XSIAM - New Phishing layout + playbook fixes #30590

idovandijk · 2023-10-31T16:48:03Z

Status

Blocked - SDK issue with layout rule

Related Issues

fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-8729
fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-8752
fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-8753
fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-8826

Description

Created a new layout for phishing in XSIAM
Fixed attachment upload flow in Process Email - Generic v2
Fixed an issue where the lack of a default input tag to the Block Indicators - Generic v2 playbook resulted in the absence of blocked indicators in the layout.
Added playbook trigger recommendation which will run the Phishing - Generic v3 playbook on Phishing alerts.

…d release notes.

…or attachment sections

…eric v2

…tag input, so that the blocked indicators would properly show in the phishing alert layout.

…ng-layout

altmannyarden · 2023-11-01T16:26:11Z

I don't know if you wanted me to review all files but the layout rule looks great :)

idovandijk · 2023-11-01T16:36:39Z

I don't know if you wanted me to review all files but the layout rule looks great :)

Only the rule. Still need to fix a few things in other places. Thanks!

…ng-layout

idovandijk · 2023-11-06T17:27:12Z

@altmannyarden Can you please review the newly added playbook trigger?
@ShirleyDenkberg Can you please review RN and descriptions?

…ng-layout

Packs/CommonPlaybooks/ReleaseNotes/2_4_14.md

Packs/Phishing/Playbooks/Process_Email_-_Generic_v2_README.md

Packs/Phishing/ReleaseNotes/3_6_0.md

ShirleyDenkberg · 2023-11-07T07:03:50Z

@AdiPeret @michal-dagan @michalgold @altmannyarden Doc review completed.

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

…ng-layout

…to xsiam-phishing-layout

guardrails · 2023-11-08T09:12:16Z

All previously detected findings have been fixed. Good job! 👍🎉

We will keep this comment up-to-date as you go along and notify you of any security issues that we identify.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

…release and will then need to commit something again to get the fix in the build

content-bot · 2023-11-12T12:52:32Z

This PR was automatically updated by a GitHub Action

CommonPlaybooks pack version was bumped to 2.4.15.

To stop automatic version bumps, add the ignore-auto-bump-version label to the github PR.

…ng-layout

* Updated the field's description. * Added layout, fixed playbook, playbook image, new playbook readme, and release notes. * Added improvements for layout - added email origin and descriptions for attachment sections * formatted * Added fromversion to layout to satisfy validator * Updated phishing pack RN to reflect the change in Process Email - Generic v2 * Updated the Block Indicators - Generic v3 playbook to have a default tag input, so that the blocked indicators would properly show in the phishing alert layout. * RNs and new readme for Block Indicators pb * Added speculative layout rule * Re-exported playbook from XSOAR * validation stuff * Added layout rule RN * Added tooltip as known word + speculative RN fix * Added phishing trigger * Updated RN with trigger recommendation * Implemented feedback - added a warning to the html rendering section. * Update Packs/Phishing/ReleaseNotes/3_6_0.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/Phishing/ReleaseNotes/3_6_0.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/Phishing/ReleaseNotes/3_6_0.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/CommonPlaybooks/ReleaseNotes/2_4_14.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/Phishing/ReleaseNotes/3_6_0.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/Phishing/ReleaseNotes/3_6_0.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Removed emailimage and attachmentitem fields that don't exist * Updated poetry to use Dan's SDK * Fixed RN manually because SDK is terrible * Reverting poetry after verified the SDK fix. Now waiting for new SDK release and will then need to commit something again to get the fix in the build * Bump pack from version CommonPlaybooks to 2.4.15. --------- Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> Co-authored-by: Content Bot <bot@demisto.com>

idovandijk added 2 commits October 27, 2023 21:30

Updated the field's description.

6792aa6

Added layout, fixed playbook, playbook image, new playbook readme, an…

30ce350

…d release notes.

idovandijk requested a review from AdiPeret October 31, 2023 16:48

idovandijk added 6 commits November 1, 2023 14:02

Added improvements for layout - added email origin and descriptions f…

cae786f

…or attachment sections

formatted

cd62063

Added fromversion to layout to satisfy validator

3082963

Updated phishing pack RN to reflect the change in Process Email - Gen…

1147071

…eric v2

Updated the Block Indicators - Generic v3 playbook to have a default …

c014e6d

…tag input, so that the blocked indicators would properly show in the phishing alert layout.

RNs and new readme for Block Indicators pb

ac3dfe4

idovandijk requested a review from michalgold as a code owner November 1, 2023 13:11

idovandijk added 2 commits November 1, 2023 16:22

Added speculative layout rule

c04e391

Merge branch 'master' of github.com:demisto/content into xsiam-phishi…

23b8f13

…ng-layout

Re-exported playbook from XSOAR

e8ee846

AdiPeret approved these changes Nov 5, 2023

View reviewed changes

idovandijk added 3 commits November 5, 2023 10:44

validation stuff

4b05604

Added layout rule RN

926069d

Added tooltip as known word + speculative RN fix

69312b1

idovandijk requested a review from michal-dagan as a code owner November 5, 2023 11:56

idovandijk added 3 commits November 5, 2023 14:05

Merge branch 'master' of github.com:demisto/content into xsiam-phishi…

319b166

…ng-layout

Added phishing trigger

265eb64

Updated RN with trigger recommendation

ae1c0eb

idovandijk requested a review from altmannyarden November 6, 2023 17:22

idovandijk assigned ShirleyDenkberg Nov 6, 2023

Merge branch 'master' of github.com:demisto/content into xsiam-phishi…

f0c4424

…ng-layout

ShirleyDenkberg reviewed Nov 7, 2023

View reviewed changes

ShirleyDenkberg added the docs-approved label Nov 7, 2023

idovandijk and others added 9 commits November 7, 2023 10:18

Implemented feedback - added a warning to the html rendering section.

8e6f8f3

Update Packs/Phishing/ReleaseNotes/3_6_0.md

88ebbb1

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/Phishing/ReleaseNotes/3_6_0.md

1569e11

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/Phishing/ReleaseNotes/3_6_0.md

a209e91

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/CommonPlaybooks/ReleaseNotes/2_4_14.md

99a0fc0

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/Phishing/ReleaseNotes/3_6_0.md

1f3b492

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/Phishing/ReleaseNotes/3_6_0.md

463a0ac

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Merge branch 'master' of github.com:demisto/content into xsiam-phishi…

8e08c1a

…ng-layout

Merge branch 'xsiam-phishing-layout' of github.com:demisto/content in…

d58b9f7

…to xsiam-phishing-layout

altmannyarden approved these changes Nov 7, 2023

View reviewed changes

idovandijk added 2 commits November 7, 2023 17:27

Removed emailimage and attachmentitem fields that don't exist

58bc94f

Updated poetry to use Dan's SDK

d22c60f

idovandijk requested review from ilaner and dorschw as code owners November 8, 2023 09:11

idovandijk and others added 4 commits November 8, 2023 11:34

Fixed RN manually because SDK is terrible

2f6db08

Reverting poetry after verified the SDK fix. Now waiting for new SDK …

1ec7488

…release and will then need to commit something again to get the fix in the build

Merged master into current branch.

6a3d0b5

Bump pack from version CommonPlaybooks to 2.4.15.

8e1661e

Merge branch 'master' of github.com:demisto/content into xsiam-phishi…

df93131

…ng-layout

idovandijk merged commit a1f817d into master Nov 12, 2023
18 of 19 checks passed

idovandijk deleted the xsiam-phishing-layout branch November 12, 2023 17:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

XSIAM - New Phishing layout + playbook fixes #30590

XSIAM - New Phishing layout + playbook fixes #30590

idovandijk commented Oct 31, 2023 •

edited

altmannyarden commented Nov 1, 2023

idovandijk commented Nov 1, 2023 •

edited

idovandijk commented Nov 6, 2023

ShirleyDenkberg commented Nov 7, 2023

guardrails bot commented Nov 8, 2023 •

edited

content-bot commented Nov 12, 2023

XSIAM - New Phishing layout + playbook fixes #30590

XSIAM - New Phishing layout + playbook fixes #30590

Conversation

idovandijk commented Oct 31, 2023 • edited

Status

Related Issues

Description

altmannyarden commented Nov 1, 2023

idovandijk commented Nov 1, 2023 • edited

idovandijk commented Nov 6, 2023

ShirleyDenkberg commented Nov 7, 2023

guardrails bot commented Nov 8, 2023 • edited

content-bot commented Nov 12, 2023

This PR was automatically updated by a GitHub Action

idovandijk commented Oct 31, 2023 •

edited

idovandijk commented Nov 1, 2023 •

edited

guardrails bot commented Nov 8, 2023 •

edited