Skip to content

Commit

Permalink
[ASM] - Expander - Update ASM fields (4821) (demisto#29702)
Browse files Browse the repository at this point in the history 
* [ASM] - Expander - Update ASM fields (4821) (demisto#29506)

* Add missing comments to grid fields

- Update descriptions of fields as needed.

* Add release notes

* Add descriptions to two fields

- asmdevcheckdetails
- asmenrichmentstatus

* Update release notes.

* Grammar updates.

* Update release notes

* Add mandatory or optional in comments

* Update comments with mandatory

* Update pack version and release notes

* Add correct 1_6_33 release notes

* fix rn

* fix rn

---------

Co-authored-by: John <40349459+BigEasyJ@users.noreply.github.com>
Co-authored-by: ostolero <86190583+ostolero@users.noreply.github.com>
Co-authored-by: ostolero <ostolero@paloaltonetworks.com>
  • Loading branch information
@content-bot @BigEasyJ
@ostolero @maimorag
4 people authored and maimorag committed Sep 28, 2023
1 parent e1d012d commit 5c90f24
Show file tree
Hide file tree
Showing 21 changed files with 139 additions and 64 deletions.
8 changes: 5 additions & 3 deletions Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Alert_Summary.json
View file
Expand Up @@ -15,7 +15,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: URL to display/download summary."
},
{
"displayName": "EntryID",
Expand All @@ -28,7 +29,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: File entryID."
}
],
"content": true,
Expand All @@ -37,7 +39,7 @@
{},
{}
],
"description": "Summary report of alert",
"description": "Summary report of alert.",
"editForm": true,
"group": 0,
"hidden": false,
Expand Down
2 changes: 1 addition & 1 deletion Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Asset_ID.json
View file
Expand Up @@ -4,7 +4,7 @@
"cliName": "asmassetid",
"closeForm": false,
"content": true,
"description": "UUID for ASM Asset",
"description": "UUID for ASM Asset.",
"editForm": true,
"group": 0,
"hidden": false,
Expand Down
2 changes: 1 addition & 1 deletion ...texAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Attack_Surface_Rule_ID.json
View file
Expand Up @@ -4,7 +4,7 @@
"cliName": "asmattacksurfaceruleid",
"closeForm": false,
"content": true,
"description": "UUID for ASM rule",
"description": "UUID for ASM rule.",
"editForm": true,
"group": 0,
"hidden": true,
Expand Down
15 changes: 10 additions & 5 deletions Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Cloud.json
View file
Expand Up @@ -15,7 +15,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: The cloud provider: AWS, GCP, Azure, etc."
},
{
"displayName": "Organization",
Expand All @@ -28,7 +29,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Optional: Highest level cloud management object."
},
{
"displayName": "Project",
Expand All @@ -41,7 +43,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Second highest level cloud management object."
},
{
"displayName": "Region",
Expand All @@ -54,7 +57,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Region being used for the asset."
},
{
"displayName": "Other",
Expand All @@ -67,7 +71,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Optional: Availability zone or other information."
}
],
"content": true,
Expand Down
14 changes: 9 additions & 5 deletions Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Data_Collection.json
View file
Expand Up @@ -15,7 +15,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Options available on data collection task."
},
{
"displayName": "Selected",
Expand All @@ -28,7 +29,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Which option was selected."
},
{
"displayName": "Answerer",
Expand All @@ -41,7 +43,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Who answered the data collection task."
},
{
"displayName": "Timestamp",
Expand All @@ -54,7 +57,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Timestamp of when the data collection task was completed."
}
],
"content": true,
Expand All @@ -63,7 +67,7 @@
{},
{}
],
"description": "Collect information on data collection tasks",
"description": "Collect information on data collection tasks.",
"editForm": true,
"group": 0,
"hidden": false,
Expand Down
1 change: 1 addition & 0 deletions ...s/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Dev_Check_Details.json
View file
Expand Up @@ -72,6 +72,7 @@
"isReadOnly": false,
"locked": false,
"name": "ASM - Dev Check Details",
"description": "A field to determine whether the asset is most likely used for solely development/non-production purposes, including uses like testing, staging, QA, sandbox, and user acceptance testing. Why reasons and confidence.",
"neverSetAsRequired": false,
"openEnded": false,
"ownerOnly": false,
Expand Down
1 change: 1 addition & 0 deletions ...s/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Enrichment_Status.json
View file
Expand Up @@ -61,6 +61,7 @@
"group": 0,
"hidden": false,
"id": "incident_asmenrichmentstatus",
"description": "A field to gather information on whether or not an integration perform enrichment for ASM.",
"isReadOnly": false,
"locked": false,
"name": "ASM - Enrichment Status",
Expand Down
12 changes: 8 additions & 4 deletions Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Notification.json
View file
Expand Up @@ -15,7 +15,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment":"Mandatory: Type of notification could be a ServiceNow incident, email, etc."
},
{
"displayName": "Value",
Expand All @@ -28,7 +29,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment":"Mandatory: Dependent on type. Ex: ServiceNOW UUID, email recipients, etc."
},
{
"displayName": "URL",
Expand All @@ -41,7 +43,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment":"Optional: Related URL of the notification created if applicable."
},
{
"displayName": "Timestamp",
Expand All @@ -54,7 +57,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment":"Mandatory: Timestamp of notification sent."
}
],
"content": true,
Expand Down
6 changes: 4 additions & 2 deletions Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Playbook_Stage.json
View file
Expand Up @@ -15,7 +15,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: The stage of playbook that was completed."
},
{
"displayName": "timestamp",
Expand All @@ -28,7 +29,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: The timestamp of the completed playbook stage."
}
],
"content": true,
Expand Down
8 changes: 5 additions & 3 deletions Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Private_IP.json
View file
Expand Up @@ -15,7 +15,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: The IP address of the relevant asset."
},
{
"displayName": "Source",
Expand All @@ -28,7 +29,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: The source of the IP address."
}
],
"content": true,
Expand All @@ -37,7 +39,7 @@
{},
{}
],
"description": "Private IP addresses found",
"description": "Field for private IP addresses found.",
"editForm": true,
"group": 0,
"hidden": false,
Expand Down
6 changes: 4 additions & 2 deletions Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Related.json
View file
Expand Up @@ -15,7 +15,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Optional: The source of related item. Ex: Alerts, ServiceNOW, JIRA, etc."
},
{
"displayName": "Link",
Expand All @@ -28,7 +29,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Optional: Link to object (if available)."
}
],
"content": true,
Expand Down
14 changes: 9 additions & 5 deletions Packs/CortexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Remediation.json
View file
Expand Up @@ -15,7 +15,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Description of the remediation action."
},
{
"displayName": "ActionTimestamp",
Expand All @@ -28,7 +29,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Timestamp of when action was taken."
},
{
"displayName": "Outcome",
Expand All @@ -41,7 +43,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Outcome of the remediation action."
},
{
"displayName": "OutcomeTimestamp",
Expand All @@ -54,7 +57,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Timestamp of the remediation outcome."
}
],
"content": true,
Expand All @@ -63,7 +67,7 @@
{},
{}
],
"description": "Collect information on remediation action(s)",
"description": "Collect information on remediation action(s).",
"editForm": true,
"group": 0,
"hidden": false,
Expand Down
6 changes: 3 additions & 3 deletions ...texAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Remediation_Objectives.json
View file
Expand Up @@ -16,7 +16,7 @@
"selectValues": null,
"type": "shortText",
"width": 150,
"_comment": "Corresponds with remediation option for the main data collection task."
"_comment": "Mandatory: Corresponds with remediation option for the main data collection task."
},
{
"displayName": "statement",
Expand All @@ -30,7 +30,7 @@
"selectValues": null,
"type": "shortText",
"width": 150,
"_comment": "Summary of the remediation action."
"_comment": "Mandatory: Summary of the remediation action."
}
],
"content": true,
Expand All @@ -39,7 +39,7 @@
{},
{}
],
"description": "Remediation objectives uses to display the remediation actions to the end user",
"description": "Remediation objectives uses to display the remediation actions to the end user.",
"editForm": true,
"group": 0,
"hidden": false,
Expand Down
15 changes: 10 additions & 5 deletions ...rtexAttackSurfaceManagement/IncidentFields/incidentfield-ASM_-_Remediation_Path_Rule.json
View file
Expand Up @@ -15,7 +15,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Name of the matching Remediation Path Rule."
},
{
"displayName": "Description",
Expand All @@ -28,7 +29,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Description of the matching rule."
},
{
"displayName": "Action",
Expand All @@ -41,7 +43,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: Action of the matching rule."
},
{
"displayName": "Created_by",
Expand All @@ -54,7 +57,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: The user that created the rule."
},
{
"displayName": "Criteria",
Expand All @@ -67,7 +71,8 @@
"script": "",
"selectValues": null,
"type": "shortText",
"width": 150
"width": 150,
"_comment": "Mandatory: The criteria of the rule."
}
],
"content": true,
Expand Down

0 comments on commit 5c90f24

Please sign in to comment.