Skip to content

Field mappings + Alert Details Widget #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Jun 29, 2020
Merged

Field mappings + Alert Details Widget #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
34ae9b8
New fields
Jun 24, 2020
e46d7ff
Update views
Jun 24, 2020
9e82c54
Merge branch 'master' into field-mappings
Jun 24, 2020
e06461a
gen yml
Jun 24, 2020
e2af568
savE
Jun 24, 2020
aaa6cd0
move and use file events mapping
Jun 25, 2020
8404248
Create details widget
Jun 25, 2020
720fda7
Merge branch 'master' into field-mappings
Jun 26, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions Packs/Code42/IncidentFields/incidentfield-Code42_Alert_Description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
{
"associatedToAll": false,
"associatedTypes": [
"Code42 Security Alert"
],
"breachScript": "",
"caseInsensitive": true,
"cliName": "code42alertdescription",
"closeForm": false,
"columns": null,
"content": false,
"defaultRows": null,
"description": "",
"editForm": true,
"fieldCalcScript": "",
"group": 0,
"hidden": false,
"id": "incident_code42alertdescription",
"isReadOnly": false,
"locked": false,
"mergeStrategy": "",
"name": "Code42 Alert Description",
"neverSetAsRequired": false,
"ownerOnly": false,
"placeholder": "",
"required": false,
"script": "",
"selectValues": null,
"sla": 0,
"sortValues": null,
"system": false,
"systemAssociatedTypes": null,
"threshold": 72,
"type": "shortText",
"unmapped": false,
"unsearchable": false,
"useAsKpi": false,
"validatedError": "",
"validationRegex": "",
"version": -1
}
41 changes: 41 additions & 0 deletions Packs/Code42/IncidentFields/incidentfield-Code42_Alert_ID.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
{
"associatedToAll": false,
"associatedTypes": [
"Code42 Security Alert"
],
"breachScript": "",
"caseInsensitive": true,
"cliName": "code42alertid",
"closeForm": false,
"columns": null,
"content": false,
"defaultRows": null,
"description": "",
"editForm": true,
"fieldCalcScript": "",
"group": 0,
"hidden": false,
"id": "incident_code42alertid",
"isReadOnly": false,
"locked": false,
"mergeStrategy": "",
"name": "Code42 Alert ID",
"neverSetAsRequired": false,
"ownerOnly": false,
"placeholder": "",
"required": false,
"script": "",
"selectValues": null,
"sla": 0,
"sortValues": null,
"system": false,
"systemAssociatedTypes": null,
"threshold": 72,
"type": "shortText",
"unmapped": false,
"unsearchable": false,
"useAsKpi": false,
"validatedError": "",
"validationRegex": "",
"version": -1
}
41 changes: 41 additions & 0 deletions Packs/Code42/IncidentFields/incidentfield-Code42_Alert_Name.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
{
"associatedToAll": false,
"associatedTypes": [
"Code42 Security Alert"
],
"breachScript": "",
"caseInsensitive": true,
"cliName": "code42alertname",
"closeForm": false,
"columns": null,
"content": false,
"defaultRows": null,
"description": "",
"editForm": true,
"fieldCalcScript": "",
"group": 0,
"hidden": false,
"id": "incident_code42alertname",
"isReadOnly": false,
"locked": false,
"mergeStrategy": "",
"name": "Code42 Alert Name",
"neverSetAsRequired": false,
"ownerOnly": false,
"placeholder": "",
"required": false,
"script": "",
"selectValues": null,
"sla": 0,
"sortValues": null,
"system": false,
"systemAssociatedTypes": null,
"threshold": 72,
"type": "shortText",
"unmapped": false,
"unsearchable": false,
"useAsKpi": false,
"validatedError": "",
"validationRegex": "",
"version": -1
}
41 changes: 41 additions & 0 deletions Packs/Code42/IncidentFields/incidentfield-Code42_Alert_State.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
{
"associatedToAll": false,
"associatedTypes": [
"Code42 Security Alert"
],
"breachScript": "",
"caseInsensitive": true,
"cliName": "code42alertstate",
"closeForm": false,
"columns": null,
"content": false,
"defaultRows": null,
"description": "",
"editForm": true,
"fieldCalcScript": "",
"group": 0,
"hidden": false,
"id": "incident_code42alertstate",
"isReadOnly": false,
"locked": false,
"mergeStrategy": "",
"name": "Code42 Alert State",
"neverSetAsRequired": false,
"ownerOnly": false,
"placeholder": "",
"required": false,
"script": "",
"selectValues": [],
"sla": 0,
"sortValues": null,
"system": false,
"systemAssociatedTypes": null,
"threshold": 72,
"type": "shortText",
"unmapped": false,
"unsearchable": false,
"useAsKpi": false,
"validatedError": "",
"validationRegex": "",
"version": -1
}
41 changes: 41 additions & 0 deletions Packs/Code42/IncidentFields/incidentfield-Code42_Alert_Timestamp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
{
"associatedToAll": false,
"associatedTypes": [
"Code42 Security Alert"
],
"breachScript": "",
"caseInsensitive": true,
"cliName": "code42alerttimestamp",
"closeForm": false,
"columns": null,
"content": false,
"defaultRows": null,
"description": "",
"editForm": true,
"fieldCalcScript": "",
"group": 0,
"hidden": false,
"id": "incident_code42alerttimestamp",
"isReadOnly": false,
"locked": false,
"mergeStrategy": "",
"name": "Code42 Alert Timestamp",
"neverSetAsRequired": false,
"ownerOnly": false,
"placeholder": "",
"required": false,
"script": "",
"selectValues": null,
"sla": 0,
"sortValues": null,
"system": false,
"systemAssociatedTypes": null,
"threshold": 72,
"type": "shortText",
"unmapped": false,
"unsearchable": false,
"useAsKpi": false,
"validatedError": "",
"validationRegex": "",
"version": -1
}
41 changes: 41 additions & 0 deletions Packs/Code42/IncidentFields/incidentfield-Code42_Severity.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
{
"associatedToAll": false,
"associatedTypes": [
"Code42 Security Alert"
],
"breachScript": "",
"caseInsensitive": true,
"cliName": "code42severity",
"closeForm": false,
"columns": null,
"content": false,
"defaultRows": null,
"description": "",
"editForm": true,
"fieldCalcScript": "",
"group": 0,
"hidden": false,
"id": "incident_code42severity",
"isReadOnly": false,
"locked": false,
"mergeStrategy": "",
"name": "Code42 Severity",
"neverSetAsRequired": false,
"ownerOnly": false,
"placeholder": "",
"required": false,
"script": "",
"selectValues": [],
"sla": 0,
"sortValues": null,
"system": false,
"systemAssociatedTypes": null,
"threshold": 72,
"type": "shortText",
"unmapped": false,
"unsearchable": false,
"useAsKpi": false,
"validatedError": "",
"validationRegex": "",
"version": -1
}
39 changes: 39 additions & 0 deletions Packs/Code42/IncidentFields/incidentfield-Code42_Username.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
{
"associatedToAll": true,
"associatedTypes": null,
"breachScript": "",
"caseInsensitive": true,
"cliName": "code42username",
"closeForm": false,
"columns": null,
"content": false,
"defaultRows": null,
"description": "",
"editForm": true,
"fieldCalcScript": "",
"group": 0,
"hidden": false,
"id": "incident_code42username",
"isReadOnly": false,
"locked": false,
"mergeStrategy": "",
"name": "Code42 Username",
"neverSetAsRequired": false,
"ownerOnly": false,
"placeholder": "",
"required": false,
"script": "",
"selectValues": null,
"sla": 0,
"sortValues": null,
"system": false,
"systemAssociatedTypes": null,
"threshold": 72,
"type": "shortText",
"unmapped": false,
"unsearchable": false,
"useAsKpi": false,
"validatedError": "",
"validationRegex": "",
"version": -1
}
1 change: 0 additions & 1 deletion Packs/Code42/IncidentTypes/incidenttype-Code42_Security_Alert.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,5 +21,4 @@
"weeks": 0,
"weeksR": 0,
"fromVersion": "5.0.0"

}
11 changes: 6 additions & 5 deletions Packs/Code42/Integrations/Code42/Code42.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -684,11 +684,11 @@ def _stringify_lists_if_needed(event):
event["sharedWith"] = str(shared_list)
if private_ip_addresses:
event["privateIpAddresses"] = str(private_ip_addresses)
return event


def _process_event_from_observation(event):
_stringify_lists_if_needed(event)
return event
return _stringify_lists_if_needed(event)


class Code42SecurityIncidentFetcher(object):
Expand Down Expand Up @@ -754,14 +754,15 @@ def _fetch_alerts(self, start_query_time):
def _create_incident_from_alert(self, alert):
details = self._client.get_alert_details(alert["id"])
incident = _create_incident_from_alert_details(details)
self._relate_files_to_alert(details)
details = self._relate_files_to_alert(details)
incident["rawJSON"] = json.dumps(details)
return incident

def _relate_files_to_alert(self, alert_details):
for obs in alert_details["observations"]:
file_events = self._get_file_events_from_alert_details(obs, alert_details)
alert_details["fileevents"] = [_process_event_from_observation(e) for e in file_events]
return alert_details

def _get_file_events_from_alert_details(self, observation, alert_details):
security_data_query = map_observation_to_security_query(observation, alert_details["actor"])
Expand Down Expand Up @@ -842,7 +843,7 @@ def main():
# Remove trailing slash to prevent wrong URL path to service
verify_certificate = not demisto.params().get("insecure", False)
proxy = demisto.params().get("proxy", False)
LOG(f"Command being called is {demisto.command()}")
LOG("Command being called is {0}.".format(demisto.command()))
try:
client = Code42Client(
base_url=base_url,
Expand Down Expand Up @@ -890,7 +891,7 @@ def main():
return_outputs(*commands[command](client, demisto.args()))
# Log exceptions
except Exception as e:
return_error(f"Failed to execute {demisto.command()} command. Error: {str(e)}")
return_error("Failed to execute {0} command. Error: {1}".format(demisto.command(), str(e)))


if __name__ in ("__main__", "__builtin__", "builtins"):
Expand Down
7 changes: 4 additions & 3 deletions Packs/Code42/Integrations/Code42/integration-Code42.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -764,11 +764,11 @@ script:
event["sharedWith"] = str(shared_list)
if private_ip_addresses:
event["privateIpAddresses"] = str(private_ip_addresses)
return event


def _process_event_from_observation(event):
_stringify_lists_if_needed(event)
return event
return _stringify_lists_if_needed(event)


class Code42SecurityIncidentFetcher(object):
Expand Down Expand Up @@ -834,14 +834,15 @@ script:
def _create_incident_from_alert(self, alert):
details = self._client.get_alert_details(alert["id"])
incident = _create_incident_from_alert_details(details)
self._relate_files_to_alert(details)
details = self._relate_files_to_alert(details)
incident["rawJSON"] = json.dumps(details)
return incident

def _relate_files_to_alert(self, alert_details):
for obs in alert_details["observations"]:
file_events = self._get_file_events_from_alert_details(obs, alert_details)
alert_details["fileevents"] = [_process_event_from_observation(e) for e in file_events]
return alert_details

def _get_file_events_from_alert_details(self, observation, alert_details):
security_data_query = map_observation_to_security_query(observation, alert_details["actor"])
Expand Down
Loading