlainText.yml +++ b/Packs/FeedPlainText/Integrations/FeedPlainText/FeedPlainText.yml @@ -18,7 +18,13 @@ configuration: name: credentials required: false type: 9 -- additionalinfo: Type of indicator in the feed. +- additionalinfo: If selected, the indicator type will be auto detected for each indicator. + defaultvalue: 'true' + display: Auto detect indicator type + name: auto_detect_type + required: false + type: 8 +- additionalinfo: Type of the indicator in the feed. If auto-detect is checked then the value set as Indicator Type will be ignored. display: Indicator Type name: indicator_type options: @@ -157,7 +163,7 @@ script: required: false secret: false - default: false - description: The indicator type. + description: The indicator type. If the configuration parameter 'Auto detect indicator type' is marked true for the integration instance, then this value will be ignored. isArray: false name: indicator_type required: false @@ -166,7 +172,7 @@ script: description: Gets indicators from the feed. execution: false name: plaintext-get-indicators - dockerimage: demisto/python3:3.8.2.6981 + dockerimage: demisto/jmespath:1.0.0.6980 feed: true isfetch: false longRunning: false diff --git a/Packs/FeedPlainText/ReleaseNotes/1_0_1.md b/Packs/FeedPlainText/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..980cdb3a439 --- /dev/null +++ b/Packs/FeedPlainText/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### __Plain Text Feed__ +- Changed the docker image to support auto-detection function. diff --git a/Packs/FeedPlainText/pack_metadata.json b/Packs/FeedPlainText/pack_metadata.json index 96f2b75401d..b4f3a2e1a59 100644 --- a/Packs/FeedPlainText/pack_metadata.json +++ b/Packs/FeedPlainText/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "Plain Text Feed", - "description": "Fetches indicators from a plain text feed.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-03-09T16:35:16Z", - "categories": [ - "Data Enrichment & Threat Intelligence" - ], - "tags": [], - "useCases": [], - "keywords": [] + "name": "Plain Text Feed", + "description": "Fetches indicators from a plain text feed.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-03-09T16:35:16Z", + "categories": [ + "Data Enrichment & Threat Intelligence" + ], + "tags": [], + "useCases": [], + "keywords": [] } \ No newline at end of file diff --git a/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/CHANGELOG.md b/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/CHANGELOG.md index a022a77d3da..131c9f65e95 100644 --- a/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/CHANGELOG.md +++ b/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/CHANGELOG.md @@ -1,5 +1,5 @@ ## [Unreleased] - +Improved parsing of IOC objects. ## [20.3.4] - 2020-03-30 Renamed the **Sub-Feeds** parameter to **Services** in the instance configuration. diff --git a/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/FeedRecordedFuture.py b/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/FeedRecordedFuture.py index 603965c36b7..c9b1c2c246d 100644 --- a/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/FeedRecordedFuture.py +++ b/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/FeedRecordedFuture.py @@ -281,7 +281,7 @@ def format_risk_string(risk_string): return f'{splitted_risk_string[0]} of {splitted_risk_string[1]} Risk Rules Triggered' -def fetch_indicators_command(client, indicator_type, limit: Optional[int]): +def fetch_indicators_command(client, indicator_type, limit: Optional[int] = None): """Fetches indicators from the Recorded Future feeds. Args: client(Client): Recorded Future Feed client. @@ -295,18 +295,23 @@ def fetch_indicators_command(client, indicator_type, limit: Optional[int]): iterator = client.build_iterator(service, indicator_type) for item in itertools.islice(iterator, limit): # if limit is None the iterator will iterate all of the items. raw_json = dict(item) - evidence_details = json.loads(item.get('EvidenceDetails')).get('EvidenceDetails') - raw_json['EvidenceDetails'] = evidence_details - raw_json['RiskString'] = format_risk_string(item.get('RiskString')) raw_json['value'] = value = item.get('Name') raw_json['type'] = get_indicator_type(indicator_type, item) - raw_json['score'] = score = client.calculate_indicator_score(item['Risk']) - raw_json['Criticality Label'] = calculate_recorded_future_criticality_label(item['Risk']) + score = 0 + risk = item.get('Risk') + if isinstance(risk, str) and risk.isdigit(): + raw_json['score'] = score = client.calculate_indicator_score(risk) + raw_json['Criticality Label'] = calculate_recorded_future_criticality_label(risk) lower_case_evidence_details_keys = [] - for rule in evidence_details: - rule = dict((k.lower(), v) for k, v in rule.items()) - lower_case_evidence_details_keys.append(rule) - + evidence_details = json.loads(item.get('EvidenceDetails', '{}')).get('EvidenceDetails', []) + if evidence_details: + raw_json['EvidenceDetails'] = evidence_details + for rule in evidence_details: + rule = dict((k.lower(), v) for k, v in rule.items()) + lower_case_evidence_details_keys.append(rule) + risk_string = item.get('RiskString') + if isinstance(risk_string, str): + raw_json['RiskString'] = format_risk_string(risk_string) indicators.append({ "value": value, "type": raw_json['type'], @@ -377,7 +382,7 @@ def main(): } try: if demisto.command() == 'fetch-indicators': - indicators = fetch_indicators_command(client, client.indicator_type, None) + indicators = fetch_indicators_command(client, client.indicator_type) # we submit the indicators in batches for b in batch(indicators, batch_size=2000): demisto.createIndicators(b) diff --git a/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/FeedRecordedFuture_test.py b/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/FeedRecordedFuture_test.py index a3109cacb3e..34d573935ee 100644 --- a/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/FeedRecordedFuture_test.py +++ b/Packs/FeedRecordedFuture/Integrations/FeedRecordedFuture/FeedRecordedFuture_test.py @@ -1,6 +1,6 @@ import pytest from collections import OrderedDict -from FeedRecordedFuture import get_indicator_type, get_indicators_command, Client +from FeedRecordedFuture import get_indicator_type, get_indicators_command, Client, fetch_indicators_command GET_INDICATOR_TYPE_INPUTS = [ ('ip', OrderedDict([('Name', '192.168.1.1'), ('Risk', '89'), ('RiskString', '5/12'), @@ -113,3 +113,24 @@ def test_calculate_dbot_score(risk_from_feed, threshold, expected_score): client = Client(indicator_type='ip', api_token='123', services=['fusion'], threshold=threshold) score = client.calculate_indicator_score(risk_from_feed) assert score == expected_score + + +def test_fetch_indicators_command(mocker): + """ + Given: + - Recorded Future Feed client initialized with ip indicator type + - Iterator which returns entry of IP object with name only + + When: + - Fetching indicators + + Then: + - Verify the fetch runs successfully. + """ + indicator_type = 'ip' + client = Client(indicator_type=indicator_type, api_token='dummytoken', services='fusion') + mocker.patch( + 'FeedRecordedFuture.Client.build_iterator', + return_value=[{'Name': '192.168.1.1'}] + ) + fetch_indicators_command(client, indicator_type) diff --git a/Packs/FeedRecordedFuture/ReleaseNotes/1_0_1.md b/Packs/FeedRecordedFuture/ReleaseNotes/1_0_1.md new file mode 100644 index 00000000000..c70e295f648 --- /dev/null +++ b/Packs/FeedRecordedFuture/ReleaseNotes/1_0_1.md @@ -0,0 +1,4 @@ + +#### Integrations +##### __Recorded Future Feed__ +- Improved parsing of IOC objects. diff --git a/Packs/FeedRecordedFuture/pack_metadata.json b/Packs/FeedRecordedFuture/pack_metadata.json index 52a995048a5..605ea396209 100644 --- a/Packs/FeedRecordedFuture/pack_metadata.json +++ b/Packs/FeedRecordedFuture/pack_metadata.json @@ -1,16 +1,16 @@ { - "name": "Recorded Future Feed", - "description": "Ingests indicators from Recorded Future feeds into Demisto.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-03-09T16:35:16Z", - "categories": [ - "Data Enrichment & Threat Intelligence" - ], - "tags": [], - "useCases": [], - "keywords": [] + "name": "Recorded Future Feed", + "description": "Ingests indicators from Recorded Future feeds into Demisto.", + "support": "xsoar", + "currentVersion": "1.0.1", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-03-09T16:35:16Z", + "categories": [ + "Data Enrichment & Threat Intelligence" + ], + "tags": [], + "useCases": [], + "keywords": [] } \ No newline at end of file diff --git a/Packs/FeedTAXII/Integrations/FeedTAXII/README.md b/Packs/FeedTAXII/Integrations/FeedTAXII/README.md index 2004766aad1..bd4f8a16f04 100644 --- a/Packs/FeedTAXII/Integrations/FeedTAXII/README.md +++ b/Packs/FeedTAXII/Integrations/FeedTAXII/README.md @@ -11,7 +11,7 @@ The TAXII Feed integration ingests indicator feeds from TAXII 1.x servers. * __Reliability__: Reliability of the feed. * __Trust any certificate (not secure)__ * __Use system proxy settings__ - * __Discovery Service__: TAXII discovery service endpoint. For example, http://hailataxii.com/taxii-discovery-service + * __Discovery Service__: TAXII discovery service endpoint. For example: `http://hailataxii.com/taxii-discovery-service` * __Collection__: Collection name to fetch indicators from. * __Subscription ID__: Subscription ID for the TAXII consumer. * __Username__: Username/Password (if required) diff --git a/Packs/FeedTAXII/TestPlaybooks/playbook-TAXII_Feed_Test.yml b/Packs/FeedTAXII/TestPlaybooks/playbook-TAXII_Feed_Test.yml index 401a72ec2f0..2099fa1542f 100644 --- a/Packs/FeedTAXII/TestPlaybooks/playbook-TAXII_Feed_Test.yml +++ b/Packs/FeedTAXII/TestPlaybooks/playbook-TAXII_Feed_Test.yml @@ -1,20 +1,20 @@ id: TAXII_Feed_Test version: -1 -contentitemfields: - propagationLabels: [] name: TAXII_Feed_Test +description: Test playbook for TAXII Feed starttaskid: "0" tasks: "0": id: "0" - taskid: 629b23e0-7b34-4e9e-8709-e40d1033914a + taskid: 988653ca-17d0-4f6b-8ef3-209f1a45d3de type: start task: - id: 629b23e0-7b34-4e9e-8709-e40d1033914a + id: 988653ca-17d0-4f6b-8ef3-209f1a45d3de version: -1 name: "" iscommand: false brand: "" + description: '' nexttasks: '#none#': - "4" @@ -30,12 +30,13 @@ tasks: timertriggers: [] ignoreworker: false skipunavailable: false + quietmode: 0 "1": id: "1" - taskid: c3764c40-9251-4198-85cb-cc403a040f1b + taskid: 31e30a66-72b2-48d3-8dc2-cc54e09ad486 type: regular task: - id: c3764c40-9251-4198-85cb-cc403a040f1b + id: 31e30a66-72b2-48d3-8dc2-cc54e09ad486 version: -1 name: Get Indicators description: Get the feed indicators. @@ -47,28 +48,29 @@ tasks: '#none#': - "2" scriptarguments: + initial_interval: + simple: 4 days limit: simple: "10" - initial_interval: - simple: "4 days" separatecontext: false view: |- { "position": { "x": 50, - "y": 370 + "y": 545 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false + quietmode: 0 "2": id: "2" - taskid: 2956dd1c-409d-4154-8837-37195cefb1c1 + taskid: 5402c5e6-14ae-4cd6-810e-ab992cb16115 type: condition task: - id: 2956dd1c-409d-4154-8837-37195cefb1c1 + id: 5402c5e6-14ae-4cd6-810e-ab992cb16115 version: -1 name: Assert Output description: Asserts output. @@ -76,6 +78,8 @@ tasks: iscommand: false brand: "" nexttasks: + '#default#': + - "6" "yes": - "3" separatecontext: false @@ -114,19 +118,20 @@ tasks: { "position": { "x": 50, - "y": 545 + "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false + quietmode: 0 "3": id: "3" - taskid: 012a601e-ed7e-4091-80ee-d9071f0c9937 + taskid: f1521e9e-4b28-43b9-8e9e-ab7df821ee8a type: title task: - id: 012a601e-ed7e-4091-80ee-d9071f0c9937 + id: f1521e9e-4b28-43b9-8e9e-ab7df821ee8a version: -1 name: Done description: Done @@ -138,19 +143,20 @@ tasks: { "position": { "x": 50, - "y": 720 + "y": 1420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false + quietmode: 0 "4": id: "4" - taskid: 4e5d7a78-4f39-481d-8168-de2e970706e5 + taskid: 388b3a2c-ead7-4e3a-8765-834101867a84 type: regular task: - id: 4e5d7a78-4f39-481d-8168-de2e970706e5 + id: 388b3a2c-ead7-4e3a-8765-834101867a84 version: -1 name: Delete Context description: Delete field from context. @@ -160,7 +166,7 @@ tasks: brand: "" nexttasks: '#none#': - - "1" + - "5" scriptarguments: all: simple: "yes" @@ -180,13 +186,293 @@ tasks: timertriggers: [] ignoreworker: false skipunavailable: false + quietmode: 0 + "5": + id: "5" + taskid: 55fe4210-fa84-4b08-82fe-12134c9e72d0 + type: regular + task: + id: 55fe4210-fa84-4b08-82fe-12134c9e72d0 + version: -1 + name: createNewIndicator + description: Change the properties of an indicator + script: Builtin|||createNewIndicator + type: regular + iscommand: true + brand: Builtin + nexttasks: + '#none#': + - "1" + scriptarguments: + accounttype: {} + actor: {} + admincountry: {} + adminemail: {} + adminname: {} + adminphone: {} + asn: {} + associatedfilenames: {} + associations: {} + biosversion: {} + creationdate: {} + customFields: {} + cvedescription: {} + cvemodified: {} + cvss: {} + description: {} + detectionengines: {} + devicemodel: {} + dhcpserver: {} + displayname: {} + dns: {} + domainname: {} + domainstatus: {} + emailaddress: {} + employeehealthstatus: {} + employeeresponsestatus: {} + entryid: {} + expirationdate: {} + fileextension: {} + filetype: {} + firstname: {} + firstseenbysource: {} + geocountry: {} + geolocation: {} + groups: {} + hostname: {} + imphash: {} + indicatoridentification: {} + internal: {} + ipaddress: {} + jobtitle: {} + lastname: {} + lastseenbysource: {} + macaddress: {} + malwarefamily: {} + md5: {} + memory: {} + merge: {} + mitrealiases: {} + mitrecontributors: {} + mitredatasources: {} + mitredefensebypassed: {} + mitredescription: {} + mitredetection: {} + mitreextendedaliases: {} + mitreexternalreferences: {} + mitreid: {} + mitreimpacttype: {} + mitrekillchainphases: {} + mitrelabels: {} + mitrename: {} + mitrepermissionsrequired: {} + mitreplatforms: {} + mitresystemrequirements: {} + mitretype: {} + mitreversion: {} + name: {} + namefield: {} + nameservers: {} + office365category: {} + office365expressroute: {} + office365required: {} + operatingsystem: {} + operatingsystemversion: {} + organization: {} + organizationalunitou: {} + osversion: {} + path: {} + port: {} + positivedetections: {} + processor: {} + processors: {} + published: {} + quarantined: {} + recordedfutureevidencedetails: {} + region: {} + registrantcountry: {} + registrantemail: {} + registrantname: {} + registrantphone: {} + registrarabuseemail: {} + registrarabusephone: {} + registrarname: {} + relatedIncidents: {} + reportedby: {} + reputation: {} + seenNow: {} + service: {} + sha1: {} + sha256: {} + sha512: {} + signatureauthentihash: {} + signaturecopyright: {} + signaturedescription: {} + signaturefileversion: {} + signatureinternalname: {} + signed: {} + size: {} + source: + simple: taxiitest + sourceTimeStamp: {} + sourceoriginalseverity: {} + ssdeep: {} + subdomains: {} + tags: {} + threattypes: {} + trafficlightprotocol: {} + type: + simple: URL + updateddate: {} + username: {} + value: + simple: www.demisto.com + separatecontext: false + view: |- + { + "position": { + "x": 50, + "y": 370 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "6": + id: "6" + taskid: 215c092f-0c67-4e43-821d-5582b78833b2 + type: regular + task: + id: 215c092f-0c67-4e43-821d-5582b78833b2 + version: -1 + name: Sleep + description: Sleep for X seconds + scriptName: Sleep + type: regular + iscommand: false + brand: "" + nexttasks: + '#none#': + - "7" + scriptarguments: + seconds: + simple: "5" + separatecontext: false + view: |- + { + "position": { + "x": 350, + "y": 890 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "7": + id: "7" + taskid: 6d990d13-a36a-429d-8520-fd09a5f7cc6b + type: regular + task: + id: 6d990d13-a36a-429d-8520-fd09a5f7cc6b + version: -1 + name: Get Indicators + description: Get the feed indicators. + script: TAXIIFeed|||get-indicators + type: regular + iscommand: true + brand: TAXIIFeed + nexttasks: + '#none#': + - "8" + scriptarguments: + initial_interval: + simple: 4 days + limit: + simple: "10" + separatecontext: false + view: |- + { + "position": { + "x": 350, + "y": 1070 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 + "8": + id: "8" + taskid: 7a0a42b7-e339-4e18-8c75-86f705bedc16 + type: condition + task: + id: 7a0a42b7-e339-4e18-8c75-86f705bedc16 + version: -1 + name: Assert Output + description: Asserts output. + type: condition + iscommand: false + brand: "" + nexttasks: + "yes": + - "3" + separatecontext: false + conditions: + - label: "yes" + condition: + - - operator: isExists + left: + value: + complex: + root: TAXII + accessor: Indicator.Value + iscontext: true + - - operator: isExists + left: + value: + complex: + root: TAXII + accessor: Indicator.Type + iscontext: true + - - operator: isExists + left: + value: + complex: + root: TAXII + accessor: Indicator.Rawjson.type + iscontext: true + - - operator: isExists + left: + value: + complex: + root: TAXII + accessor: Indicator.Rawjson.value + iscontext: true + view: |- + { + "position": { + "x": 350, + "y": 1245 + } + } + note: false + timertriggers: [] + ignoreworker: false + skipunavailable: false + quietmode: 0 +system: true view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { - "height": 735, - "width": 380, + "height": 1435, + "width": 680, "x": 50, "y": 50 } @@ -194,4 +480,4 @@ view: |- } inputs: [] outputs: [] -sourceplaybookid: 8b67d530-5b0f-4085-82b9-4429228f211e +fromversion: 4.1.0 diff --git a/Packs/FeedTAXII/pack_metadata.json b/Packs/FeedTAXII/pack_metadata.json index 4d4e914029a..1a6796cad27 100644 --- a/Packs/FeedTAXII/pack_metadata.json +++ b/Packs/FeedTAXII/pack_metadata.json @@ -1,16 +1,17 @@ { - "name": "TAXII Feed", - "description": "Ingests indicator feeds from TAXII 1.x servers.", - "support": "xsoar", - "currentVersion": "1.0.0", - "author": "Cortex XSOAR", - "url": "https://www.paloaltonetworks.com/cortex", - "email": "", - "created": "2020-04-14T00:00:00Z", - "categories": [ - "Data Enrichment & Threat Intelligence" - ], - "tags": [], - "useCases": [], - "keywords": [] -} + "name": "TAXII Feed", + "description": "Ingests indicator feeds from TAXII 1.x servers.", + "support": "xsoar", + "currentVersion": "1.0.0", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "created": "2020-04-14T00:00:00Z", + "categories": [ + "Data Enrichment & Threat Intelligence" + ], + "tags": [], + "useCases": [], + "keywords": [], + "dependencies": {} +} \ No newline at end of file diff --git a/Packs/IPWhitelisting/.pack-ignore b/Packs/FeedZoom/.pack-ignore similarity index 100% rename from Packs/IPWhitelisting/.pack-ignore rename to Packs/FeedZoom/.pack-ignore diff --git a/Packs/FeedZoom/.secrets-ignore b/Packs/FeedZoom/.secrets-ignore new file mode 100644 index 00000000000..320b9fe0d22 --- /dev/null +++ b/Packs/FeedZoom/.secrets-ignore @@ -0,0 +1,4 @@ +3.235.82.0 +http://www.linkedin.com +https://zoomus.zendesk.com +3.7.35.0 diff --git a/Packs/Exchange/CHANGELOG.md b/Packs/FeedZoom/CHANGELOG.md similarity index 100% rename from Packs/Exchange/CHANGELOG.md rename to Packs/FeedZoom/CHANGELOG.md diff --git a/Packs/FeedZoom/Integrations/FeedZoom/CHANGELOG.md b/Packs/FeedZoom/Integrations/FeedZoom/CHANGELOG.md new file mode 100644 index 00000000000..63439c17f37 --- /dev/null +++ b/Packs/FeedZoom/Integrations/FeedZoom/CHANGELOG.md @@ -0,0 +1,2 @@ +## [Unreleased] +- diff --git a/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom.py b/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom.py new file mode 100644 index 00000000000..4b7a67ef8ea --- /dev/null +++ b/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom.py @@ -0,0 +1,191 @@ +import demistomock as demisto +from CommonServerPython import * +from typing import Dict, List, Tuple, Any, Callable + +import urllib3 +from bs4 import BeautifulSoup + +# disable insecure warnings +urllib3.disable_warnings() + +INTEGRATION_NAME = 'Zoom Feed' + + +class Client(BaseClient): + """ + Client to use in the Zoom Feed integration. Overrides BaseClient. + """ + + def __init__(self, base_url: str, verify: bool = False, proxy: bool = False): + """ + Implements class for Zoom feeds. + :param url: the Zoom endpoint URL + :verify: boolean, if *false* feed HTTPS server certificate is verified. Default: *false* + :param proxy: boolean, if *false* feed HTTPS server certificate will not use proxies. Default: *false* + """ + super().__init__(base_url, verify=verify, proxy=proxy) + + def build_iterator(self) -> List: + """Retrieves all entries from the feed. + Returns: + A list of objects, containing the indicators. + """ + result = [] + r = self._http_request('GET', url_suffix='', full_url=self._base_url, resp_type='text') + + soup = BeautifulSoup(r, 'html.parser') + + try: + raw_data: List = sum([cell.get_text(strip=True, separator=" ").split(" ") + for cell in soup.select(".pure-table tbody tr td")], []) + indicators = list(set(raw_data)) + for indicator in indicators: + if auto_detect_indicator_type(indicator): + result.append({ + 'value': indicator, + 'type': auto_detect_indicator_type(indicator), + 'FeedURL': self._base_url + }) + + except requests.exceptions.SSLError as err: + demisto.debug(str(err)) + raise Exception(f'Connection error in the API call to {INTEGRATION_NAME}.\n' + f'Check your not secure parameter.\n\n{err}') + except requests.ConnectionError as err: + demisto.debug(str(err)) + raise Exception(f'Connection error in the API call to {INTEGRATION_NAME}.\n' + f'Check your Server URL parameter.\n\n{err}') + except requests.exceptions.HTTPError as err: + demisto.debug(str(err)) + raise Exception(f'Connection error in the API call to {INTEGRATION_NAME}.\n') + except ValueError as err: + demisto.debug(str(err)) + raise ValueError(f'Could not parse returned data to Json. \n\nError massage: {err}') + + return result + + +def test_module(client: Client, *_) -> Tuple[str, Dict[Any, Any], Dict[Any, Any]]: + """Builds the iterator to check that the feed is accessible. + Args: + client: Client object. + Returns: + Outputs. + """ + client.build_iterator() + return 'ok', {}, {} + + +def fetch_indicators(client: Client, feed_tags: List = [], limit: int = -1) -> List[Dict]: + """Retrieves indicators from the feed + Args: + client (Client): Client object with request + feed_tags (list): tags to assign fetched indicators + limit (int): limit the results + Returns: + Indicators. + """ + iterator = client.build_iterator() + indicators = [] + if limit > 0: + iterator = iterator[:limit] + for item in iterator: + value = item.get('value') + type_ = item.get('type', FeedIndicatorType.Domain) + raw_data = { + 'value': value, + 'type': type_, + } + for key, val in item.items(): + raw_data.update({key: val}) + indicator_obj = { + 'value': value, + 'type': type_, + 'service': 'Zoom Feed', + 'rawJSON': raw_data + } + if feed_tags: + indicator_obj['fields'] = { + 'tags': feed_tags + } + indicators.append(indicator_obj) + return indicators + + +def get_indicators_command(client: Client, + params: Dict[str, str], + args: Dict[str, str] + ) -> Tuple[str, Dict[Any, Any], Dict[Any, Any]]: + """Wrapper for retrieving indicators from the feed to the war-room. + Args: + client: Client object with request + params: demisto.params() + args: demisto.args() + Returns: + Outputs. + """ + feed_tags = argToList(params.get('feedTags', '')) + limit = int(args.get('limit', '10')) + indicators = fetch_indicators(client, feed_tags, limit) + human_readable = tableToMarkdown('Indicators from Zoom Feed:', indicators, + headers=['value', 'type'], removeNull=True) + + return human_readable, {}, {'raw_response': indicators} + + +def fetch_indicators_command(client: Client, params: Dict[str, str]) -> List[Dict]: + """Wrapper for fetching indicators from the feed to the Indicators tab. + Args: + client: Client object with request + params: demisto.params() + Returns: + Indicators. + """ + feed_tags = argToList(params.get('feedTags', '')) + indicators = fetch_indicators(client, feed_tags) + return indicators + + +def main(): + """ + PARSE AND VALIDATE INTEGRATION PARAMS + """ + params = demisto.params() + base_url = params.get('url') + insecure = not params.get('insecure', False) + proxy = params.get('proxy', False) + + command = demisto.command() + demisto.info(f'Command being called is {command}') + + try: + client = Client( + base_url=base_url, + verify=insecure, + proxy=proxy, + ) + + commands: Dict[ + str, Callable[[Client, Dict[str, str], Dict[str, str]], Tuple[str, Dict[Any, Any], Dict[Any, Any]]] + ] = { + 'test-module': test_module, + 'zoom-get-indicators': get_indicators_command + } + if command in commands: + return_outputs(*commands[command](client, demisto.params(), demisto.args())) + + elif command == 'fetch-indicators': + indicators = fetch_indicators_command(client, demisto.params()) + for iter_ in batch(indicators, batch_size=2000): + demisto.createIndicators(iter_) + + else: + raise NotImplementedError(f'Command {command} is not implemented.') + + except Exception as err: + err_msg = f'Error in {INTEGRATION_NAME} Integration. [{err}]' + return_error(err_msg) + + +if __name__ in ['__main__', 'builtin', 'builtins']: + main() diff --git a/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom.yml b/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom.yml new file mode 100644 index 00000000000..40304502804 --- /dev/null +++ b/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom.yml @@ -0,0 +1,102 @@ +commonfields: + id: Zoom Feed + version: -1 +fromversion: 5.5.0 +name: Zoom Feed +display: Zoom Feed +category: Data Enrichment & Threat Intelligence +description: Use the Zoom Feed integration to get indicators from the feed. +configuration: +- display: Fetch indicators + name: feed + defaultvalue: "true" + type: 8 + required: false +- display: Indicator Reputation + name: feedReputation + defaultvalue: Good + type: 18 + required: false + options: + - None + - Good + - Suspicious + - Bad + additionalinfo: Indicators from this integration instance will be marked with this + reputation +- display: Source Reliability + name: feedReliability + defaultvalue: A - Completely reliable + type: 15 + required: true + options: + - A - Completely reliable + - B - Usually reliable + - C - Fairly reliable + - D - Not usually reliable + - E - Unreliable + - F - Reliability cannot be judged + additionalinfo: Reliability of the source providing the intelligence data +- display: "" + name: feedExpirationPolicy + defaultvalue: suddenDeath + type: 17 + required: false + options: + - never + - interval + - indicatorType + - suddenDeath +- display: "" + name: feedExpirationInterval + defaultvalue: "20160" + type: 1 + required: false +- display: Feed Fetch Interval + name: feedFetchInterval + defaultvalue: "30" + type: 19 + required: false +- display: Zoom Endpoint URL + name: url + defaultvalue: https://support.zoom.us/hc/en-us/articles/201362683-Network-Firewall-or-Proxy-Server-Settings-for-Zoom + type: 0 + required: true +- display: Tags + name: feedTags + defaultvalue: "" + type: 0 + required: false + additionalinfo: Supports CSV values. +- display: Bypass exclusion list + name: feedBypassExclusionList + defaultvalue: "true" + type: 8 + required: false + additionalinfo: When selected, the exclusion list is ignored for indicators from + this feed. This means that if an indicator from this feed is on the exclusion + list, the indicator might still be added to the system. +- display: Trust any certificate (not secure) + name: insecure + defaultvalue: "" + type: 8 + required: false +- display: Use system proxy settings + name: proxy + defaultvalue: "" + type: 8 + required: false +script: + script: '' + type: python + commands: + - name: zoom-get-indicators + arguments: + - name: limit + description: The maximum number of results to return. The default value is 10. + defaultValue: "10" + description: Gets indicators from the feed. + dockerimage: demisto/btfl-soup:1.0.1.9249 + feed: true + runonce: false + subtype: python3 diff --git a/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom_description.md b/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom_description.md new file mode 100644 index 00000000000..66e78ed741e --- /dev/null +++ b/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom_description.md @@ -0,0 +1,10 @@ +## Zoom Endpoints Web Scraper +https://support.zoom.us/hc/en-us/articles/201362683-Network-Firewall-or-Proxy-Server-Settings-for-Zoom + +Most IT services are moving from on-premise solutions to cloud-based solutions. The public IP addresses, domains, and URLs that function as the endpoints for these solutions are very often not fixed, and the providers of the service publish their details on their websites in a less than ideal format (i.e.: HTML) rather than through a proper REST API (i.e.: JSON). + +This fact makes it very difficult for IT and Security teams to provide these services with an appropriate level of security and automation. Any changes in the HTML schema of the provider website, will break the automation and has the potential to cause serious disruption to the users and the business. The alternative is to compromise on the security posture of the organization. + +One example of these providers is Zoom. + +This pack aims is to address this issue by automating the collection of endpoint data in the form of an indicator feed. This will facilitate validation of the indicators before using them in enforcement points, for example firewalls, proxies, and more. diff --git a/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom_image.png b/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom_image.png new file mode 100644 index 00000000000..ca13c51b3f4 Binary files /dev/null and b/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom_image.png differ diff --git a/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom_test.py b/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom_test.py new file mode 100644 index 00000000000..5b8f37e18bf --- /dev/null +++ b/Packs/FeedZoom/Integrations/FeedZoom/FeedZoom_test.py @@ -0,0 +1,25 @@ +from FeedZoom import Client + + +URL = "https://support.zoom.us/hc/en-us/articles/201362683-Network-Firewall-or-Proxy-Server-Settings-for-Zoom" + + +def test_build_iterator(requests_mock): + with open('test_data/zoom_endpoint_mock.html', 'r') as file: + response = file.read() + requests_mock.get(URL, text=response) + expected_cidr = '3.7.35.0/25' + expected_ipv6 = '2620:123:2000::/40' + expected_glob = '*.zoom.us' + client = Client( + base_url=URL, + verify=False, + proxy=False, + ) + indicators = client.build_iterator() + cidr_indicators = {indicator['value'] for indicator in indicators if indicator['type'] == 'CIDR'} + ipv6_indicators = {indicator['value'] for indicator in indicators if indicator['type'] == 'IPv6CIDR'} + domain_glob_indicators = {indicator['value'] for indicator in indicators if indicator['type'] == 'DomainGlob'} + assert expected_cidr in cidr_indicators + assert expected_ipv6 in ipv6_indicators + assert expected_glob in domain_glob_indicators diff --git a/Packs/FeedZoom/Integrations/FeedZoom/Pipfile b/Packs/FeedZoom/Integrations/FeedZoom/Pipfile new file mode 100644 index 00000000000..70760996edd --- /dev/null +++ b/Packs/FeedZoom/Integrations/FeedZoom/Pipfile @@ -0,0 +1,42 @@ +[[source]] +name = "pypi" +url = "https://pypi.org/simple" +verify_ssl = true + +[dev-packages] +pylint = "*" +pytest = "==5.0.1" +pytest-mock = "*" +requests-mock = "*" +pytest-asyncio = "*" +pytest-xdist = "*" +pytest-datadir-ng = "*" +freezegun = "*" +pytest-json = "*" +flake8 = "*" + +[packages] +beautifulsoup4 = "==4.9.0" +certifi = "==2019.11.28" +chardet = "==3.0.4" +dateparser = "==0.7.2" +funcy = "==1.14" +idna = "==2.8" +markdownify = "==0.4.1" +olefile = "==0.46" +pyasn1 = "==0.4.8" +pycryptodome = "==3.9.7" +python-dateutil = "==2.8.1" +pytz = "==2019.3" +regex = "==2019.11.1" +requests = "==2.22.0" +rsa = "==4.0" +six = "==1.14.0" +soupsieve = "==2.0" +tzlocal = "==2.0.0" +urllib3 = "==1.25.7" +PySocks = "==1.7.1" +PyYAML = "==5.2" + +[requires] +python_version = "3.7" diff --git a/Packs/FeedZoom/Integrations/FeedZoom/Pipfile.lock b/Packs/FeedZoom/Integrations/FeedZoom/Pipfile.lock new file mode 100644 index 00000000000..f67a054dc63 --- /dev/null +++ b/Packs/FeedZoom/Integrations/FeedZoom/Pipfile.lock @@ -0,0 +1,313 @@ +{ + "_meta": { + "hash": { + "sha256": "ad93cb442695af299ced5f803aa15e40c1407e2da4d34c19b550caee5bdbb98a" + }, + "pipfile-spec": 6, + "requires": { + "python_version": "3.7" + }, + "sources": [ + { + "name": "pypi", + "url": "https://pypi.org/simple", + "verify_ssl": true + } + ] + }, + "default": {}, + "develop": { + "apipkg": { + "hashes": [ + "sha256:37228cda29411948b422fae072f57e31d3396d2ee1c9783775980ee9c9990af6", + "sha256:58587dd4dc3daefad0487f6d9ae32b4542b185e1c36db6993290e7c41ca2b47c" + ], + "version": "==1.5" + }, + "astroid": { + "hashes": [ + "sha256:71ea07f44df9568a75d0f354c49143a4575d90645e9fead6dfb52c26a85ed13a", + "sha256:840947ebfa8b58f318d42301cf8c0a20fd794a33b61cc4638e28e9e61ba32f42" + ], + "version": "==2.3.3" + }, + "atomicwrites": { + "hashes": [ + "sha256:03472c30eb2c5d1ba9227e4c2ca66ab8287fbfbbda3888aa93dc2e28fc6811b4", + "sha256:75a9445bac02d8d058d5e1fe689654ba5a6556a1dfd8ce6ec55a0ed79866cfa6" + ], + "version": "==1.3.0" + }, + "attrs": { + "hashes": [ + "sha256:08a96c641c3a74e44eb59afb61a24f2cb9f4d7188748e76ba4bb5edfa3cb7d1c", + "sha256:f7b7ce16570fe9965acd6d30101a28f62fb4a7f9e926b3bbc9b61f8b04247e72" + ], + "version": "==19.3.0" + }, + "certifi": { + "hashes": [ + "sha256:017c25db2a153ce562900032d5bc68e9f191e44e9a0f762f373977de9df1fbb3", + "sha256:25b64c7da4cd7479594d035c08c2d809eb4aab3a26e5a990ea98cc450c320f1f" + ], + "version": "==2019.11.28" + }, + "chardet": { + "hashes": [ + "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae", + "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691" + ], + "version": "==3.0.4" + }, + "execnet": { + "hashes": [ + "sha256:cacb9df31c9680ec5f95553976c4da484d407e85e41c83cb812aa014f0eddc50", + "sha256:d4efd397930c46415f62f8a31388d6be4f27a91d7550eb79bc64a756e0056547" + ], + "version": "==1.7.1" + }, + "freezegun": { + "hashes": [ + "sha256:82c757a05b7c7ca3e176bfebd7d6779fd9139c7cb4ef969c38a28d74deef89b2", + "sha256:e2062f2c7f95cc276a834c22f1a17179467176b624cc6f936e8bc3be5535ad1b" + ], + "index": "pypi", + "version": "==0.3.15" + }, + "idna": { + "hashes": [ + "sha256:7588d1c14ae4c77d74036e8c22ff447b26d0fde8f007354fd48a7814db15b7cb", + "sha256:a068a21ceac8a4d63dbfd964670474107f541babbd2250d61922f029858365fa" + ], + "version": "==2.9" + }, + "importlib-metadata": { + "hashes": [ + "sha256:06f5b3a99029c7134207dd882428a66992a9de2bef7c2b699b5641f9886c3302", + "sha256:b97607a1a18a5100839aec1dc26a1ea17ee0d93b20b0f008d80a5a050afb200b" + ], + "markers": "python_version < '3.8'", + "version": "==1.5.0" + }, + "isort": { + "hashes": [ + "sha256:54da7e92468955c4fceacd0c86bd0ec997b0e1ee80d97f67c35a78b719dccab1", + "sha256:6e811fcb295968434526407adb8796944f1988c5b65e8139058f2014cbe100fd" + ], + "version": "==4.3.21" + }, + "lazy-object-proxy": { + "hashes": [ + "sha256:0c4b206227a8097f05c4dbdd323c50edf81f15db3b8dc064d08c62d37e1a504d", + "sha256:194d092e6f246b906e8f70884e620e459fc54db3259e60cf69a4d66c3fda3449", + "sha256:1be7e4c9f96948003609aa6c974ae59830a6baecc5376c25c92d7d697e684c08", + "sha256:4677f594e474c91da97f489fea5b7daa17b5517190899cf213697e48d3902f5a", + "sha256:48dab84ebd4831077b150572aec802f303117c8cc5c871e182447281ebf3ac50", + "sha256:5541cada25cd173702dbd99f8e22434105456314462326f06dba3e180f203dfd", + "sha256:59f79fef100b09564bc2df42ea2d8d21a64fdcda64979c0fa3db7bdaabaf6239", + "sha256:8d859b89baf8ef7f8bc6b00aa20316483d67f0b1cbf422f5b4dc56701c8f2ffb", + "sha256:9254f4358b9b541e3441b007a0ea0764b9d056afdeafc1a5569eee1cc6c1b9ea", + "sha256:9651375199045a358eb6741df3e02a651e0330be090b3bc79f6d0de31a80ec3e", + "sha256:97bb5884f6f1cdce0099f86b907aa41c970c3c672ac8b9c8352789e103cf3156", + "sha256:9b15f3f4c0f35727d3a0fba4b770b3c4ebbb1fa907dbcc046a1d2799f3edd142", + "sha256:a2238e9d1bb71a56cd710611a1614d1194dc10a175c1e08d75e1a7bcc250d442", + "sha256:a6ae12d08c0bf9909ce12385803a543bfe99b95fe01e752536a60af2b7797c62", + "sha256:ca0a928a3ddbc5725be2dd1cf895ec0a254798915fb3a36af0964a0a4149e3db", + "sha256:cb2c7c57005a6804ab66f106ceb8482da55f5314b7fcb06551db1edae4ad1531", + "sha256:d74bb8693bf9cf75ac3b47a54d716bbb1a92648d5f781fc799347cfc95952383", + "sha256:d945239a5639b3ff35b70a88c5f2f491913eb94871780ebfabb2568bd58afc5a", + "sha256:eba7011090323c1dadf18b3b689845fd96a61ba0a1dfbd7f24b921398affc357", + "sha256:efa1909120ce98bbb3777e8b6f92237f5d5c8ea6758efea36a473e1d38f7d3e4", + "sha256:f3900e8a5de27447acbf900b4750b0ddfd7ec1ea7fbaf11dfa911141bc522af0" + ], + "version": "==1.4.3" + }, + "mccabe": { + "hashes": [ + "sha256:ab8a6258860da4b6677da4bd2fe5dc2c659cff31b3ee4f7f5d64e79735b80d42", + "sha256:dd8d182285a0fe56bace7f45b5e7d1a6ebcbf524e8f3bd87eb0f125271b8831f" + ], + "version": "==0.6.1" + }, + "more-itertools": { + "hashes": [ + "sha256:5dd8bcf33e5f9513ffa06d5ad33d78f31e1931ac9a18f33d37e77a180d393a7c", + "sha256:b1ddb932186d8a6ac451e1d95844b382f55e12686d51ca0c68b6f61f2ab7a507" + ], + "version": "==8.2.0" + }, + "packaging": { + "hashes": [ + "sha256:170748228214b70b672c581a3dd610ee51f733018650740e98c7df862a583f73", + "sha256:e665345f9eef0c621aa0bf2f8d78cf6d21904eef16a93f020240b704a57f1334" + ], + "version": "==20.1" + }, + "pluggy": { + "hashes": [ + "sha256:15b2acde666561e1298d71b523007ed7364de07029219b604cf808bfa1c765b0", + "sha256:966c145cd83c96502c3c3868f50408687b38434af77734af1e9ca461a4081d2d" + ], + "version": "==0.13.1" + }, + "py": { + "hashes": [ + "sha256:5e27081401262157467ad6e7f851b7aa402c5852dbcb3dae06768434de5752aa", + "sha256:c20fdd83a5dbc0af9efd622bee9a5564e278f6380fffcacc43ba6f43db2813b0" + ], + "version": "==1.8.1" + }, + "pylint": { + "hashes": [ + "sha256:3db5468ad013380e987410a8d6956226963aed94ecb5f9d3a28acca6d9ac36cd", + "sha256:886e6afc935ea2590b462664b161ca9a5e40168ea99e5300935f6591ad467df4" + ], + "index": "pypi", + "version": "==2.4.4" + }, + "pyparsing": { + "hashes": [ + "sha256:4c830582a84fb022400b85429791bc551f1f4871c33f23e44f353119e92f969f", + "sha256:c342dccb5250c08d45fd6f8b4a559613ca603b57498511740e65cd11a2e7dcec" + ], + "version": "==2.4.6" + }, + "pytest": { + "hashes": [ + "sha256:6ef6d06de77ce2961156013e9dff62f1b2688aa04d0dc244299fe7d67e09370d", + "sha256:a736fed91c12681a7b34617c8fcefe39ea04599ca72c608751c31d89579a3f77" + ], + "index": "pypi", + "version": "==5.0.1" + }, + "pytest-asyncio": { + "hashes": [ + "sha256:9fac5100fd716cbecf6ef89233e8590a4ad61d729d1732e0a96b84182df1daaf", + "sha256:d734718e25cfc32d2bf78d346e99d33724deeba774cc4afdf491530c6184b63b" + ], + "index": "pypi", + "version": "==0.10.0" + }, + "pytest-datadir-ng": { + "hashes": [ + "sha256:0d9e0212eaa4d0440a4b7c3d2df4b4b7eeebde1854ab383c5aff590764ad8a52", + "sha256:7fec7a4996a12529a935512c128624fa7289495b520fd31b4645c3a71daa394e" + ], + "index": "pypi", + "version": "==1.1.1" + }, + "pytest-forked": { + "hashes": [ + "sha256:1805699ed9c9e60cb7a8179b8d4fa2b8898098e82d229b0825d8095f0f261100", + "sha256:1ae25dba8ee2e56fb47311c9638f9e58552691da87e82d25b0ce0e4bf52b7d87" + ], + "version": "==1.1.3" + }, + "pytest-json": { + "hashes": [ + "sha256:8bf4e1be1691f4416bc12b14785b5ad9e842887b0b2b2d61b37dcb555b208630" + ], + "index": "pypi", + "version": "==0.4.0" + }, + "pytest-mock": { + "hashes": [ + "sha256:b35eb281e93aafed138db25c8772b95d3756108b601947f89af503f8c629413f", + "sha256:cb67402d87d5f53c579263d37971a164743dc33c159dfb4fb4a86f37c5552307" + ], + "index": "pypi", + "version": "==2.0.0" + }, + "pytest-xdist": { + "hashes": [ + "sha256:0f46020d3d9619e6d17a65b5b989c1ebbb58fc7b1da8fb126d70f4bac4dfeed1", + "sha256:7dc0d027d258cd0defc618fb97055fbd1002735ca7a6d17037018cf870e24011" + ], + "index": "pypi", + "version": "==1.31.0" + }, + "python-dateutil": { + "hashes": [ + "sha256:73ebfe9dbf22e832286dafa60473e4cd239f8592f699aa5adaf10050e6e1823c", + "sha256:75bb3f31ea686f1197762692a9ee6a7550b59fc6ca3a1f4b5d7e32fb98e2da2a" + ], + "version": "==2.8.1" + }, + "requests": { + "hashes": [ + "sha256:43999036bfa82904b6af1d99e4882b560e5e2c68e5c4b0aa03b655f3d7d73fee", + "sha256:b3f43d496c6daba4493e7c431722aeb7dbc6288f52a6e04e7b6023b0247817e6" + ], + "version": "==2.23.0" + }, + "requests-mock": { + "hashes": [ + "sha256:510df890afe08d36eca5bb16b4aa6308a6f85e3159ad3013bac8b9de7bd5a010", + "sha256:88d3402dd8b3c69a9e4f9d3a73ad11b15920c6efd36bc27bf1f701cf4a8e4646" + ], + "index": "pypi", + "version": "==1.7.0" + }, + "six": { + "hashes": [ + "sha256:236bdbdce46e6e6a3d61a337c0f8b763ca1e8717c03b369e87a7ec7ce1319c0a", + "sha256:8f3cd2e254d8f793e7f3d6d9df77b92252b52637291d0f0da013c76ea2724b6c" + ], + "version": "==1.14.0" + }, + "typed-ast": { + "hashes": [ + "sha256:0666aa36131496aed8f7be0410ff974562ab7eeac11ef351def9ea6fa28f6355", + "sha256:0c2c07682d61a629b68433afb159376e24e5b2fd4641d35424e462169c0a7919", + "sha256:249862707802d40f7f29f6e1aad8d84b5aa9e44552d2cc17384b209f091276aa", + "sha256:24995c843eb0ad11a4527b026b4dde3da70e1f2d8806c99b7b4a7cf491612652", + "sha256:269151951236b0f9a6f04015a9004084a5ab0d5f19b57de779f908621e7d8b75", + "sha256:4083861b0aa07990b619bd7ddc365eb7fa4b817e99cf5f8d9cf21a42780f6e01", + "sha256:498b0f36cc7054c1fead3d7fc59d2150f4d5c6c56ba7fb150c013fbc683a8d2d", + "sha256:4e3e5da80ccbebfff202a67bf900d081906c358ccc3d5e3c8aea42fdfdfd51c1", + "sha256:6daac9731f172c2a22ade6ed0c00197ee7cc1221aa84cfdf9c31defeb059a907", + "sha256:715ff2f2df46121071622063fc7543d9b1fd19ebfc4f5c8895af64a77a8c852c", + "sha256:73d785a950fc82dd2a25897d525d003f6378d1cb23ab305578394694202a58c3", + "sha256:8c8aaad94455178e3187ab22c8b01a3837f8ee50e09cf31f1ba129eb293ec30b", + "sha256:8ce678dbaf790dbdb3eba24056d5364fb45944f33553dd5869b7580cdbb83614", + "sha256:aaee9905aee35ba5905cfb3c62f3e83b3bec7b39413f0a7f19be4e547ea01ebb", + "sha256:bcd3b13b56ea479b3650b82cabd6b5343a625b0ced5429e4ccad28a8973f301b", + "sha256:c9e348e02e4d2b4a8b2eedb48210430658df6951fa484e59de33ff773fbd4b41", + "sha256:d205b1b46085271b4e15f670058ce182bd1199e56b317bf2ec004b6a44f911f6", + "sha256:d43943ef777f9a1c42bf4e552ba23ac77a6351de620aa9acf64ad54933ad4d34", + "sha256:d5d33e9e7af3b34a40dc05f498939f0ebf187f07c385fd58d591c533ad8562fe", + "sha256:fc0fea399acb12edbf8a628ba8d2312f583bdbdb3335635db062fa98cf71fca4", + "sha256:fe460b922ec15dd205595c9b5b99e2f056fd98ae8f9f56b888e7a17dc2b757e7" + ], + "markers": "implementation_name == 'cpython' and python_version < '3.8'", + "version": "==1.4.1" + }, + "urllib3": { + "hashes": [ + "sha256:2f3db8b19923a873b3e5256dc9c2dedfa883e33d87c690d9c7913e1f40673cdc", + "sha256:87716c2d2a7121198ebcb7ce7cccf6ce5e9ba539041cfbaeecfb641dc0bf6acc" + ], + "version": "==1.25.8" + }, + "wcwidth": { + "hashes": [ + "sha256:8fd29383f539be45b20bd4df0dc29c20ba48654a41e661925e612311e9f3c603", + "sha256:f28b3e8a6483e5d49e7f8949ac1a78314e740333ae305b4ba5defd3e74fb37a8" + ], + "version": "==0.1.8" + }, + "wrapt": { + "hashes": [ + "sha256:565a021fd19419476b9362b05eeaa094178de64f8361e44468f9e9d7843901e1" + ], + "version": "==1.11.2" + }, + "zipp": { + "hashes": [ + "sha256:12248a63bbdf7548f89cb4c7cda4681e537031eda29c02ea29674bc6854460c2", + "sha256:7c0f8e91abc0dc07a5068f315c52cb30c66bfbc581e5b50704c8a2f6ebae794a" + ], + "version": "==3.0.0" + } + } +} diff --git a/Packs/FeedZoom/Integrations/FeedZoom/README.md b/Packs/FeedZoom/Integrations/FeedZoom/README.md new file mode 100644 index 00000000000..08330365aea --- /dev/null +++ b/Packs/FeedZoom/Integrations/FeedZoom/README.md @@ -0,0 +1,10 @@ +## Zoom Endpoints Web Scraper +https://support.zoom.us/hc/en-us/articles/201362683-Network-Firewall-or-Proxy-Server-Settings-for-Zoom + +Most IT services are moving from on-premise solutions to cloud-based solutions. The public IP addresses, domains, and URLs that function as the endpoints for these solutions are very often not fixed, and the providers of the service publish their details on their websites in a less than ideal format (i.e., HTML) rather than through a proper REST API (i.e., JSON). + +This fact makes it very difficult for IT and Security teams to provide these services with an appropriate level of security and automation. Any changes in the HTML schema of the provider website, will break the automation and has the potential to cause serious disruption to the users and the business. The alternative is to compromise on the security posture of the organization. + +One example of these providers is Zoom. + +This pack aims is to address this issue by automating the collection of endpoint data in the form of an indicator feed. This will facilitate validation of the indicators before using them in enforcement points, for example firewalls, proxies, and more. diff --git a/Packs/FeedZoom/Integrations/FeedZoom/test_data/zoom_endpoint_mock.html b/Packs/FeedZoom/Integrations/FeedZoom/test_data/zoom_endpoint_mock.html new file mode 100644 index 00000000000..d8edbf44b21 --- /dev/null +++ b/Packs/FeedZoom/Integrations/FeedZoom/test_data/zoom_endpoint_mock.html @@ -0,0 +1,557 @@ + + + + + + + + Network Firewall or Proxy Server Settings for Zoom – Zoom Help Center + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    + + + +
    + +
    +

    +
    +Important Notice: Please update all of your Zoom applications to version 5.0 or higher. After May 30, 2020, all Zoom applications on older versions will receive a forced upgrade when trying to join meetings as GCM Encryption will be fully enabled across the Zoom platform. Learn more on how to update your Zoom application or update now.

    +Note: As our world comes together to slow the spread of COVID-19 pandemic, the Zoom Support Center has continued to operate 24x7 globally to support you. Please see the updated Support Guidelines during these unprecedented times. +

    +
    + + +
    +
    +
    + +
    +


    + +
    + +
    +
    + +
    + +
    + +

    Related articles

    + + +
    + + +
    +
    + +
    +
    +

    Network Firewall or Proxy Server Settings for Zoom Follow

    + +
    + +
    +
    +

    Network Firewall or Web Security Gateway

    +

    If your app stays in a "connecting" mode or  timed out due to "Network error, please try again" or "Can't connect to our service, please check your network connection and try again"  - it could be related to your network connection, network firewall settings or web security gateway settings.

    +

    Note: Check your network connection by opening a browser and ensure that you can access https://www.demisto.com

    +

    To configure your network firewall, please see the following table: 

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ProtocolPortsSourceDestination
    TCP80,443All Zoom Clients*.zoom.us
    TCP443, 8801, 8802All Zoom Clients +

    IPv4:

    +

    3.7.35.0/25
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/23
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/23
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/23
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/32
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/23
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/32
    8.8.8.8/26
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/22
    8.8.8.8/25
    8.8.8.8/23
    8.8.8.8/22
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/26  
    8.8.8.8/26
    8.8.8.8/26 
    8.8.8.8/26
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/19
    8.8.8.8/17
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/22
    8.8.8.8/22
    8.8.8.8/22
    8.8.8.8/23
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/20
    8.8.8.8/22
    8.8.8.8/22
    8.8.8.8/19
    8.8.8.8/22
    8.8.8.8/19
    8.8.8.8/17
    8.8.8.8/27
    8.8.8.8/27
    8.8.8.8/21
    8.8.8.8/22
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/27
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/27

    IPv6:
    2620:123:2000::/40

    +
    UDP +

    3478, 3479, 8801 - 8810

    +    		All Zoom Clients +

    IPv4:

    +

    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/23
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/23
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/23
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/32
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/23
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/32
    8.8.8.8/26
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/22
    8.8.8.8/25
    8.8.8.8/23
    8.8.8.8/22
    8.8.8.8/25
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/26  
    8.8.8.8/26
    8.8.8.8/26 
    8.8.8.8/26
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/19
    8.8.8.8/17
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/22
    8.8.8.8/22
    8.8.8.8/22
    8.8.8.8/23
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/20
    8.8.8.8/22
    8.8.8.8/22
    8.8.8.8/19
    8.8.8.8/22
    8.8.8.8/19
    8.8.8.8/17
    8.8.8.8/27
    8.8.8.8/27
    8.8.8.8/21
    8.8.8.8/22
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/27
    8.8.8.8/25
    8.8.8.8/25
    8.8.8.8/27

    IPv6:
    2620:123:2000::/40

    +
    +

     

    +

    Connection Type: Zoom Phone

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ProtocolPortsSourceDestination
    TCP5090, 5091All Zoom Clients8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/23
    8.8.8.8/22
    8.8.8.8/24
    8.8.8.8/19
    8.8.8.8/22
    8.8.8.8/24
    8.8.8.8/24
    UDP5090All Zoom Clients8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/23
    8.8.8.8/22
    8.8.8.8/24
    8.8.8.8/19
    8.8.8.8/22
    8.8.8.8/24
    8.8.8.8/24
    UDP20000-64000All Zoom Clients8.8.8.8/24
    8.8.8.8/23
    8.8.8.8/19
    8.8.8.8/22
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    8.8.8.8/24
    +

     

    +

    Connection Type: Zoom Website

    + + + + + + + + + + + + + + + + + +
    ProtocolPortsSourceDestination
    TCP80, 443All Zoom Clients*.zoom.us
    *.cloudfront.net
    +


    Proxy Server 

    +

    We support https/SSL proxy server via port 443.

    +

    Zoom automatically detects your proxy settings. In some instances, you may be prompted to enter the proxy username/password.

    +

    Note: We recommend whitelisting zoom.us and *.zoom.us from proxy or SSL inspection. 

    +

    Note: IP ranges to be whitelisted can also be found at the following:

    + +

    For Meeting Connector and Others

    + +

    Please submit a ticket if you have further questions. 

    +

     

    +
    + +
    +
      + +
    +
    + +
    + +
    + Was this article helpful? +
    + + +
    + +
    + +
    +
    +
    + +
    +
    +
    + + + +