Skip to content

Commit 41ab9fa

Browse files
content-botcontent-bot
authored
YUG-4241: Added new automation GRAAnomaliesDisplay.py, Corrected desc… (#24640)
1 parent 5c15a52 commit 41ab9fa

File tree

16 files changed

+263
-33
lines changed

16 files changed

+263
-33
lines changed

‎Packs/Gurucul/Author_image.png

-624 Bytes
Loading

‎Packs/Gurucul/Integrations/GuruculGRA/GuruculGRA.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -334,6 +334,10 @@ def main() -> None:
334334
if entityTypeId is not None:
335335
analyticalFeatures_url += '&entityTypeId=' + entityTypeId
336336
fetch_records(client, analyticalFeatures_url, 'Gra.Analytical.Features.Entity.Value', 'entityID', params)
337+
elif demisto.command() == 'gra-cases-anomaly':
338+
caseId = arguments.get('caseId')
339+
anomaliesUrl = '/anomalies/' + caseId
340+
fetch_records(client, anomaliesUrl, 'Gra.Cases.anomalies', 'caseId', params)
337341

338342
# Log exceptions and return errors
339343
except Exception as e:

‎Packs/Gurucul/Integrations/GuruculGRA/GuruculGRA.yml

Lines changed: 46 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ script:
101101
- contextPath: Gra.Users.exitDate
102102
description: Exit Date
103103
type: date
104-
description: Retrieve List of All Users (Identities)
104+
description: Retrieve list of all users (identities).
105105
- name: gra-fetch-accounts
106106
arguments:
107107
- name: page
@@ -153,7 +153,7 @@ script:
153153
- contextPath: Gra.Accounts.updated_on
154154
description: Updated On
155155
type: date
156-
description: Retrieve all Accounts Information
156+
description: Retrieve list of all accounts.
157157
- name: gra-fetch-active-resource-accounts
158158
arguments:
159159
- name: resource_name
@@ -209,7 +209,7 @@ script:
209209
- contextPath: Gra.Active.Resource.Accounts.updated_on
210210
description: Updated On
211211
type: date
212-
description: Retrieve List of All Active Accounts for a Given Resource
212+
description: Retrieve list of all active accounts for specified resource.
213213
- name: gra-fetch-user-accounts
214214
arguments:
215215
- name: employee_id
@@ -264,7 +264,7 @@ script:
264264
- contextPath: Gra.User.Accounts.updated_on
265265
description: Updated On
266266
type: date
267-
description: Retrieve List of All Active Accounts and Details for a Given User / Identity
267+
description: Retrieve list of all active accounts and details for specified user identity.
268268
- name: gra-fetch-resource-highrisk-accounts
269269
arguments:
270270
- name: resource_name
@@ -320,7 +320,7 @@ script:
320320
- contextPath: Gra.Resource.Highrisk.Accounts.updated_on
321321
description: Updated On
322322
type: date
323-
description: Retrieve High Risk Accounts for a Given Resource
323+
description: Retrieve high risk accounts for specified resource.
324324
- name: gra-fetch-hpa
325325
arguments:
326326
- name: page
@@ -372,7 +372,7 @@ script:
372372
- contextPath: Gra.Hpa.updated_on
373373
description: Updated On
374374
type: date
375-
description: Retrieve List of All High Risk Privileged Accounts
375+
description: Retrieve list of all high risk privileged accounts.
376376
- name: gra-fetch-resource-hpa
377377
arguments:
378378
- name: resource_name
@@ -428,7 +428,7 @@ script:
428428
- contextPath: Gra.Resource.Hpa.updated_on
429429
description: Updated On
430430
type: date
431-
description: Retrieve all High Privileged Accounts for a Given Resource
431+
description: Retrieve all high privileged accounts for specified resource.
432432
- name: gra-fetch-orphan-accounts
433433
arguments:
434434
- name: page
@@ -480,7 +480,7 @@ script:
480480
- contextPath: Gra.Orphan.Accounts.updated_on
481481
description: Updated On
482482
type: date
483-
description: Retrieve List of All Orphan / Rogue Accounts
483+
description: Retrieve list of all orphan / rogue accounts.
484484
- name: gra-fetch-resource-orphan-accounts
485485
arguments:
486486
- name: resource_name
@@ -536,7 +536,7 @@ script:
536536
- contextPath: Gra.Resource.Orphan.Accounts.updated_on
537537
description: Updated On
538538
type: date
539-
description: Retrieve All Orphan / Rogue Accounts for a Given Resource
539+
description: Retrieve all orphan / rogue accounts for specified resource.
540540
- name: gra-user-activities
541541
arguments:
542542
- name: employee_id
@@ -570,7 +570,7 @@ script:
570570
- contextPath: Gra.User.Activity.risk_score
571571
description: Risk Score
572572
type: number
573-
description: Retrieve User Activity for a Given User
573+
description: Retrieve activity for specified user.
574574
- name: gra-fetch-users-details
575575
arguments:
576576
- name: employee_id
@@ -622,7 +622,7 @@ script:
622622
- contextPath: Gra.User.profilePicturePath
623623
description: Profile Picture Path
624624
type: string
625-
description: Get details of the user
625+
description: Retrieve details for specified user.
626626
- name: gra-highRisk-users
627627
arguments:
628628
- name: page
@@ -710,7 +710,7 @@ script:
710710
- contextPath: Gra.Highrisk.Users.domain
711711
description: Domain
712712
type: string
713-
description: Retrieve All High Risk User Information
713+
description: Retrieve list of all high risk users.
714714
- name: gra-cases
715715
arguments:
716716
- name: status
@@ -766,7 +766,7 @@ script:
766766
- contextPath: Gra.Cases.anomalies
767767
description: Anomalies
768768
type: string
769-
description: Retrieve List of All Cases for a Given Status
769+
description: Retrieve list of all cases for specified status.
770770
- name: gra-user-anomalies
771771
arguments:
772772
- name: employee_id
@@ -784,7 +784,7 @@ script:
784784
- contextPath: Gra.User.Anomalies.anomaly_name
785785
description: Anomaly Name
786786
type: string
787-
description: Retrieve Detailed Information for a Given User
787+
description: Retrieve list of anomalies for specified user.
788788
- name: gra-case-action
789789
arguments:
790790
- name: action
@@ -819,7 +819,7 @@ script:
819819
- contextPath: Gra.Case.Action.Message
820820
description: Message
821821
type: string
822-
description: Closing a case and updating the anomaly status as Closed / Risk Managed / Model Reviewed.
822+
description: Close a case and update the anomaly status as Closed / Risk Managed / Model Reviewed.
823823
- name: gra-case-action-anomaly
824824
arguments:
825825
- name: action
@@ -860,7 +860,7 @@ script:
860860
- contextPath: Gra.Case.Action.Anomaly.anomalyName
861861
description: Anomaly Name
862862
type: string
863-
description: Closing an anomaly or anomalies within a case and updating the anomaly status as Closed / Risk Managed / Model Reviewed.
863+
description: Close an anomaly or anomalies within a case and update the anomaly status as Closed / Risk Managed / Model Reviewed.
864864
- name: gra-investigate-anomaly-summary
865865
arguments:
866866
- name: modelName
@@ -949,8 +949,36 @@ script:
949949
- contextPath: Gra.Analytical.Features.Entity.Value.analyticalFeatureValues
950950
description: Analytical Feature Values
951951
type: string
952-
description: Retrieve analytical features for specified entity value and model name.
953-
dockerimage: demisto/python3:3.10.8.37233
952+
description: Retrieve analytical features for specified entity value, model name and dates.
953+
- name: gra-cases-anomaly
954+
arguments:
955+
- name: caseId
956+
description: GRA Case Id
957+
required: true
958+
outputs:
959+
- contextPath: Gra.Cases.anomalies.anomalyName
960+
description: Cases Anomaly name
961+
type: String
962+
- contextPath: Gra.Cases.anomalies.riskAcceptedDate
963+
description: Risk accepted date of anomaly
964+
type: date
965+
- contextPath: Gra.Cases.anomalies.resourceName
966+
description: Resource Name
967+
type: String
968+
- contextPath: Gra.Cases.anomalies.riskScore
969+
description: Risk score for anomaly
970+
type: String
971+
- contextPath: Gra.Cases.anomalies.assignee
972+
description: Assignee name
973+
type: String
974+
- contextPath: Gra.Cases.anomalies.assigneeType
975+
description: Assignee type (User/Role)
976+
type: String
977+
- contextPath: Gra.Cases.anomalies.status
978+
description: Current status of anomaly
979+
type: String
980+
description: Retrieve anomalies for specified case id.
981+
dockerimage: demisto/python3:3.10.10.47713
954982
isfetch: true
955983
runonce: false
956984
subtype: python3

‎Packs/Gurucul/Integrations/GuruculGRA/GuruculGRA_image.png

-624 Bytes
Loading

‎Packs/Gurucul/Integrations/GuruculGRA/README.md

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1078,6 +1078,61 @@ Retrieve analytical features for specified entity value and model name.
10781078
```
10791079

10801080
#### Human Readable Output
1081+
1082+
### gra-cases-anomaly
1083+
***
1084+
Retrieve anomalies for specified case id from GRA and update in XSOAR.
1085+
1086+
#### Base Command
1087+
1088+
`gra-cases-anomaly`
10811089

1090+
#### Input
1091+
1092+
| **Argument Name** | **Description** | **Required** |
1093+
|-------------------|-----------------| --- |
1094+
| caseId | GRA Case Id | Required |
1095+
1096+
#### Context Output
1097+
1098+
| **Path** | **Type** | **Description** |
1099+
|--------------------------------------|----------|--------------------|
1100+
| Gra.Cases.anomalies.anomalyName | String | Cases Anomaly name |
1101+
| Gra.Cases.anomalies.riskAcceptedDate | date |Risk accepted date of anomaly|
1102+
| Gra.Cases.anomalies.resourceName | String |Resource Name|
1103+
|Gra.Cases.anomalies.riskScore| String|Risk score for anomaly|
1104+
|Gra.Cases.anomalies.assignee| String |Assignee name|
1105+
|Gra.Cases.anomalies.assigneeType| String |Assignee type (User/Role)|
1106+
|Gra.Cases.anomalies.status| String |Current status of anomaly|
1107+
1108+
1109+
#### Command Example
1110+
```!gra-cases-anomaly caseId=10```
1111+
1112+
#### Context Example
1113+
```
1114+
[
1115+
{
1116+
"anomalyName": "Anomaly Name 1",
1117+
"riskAcceptedDate": "2023-02-01T18:30:00Z",
1118+
"resourceName": "Resource Name 1",
1119+
"riskScore": 0,
1120+
"assignee": "Assignee 1",
1121+
"assigneeType": "User",
1122+
"status": "Open"
1123+
},
1124+
{
1125+
"anomalyName": "Anomaly Name 2",
1126+
"riskAcceptedDate": null,
1127+
"resourceName": "Resource Name 2",
1128+
"riskScore": 0,
1129+
"assignee": "Assignee 2",
1130+
"assigneeType": "User",
1131+
"status": "Closed"
1132+
}
1133+
]
1134+
```
1135+
1136+
#### Human Readable Output
10821137

10831138

‎Packs/Gurucul/Layouts/layoutscontainer-GRACaseLayout.json

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,24 @@
132132
"x": 2,
133133
"y": 0
134134
},
135+
{
136+
"displayType": "ROW",
137+
"h": 2,
138+
"i": "GRA Anomaly Display",
139+
"maxH": null,
140+
"maxW": 1,
141+
"minH": null,
142+
"minW": 1,
143+
"moved": false,
144+
"name": "Anomaly Updates",
145+
"static": false,
146+
"type": "dynamic",
147+
"w": 1,
148+
"x": 0,
149+
"y": 1,
150+
"query": "GRAAnomaliesDisplay",
151+
"queryType": "script"
152+
},
135153
{
136154
"displayType": "ROW",
137155
"h": 2,
@@ -159,16 +177,15 @@
159177
"moved": false,
160178
"name": "Evidence",
161179
"static": false,
162-
"type": "evidence",
163180
"w": 1,
164181
"x": 2,
165-
"y": 2
182+
"y": 2,
183+
"type": "evidence"
166184
},
167185
{
168186
"displayType": "CARD",
169187
"h": 2,
170188
"i": "caseinfoid-e54b1770-a0b1-11e9-b27f-13ae1773d289",
171-
"isVisible": true,
172189
"items": [
173190
{
174191
"endCol": 2,
@@ -198,12 +215,11 @@
198215
"static": false,
199216
"w": 1,
200217
"x": 1,
201-
"y": 2
218+
"y": 2,
219+
"isVisible": true
202220
},
203221
{
204-
"displayType": "ROW",
205222
"h": 2,
206-
"hideItemTitleOnlyOne": true,
207223
"hideName": false,
208224
"i": "caseinfoid-07dab470-0fba-11ec-82a4-8da638163409",
209225
"items": [
@@ -228,7 +244,9 @@
228244
"static": false,
229245
"w": 3,
230246
"x": 1,
231-
"y": 3
247+
"y": 3,
248+
"displayType": "ROW",
249+
"hideItemTitleOnlyOne": true
232250
},
233251
{
234252
"h": 2,
@@ -782,5 +800,7 @@
782800
"name": "GRACaseLayout",
783801
"system": false,
784802
"version": -1,
785-
"marketplaces": ["xsoar"]
803+
"marketplaces": [
804+
"xsoar"
805+
]
786806
}

‎Packs/Gurucul/Playbooks/playbook-GRACase_README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Playbook for fetching cases assosiated to high risk users.
1+
Playbook for fetching cases associated to high risk users.
22

33
## Dependencies
44
This playbook uses the following sub-playbooks, integrations, and scripts.

‎Packs/Gurucul/ReleaseNotes/2_0_0.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#### Scripts
2+
##### New: GRAAnomaliesDisplay
3+
- Retrieve anomalies for specified case id from GRA and update in XSOAR
4+
##### GRAAnalyticalFeatureDisplay
5+
- Updated the Docker image to: *demisto/python3:3.10.10.47713*.
6+
7+
8+
##### GRAUpdateCaseStatus
9+
- Updated the Docker image to: *demisto/python3:3.10.10.47713*.
10+
11+
#### Integrations
12+
##### Gurucul-GRA
13+
- Updated the Docker image to: *demisto/python3:3.10.10.47713*.
14+
15+
- Changed the Gurucul-GRA logo
16+
- Changed the description of all commands
17+
18+
19+
#### Layouts
20+
##### GRACaseLayout
21+
- Added new dynamic section to incident layout
22+
This section uses the new automation script GRAAnomaliesDisplay
23+
With this change, XSOAR will be able to get the newly added/modified anomalies for a particular case/incident from GRA
24+
The new anomalies will then be synced with XSOAR

0 commit comments

Comments
 (0)