new commands and playbook added #25253

pk-druva · 2023-03-14T05:26:49Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

fixes: link to the issue

Description

A few sentences describing the overall goals of the pull request's commits.

Screenshots

Paste here any images that will help the reviewer

Minimum version of Cortex XSOAR

6.0.0
6.1.0
6.2.0
6.5.0

Does it break backward compatibility?

Yes
- Further details:
No

Must have

Tests
Documentation

CLAassistant · 2023-03-14T05:26:54Z

All committers have signed the CLA.

content-bot · 2023-03-14T05:28:35Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @yucohen will know the proposed changes are ready to bereviewed.

kgal-pan · 2023-03-15T11:59:31Z

Packs/Druva/Integrations/Druva/Druva.py

+
+
+    def post_quarantineResource(self,org_id,resource_id, resource_type, from_date, to_date):
+        if org_id is not None:


Are we expecting org_id to be defined? What happens if org_id is None? Currently, we still send it in json_data.

In case of Backupset that is FS,NAS or VMware OrgId is mandatory and in other resource types we don't need to give orgid

kgal-pan · 2023-03-15T12:01:06Z

Packs/Druva/Integrations/Druva/Druva.py

+            org_id=int(org_id)
+        json_data = {'orgID':org_id,'resourceType': resource_type, 'fromDate': from_date, 'toDate': to_date}
+
+        url_suffix = '/realize/ransomwarerecovery/v1/quarantineranges/resource/' + str(resource_id)


We can utilize format strings in this. Looks cleaner IMO.

Suggested change

url_suffix = '/realize/ransomwarerecovery/v1/quarantineranges/resource/' + str(resource_id)

url_suffix = f"/realize/ransomwarerecovery/v1/quarantineranges/resource/{resource_id}"

Feel free to change in all other client method url_suffixs.

url_suffixs are now changed in all other client method

kgal-pan · 2023-03-15T12:06:24Z

Packs/Druva/Integrations/Druva/Druva.py

+        return (readable_output, outputs, raw_response)
+
+    else:
+        raise RuntimeError('Error: ' + str(response.status_code))


If there's an error in the request (statusCode != 200), does the endpoint provide an error message back (usually in response.content or response.json())?

I think that providing the user with Error: {statusCode} doesn't contain enough information for the user to know what's wrong and how to fix their issue. Might be helpful to add the response content when you raise the RuntimeError in all *_Command methods.

kgal-pan · 2023-03-15T12:08:42Z

Packs/Druva/Integrations/Druva/Druva.py

+
+        if command == 'hi-command':


Remove. Also, remove all other commented out code you have in the file, for example:

# return_outputs(*Druva_ListQuarantine_Snapshots_Command(clientObj, resource_id, range_id))

Commented code is removed

efelmandar · 2023-03-15T14:49:30Z

Hi @pk-druva thank you very much for your contribution it is highly appreciated, I reviewed the playbook you added and everything looks great. just a couple of things to consider:

Please add some descriptions to the playbook itself, playbook inputs, and playbook tasks to help the users better understand and use your content.
The playbook begins with !DeleteContext all=yes which will delete all of the context every time the playbooks run, which can result in some unwanted behavior such as deleting other integration's data of an existing incident. please consider removing it if not strictly necessary.

yucohen

@pk-druva Thanks for the contribution! great work!
Please see my comments :)

yucohen · 2023-03-15T14:53:07Z

Packs/Druva/Integrations/Druva/Druva.py

+        readable_output = tableToMarkdown('Found Druva users', responseJson['users'])
+        outputs = {"Druva.User(val.userID == obj.userID)": responseJson['users']}
+        raw_response = responseJson
+        return (readable_output, outputs, raw_response)


Lets change this to a commandResults object. You can see this article. Relevant to all the new commands added

commandResults object is used in all commands.

yucohen · 2023-03-15T14:54:30Z

Packs/Druva/Integrations/Druva/Druva.py

@@ -282,12 +355,29 @@ def main():
            search_string = demisto.args().get('search_string')
            return_outputs(*Druva_FindDevice_Command(clientObj, search_string))

+        if command == 'druva-find-user':
+            user_string=demisto.args().get('user_string')
+            return_outputs(*Druva_FindUser_Command(clientObj,user_string))


After changing to ComandResults, lets also change the return outputs to return_results

return_outputs is replaced with return_results

yucohen · 2023-03-15T14:55:27Z

Packs/Druva/Integrations/Druva/Druva.yml

@@ -15,10 +15,67 @@ configuration:
  name: clientId
  type: 4
  required: true
+  defaultvalue: K7QYkjixOag7f2P0J/t2sgXq9NMsbzj/


Is this default value should work for some users? If not, lets remove it

default value is removed

yucohen · 2023-03-15T14:55:35Z

Packs/Druva/Integrations/Druva/Druva.yml

 - display: Secret Key
  name: secretKey
  type: 4
  required: true
+  defaultvalue: 7AHzEWu9yYgjeB4GdWVs9QopoWRlIGc3


yucohen · 2023-03-15T14:56:15Z

Packs/Druva/Integrations/Druva/Druva.yml

  runonce: false
  subtype: python3
+  longRunningPort: true


is this a long running integration? if not, lets remove this

Removed long running integration.

yucohen · 2023-03-15T14:58:33Z

Packs/Druva/Integrations/Druva/README.md

-#### Command Example
-```!druva-list-quarantine-ranges```
-
-#### Context Example
-```
-{
-    "Druva": {
-        "activeQuarantineRanges": {
-            "fromDate": "2020-07-13",
-            "orgID": -1,
-            "rangeID": 415,
-            "recoveryStatus": "None",
-            "resourceID": 4497505,
-            "resourceName": "SahilG-MBP",
-            "resourceParent": "Druva Integrations",
-            "resourcePlatform": "darwin",
-            "resourceType": "Endpoint",
-            "toDate": "2020-07-15",
-            "workload": "endpoints"
-        }
-    }
-}
-```


why did we remove this?

Added Command Example

yucohen · 2023-03-15T14:59:29Z

Packs/Druva/ReleaseNotes/1_1_2.md

+
+##### Druva Ransomware Response
+
+- %%UPDATE_RN%%


please update the relevant change

Updated relevant change in 1_1_2.md

efelmandar · 2023-03-19T11:33:00Z

@pk-druva changes now look excellent! Thank you again for making this contribution!
@yucohen everything is done from PB side

yucohen · 2023-03-20T10:01:21Z

Packs/Druva/Integrations/Druva/Druva.yml

+- display: Fetch indicators
+  name: feed
+  type: 8
+  required: false
+- display: Indicator Verdict
+  name: feedReputation
+  type: 18
+  required: false
+  options:
+  - Unknown
+  - None
+  - Benign
+  - Good
+  - Suspicious
+  - Malicious
+  - Bad
+  additionalinfo: Indicators from this integration instance will be marked with this verdict
+- display: Source Reliability
+  name: feedReliability
+  defaultvalue: F - Reliability cannot be judged
+  type: 15
+  required: true
+  options:
+  - A - Completely reliable
+  - B - Usually reliable
+  - C - Fairly reliable
+  - D - Not usually reliable
+  - E - Unreliable
+  - F - Reliability cannot be judged
+  additionalinfo: Reliability of the source providing the intelligence data
+- display: ""
+  name: feedExpirationPolicy
+  defaultvalue: indicatorType
+  type: 17
+  required: false
+  options:
+  - never
+  - interval
+  - indicatorType
+  - suddenDeath
+- display: ""
+  name: feedExpirationInterval
+  defaultvalue: "20160"
+  type: 1
+  required: false
+- display: Feed Fetch Interval
+  name: feedFetchInterval
+  defaultvalue: "240"
+  type: 19
+  required: false
+- display: Bypass exclusion list
+  name: feedBypassExclusionList
+  type: 8
+  required: false
+  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.


Is the integration feed? If not, those parameters can be remoed

Removed these parameters.

* new command added * suggested changes have been made * Feed parameters removed * fixed lint * fixed validate * fixed validate * fixed validate --------- Co-authored-by: pk-druva <126672043+pk-druva@users.noreply.github.com>

content-bot added the Contribution Thank you! Contributions are always welcome! label Mar 14, 2023

content-bot changed the base branch from master to contrib/pk-druva_Druva March 14, 2023 05:28

content-bot assigned yucohen Mar 14, 2023

content-bot requested a review from yucohen March 14, 2023 05:28

kgal-pan self-assigned this Mar 14, 2023

content-bot added Contribution Form Filled Whether contribution form filled or not. Partner labels Mar 14, 2023

kgal-pan requested a review from efelmandar March 15, 2023 11:56

kgal-pan reviewed Mar 15, 2023

View reviewed changes

yucohen requested changes Mar 15, 2023

View reviewed changes

pk-druva requested review from kgal-pan and yucohen and removed request for efelmandar, kgal-pan and yucohen March 17, 2023 09:35

yucohen requested a review from efelmandar March 19, 2023 10:25

yucohen assigned efelmandar Mar 19, 2023

pk-druva force-pushed the Druva branch from bfa8ad1 to dbc960e Compare March 20, 2023 07:01

pk-druva added 2 commits March 20, 2023 07:07

new command added

5361140

suggested changes have been made

01b4d71

pk-druva force-pushed the Druva branch from dbc960e to 01b4d71 Compare March 20, 2023 07:08

yucohen reviewed Mar 20, 2023

View reviewed changes

pk-druva and others added 7 commits March 20, 2023 12:06

Feed parameters removed

79b0458

fixed lint

17ea8c3

fixed validate

6e95649

Merge branch 'contrib/pk-druva_Druva' into Druva

9ac9c40

fixed validate

daef350

Merge remote-tracking branch 'pk-druva/Druva' into pr/pk-druva/25253

98833ea

fixed validate

d052ced

yucohen added the docs-approved label Mar 22, 2023

yucohen approved these changes Mar 22, 2023

View reviewed changes

yucohen merged commit a2295ad into demisto:contrib/pk-druva_Druva Mar 22, 2023
17 of 19 checks passed

yucohen mentioned this pull request Mar 23, 2023

new commands and playbook added (#25253) #25472

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

new commands and playbook added #25253

new commands and playbook added #25253

pk-druva commented Mar 14, 2023

CLAassistant commented Mar 14, 2023 •

edited

content-bot commented Mar 14, 2023

kgal-pan Mar 15, 2023

pk-druva Mar 16, 2023

kgal-pan Mar 15, 2023

pk-druva Mar 16, 2023

kgal-pan Mar 15, 2023

kgal-pan Mar 15, 2023

pk-druva Mar 16, 2023

efelmandar commented Mar 15, 2023

yucohen left a comment

yucohen Mar 15, 2023

pk-druva Mar 16, 2023

yucohen Mar 15, 2023

pk-druva Mar 16, 2023

yucohen Mar 15, 2023

pk-druva Mar 16, 2023

yucohen Mar 15, 2023

yucohen Mar 15, 2023

pk-druva Mar 16, 2023

yucohen Mar 15, 2023

pk-druva Mar 16, 2023

yucohen Mar 15, 2023

pk-druva Mar 16, 2023

efelmandar commented Mar 19, 2023

yucohen Mar 20, 2023

pk-druva Mar 21, 2023



		def post_quarantineResource(self,org_id,resource_id, resource_type, from_date, to_date):
		if org_id is not None:

	url_suffix = '/realize/ransomwarerecovery/v1/quarantineranges/resource/' + str(resource_id)
	url_suffix = f"/realize/ransomwarerecovery/v1/quarantineranges/resource/{resource_id}"

new commands and playbook added #25253

new commands and playbook added #25253

Conversation

pk-druva commented Mar 14, 2023

Contributing to Cortex XSOAR Content

Status

Related Issues

Description

Screenshots

Minimum version of Cortex XSOAR

Does it break backward compatibility?

Must have

CLAassistant commented Mar 14, 2023 • edited

content-bot commented Mar 14, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

efelmandar commented Mar 15, 2023

yucohen left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

efelmandar commented Mar 19, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

CLAassistant commented Mar 14, 2023 •

edited