EWS - Adding O365 Tenant Allow/Block List Management #19103

mikejrizzo · 2022-05-18T16:09:05Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

No related issues.

Description

This pull request adds additional commands to the "EWS Extension Online Powershell v2" to allow management of O365 Tenant Allow/Block Lists. This O365 feature allows for simple tenant-wide blocking or allowing of things such as email senders, file hashes, and URLs. This feature is managed using the same PowerShell module already incorporated into the integration.

Existing functionality of this integration is not changed. This contribution only adds new functionality.

Official documentation of this O365 feature can be found here: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/tenant-allow-block-list?view=o365-worldwide

Screenshots

Paste here any images that will help the reviewer

Minimum version of Cortex XSOAR

5.5 or later - same as the current published version of this integration.

Does it break backward compatibility?

Yes
- Further details:
[ X ] No

Must have

Tests (Published integration contains no tests)
[ X ] Documentation

…al working version.

…for new commands.

…ntegration version number.

content-bot · 2022-05-18T16:10:23Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @ShacharKidor will know he can start review the proposed changes.

content-bot · 2022-05-18T16:37:48Z

The CircleCI check from your latest pushed commit was unsuccessful. @mikejrizzo take a look at the build by clicking this link.

Failed Build Steps

Validate Files and Yaml

Try and address the listed CircleCI build step failures at your earliest convenience. This will greatly expedite the process of getting your proposed changes merged into master. Happy coding and may the force be with you.

content-bot · 2022-05-18T17:38:06Z

The CircleCI build failed again. @mikejrizzo take a look at the build details here - and try and fix the issues so that we can merge your proposed changes as soon as possible.

Failed Build Steps

Validate Files and Yaml

yaakovi · 2022-05-25T17:16:50Z

Packs/EWS/Integrations/EwsExtensionEXOPowershellV2/EwsExtensionEXOPowershellV2_description.md

+
+
+---
+[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/ews-extension-online-powershell-v2)


Remove (This is added automatically when publishing to the marketplace)

Suggested change

---

[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/ews-extension-online-powershell-v2)

I think this was added by one of the demisto-sdk commands I ran to format and validate files, but I've manually removed it.

Done.

yaakovi · 2022-06-05T20:34:22Z

Packs/EWS/Integrations/EwsExtensionEXOPowershellV2/EwsExtensionEXOPowershellV2.yml

+    arguments:
+    - name: entries
+      required: true
+      description: Entries to add to the list.  Separate multiple entries with a comma (e.g. "Item1,Item2").


Suggested change

description: Entries to add to the list. Separate multiple entries with a comma (e.g. "Item1,Item2").

description: A comma-separated list of entries to add to the list (e.g. "Item1,Item2").

yaakovi · 2022-06-05T20:34:34Z

Packs/EWS/Integrations/EwsExtensionEXOPowershellV2/EwsExtensionEXOPowershellV2.yml

+      predefined:
+      - Tenant
+      - AdvancedDelivery
+      description: 'List subtype to add items to. '


Suggested change

description: 'List subtype to add items to. '

description: List subtype to add items to.

yaakovi · 2022-06-05T20:37:22Z

Packs/EWS/Integrations/EwsExtensionEXOPowershellV2/EwsExtensionEXOPowershellV2.yml

+    - name: notes
+      description: Notes to include on new list entries
+    - name: expiration_date
+      description: Enter a specific date and time for the new entries to expire using format "YYYY-MM-DD HH:MM:SSz" for UTC time.  Alternately, a PowerShell **GetDate** statement can be used.


Can we use the ISO format (YYYY-MM-DDTHH:MM:SSZ) instead? We are using it across the product.

The time format I used came from the Microsoft documentation for this Powershell cmdlet, however I tested the command with ISO formatting and that works as well. I'm updating the field description to specify to use ISO format.

Done.

yaakovi · 2022-06-05T20:38:56Z

Packs/EWS/Integrations/EwsExtensionEXOPowershellV2/EwsExtensionEXOPowershellV2.yml

+      - Allow
+      description: Action to filter entries by.
+    - name: expiration_date
+      description: Enter a specific date and time to filter entries by using format "YYYY-MM-DD HH:MM:SSz" for UTC time.  Alternately, a PowerShell **GetDate** statement can be used.


yaakovi · 2022-06-05T20:44:25Z

Packs/EWS/Integrations/EwsExtensionEXOPowershellV2/EwsExtensionEXOPowershellV2.ps1

+    $ids = $kwargs.ids
+    $list_type = $kwargs.list_type
+    $list_subtype = $kwargs.list_subtype
+    if ($entries -and $ids)


What if not are passed?

yaakovi · 2022-06-05T20:45:48Z

Packs/EWS/Integrations/EwsExtensionEXOPowershellV2/EwsExtensionEXOPowershellV2.ps1

+    if ($kwargs.set_context -eq "yes")
+    {
+        $entry_context = @{ "$script:INTEGRATION_ENTRY_CONTEXT.RemovedTenantBlocks" = $raw_response }
+        Write-Output $human_readable, $entry_context, $raw_response
+    }


No need to write to context on "delete" commands

This is intended to allow storing a list of deleted items for later confirmation in playbooks/scripts that deletion was successful. I would suggest keeping this here unless it cannot be included.

yaakovi · 2022-06-05T20:47:38Z

Packs/EWS/Integrations/EwsExtensionEXOPowershellV2/EwsExtensionEXOPowershellV2.ps1

+        $entries, $list_type, $list_subtype, $action, $notes, $no_expiration, $expiration_date
+    )
+    $human_readable = TableToMarkdown $raw_response "Results of $command"
+    if ($kwargs.set_context -eq "yes")


The command should always set the context.

yaakovi · 2022-06-05T20:47:58Z

Packs/EWS/Integrations/EwsExtensionEXOPowershellV2/EwsExtensionEXOPowershellV2.ps1

+        $entry, $list_type, $list_subtype, $action, $no_expiration, $expiration_date
+    )
+    $human_readable = TableToMarkdown $raw_response "Results of $command"
+    if ($kwargs.set_context -eq "yes")


The command should always set the context.

CLAassistant · 2022-06-06T23:40:49Z

All committers have signed the CLA.

mikejrizzo · 2022-06-08T21:40:33Z

@yaakovi I've pushed the various changes we discussed in our meeting on Tuesday. Please let me know if you have any further questions or items I need to look at.

Thanks!

* Added new commands to retrieve/modify Tenant Allow/Block Lists. Initial working version. * Restoring Readme content deleted accidentally * Tweaked description on command ews-get-tenant-allow-block-list-items * Updated pack documentation with new release notes and readme content for new commands. * Added command output definitions for added commands and incremented integration version number. * Added contributors.md file to pack. * Fixed issues found by YAML validation. * Fixed validation issue in release notes md file. * Added mention of Tenant Allow/Block List management features. * Removing set-context arguments and related code * Removed references to set_context argument. * Removed duplicated contributor section. * Removed duplicated contributor section. Co-authored-by: Mike Rizzo <mjrizzo@gmail.com> Co-authored-by: yaakovi <syaakovi@paloaltonetworks.com>

…emisto#19554) * Added new commands to retrieve/modify Tenant Allow/Block Lists. Initial working version. * Restoring Readme content deleted accidentally * Tweaked description on command ews-get-tenant-allow-block-list-items * Updated pack documentation with new release notes and readme content for new commands. * Added command output definitions for added commands and incremented integration version number. * Added contributors.md file to pack. * Fixed issues found by YAML validation. * Fixed validation issue in release notes md file. * Added mention of Tenant Allow/Block List management features. * Removing set-context arguments and related code * Removed references to set_context argument. * Removed duplicated contributor section. * Removed duplicated contributor section. Co-authored-by: Mike Rizzo <mjrizzo@gmail.com> Co-authored-by: yaakovi <syaakovi@paloaltonetworks.com>

mikejrizzo added 6 commits May 12, 2022 15:54

Added new commands to retrieve/modify Tenant Allow/Block Lists. Initi…

2020863

…al working version.

Restoring Readme content deleted accidentally

57e8d8e

Tweaked description on command ews-get-tenant-allow-block-list-items

c0e731c

Updated pack documentation with new release notes and readme content …

c93c3cc

…for new commands.

Added command output definitions for added commands and incremented i…

c65e561

…ntegration version number.

Added contributors.md file to pack.

3ab453c

content-bot added the Contribution Thank you! Contributions are always welcome! label May 18, 2022

content-bot changed the base branch from master to contrib/mikejrizzo_contrib/mikerizzo_ews May 18, 2022 16:10

content-bot assigned ShacharKidor May 18, 2022

content-bot requested a review from ShacharKidor May 18, 2022 16:10

content-bot added Community Contribution Form Filled Whether contribution form filled or not. labels May 18, 2022

mikejrizzo added 2 commits May 18, 2022 12:45

Fixed issues found by YAML validation.

a9d976e

Fixed validation issue in release notes md file.

63dec37

ShacharKidor removed their request for review May 22, 2022 13:03

ShacharKidor removed their assignment May 22, 2022

Noy-Maimon requested a review from yaakovi May 25, 2022 07:50

yaakovi reviewed Jun 5, 2022

View reviewed changes

Noy-Maimon assigned yaakovi Jun 6, 2022

Performed edits requested during content review.

28dae59

mikejrizzo requested review from a team and michalgold as code owners June 6, 2022 23:40

mikejrizzo added 4 commits June 7, 2022 08:42

Added mention of Tenant Allow/Block List management features.

cad63c6

Removing set-context arguments and related code

26f9cf9

Removed references to set_context argument.

d3fe372

Removed duplicated contributor section.

7d15d94

Removed duplicated contributor section.

c3d701d

ShahafBenYakir removed the request for review from a team June 8, 2022 22:22

yaakovi self-requested a review June 14, 2022 05:31

yaakovi approved these changes Jun 14, 2022

View reviewed changes

yaakovi added the docs-approved label Jun 14, 2022

yaakovi merged commit 9114c6c into demisto:contrib/mikejrizzo_contrib/mikerizzo_ews Jun 14, 2022

content-bot mentioned this pull request Jun 14, 2022

EWS - Adding O365 Tenant Allow/Block List Management #19554

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

EWS - Adding O365 Tenant Allow/Block List Management #19103

EWS - Adding O365 Tenant Allow/Block List Management #19103

mikejrizzo commented May 18, 2022

content-bot commented May 18, 2022

content-bot commented May 18, 2022

content-bot commented May 18, 2022

yaakovi May 25, 2022

mikejrizzo Jun 6, 2022

yaakovi Jun 5, 2022

mikejrizzo Jun 6, 2022

yaakovi Jun 5, 2022

mikejrizzo Jun 6, 2022

yaakovi Jun 5, 2022

mikejrizzo Jun 6, 2022

yaakovi Jun 5, 2022

mikejrizzo Jun 6, 2022

yaakovi Jun 5, 2022

yaakovi Jun 5, 2022

mikejrizzo Jun 6, 2022

yaakovi Jun 5, 2022

yaakovi Jun 5, 2022

CLAassistant commented Jun 6, 2022 •

edited

Loading

mikejrizzo commented Jun 8, 2022



		---
		[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/ews-extension-online-powershell-v2)

	description: Entries to add to the list. Separate multiple entries with a comma (e.g. "Item1,Item2").
	description: A comma-separated list of entries to add to the list (e.g. "Item1,Item2").

	description: 'List subtype to add items to. '
	description: List subtype to add items to.

EWS - Adding O365 Tenant Allow/Block List Management #19103

EWS - Adding O365 Tenant Allow/Block List Management #19103

Conversation

mikejrizzo commented May 18, 2022

Contributing to Cortex XSOAR Content

Status

Related Issues

Description

Screenshots

Minimum version of Cortex XSOAR

Does it break backward compatibility?

Must have

content-bot commented May 18, 2022

content-bot commented May 18, 2022

Failed Build Steps

content-bot commented May 18, 2022

Failed Build Steps

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

CLAassistant commented Jun 6, 2022 • edited Loading

mikejrizzo commented Jun 8, 2022

CLAassistant commented Jun 6, 2022 •

edited

Loading