From 0d5a310233f256d09c9420ee98be3ef41b2cd471 Mon Sep 17 00:00:00 2001 From: content-bot <55035720+content-bot@users.noreply.github.com> Date: Mon, 17 Jul 2023 10:24:36 +0300 Subject: [PATCH] [Cortex XDR] Fixed status parsing issue (#28183) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [Cortex XDR] Fixed status parsing issue (#28131) * master * reverting crowdstrike.py * fixed status issue * added release notes * reverted 4_11_8.md 4_11_7.md * bumped version * apimodules release notes * apimodules * removed 4_11_9.md * a minor improvement * code improvements * Update RN * Fixed a typo * Update README files --------- Co-authored-by: Menachem Weinfeld * pre-commit * fix --------- Co-authored-by: Enes Özdemir <49711791+ennozdd@users.noreply.github.com> Co-authored-by: Menachem Weinfeld --- Packs/ApiModules/ReleaseNotes/2_2_18.md | 4 ++++ .../Scripts/CoreIRApiModule/CoreIRApiModule.py | 15 ++++++++------- Packs/ApiModules/pack_metadata.json | 2 +- .../Integrations/CortexCoreIR/CortexCoreIR.yml | 3 ++- Packs/Core/Integrations/CortexCoreIR/README.md | 2 +- Packs/Core/ReleaseNotes/2_0_1.md | 6 ++++++ Packs/Core/pack_metadata.json | 2 +- .../Integrations/CortexXDRIR/CortexXDRIR.yml | 2 +- .../CortexXDR/Integrations/CortexXDRIR/README.md | 2 +- Packs/CortexXDR/ReleaseNotes/5_0_2.md | 6 ++++++ Packs/CortexXDR/pack_metadata.json | 2 +- 11 files changed, 32 insertions(+), 14 deletions(-) create mode 100644 Packs/ApiModules/ReleaseNotes/2_2_18.md create mode 100644 Packs/Core/ReleaseNotes/2_0_1.md create mode 100644 Packs/CortexXDR/ReleaseNotes/5_0_2.md diff --git a/Packs/ApiModules/ReleaseNotes/2_2_18.md b/Packs/ApiModules/ReleaseNotes/2_2_18.md new file mode 100644 index 000000000000..ad802dcbfb22 --- /dev/null +++ b/Packs/ApiModules/ReleaseNotes/2_2_18.md @@ -0,0 +1,4 @@ + +#### Scripts +##### CoreIRApiModule +- Added support for multiple endpoint statuses when calling **get_endpoints_command** function. diff --git a/Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py b/Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py index d68d8bec3a5d..e33fea8d3195 100644 --- a/Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py +++ b/Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py @@ -1725,6 +1725,7 @@ def arg_to_timestamp(arg, arg_name: str, required: bool = False): return int(date.timestamp() * 1000) if isinstance(arg, (int, float)): return arg + return None def create_account_context(endpoints): @@ -1813,7 +1814,7 @@ def get_endpoints_command(client, args): alias_name = argToList(args.get('alias_name')) isolate = args.get('isolate') hostname = argToList(args.get('hostname')) - status = args.get('status') + status = argToList(args.get('status')) first_seen_gte = arg_to_timestamp( arg=args.get('first_seen_gte'), @@ -2385,7 +2386,7 @@ def get_process_context(alert, process_type): remove_nulls_from_dictionary(process_context) # If the process contains only 'HostName' , don't create an indicator - if len(process_context.keys()) == 1 and 'Hostname' in process_context.keys(): + if len(process_context.keys()) == 1 and 'Hostname' in process_context: return {} return process_context @@ -2678,7 +2679,7 @@ def sort_by_key(list_to_sort, main_key, fallback_key): def drop_field_underscore(section): section_copy = section.copy() - for field in section_copy.keys(): + for field in section_copy: if '_' in field: section[field.replace('_', '')] = section.get(field) @@ -2736,7 +2737,7 @@ def get_distribution_versions_command(client, args): versions = client.get_distribution_versions() readable_output = [] - for operation_system in versions.keys(): + for operation_system in versions: os_versions = versions[operation_system] readable_output.append( @@ -3255,7 +3256,7 @@ def get_original_alerts_command(client: CoreClient, args: Dict) -> CommandResult reply = copy.deepcopy(raw_response) alerts = reply.get('alerts', []) filtered_alerts = [] - for i, alert in enumerate(alerts): + for _i, alert in enumerate(alerts): # decode raw_response try: alert['original_alert_json'] = safe_load_json(alert.get('original_alert_json', '')) @@ -3409,7 +3410,7 @@ def get_dynamic_analysis_command(client: CoreClient, args: Dict) -> CommandResul reply = copy.deepcopy(raw_response) alerts = reply.get('alerts', []) filtered_alerts = [] - for i, alert in enumerate(alerts): + for _i, alert in enumerate(alerts): # decode raw_response try: alert['original_alert_json'] = safe_load_json(alert.get('original_alert_json', '')) @@ -3458,7 +3459,7 @@ def create_request_filters( filters.append({ 'field': 'endpoint_status', 'operator': 'IN', - 'value': [status] + 'value': status if isinstance(status, list) else [status] }) if username: diff --git a/Packs/ApiModules/pack_metadata.json b/Packs/ApiModules/pack_metadata.json index ee5c2218aa9f..43b5d00f8a4c 100644 --- a/Packs/ApiModules/pack_metadata.json +++ b/Packs/ApiModules/pack_metadata.json @@ -2,7 +2,7 @@ "name": "ApiModules", "description": "API Modules", "support": "xsoar", - "currentVersion": "2.2.17", + "currentVersion": "2.2.18", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml b/Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml index 144772412b12..49b4645c46d0 100644 --- a/Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml +++ b/Packs/Core/Integrations/CortexCoreIR/CortexCoreIR.yml @@ -177,8 +177,9 @@ script: - asc - desc - auto: PREDEFINED - description: The status of the endpoint to filter. + description: A comma-separated list of endpoints statuses to filter. name: status + isArray: true predefined: - connected - disconnected diff --git a/Packs/Core/Integrations/CortexCoreIR/README.md b/Packs/Core/Integrations/CortexCoreIR/README.md index b984d5f131d3..75ebd36bf82e 100644 --- a/Packs/Core/Integrations/CortexCoreIR/README.md +++ b/Packs/Core/Integrations/CortexCoreIR/README.md @@ -98,7 +98,7 @@ Gets a list of endpoints, according to the passed filters. If there are no filte | limit | Maximum number of endpoints to return per page. The default and maximum is 30. Default is 30. | Optional | | sort_by | Specifies whether to sort endpoints by the first time or last time they were seen. Can be "first_seen" or "last_seen". Possible values are: first_seen, last_seen. | Optional | | sort_order | The order by which to sort results. Can be "asc" (ascending) or "desc" ( descending). Default set to asc. Possible values are: asc, desc. Default is asc. | Optional | -| status | The status of the endpoint to filter. Possible values are: connected, disconnected, lost, uninstalled. | Optional | +| status | A comma-separated list of endpoints statuses to filter. Possible values are: connected, disconnected, lost, uninstalled. | Optional | | username | The usernames to query for, accepts a single user, or comma-separated list of usernames. | Optional | #### Context Output diff --git a/Packs/Core/ReleaseNotes/2_0_1.md b/Packs/Core/ReleaseNotes/2_0_1.md new file mode 100644 index 000000000000..b69a66ef8289 --- /dev/null +++ b/Packs/Core/ReleaseNotes/2_0_1.md @@ -0,0 +1,6 @@ + +#### Integrations + +##### Investigation & Response + +- Added support for multiple endpoint statuses when calling **core-get-endpoints**. diff --git a/Packs/Core/pack_metadata.json b/Packs/Core/pack_metadata.json index 00b8793c9864..d366db9c75a8 100644 --- a/Packs/Core/pack_metadata.json +++ b/Packs/Core/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Core - Investigation and Response", "description": "Automates incident response", "support": "xsoar", - "currentVersion": "2.0.0", + "currentVersion": "2.0.1", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR.yml b/Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR.yml index 5fe59fd2d4ac..1fd0d90a84c1 100644 --- a/Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR.yml +++ b/Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR.yml @@ -740,7 +740,7 @@ script: - 'true' - 'false' - arguments: - - description: 'A comma-separated list of enpoint statuses to filter. Valid values are: connected, disconnected, lost, uninstalled, windows, linux, macos, android, isolated, unisolated' + - description: 'A comma-separated list of endpoints statuses to filter. Valid values are: connected, disconnected, lost, uninstalled, windows, linux, macos, android, isolated, unisolated' name: status isArray: true - description: A comma-separated list of endpoint IDs. diff --git a/Packs/CortexXDR/Integrations/CortexXDRIR/README.md b/Packs/CortexXDR/Integrations/CortexXDRIR/README.md index f492c098aa15..a9b04f8d8b68 100644 --- a/Packs/CortexXDR/Integrations/CortexXDRIR/README.md +++ b/Packs/CortexXDR/Integrations/CortexXDRIR/README.md @@ -923,7 +923,7 @@ Builtin Roles with this permission includes: "Privileged Responder", "Viewer" an | **Argument Name** | **Description** | **Required** | | --- | --- | --- | -| status | The status of the endpoint to filter. Possible values are: connected, disconnected, lost, uninstalled. | Optional | +| status | A comma-separated list of endpoints statuses to filter. Valid values are: connected, disconnected, lost, uninstalled, windows, linux, macos, android, isolated, unisolated. | Optional | | endpoint_id_list | A comma-separated list of endpoint IDs. | Optional | | dist_name | A comma-separated list of distribution package names or installation package names.
Example: dist_name1,dist_name2. | Optional | | ip_list | A comma-separated list of IP addresses.
Example: 8.8.8.8,1.1.1.1. | Optional | diff --git a/Packs/CortexXDR/ReleaseNotes/5_0_2.md b/Packs/CortexXDR/ReleaseNotes/5_0_2.md new file mode 100644 index 000000000000..9a7f3edf7075 --- /dev/null +++ b/Packs/CortexXDR/ReleaseNotes/5_0_2.md @@ -0,0 +1,6 @@ + +#### Integrations + +##### Palo Alto Networks Cortex XDR - Investigation and Response + +- Added support for multiple endpoint statuses when calling **xdr-get-endpoints**. diff --git a/Packs/CortexXDR/pack_metadata.json b/Packs/CortexXDR/pack_metadata.json index 909d99ee39b4..1cb5c9597dbc 100644 --- a/Packs/CortexXDR/pack_metadata.json +++ b/Packs/CortexXDR/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Cortex XDR by Palo Alto Networks", "description": "Automates Cortex XDR incident response, and includes custom Cortex XDR incident views and layouts to aid analyst investigations.", "support": "xsoar", - "currentVersion": "5.0.1", + "currentVersion": "5.0.2", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "",