Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Marketplace Contribution] CSV Feed - Content Pack Update #30710

Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions Packs/FeedCSV/Integrations/FeedCSV/FeedCSV.py
@@ -1,5 +1,5 @@
import demistomock as demisto
from CommonServerPython import *
import demistomock as demisto # noqa: F401
from CommonServerPython import * # noqa: F401


def main():
Expand Down
16 changes: 11 additions & 5 deletions Packs/FeedCSV/Integrations/FeedCSV/FeedCSV.yml
@@ -1,4 +1,4 @@
category: Data Enrichment & Threat Intelligence

Check failure on line 1 in Packs/FeedCSV/Integrations/FeedCSV/FeedCSV.yml

View workflow job for this annotation

GitHub Actions / pre-commit

Validation Error IN116

A required field ('encoding') has been added to an existing integration.
commonfields:
id: CSVFeed
version: -1
Expand Down Expand Up @@ -129,19 +129,25 @@
name: skipinitialspace
type: 8
required: false
- additionalinfo: Supports CSV values.
display: Tags
- additionalinfo: Text encoding for the CSV file. Defaults to latin-1.
display: Text Encoding
name: encoding
type: 0
required: true
ilappe marked this conversation as resolved.
Show resolved Hide resolved
defaultvalue: latin-1
- display: Tags
name: feedTags
type: 0
required: false
additionalinfo: Supports CSV values.
- display: Trust any certificate (not secure)
name: insecure
type: 8
required: false
- display: Use system proxy settings
name: proxy
type: 8
required: false
type: 8
description: Fetch indicators from a CSV feed.
display: CSV Feed
name: CSVFeed
Expand All @@ -165,10 +171,10 @@
- contextPath: CSV.Indicator.rawJSON
description: The indicator rawJSON value.
type: Unknown
dockerimage: demisto/py3-tools:1.0.0.45904
dockerimage: demisto/py3-tools:1.0.0.80165
feed: true
runonce: false
script: '-'
script: ''
subtype: python3
type: python
tests:
Expand Down
12 changes: 6 additions & 6 deletions Packs/FeedCSV/Integrations/FeedCSV/FeedCSV_description.md
Expand Up @@ -2,7 +2,7 @@ Fetch indicators from a CSV feed. The integration allows a great amount of user

* **Indicator Type** - The type of indicators in the feed.
* **Server URL** - URL of the feed.
* **Username + Password** - Credentials to access feeds that require basic authentication.
* **Username + Password** - Credentials to access feeds that require basic authentication.
These fields also support the use of API key headers. To use API key headers, specify the header name and value in the following format:
`_header:<header_name>` in the **Username** field and the header value in the **Password** field.
* **Ignore Regex** - Python regular expression for lines that should be ignored.
Expand All @@ -14,16 +14,16 @@ These fields also support the use of API key headers. To use API key headers, sp
* **Skip Initial Space** - When True, whitespace immediately following the delimiter is ignored.

## Step by step configuration
As an example, we'll be looking at the SSL BL feed by Abuse. This feed will ingest indicators of type IP. These are the feed isntance configuration parameters for our example.
As an example, we'll be looking at the SSL BL feed by Abuse. This feed will ingest indicators of type IP. These are the feed isntance configuration parameters for our example.

**Indicator Type** - IP.

**Server URL**: https://sslbl.abuse.ch/blacklist/sslipblacklist.csv.

**Credentials** - This feed does not require authentication.

From a quick look at the feed in the web browser, we are going to configure the rest of the parameters:

**Ignore Regex** - We are going to need to ignore all the text inside the part enclosed by the `#` character (included)
so we'll configure `^#` as the regular expression to use to ignore this text.

Expand All @@ -35,12 +35,12 @@ Note that the field for the indicator value itself (the IP) must be `value`. So
**Delimiter** - The delimiter between the fields in this feed is `,`, we'll use that as the value for this field.

**Quote Character** - No need to change the quote character, we'll leave that as the default (`"`).

**Escape Character** - No need to change the escape character, we'll leave that empty.

**Skip Initial Space** - No whitespaces between the delimiter and the value, we'll leave the unchecked.

Now we have successfully configured an instance for the Abuse SSL BL feed, once we enable `Fetches indicators` the instance will start pulling indicators.

By clicking `Mapping` in the integration instance, we can map the field names we previously configured to actual indicator fields (except `value` which is the indicator value).
We can use `Set up a new classification rule` using actual data from the feed.
We can use `Set up a new classification rule` using actual data from the feed.
7 changes: 7 additions & 0 deletions Packs/FeedCSV/ReleaseNotes/1_1_29.md
@@ -0,0 +1,7 @@

#### Integrations

##### CSV Feed

- Added an encoding parameter to support CSVs containing non-English text.
- Updated the Docker image to: *demisto/py3-tools:1.0.0.80165*.
2 changes: 1 addition & 1 deletion Packs/FeedCSV/pack_metadata.json
Expand Up @@ -2,7 +2,7 @@
"name": "CSV Feed",
"description": "Indicators feed from a CSV file",
"support": "xsoar",
"currentVersion": "1.1.28",
"currentVersion": "1.1.29",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down