Skip to content

Commit 09b057c

Browse files
eyalpalodorschw
eyalpalo
and
dorschw
authored
Xsiam layout rule (#23481)
* poetry * revert * debug logs added * revert * added layout rule * Update Tests/scripts/collect_tests/constants.py Co-authored-by: dorschw <[email protected]> * CR fixes * bug fix * removed from SIEM RULES OBJECT * added code pan run to secrets ignore * release notes --------- Co-authored-by: dorschw <[email protected]>
1 parent cbc5088 commit 09b057c

File tree

18 files changed

+178
-8
lines changed

18 files changed

+178
-8
lines changed

‎Packs/AccessInvestigation/LayoutRules/Access.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"rule_id": "Access_layout_rule",
3+
"layout_id": "Access",
4+
"description": "",
5+
"rule_name": "Access Layout Rule",
6+
"alerts_filter": {
7+
"filter": {
8+
"AND": [
9+
{
10+
"SEARCH_FIELD": "alert_type",
11+
"SEARCH_TYPE": "EQ",
12+
"SEARCH_VALUE": "Access"
13+
}
14+
]
15+
}
16+
},
17+
"fromVersion": "6.10.0"
18+
}

‎Packs/AccessInvestigation/ReleaseNotes/1_2_3.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
2+
#### Layout Rules
3+
##### New: Access Layout Rule
4+
- Added support for layouts and layout rules in XSIAM.

‎Packs/AccessInvestigation/pack_metadata.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Access Investigation",
33
"description": "This Content Pack automates response to unauthorised access incidents and contains customer access incident views and layouts to aid investigation.",
44
"support": "xsoar",
5-
"currentVersion": "1.2.2",
5+
"currentVersion": "1.2.3",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",
@@ -37,4 +37,4 @@
3737
"xsoar",
3838
"marketplacev2"
3939
]
40-
}
40+
}

‎Packs/CommonTypes/LayoutRules/Indicator_Feed.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"rule_id": "Indicator_Feed_layout_rule",
3+
"layout_id": "Indicator Feed",
4+
"description": "",
5+
"rule_name": "Indicator Feed Layout Rule",
6+
"alerts_filter": {
7+
"filter": {
8+
"AND": [
9+
{
10+
"SEARCH_FIELD": "alert_type",
11+
"SEARCH_TYPE": "EQ",
12+
"SEARCH_VALUE": "Indicator Feed"
13+
}
14+
]
15+
}
16+
},
17+
"fromVersion": "6.10.0"
18+
}

‎Packs/CommonTypes/LayoutRules/Vulnerability.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"rule_id": "Vulnerability_layout_rule",
3+
"layout_id": "Vulnerability",
4+
"description": "",
5+
"rule_name": "Vulnerability Layout Rule",
6+
"alerts_filter": {
7+
"filter": {
8+
"AND": [
9+
{
10+
"SEARCH_FIELD": "alert_type",
11+
"SEARCH_TYPE": "EQ",
12+
"SEARCH_VALUE": "Vulnerability"
13+
}
14+
]
15+
}
16+
},
17+
"fromVersion": "6.10.0"
18+
}

‎Packs/CommonTypes/ReleaseNotes/3_3_49.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
2+
#### Layout Rules
3+
##### New: Vulnerability Layout Rule
4+
- Added support for layouts and layout rules in XSIAM.
5+
##### New: Indicator Feed Layout Rule
6+
- Added support for layouts and layout rules in XSIAM.

‎Packs/CommonTypes/pack_metadata.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Common Types",
33
"description": "This Content Pack will get you up and running in no-time and provide you with the most commonly used incident & indicator fields and types.",
44
"support": "xsoar",
5-
"currentVersion": "3.3.48",
5+
"currentVersion": "3.3.49",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",

‎Packs/CrisisManagement/LayoutRules/Employee_Health_Check.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"rule_id": "Employee_Health_Check_layout_rule",
3+
"layout_id": "Employee Health Check",
4+
"description": "",
5+
"rule_name": "Employee Health Check Layout Rule",
6+
"alerts_filter": {
7+
"filter": {
8+
"AND": [
9+
{
10+
"SEARCH_FIELD": "alert_type",
11+
"SEARCH_TYPE": "EQ",
12+
"SEARCH_VALUE": "Employee Health Check"
13+
}
14+
]
15+
}
16+
},
17+
"fromVersion": "6.10.0"
18+
}

‎Packs/CrisisManagement/ReleaseNotes/1_2_3.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
2+
#### Layout Rules
3+
##### New: Employee Health Check Layout Rule
4+
- Added support for layouts and layout rules in XSIAM.

‎Packs/CrisisManagement/pack_metadata.json

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,13 @@
22
"name": "Crisis Management",
33
"description": "This Content Pack helps you automate data collection and crisis event communications such as monitoring remote employee health and safety well being.",
44
"support": "xsoar",
5-
"currentVersion": "1.2.2",
5+
"currentVersion": "1.2.3",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",
9-
"videos": ["https://www.youtube.com/watch?v=J6DcD5y5B_U"],
9+
"videos": [
10+
"https://www.youtube.com/watch?v=J6DcD5y5B_U"
11+
],
1012
"categories": [
1113
"Case Management"
1214
],

‎Packs/IronDefense/LayoutRules/IronDefense_Alert_Notification.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"rule_id": "IronDefense_Alert_Notification_layout_rule",
3+
"layout_id": "IronDefense Alert Notification",
4+
"description": "",
5+
"rule_name": "IronDefense Alert Notification Layout Rule",
6+
"alerts_filter": {
7+
"filter": {
8+
"AND": [
9+
{
10+
"SEARCH_FIELD": "alert_type",
11+
"SEARCH_TYPE": "EQ",
12+
"SEARCH_VALUE": "IronDefense Alert Notification"
13+
}
14+
]
15+
}
16+
},
17+
"fromVersion": "6.10.0"
18+
}

‎Packs/IronDefense/LayoutRules/IronDefense_Event_Notification.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"rule_id": "IronDefense_Event_Notification_layout_rule",
3+
"layout_id": "IronDefense Event Notification",
4+
"description": "",
5+
"rule_name": "IronDefense Event Notification Layout Rule",
6+
"alerts_filter": {
7+
"filter": {
8+
"AND": [
9+
{
10+
"SEARCH_FIELD": "alert_type",
11+
"SEARCH_TYPE": "EQ",
12+
"SEARCH_VALUE": "IronDefense Event Notification"
13+
}
14+
]
15+
}
16+
},
17+
"fromVersion": "6.10.0"
18+
}

‎Packs/IronDefense/LayoutRules/IronDefense_IronDome_Notification.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"rule_id": "IronDome_Notification_layout_rule",
3+
"layout_id": "IronDefense IronDome Notification",
4+
"description": "",
5+
"rule_name": "IronDome Notification Layout Rule",
6+
"alerts_filter": {
7+
"filter": {
8+
"AND": [
9+
{
10+
"SEARCH_FIELD": "alert_type",
11+
"SEARCH_TYPE": "EQ",
12+
"SEARCH_VALUE": "IronDefense IronDome Notification"
13+
}
14+
]
15+
}
16+
},
17+
"fromVersion": "6.10.0"
18+
}

‎Packs/IronDefense/ReleaseNotes/1_1_15.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
2+
#### Layout Rules
3+
##### New: IronDome Notification Layout Rule
4+
- Added support for layouts and layout rules in XSIAM.
5+
##### New: IronDefense Alert Notification Layout Rule
6+
- Added support for layouts and layout rules in XSIAM.
7+
##### New: IronDefense Event Notification Layout Rule
8+
- Added support for layouts and layout rules in XSIAM.

‎Packs/IronDefense/pack_metadata.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "IronNet",
33
"description": "The IronDefense Integration allows users to interact with IronDefense alerts within Demisto. The Integration provides the ability to rate alerts, update alert statuses, add comments to alerts, and to report observed bad activity.",
44
"support": "partner",
5-
"currentVersion": "1.1.14",
5+
"currentVersion": "1.1.15",
66
"author": "Iron Defense",
77
"url": "https://ironnet.atlassian.net/servicedesk/customer/portal/4",
88
"email": "[email protected]",

‎Tests/Marketplace/marketplace_constants.py

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,7 @@ class PackFolders(enum.Enum):
222222
TRIGGERS = 'Triggers'
223223
WIZARDS = 'Wizards'
224224
XDRC_TEMPLATES = 'XDRCTemplates'
225+
LAYOUT_RULES = 'LayoutRules'
225226

226227
@classmethod
227228
def pack_displayed_items(cls):
@@ -234,7 +235,7 @@ def pack_displayed_items(cls):
234235
PackFolders.GENERIC_TYPES.value, PackFolders.LISTS.value, PackFolders.JOBS.value,
235236
PackFolders.PARSING_RULES.value, PackFolders.MODELING_RULES.value, PackFolders.CORRELATION_RULES.value,
236237
PackFolders.XSIAM_DASHBOARDS.value, PackFolders.XSIAM_REPORTS.value, PackFolders.TRIGGERS.value,
237-
PackFolders.WIZARDS.value, PackFolders.XDRC_TEMPLATES.value,
238+
PackFolders.WIZARDS.value, PackFolders.XDRC_TEMPLATES.value, PackFolders.LAYOUT_RULES.value
238239
}
239240

240241
@classmethod
@@ -253,7 +254,7 @@ def json_supported_folders(cls):
253254
PackFolders.GENERIC_MODULES.value, PackFolders.GENERIC_TYPES.value, PackFolders.LISTS.value,
254255
PackFolders.PREPROCESS_RULES.value, PackFolders.JOBS.value, PackFolders.XSIAM_DASHBOARDS.value,
255256
PackFolders.XSIAM_REPORTS.value, PackFolders.TRIGGERS.value, PackFolders.WIZARDS.value,
256-
PackFolders.XDRC_TEMPLATES.value,
257+
PackFolders.XDRC_TEMPLATES.value, PackFolders.LAYOUT_RULES.value
257258
}
258259

259260

@@ -306,6 +307,7 @@ class PackIgnored(object):
306307
PackFolders.TRIGGERS.value: "Triggers",
307308
PackFolders.WIZARDS.value: "Wizards",
308309
PackFolders.XDRC_TEMPLATES.value: "XDRCTemplates",
310+
PackFolders.LAYOUT_RULES.value: "LayoutRules"
309311
}
310312

311313

@@ -390,6 +392,7 @@ class Changelog(object):
390392
'Triggers Recommendations': 'Triggers',
391393
'Wizards': 'Wizards',
392394
'XDRC Templates': 'XDRCTemplates',
395+
'Layout Rules': 'LayoutRules'
393396
}
394397

395398

@@ -422,6 +425,7 @@ class Changelog(object):
422425
PackFolders.TRIGGERS.value: "trigger",
423426
PackFolders.WIZARDS.value: "wizard",
424427
PackFolders.XDRC_TEMPLATES.value: "xdrctemplate",
428+
PackFolders.LAYOUT_RULES.value: "layoutrule"
425429
}
426430

427431
ITEMS_NAMES_TO_DISPLAY_MAPPING = {
@@ -452,4 +456,5 @@ class Changelog(object):
452456
CONTENT_ITEM_NAME_MAPPING[PackFolders.TRIGGERS.value]: "Trigger",
453457
CONTENT_ITEM_NAME_MAPPING[PackFolders.WIZARDS.value]: "Wizard",
454458
CONTENT_ITEM_NAME_MAPPING[PackFolders.XDRC_TEMPLATES.value]: "XDRC Template",
459+
CONTENT_ITEM_NAME_MAPPING[PackFolders.LAYOUT_RULES.value]: "Layout Rule"
455460
}

‎Tests/Marketplace/marketplace_services.py

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2344,6 +2344,19 @@ def collect_content_items(self):
23442344
'marketplaces': content_item.get('marketplaces', ["marketplacev2"]),
23452345
})
23462346

2347+
elif current_directory == PackFolders.LAYOUT_RULES.value and pack_file_name.startswith(
2348+
"external-"):
2349+
self.add_pack_type_tags(content_item, 'LayoutRule')
2350+
layout_rule_metadata = {
2351+
'id': content_item.get('id', ''),
2352+
'name': content_item.get('name', ''),
2353+
'marketplaces': content_item.get('marketplaces', ["marketplacev2"]),
2354+
}
2355+
layout_rule_description = content_item.get('description')
2356+
if layout_rule_description is not None:
2357+
layout_rule_metadata['description'] = layout_rule_description
2358+
folder_collected_items.append(layout_rule_metadata)
2359+
23472360
else:
23482361
logging.info(f'Failed to collect: {current_directory}')
23492362

‎Tests/scripts/collect_tests/utils.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,8 @@ def id_(self) -> Optional[str]: # Optional as some content items don't have an
196196
return self['trigger_id']
197197
if self.path.parent.parent.name == 'XDRCTemplates' and self.path.suffix == '.json':
198198
return self['content_global_id']
199+
if self.path.parent.name == 'LayoutRules' and self.path.suffix == '.json':
200+
return self['rule_id']
199201
return self['id']
200202

201203
@property

0 commit comments

Comments
 (0)