FireEyeHX Create Indicator Enhacement

Packs/FireEyeHX/Integrations/FireEyeHXv2/FireEyeHXv2.py

@@ -1151,16 +1151,18 @@ def delete_condition(self, indicator_name: str, category: str, condition_type: s
             raise_on_status=True,
         )
 
-    def new_indicator_request(self, category):
+    def new_indicator_request(self, category, body: Dict[str, Any]):
         """
         Create a new indicator
         """
 
         try:
             return self._http_request(
                 method='POST',
-                url_suffix=f"indicators/{category}"
+                url_suffix=f"indicators/{category}",
+                json_data=body
             )
+
         except Exception as e:
             demisto.debug(str(e))
             raise ValueError('Failed to parse response body, unexpected response structure from the server.')
@@ -2821,16 +2823,29 @@ def create_indicator_command(client: Client, args: Dict[str, Any]) -> CommandRes
     """
 
     category = args.get('category')
+    payload = {}
+    if args.get('display_name'):
+        payload['display_name'] = args.get('display_name')
+
+    if args.get('description'):
+        payload['description'] = args.get('description')
+
+    if args.get('platforms'):
+        if isinstance(args.get('platforms'), list):
+            payload['platforms'] = args.get('platforms')
+        else:
+            payload['platforms'] = [args.get('platforms')]
 
-    response = client.new_indicator_request(category)["data"]
+    response = client.new_indicator_request(category, payload)
 
-    md_table = tableToMarkdown('FireEye HX New Indicator created successfully', {'ID': response.get('_id')})
+    md_table = tableToMarkdown('FireEye HX New Indicator created successfully', {'ID': response.get('data').get('_id')})
 
     return CommandResults(
         outputs_prefix="FireEyeHX.Indicators",
         outputs_key_field="_id",
-        outputs=response,
-        readable_output=md_table
+        outputs=response.get('data'),
+        readable_output=md_table,
+        raw_response=response
     )
 
 

Packs/FireEyeHX/Integrations/FireEyeHXv2/FireEyeHXv2.yml

@@ -1873,6 +1873,29 @@ script:
       default: false
       isArray: false
       secret: false
+    - description: Display Name for the indicator.
+      name: display_name
+      required: false
+      default: false
+      isArray: false
+      secret: false
+    - description: Description for the indicator.
+      name: description
+      required: false
+      default: false
+      isArray: false
+      secret: false
+    - auto: PREDEFINED
+      description: The platform for the indicator. If not selected, the indicator will be created for all platforms.
+      name: platforms
+      required: false
+      default: false
+      isArray: true
+      secret: false
+      predefined:
+        - 'win'
+        - 'linux'
+        - 'mac'
     description: Create a new indicator.
     name: fireeye-hx-create-indicator
     outputs:
@@ -2413,7 +2436,7 @@ script:
   script: '-'
   type: python
   subtype: python3
-  dockerimage: demisto/python3:3.10.10.48392
+  dockerimage: demisto/python3:3.10.12.63474
   feed: false
   longRunning: false
   longRunningPort: false

Packs/FireEyeHX/Integrations/FireEyeHXv2/FireEyeHXv2_test.py

@@ -1,7 +1,7 @@
 import io
 import json
 from pathlib import Path
-
+from typing import Any
 import pytest
 from CommonServerPython import DemistoException
 
@@ -1991,3 +1991,37 @@ def test_validate_base_url(baseurl: str, expected_error: str):
     with pytest.raises(ValueError) as e:
         validate_base_url(baseurl)
     assert str(e.value) == expected_error
+
+
+CREATE_INDICATOR_ARGS = {
+    'category': 'test_cat',
+    'name': 'test_name',
+    'display_name': 'test_display_name',
+    'description': 'test_desc',
+    'platforms': ['platform1', 'platform2'],
+    'data': {
+        '_id': 'test'
+    }
+}
+
+
+def test_create_indicator_command(monkeypatch):
+    import FireEyeHXv2
+
+    class MockClient:
+        def __init__(self, base_url):
+            pass
+
+        def get_token_request(self):
+            return "mock_token"
+
+        def new_indicator_request(self, category, body: dict[str, Any]):
+            return CREATE_INDICATOR_ARGS
+
+    monkeypatch.setattr(FireEyeHXv2, "Client", MockClient)
+
+    args = CREATE_INDICATOR_ARGS
+    from FireEyeHXv2 import Client, create_indicator_command
+    client = Client(base_url='https://www.example.com')
+    command_result = create_indicator_command(client=client, args=args)
+    assert command_result.raw_response == CREATE_INDICATOR_ARGS

Packs/FireEyeHX/Integrations/FireEyeHXv2/README.md

@@ -2107,8 +2107,11 @@ Create a new indicator.
 #### Input
 
 | **Argument Name** | **Description** | **Required** |
-| --- | --- | --- |
-| category | The indicator category. | Required | 
+| --- | --- |----------|
+| category | The indicator category. | Required |
+| display_name | Display name for the indicator. | Optional |
+| description | Description for the indicator. | Optional |
+| platforms | The platform for the Indicator. If not selected, the indicator will be created for all platforms. | Optional |
 
 
 #### Context Output

Packs/FireEyeHX/ReleaseNotes/2_3_9.md

@@ -0,0 +1,7 @@
+
+#### Integrations
+
+##### FireEye Endpoint Security (HX) v2
+
+- Updated the ***fireeye-hx-create-indicator*** command to support additional optional arguments. 
+- Updated the Docker image to: *demisto/python3:3.10.12.63474*.

Packs/FireEyeHX/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "FireEye HX",
     "description": "FireEye Endpoint Security is an integrated solution that detects and protects endpoints against known and unknown threats. The FireEye HX Cortex XSOAR integration provides access to information about endpoints, acquisitions, alerts, indicators, and containment. Customers can extract critical data and effectively operate the security operations automated playbooks.",
     "support": "xsoar",
-    "currentVersion": "2.3.8",
+    "currentVersion": "2.3.9",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",