[ASM] - Expander - Update Cortex ASM - Service Ownership playbook #26334

BigEasyJ · 2023-05-05T00:35:57Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - Reviewing with @kball-pa

Related Issues

fixes: EXPANDR-3830 to address #25927

Description

Remove the service owner field change related to service accounts in GCP enrichment playbook.
Remove the service accounts look up in Service Ownership playbook.
Fix an issue where GCP project is not found.
Update the Cortex ASM - Service Ownership playbook to check for GCP as an external service before completing GCP related tasks for ranking users.

Screenshots

Minimum version of Cortex XSOAR

6.0.0
6.1.0
6.2.0
6.5.0

Does it break backward compatibility?

Yes
- Further details:
No

Must have

Tests
Documentation

- Fixed an issue where GCP project is not found. - Updated the Cortex ASM - Service Ownership playbook to check for GCP as an external service before completing GCP related tasks for ranking users.

BigEasyJ · 2023-05-05T00:36:59Z

cc: @johnnywilkes @capanw @kball-pa @ptoman-pa

content-bot · 2023-05-05T00:37:42Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @GuyAfik will know the proposed changes are ready to be reviewed.

- Local validate did not catch input that was not defined, but CI/CD validate did - Removing unused conditional check in "What provider is this service?" task demisto#14

- Remove Service Account lookup and source updates from Cortex_ASM_-_GCP_Enrichment playbook. - Remove retrieval of owners assocaited to a service account until more testing is completed.

…nto EXPANDR-3830_service_owner_playbook

johnnywilkes

Few small changes needed

johnnywilkes · 2023-05-08T12:55:16Z

Packs/CortexAttackSurfaceManagement/ReleaseNotes/1_6_10.md

@@ -0,0 +1,11 @@
+


Please change filename to 1_6_11 because of conflict with #26355

I believe the bug fix should go in first but we can discuss.

johnnywilkes · 2023-05-08T12:55:23Z

Packs/CortexAttackSurfaceManagement/pack_metadata.json

@@ -2,7 +2,7 @@
    "name": "Cortex Attack Surface Management",
    "description": "Content for working with Attack Surface Management (ASM).",
    "support": "xsoar",
-    "currentVersion": "1.6.9",
+    "currentVersion": "1.6.10",


Please change filename to 1_6_11 because of conflict with #26355

I believe the bug fix should go in first but we can discuss.

johnnywilkes · 2023-05-08T13:08:11Z

Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Service_Ownership.yml

+      version: -1
+      name: Get external service information
+      description: Get service details according to the service ID.
+      script: Cortex Attack Surface Management|||asm-get-external-service


This command is already run in "Cortex ASM - Enrichment". So we can do one of the following:

Pass full results of ${ASM.ExternalService.externally_detected_providers} into this playbook as an input (preferred)

Add a conditional to make sure CASM integration is enabled (similar to "Is Cortex ASM enabled?" task in "Cortex ASM - Enrichment".

I was thinking about this repetition as well. The first option should be a later change, just to keep the main playbook out of scope. I'll go with the second option.

johnnywilkes · 2023-05-08T13:08:52Z

Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Service_Ownership.yml

@@ -6,10 +6,10 @@ starttaskid: "0"
 tasks:


Please make sure to update this README after all changes are done: https://github.com/demisto/content/blob/master/Packs/CortexAttackSurfaceManagement/Playbooks/Cortex_ASM_-_Service_Ownership_README.md

GuyAfik · 2023-05-09T18:10:19Z

@BigEasyJ please merge from master to retrieve the latest changes of the pack.

…nto EXPANDR-3830_service_owner_playbook

johnnywilkes

One last small change and we should be good

johnnywilkes · 2023-05-10T13:44:42Z

Packs/CortexAttackSurfaceManagement/doc_files/Cortex_ASM_-_Service_Ownership.png

@BigEasyJ , I think you need to update the screenshot after your changes

Good catch. Updated in 8fd7274.

johnnywilkes

Approved

johnnywilkes

Approved

GuyAfik

looks good, great work!

content-bot · 2023-05-10T17:15:56Z

For the Reviewer: Successfully created a pipeline in Gitlab with url: https://code.pan.run/xsoar/content/-/pipelines/5234853

…6334) (#26442) * Update Cortex ASM - Service Ownership playbook - Fixed an issue where GCP project is not found. - Updated the Cortex ASM - Service Ownership playbook to check for GCP as an external service before completing GCP related tasks for ranking users. * Remove unneccessary condition from playbook - Local validate did not catch input that was not defined, but CI/CD validate did - Removing unused conditional check in "What provider is this service?" task #14 * Update Service Ownership and GCP Enrichment playbooks - Remove Service Account lookup and source updates from Cortex_ASM_-_GCP_Enrichment playbook. - Remove retrieval of owners assocaited to a service account until more testing is completed. * Update release notes * Updates from code review * Update PNG Co-authored-by: John <[email protected]> Co-authored-by: GuyAfik <[email protected]>

Update Cortex ASM - Service Ownership playbook

6f787e2

- Fixed an issue where GCP project is not found. - Updated the Cortex ASM - Service Ownership playbook to check for GCP as an external service before completing GCP related tasks for ranking users.

BigEasyJ changed the title ~~Update Cortex ASM - Service Ownership playbook~~ [ASM] - Expander - Update Cortex ASM - Service Ownership playbook May 5, 2023

content-bot added the Contribution Thank you! Contributions are always welcome! label May 5, 2023

content-bot changed the base branch from master to contrib/BigEasyJ_EXPANDR-3830_service_owner_playbook May 5, 2023 00:37

content-bot assigned GuyAfik May 5, 2023

content-bot requested a review from GuyAfik May 5, 2023 00:37

content-bot added Community Contribution Form Filled Whether contribution form filled or not. labels May 5, 2023

Remove unneccessary condition from playbook

564b51b

- Local validate did not catch input that was not defined, but CI/CD validate did - Removing unused conditional check in "What provider is this service?" task demisto#14

BigEasyJ marked this pull request as draft May 5, 2023 12:56

Update Service Ownership and GCP Enrichment playbooks

4e85c5e

- Remove Service Account lookup and source updates from Cortex_ASM_-_GCP_Enrichment playbook. - Remove retrieval of owners assocaited to a service account until more testing is completed.

BigEasyJ marked this pull request as ready for review May 5, 2023 16:56

BigEasyJ and others added 2 commits May 5, 2023 12:13

Update release notes

e2215bb

Merge branch 'contrib/BigEasyJ_EXPANDR-3830_service_owner_playbook' i…

d448622

…nto EXPANDR-3830_service_owner_playbook

johnnywilkes suggested changes May 8, 2023

View reviewed changes

Updates from code review

6e27a2f

BigEasyJ added 2 commits May 9, 2023 14:40

Merge branch 'contrib/BigEasyJ_EXPANDR-3830_service_owner_playbook' i…

fb1ea2c

…nto EXPANDR-3830_service_owner_playbook

Merge branch 'contrib/BigEasyJ_EXPANDR-3830_service_owner_playbook' i…

e75b3b9

…nto EXPANDR-3830_service_owner_playbook

johnnywilkes suggested changes May 10, 2023

View reviewed changes

Update PNG

8fd7274

johnnywilkes approved these changes May 10, 2023

View reviewed changes

GuyAfik approved these changes May 10, 2023

View reviewed changes

GuyAfik added the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label May 10, 2023

GuyAfik merged commit fed319d into demisto:contrib/BigEasyJ_EXPANDR-3830_service_owner_playbook May 10, 2023

content-bot mentioned this pull request May 10, 2023

[ASM] - Expander - Update Cortex ASM - Service Ownership playbook #26442

Merged

11 tasks

[ASM] - Expander - Update Cortex ASM - Service Ownership playbook #26334

[ASM] - Expander - Update Cortex ASM - Service Ownership playbook #26334

Uh oh!

Conversation

BigEasyJ commented May 5, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contributing to Cortex XSOAR Content

Status

Related Issues

Description

Screenshots

Minimum version of Cortex XSOAR

Does it break backward compatibility?

Must have

Uh oh!

BigEasyJ commented May 5, 2023

Uh oh!

content-bot commented May 5, 2023

Uh oh!

johnnywilkes left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

GuyAfik commented May 9, 2023

Uh oh!

johnnywilkes left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BigEasyJ May 10, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johnnywilkes left a comment

Choose a reason for hiding this comment

Uh oh!

johnnywilkes left a comment

Choose a reason for hiding this comment

Uh oh!

GuyAfik left a comment

Choose a reason for hiding this comment

Uh oh!

content-bot commented May 10, 2023

Uh oh!

Uh oh!

BigEasyJ commented May 5, 2023 •

edited

Loading

BigEasyJ May 10, 2023 •

edited

Loading