FireEyeHX Create Indicator Enhacement (#27717)

* FireEyeHX Create Indicator Enhacement (#27625)

* Added additional arguments for fireeye-hx-create-indicator command.
Updated FireEyeHXv2.py to use additional arguments in the HTTP POST.

* Added 2_3_9.md release note and bumped up version in pack_metadata.json

* Updated release notes

* Updated release notes and README.md

* Updated FireEyeHXv2.py

* Updated Docker Image in FireEyeHXv2.yml
Updated Release Notes 2_3_9.md

* Adding unit test for new optional
arguments in create_indicator_command

* Apply suggestions from code review

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

---------

Co-authored-by: Danny_Fried <dfried@paloaltonetworks.com>
Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

---------

Co-authored-by: Martin Ohl <Martin.Ohl@ohl-net.eu>
Co-authored-by: Danny_Fried <dfried@paloaltonetworks.com>
Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Packs/FireEyeHX/Integrations/FireEyeHXv2/FireEyeHXv2.py

@@ -1151,16 +1151,18 @@ def delete_condition(self, indicator_name: str, category: str, condition_type: s
             raise_on_status=True,
         )
 
-    def new_indicator_request(self, category):
+    def new_indicator_request(self, category, body: Dict[str, Any]):
         """
         Create a new indicator
         """
 
         try:
             return self._http_request(
                 method='POST',
-                url_suffix=f"indicators/{category}"
+                url_suffix=f"indicators/{category}",
+                json_data=body
             )
+
         except Exception as e:
             demisto.debug(str(e))
             raise ValueError('Failed to parse response body, unexpected response structure from the server.')
@@ -2821,16 +2823,29 @@ def create_indicator_command(client: Client, args: Dict[str, Any]) -> CommandRes
     """
 
     category = args.get('category')
+    payload = {}
+    if args.get('display_name'):
+        payload['display_name'] = args.get('display_name')
+
+    if args.get('description'):
+        payload['description'] = args.get('description')
+
+    if args.get('platforms'):
+        if isinstance(args.get('platforms'), list):
+            payload['platforms'] = args.get('platforms')
+        else:
+            payload['platforms'] = [args.get('platforms')]
 
-    response = client.new_indicator_request(category)["data"]
+    response = client.new_indicator_request(category, payload)
 
-    md_table = tableToMarkdown('FireEye HX New Indicator created successfully', {'ID': response.get('_id')})
+    md_table = tableToMarkdown('FireEye HX New Indicator created successfully', {'ID': response.get('data').get('_id')})
 
     return CommandResults(
         outputs_prefix="FireEyeHX.Indicators",
         outputs_key_field="_id",
-        outputs=response,
-        readable_output=md_table
+        outputs=response.get('data'),
+        readable_output=md_table,
+        raw_response=response
     )
 
 

Packs/FireEyeHX/Integrations/FireEyeHXv2/FireEyeHXv2.yml

@@ -1873,6 +1873,29 @@ script:
       default: false
       isArray: false
       secret: false
+    - description: Display name for the indicator.
+      name: display_name
+      required: false
+      default: false
+      isArray: false
+      secret: false
+    - description: Description for the indicator.
+      name: description
+      required: false
+      default: false
+      isArray: false
+      secret: false
+    - auto: PREDEFINED
+      description: The platform for the indicator. If not selected, the indicator will be created for all platforms.
+      name: platforms
+      required: false
+      default: false
+      isArray: true
+      secret: false
+      predefined:
+        - 'win'
+        - 'linux'
+        - 'mac'
     description: Create a new indicator.
     name: fireeye-hx-create-indicator
     outputs:
@@ -2413,7 +2436,7 @@ script:
   script: '-'
   type: python
   subtype: python3
-  dockerimage: demisto/python3:3.10.10.48392
+  dockerimage: demisto/python3:3.10.12.63474
   feed: false
   longRunning: false
   longRunningPort: false

Packs/FireEyeHX/Integrations/FireEyeHXv2/FireEyeHXv2_test.py

@@ -1,7 +1,7 @@
 import io
 import json
 from pathlib import Path
-
+from typing import Any
 import pytest
 from CommonServerPython import DemistoException
 
@@ -1991,3 +1991,37 @@ def test_validate_base_url(baseurl: str, expected_error: str):
     with pytest.raises(ValueError) as e:
         validate_base_url(baseurl)
     assert str(e.value) == expected_error
+
+
+CREATE_INDICATOR_ARGS = {
+    'category': 'test_cat',
+    'name': 'test_name',
+    'display_name': 'test_display_name',
+    'description': 'test_desc',
+    'platforms': ['platform1', 'platform2'],
+    'data': {
+        '_id': 'test'
+    }
+}
+
+
+def test_create_indicator_command(monkeypatch):
+    import FireEyeHXv2
+
+    class MockClient:
+        def __init__(self, base_url):
+            pass
+
+        def get_token_request(self):
+            return "mock_token"
+
+        def new_indicator_request(self, category, body: dict[str, Any]):
+            return CREATE_INDICATOR_ARGS
+
+    monkeypatch.setattr(FireEyeHXv2, "Client", MockClient)
+
+    args = CREATE_INDICATOR_ARGS
+    from FireEyeHXv2 import Client, create_indicator_command
+    client = Client(base_url='https://www.example.com')
+    command_result = create_indicator_command(client=client, args=args)
+    assert command_result.raw_response == CREATE_INDICATOR_ARGS

Packs/FireEyeHX/Integrations/FireEyeHXv2/README.md

@@ -2107,8 +2107,11 @@ Create a new indicator.
 #### Input
 
 | **Argument Name** | **Description** | **Required** |
-| --- | --- | --- |
-| category | The indicator category. | Required | 
+| --- | --- |----------|
+| category | The indicator category. | Required |
+| display_name | Display name for the indicator. | Optional |
+| description | Description for the indicator. | Optional |
+| platforms | The platform for the indicator. If not selected, the indicator will be created for all platforms. | Optional |
 
 
 #### Context Output

Packs/FireEyeHX/ReleaseNotes/2_3_9.md

@@ -0,0 +1,7 @@
+
+#### Integrations
+
+##### FireEye Endpoint Security (HX) v2
+
+- Updated the ***fireeye-hx-create-indicator*** command to support additional optional arguments. 
+- Updated the Docker image to: *demisto/python3:3.10.12.63474*.

Packs/FireEyeHX/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "FireEye HX",
     "description": "FireEye Endpoint Security is an integrated solution that detects and protects endpoints against known and unknown threats. The FireEye HX Cortex XSOAR integration provides access to information about endpoints, acquisitions, alerts, indicators, and containment. Customers can extract critical data and effectively operate the security operations automated playbooks.",
     "support": "xsoar",
-    "currentVersion": "2.3.8",
+    "currentVersion": "2.3.9",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",