Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FireEyeNX Pack Corrections #24723

Merged
merged 13 commits into from
Feb 20, 2023
Merged

FireEyeNX Pack Corrections #24723

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
b26c7a2
commit xdr mapping
eepstain Feb 19, 2023
697e21d
Check
eepstain Feb 19, 2023
6adff95
Check2
eepstain Feb 19, 2023
7327b2e
Test - Changed Multimodel
eepstain Feb 19, 2023
1c40c13
Merge branch 'master' into FireEyeNX-Test
eepstain Feb 19, 2023
361e56f
Update FireEyeNX_1_3.xif
eepstain Feb 20, 2023
435cabf
Updated RE
eepstain Feb 20, 2023
4c5fb9e
Merge branch 'FireEyeNX-Test' of github.com:demisto/content into Fire…
eepstain Feb 20, 2023
402b035
Removed ParsingRules
eepstain Feb 20, 2023
d953b91
ParsingRules stash
eepstain Feb 20, 2023
640e2fc
Updated toversion
eepstain Feb 20, 2023
ac1f333
Updated Parsing
eepstain Feb 20, 2023
74dd5ee
Updated Parsing
eepstain Feb 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion Packs/FireEyeNX/ModelingRules/FireEyeNX/FireEyeNX.xif
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
[MODEL: dataset=fireeye_mps_raw, model=Network]
[MODEL:model="Network", dataset="fireeye_mps_raw"]
alter XDM.Network.event_timestamp = parse_timestamp("%s",arrayindex( regextract(to_string(rt),"(\d+)\d{3}"),0) ),
XDM.Network.Destination.port = to_number(dpt),
XDM.Network.Source.port = to_number(spt),
Expand Down
1 change: 1 addition & 0 deletions Packs/FireEyeNX/ModelingRules/FireEyeNX/FireEyeNX.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
name: FireEye NX Modeling Rule
id: fireeye_nx_modeling_rule
fromversion: 6.8.0
toversion: 6.9.9
tags: FireEye NX
rules: ''
schema: ''
5 changes: 3 additions & 2 deletions Packs/FireEyeNX/ModelingRules/FireEyeNX_1_3/FireEyeNX_1_3.xif
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
[MODEL: dataset=fireeye_mps_raw]
alter xdm.target.port = to_number(dpt),
alter
xdm.target.port = to_number(dpt),
xdm.source.port = to_number(spt),
xdm.event.operation_sub_type = act,
xdm.target.ipv4 = dst,
Expand All @@ -15,4 +16,4 @@ alter xdm.target.port = to_number(dpt),
xdm.source.process.executable.md5 = fileHash,
xdm.source.process.executable.file_type = fileType,
xdm.network.http.method = requestMethod,
xdm.alert.original_threat_name = cs1;
xdm.alert.original_threat_name = cs1;
5 changes: 1 addition & 4 deletions Packs/FireEyeNX/ParsingRules/FireEyeNX/FireEyeNX.xif
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,2 @@
[INGEST:vendor="fireeye", product="mps", target_dataset="fireeye_mps_raw", no_hit = keep]
alter tmp_year_number = format_timestamp("%Y", _insert_time)
, tmp_time_extract = arrayindex(regextract(_raw_log ,"\>\s*([a-zA-Z]+\s+\d+\s+\d+\:\d+\:\d+)"),0)
| alter _time = parse_timestamp("%b %d %H:%M:%S %Y",concat(tmp_time_extract , " " ,tmp_year_number ))
| fields - tmp_time_extract , tmp_year_number;
alter _time = to_timestamp(to_integer(RT), "millis");
6 changes: 6 additions & 0 deletions Packs/FireEyeNX/ReleaseNotes/1_1_16.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Modeling Rules

##### FireEye NX Modeling Rule

- Updated Modeling Rules
2 changes: 1 addition & 1 deletion Packs/FireEyeNX/pack_metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "FireEye Network Security (NX)",
"description": "FireEye Network Security is an effective cyber threat protection solution that helps organizations minimize the risk of costly breaches by accurately detecting and immediately stopping advanced, targeted, and other evasive attacks hiding in Internet traffic.",
"support": "xsoar",
"currentVersion": "1.1.15",
"currentVersion": "1.1.16",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down