Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Code42 new playbooks #25702

Merged
merged 49 commits into from May 10, 2023
Merged

Code42 new playbooks #25702

merged 49 commits into from May 10, 2023

Conversation

timabrmsn
Copy link
Contributor

Status

  • In Progress
  • Ready
  • In Hold - (Reason for hold)

Description

Adds 12 new Playbooks to the Code42 Integration and makes a small update to the Code42 Security Alert Layout.

Screenshots

Updated layout:
Updated_layout

Minimum version of Cortex XSOAR

  • 6.0.0
  • 6.1.0
  • 6.2.0
  • 6.5.0

Does it break backward compatibility?

  • Yes
    • Further details:
  • No

Must have

  • [N/A] Tests
  • Documentation

@content-bot content-bot added Contribution Form Filled Whether contribution form filled or not. Partner Contribution Thank you! Contributions are always welcome! labels Apr 3, 2023
@content-bot content-bot changed the base branch from master to contrib/code42_feature/code42_new_playbooks April 3, 2023 13:39
@content-bot
Copy link
Collaborator

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @samuelFain will know the proposed changes are ready to be reviewed.

@github-advanced-security
Copy link

You have successfully added a new CodeQL configuration /language:javascript. As part of the setup process, we have scanned this repository and found no existing alerts. In the future, you will see all code scanning alerts on the repository Security tab.

@github-advanced-security
Copy link

You have successfully added a new CodeQL configuration /language:python. As part of the setup process, we have scanned this repository and found no existing alerts. In the future, you will see all code scanning alerts on the repository Security tab.

@dantavori dantavori assigned merit-maita and efelmandar and unassigned samuelFain Apr 4, 2023
@dantavori dantavori requested review from merit-maita and efelmandar and removed request for samuelFain April 4, 2023 07:46
@merit-maita
Copy link
Contributor

Hi @timabrmsn ,
Thank you for your contribution.
Due to holidays in Israel in the upcoming days, your PR review will be slightly delayed, I apologize in advance.
In the meantime, please fill in the following registration form
You can also try to solve the errors in the build, except for pull check (documentation).
I’m available for any of your questions here or on slack.
Thanks again.

merit-maita
merit-maita requested changes Apr 9, 2023
View reviewed changes
Copy link
Contributor

@merit-maita merit-maita left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you so much for your contribution
please go over my comments, and make sure to pass the failing validation check.
@efelmandar will review your PR.
thanks again!

Packs/Code42/Integrations/Code42/Code42.py
@@ -1021,9 +1018,6 @@ def securitydata_search_command(client, args):

@logger
def file_events_search_command(client, args):
file_events_version = demisto.incident()["CustomFields"].get("code42fileeventsversion", "1")
if file_events_version != "2":
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why did you remove thee two conditions in the code?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had initially added those error conditions to prevent users from mixing the different event formats within the same incident (e.g. an incident fetched with V1 events shouldn't be able to make a V2 event search and add them to the V1 incident), but I realized after the release that this prevents running these commands from scheduled job playbooks (or testing in playbooks) without first manually setting the incident context value to the correct file event version.

Packs/Code42/Integrations/Code42/Code42_test.py
@@ -2511,24 +2511,6 @@ def test_security_data_search_command_searches_exposure_exists_when_no_exposure_
assert len(filter_groups) == 3


def test_file_events_search_command_returns_error_when_v2_events_not_configured(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why did you remove the test as well, is the version not relevant anymore?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In deciding to remove the error condition altogether above, this test is no longer necessary.

Packs/Code42/Playbooks/playbook-Code42_Close_Related_XSOAR_And_Incydr_Incidents_README.md
Comment on lines +35 to +37
## Playbook Image

---
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
## Playbook Image
---

if the section is empty, it should be removed

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not empty, as there's the image link right below this.

Packs/Code42/Playbooks/playbook-Code42_Check_Incydr_Status_And_Close_XSOAR_Incident_README.md Show resolved Hide resolved
Packs/Code42/Playbooks/playbook-Code42_Add_Employees_To_Departing_Employee_Watchlist_README.md Show resolved Hide resolved
Packs/Code42/Playbooks/playbook-Code42_Add_Employees_To_New_Hire_Watchlist_README.md Show resolved Hide resolved
Packs/Code42/ReleaseNotes/3_1_5.md Outdated Show resolved Hide resolved
@merit-maita merit-maita added the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label May 7, 2023
@merit-maita
Copy link
Contributor

@timabrmsn can you pull from master and push again please?

efelmandar
efelmandar approved these changes May 7, 2023
View reviewed changes
Copy link
Contributor

@efelmandar efelmandar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@timabrmsn @merit-maita Thanks for making the changes, I went over them and everything looks good!

@merit-maita merit-maita added ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. and removed ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. labels May 9, 2023
@timabrmsn timabrmsn requested a review from ostolero as a code owner May 9, 2023 13:53
@CLAassistant
Copy link

CLAassistant commented May 9, 2023 •
edited

CLA assistant check
All committers have signed the CLA.

@merit-maita merit-maita removed the request for review from ostolero May 9, 2023 17:50
@merit-maita merit-maita added ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. and removed ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. pending-demo Demo pending pending-contributor The PR is pending the response of its creator labels May 9, 2023
@merit-maita merit-maita merged commit b72beab into demisto:contrib/code42_feature/code42_new_playbooks May 10, 2023
27 of 30 checks passed
@content-bot content-bot mentioned this pull request May 10, 2023
Merged
10 tasks
merit-maita added a commit that referenced this pull request May 10, 2023
@content-bot @timabrmsn @merit-maita
Code42 new playbooks (#26431)
78022b1 
* Code42 new playbooks (#25702)

* add mapping update to release notes

* add new playbooks

* layout update

* linting and Security Alert playbook file rename

* update Security Alert description

* update version/release notes

* Remove error handling around v1/v2 commands

* add integration fix note in release notes

* bump py42 docker image

* remove test for file-events-search returning error

* update playbooks to use code42-file-events-search instead of code42-securitydata-search

* bump container version

* remove 3_1_5.md change

* update docker images

* playbook PR feedback

* bump to 3.1.7

* add departing employee playbook update

* add new hire playbook update

* departing employee auto add playbook update

* departing employee cleanup playbook update

* new hire auto add playbook update

* new hire cleanup playbook update

* remove departing employees playbook update

* remove new hire playbook update

* fix incident query

* bump version

* add `code42-get-user-risk-profile` command

* update release notes

* fix get user risk profile name and add test

* playbook updates with new code42-user-get-risk-profile command

* validation

* validation

* correct release notes docker image

* add unit test for Code42FileEventsToMarkdownTable script

* update docker image

* updated docker image

---------

Co-authored-by: Tim Abramson <tim.abramson@code42.com>
Co-authored-by: merit <meretmaayta@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@merit-maita merit-maita merit-maita approved these changes

@efelmandar efelmandar efelmandar approved these changes

Assignees

@merit-maita merit-maita

@mchasepan mchasepan

@efelmandar efelmandar

Labels
Contribution Form Filled Whether contribution form filled or not. Contribution Thank you! Contributions are always welcome! Partner ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR.
Projects
None yet
Milestone
No milestone
7 participants
@timabrmsn @content-bot @merit-maita @efelmandar @CLAassistant @mchasepan @samuelFain