[Marketplace Contribution] PAN-OS by Palo Alto Networks - Content Pack Update #31239

xsoar-bot · 2023-12-01T17:40:37Z

Warning
The changes in the contributed files were not made on the most updated pack versions

Item Name Contribution Pack Version Latest Pack Version

Panorama 2.1.3 2.1.15

For the Reviewer:

Compare the code of this PR with the latest version of the pack. Make sure you understand the changes the contributor intended to contribute, and solve the conflicts accordingly.

In case improvements are needed, instruct the contributor to edit the code through the GitHub Codespaces and Not through the XSOAR UI.

For the Contributor:
@amkoppad
In case you are requested by your reviewer to improve the code or to make changes, submit them through the GitHub Codespaces and Not through the XSOAR UI.

To use the GitHub Codespaces, do the following:

Click the 'Code' button in the right upper corner of this PR.

Click 'Create codespace on Transformers'.

Click 'Authorize and continue'.

Wait until your Codespace environment is generated. When it is, you can edit your code.

Commit and push your changes to the head branch of the PR.

Status

In Progress
Ready
In Hold - (Reason for hold)

Contributor

@amkoppad

Notes

Added the filename argument to the two commands.
!pan-os-platform-get-device-state
!pan-os-get-running-config
If the filename argument is not provided then it uses the current logic to name the files.
If the filename argument is provided then it appends the provided value to the hostname/target and then saves the file.
This is very useful for the running-config command because that downloads all the files with the same name which makes it very difficult to identify which target the running config belongs to.

Video Link

Short demo video of the Pack usage. Speeds up the review. Optional but recommended. Use a video sharing service such as Google Drive or YouTube.

* added the ability to add resolution when closing issue * RN * RN * add in yml * revert non-relevant * Update Packs/Jira/ReleaseNotes/3_1_5.md Co-authored-by: Adi Bamberger Edri <72088126+BEAdi@users.noreply.github.com> * Update Packs/Jira/Integrations/JiraV2/JiraV2.yml Co-authored-by: Adi Bamberger Edri <72088126+BEAdi@users.noreply.github.com> --------- Co-authored-by: Adi Bamberger Edri <72088126+BEAdi@users.noreply.github.com>

* Reco: get user context by email address (demisto#30720) * Reco: get user context by email address Signed-off-by: Gal Nakash <gal@recolabs.ai> * Update Packs/Reco/Integrations/Reco/Reco_test.py Co-authored-by: Sapir Shuker <49246861+sapirshuker@users.noreply.github.com> * Reco: fix error handling Signed-off-by: Gal Nakash <gal@recolabs.ai> * Reco: fix readme.md Signed-off-by: Gal Nakash <gal@recolabs.ai> * Reco: get user context by email address Signed-off-by: Gal Nakash <gal@recolabs.ai> --------- Signed-off-by: Gal Nakash <gal@recolabs.ai> Co-authored-by: Sapir Shuker <49246861+sapirshuker@users.noreply.github.com> * Update .secrets-ignore * Update README.md * update docker --------- Signed-off-by: Gal Nakash <gal@recolabs.ai> Co-authored-by: GalNakash-RecoLabs <71227802+GalNakash-RecoLabs@users.noreply.github.com> Co-authored-by: Sapir Shuker <49246861+sapirshuker@users.noreply.github.com> Co-authored-by: sapirshuker <sshuker@paloaltonetworks.com>

…uts (demisto#30784) * Added playbook, formatted, and added README * RN * Update Packs/CommonPlaybooks/ReleaseNotes/2_4_14.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Bump pack from version CommonPlaybooks to 2.4.15. * Bump pack from version CommonPlaybooks to 2.4.16. * Bump pack from version CommonPlaybooks to 2.4.17. * Bump pack from version CommonPlaybooks to 2.4.18. * Bump pack from version CommonPlaybooks to 2.4.19. * Bump pack from version CommonPlaybooks to 2.4.20. * Bump pack from version CommonPlaybooks to 2.4.21. * Bump pack from version CommonPlaybooks to 2.4.22. * Bump pack from version CommonPlaybooks to 2.4.23. * Bump pack from version CommonPlaybooks to 2.4.24. * Bump pack from version CommonPlaybooks to 2.4.25. --------- Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> Co-authored-by: Content Bot <bot@demisto.com>

* changed path for test playbook in xsoar * changed path for test playbook in xsoar * changed path for test playbook in xsoar * changed keyword for testing --------- Co-authored-by: JudithB <132264628+jbabazadeh@users.noreply.github.com>

Co-authored-by: Content Bot <bot@demisto.com> Co-authored-by: JudithB <132264628+jbabazadeh@users.noreply.github.com>

* Beyond Trust new pack - CIAC-8670 * Update Packs/BeyondTrustRemoteSupport/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * fixes --------- Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

…30968) * Small fixes to pack names * Update pack_metadata.json

* Adding new Playbook input grouping * adding new Playbook input grouping * updating pack pack_metadata * update ReleaseNotes * Update Packs/Phishing/ReleaseNotes/3_6_1.md Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com> --------- Co-authored-by: Dan Tavori <38749041+dantavori@users.noreply.github.com>

* added explanation about command in the documentation * rn * update docker * Update Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/README.md Co-authored-by: Sapir Shuker <49246861+sapirshuker@users.noreply.github.com> --------- Co-authored-by: Sapir Shuker <49246861+sapirshuker@users.noreply.github.com>

* fix sync validation * fix prod-us

…ils (demisto#30961) * Add corrupt email object handling; Add debug logs * Update docker image * Update release notes * Remove additional debug logs * Fix double printing of message id in debug log * Add UT

* playbook fix * added release notes * Added to ignore pack Inteval and InternetAccess * Deleted unused input: Interval * Added release notes * deleted from ignore input * Update Packs/JoeSecurity/ReleaseNotes/1_1_16.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/JoeSecurity/ReleaseNotes/1_1_16.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * added error message to the playbook outputs. added new task for checking if the file type is supported * release notes added * Update Packs/JoeSecurity/Playbooks/playbook-Detonate_File_-_JoeSecurity_V2_README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/SecneurXAnalysis/Playbooks/Detonate_File_-_SecneurX_Analysis_README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Fixes for the pre-commit process * Added new images for Joesecurity and SecneurXAnalysis playbooks. Grammer fix for the release notes * Added ignore case for task of the supported types * Fixes for the release notes * added file types * fixes for release ReleaseNotes removed input of interval --------- Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

* added missing outputs and removed unneeded playbook outputs * Re-added the test playbook and marketplaces configs * RN * Bump pack from version CommonPlaybooks to 2.4.21. * Bump pack from version CommonPlaybooks to 2.4.22. * Bump pack from version CommonPlaybooks to 2.4.23. * Bump pack from version CommonPlaybooks to 2.4.24. * Bump pack from version CommonPlaybooks to 2.4.25. * Bump pack from version CommonPlaybooks to 2.4.26. --------- Co-authored-by: Content Bot <bot@demisto.com>

* add-microsoft-defender-modeling * fix-readme-instruction-number-1-to-5 * event_type_minor_fix * fix-duration-typo * fix-minor-issues * fix-target-file-path * add-process_id-type-safety

* added icons * added icons * added icons * reverted changes * added more icons

* Wiz 1.2.14 (demisto#30951) * initial commit - better error management for empty issues fetch * update testing to correspond with changed error catching * RNs * Update Wiz.py * Docker Image --------- Co-authored-by: solalraveh <solal.raveh@gmail.com> Co-authored-by: MLainer1 <93524335+MLainer1@users.noreply.github.com> Co-authored-by: MLainer1 <mlainer@paloaltonetworks.com>

* Added filter to the parsing rule of manage engine * Added release note. * Removed capture group from the parsing rule filter * Modified the parsing rule.

* Fixes for 'Detonate URL - Generic v1.5' playbook * RN * Bump pack from version CommonPlaybooks to 2.4.17. * Bump pack from version CommonPlaybooks to 2.4.18. * Bump pack from version CommonPlaybooks to 2.4.19. * Bump pack from version CommonPlaybooks to 2.4.20. * Bump pack from version CommonPlaybooks to 2.4.21. * Bump pack from version CommonPlaybooks to 2.4.22. * added 'unique' transformer to 'url' input within all sub-playbooks and tasks. * Bump pack from version CommonPlaybooks to 2.4.23. * Bump pack from version CommonPlaybooks to 2.4.24. * Bump pack from version CommonPlaybooks to 2.4.25. * Bump pack from version CommonPlaybooks to 2.4.26. * Bump pack from version CommonPlaybooks to 2.4.27. * replaced the command used within task number 19 - replaced 'OPSWAT Filescan|||opswat-filescan-scan-url' command with 'opswat-filescan-scan-url' command. --------- Co-authored-by: Content Bot <bot@demisto.com>

* fix * update docker

* updated the outputs description * updated the outputs description - RN * updated the outputs description - RN pack meta date * Bump pack from version CommonPlaybooks to 2.4.26. * updated the outputs types - Boolean * Apply suggestions from code review Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Bump pack from version CommonPlaybooks to 2.4.27. * Bump pack from version CommonPlaybooks to 2.4.28. --------- Co-authored-by: Content Bot <bot@demisto.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

* Detonate_URL_-_ThreatStream * RN * RN * RN

…ack (demisto#30999)

* set to false field Threat Name Co-authored-by: franciscojavierfernandezjim <127735202+franciscojavierfernandezjim@users.noreply.github.com>

* Fixed the modeling rule and the schema file, in reference to the boolean fields. * Fixed the modeling rule and the schema file, in reference to the boolean fields. * Added release notes. * Fixed the schema file

…t entity alerts by MITRE tactics (demisto#30874) * Added playbook, new pb readme and new pb image * RN * Bump pack from version CommonPlaybooks to 2.4.18. * Bump pack from version CommonPlaybooks to 2.4.19. * Bump pack from version CommonPlaybooks to 2.4.20. * Bump pack from version CommonPlaybooks to 2.4.21. * Update Packs/CommonPlaybooks/ReleaseNotes/2_4_21.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Bump pack from version CommonPlaybooks to 2.4.22. * Bump pack from version CommonPlaybooks to 2.4.23. * Bump pack from version CommonPlaybooks to 2.4.24. * Bump pack from version CommonPlaybooks to 2.4.25. * Bump pack from version CommonPlaybooks to 2.4.26. * Fixed issue in get entity alerts playbook and in firewall search. Updated RN. * Fixed version * Updated playbook with fixes from review * Updated playbook with fixes from review * Bump pack from version CommonPlaybooks to 2.4.27. * Updated playbook with fixes from review * Bump pack from version CommonPlaybooks to 2.4.28. * Bump pack from version CommonPlaybooks to 2.4.29. --------- Co-authored-by: Content Bot <bot@demisto.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

* first commit * commit * commit * first commit * update pack_metadata file * extract_logs_from_response changes * get_events_command changes * commit * commit * add logs * commit * commit * commit * commit * commit * commit * commit * commit * commit * commit * commit * commit * commit * Fixed the memory load on Docker * commit * first commit for rewrite * commit * commit * add UT and finish implementation * design * Change pack name * add-modeling-rules * add-parsing-rules * siem-content-minor-fixes * add UT and docstring * add-siem-documentation * update-siem-documentation * update-siem-documentation * commit * Change readme file * fix UT and add description to pack_metadata * commit * fix mypy flake8 * add UT * refactor-siem-content * Apply suggestions from code review Comment corrections Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * comment corrections * comment corrections and add UT for it * comment correction * mypy * update Docker * comment corrections * comment corrections * update docker * fix UT and pre-commit * commit * commit * fix pre commit * commit --------- Co-authored-by: Chanan Welt <cwelt@paloaltonetworks.com> Co-authored-by: cweltPA <129675344+cweltPA@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

* Fixed date parsing * format and tests * fixed date parsing from and to the api * fixed tests * fixed invalid date order * fetch in asc order * fetch in asc order * fix unitesing * fix potential formatting issue * change first_run * change first_run * Fix RN * Fix lint * Fix lint * added unitests * added unitests * CR fixes * CR fixes

MLainer1

Nice work! make sure to look at the review comments, and fix the validation errors.
Afterwards, we can schedule a short demo to see the changes you made in the PR.

Packs/PAN-OS/Integrations/Panorama/Panorama.py

amkoppad · 2023-12-11T13:06:43Z

Hi @MLainer1. I will make the suggested changes. Just give me a couple of days. It’s a busy week with the customers.

Co-authored-by: MLainer1 <93524335+MLainer1@users.noreply.github.com>

amkoppad · 2023-12-12T20:13:48Z

Hi @MLainer1 I have committed the suggested changes. Please let me know when you want to have a quick meeting for the demo. Thank you. Please feel free to reach out to me on slack.

jlevypaloalto

great work, a few comments:

jlevypaloalto · 2023-12-18T15:13:44Z

Packs/PAN-OS/Integrations/Panorama/Panorama.py

+    file_name_arg = args.get("filename")
+    target = args.get("target")
+    if file_name_arg != 'running_config':
+        file_name =  target + '_' + file_name_arg + '_running_config'


Let's use the filename as we receive it from the user without changing it.

Hi @jlevypaloalto We will have to append at least the target name to the filename argument because it will save all the config files to all the hostnames with the same filename which will be confusing.

jlevypaloalto · 2023-12-18T15:18:24Z

Packs/PAN-OS/Integrations/Panorama/Panorama.yml

@@ -5033,6 +5033,9 @@ script:
  - arguments:
    - description: The serial number of the device.
      name: target
+    - defaultValue: running_config
+      description: Name of the file to save the config to. Default is "running_config"


The default values are added to the README when it's generated, let's remove it from the yml

I addressed this in my new PR that I created.

MLainer1 · 2023-12-24T07:38:39Z

Hi @amkoppad, Your contribution was impacted by changes in the git history of the content repo, and you see many file changes that are not related to your PR. Our team is currently working on a solution, and we hope that it will be resolved soon.

MLainer1 · 2023-12-26T08:26:45Z

Hi @amkoppad ,

Last Thursday, December 20th, there was an update in the content repo. This is why your PR looks like there were a lot of commits and files changed.
Please open a new PR to fix this issue.

Thank you very much for your contribution and your understanding of the situation.
Have a nice holiday season!

amkoppad · 2024-01-04T17:36:55Z

I have created a new PR and made the contribution @MLainer1
#31985

JasBeilin and others added 30 commits November 19, 2023 16:29

Oncall artifacts missing (demisto#30966)

ee5ce92

* changed path for test playbook in xsoar * changed path for test playbook in xsoar * changed path for test playbook in xsoar * changed keyword for testing --------- Co-authored-by: JudithB <132264628+jbabazadeh@users.noreply.github.com>

poetry files (demisto#30970)

279684b

Co-authored-by: Content Bot <bot@demisto.com> Co-authored-by: JudithB <132264628+jbabazadeh@users.noreply.github.com>

Run Release Notes Review only on XSOAR-supported Packs (demisto#30948)

eff3cb4

Free Enrichers - Small fixes to pack names that are missing (demisto#…

57439a8

…30968) * Small fixes to pack names * Update pack_metadata.json

Fix sync validation for xsoar-saas bucket (demisto#30989)

5945975

* fix sync validation * fix prod-us

[Mail Listener V2] Handle corrupt mail object in stream of fetched ma…

65e5014

…ils (demisto#30961) * Add corrupt email object handling; Add debug logs * Update docker image * Update release notes * Remove additional debug logs * Fix double printing of message id in debug log * Add UT

xsiam-siem-windows-defender-modeling-ciac-8043 (demisto#30973)

2c8d27f

* add-microsoft-defender-modeling * fix-readme-instruction-number-1-to-5 * event_type_minor_fix * fix-duration-typo * fix-minor-issues * fix-target-file-path * add-process_id-type-safety

Add svgs files to integrations (demisto#30931)

8ee0fd8

* added icons * added icons * added icons * reverted changes * added more icons

Added filter to the parsing rule of manage engine (demisto#30975)

58f4af4

* Added filter to the parsing rule of manage engine * Added release note. * Removed capture group from the parsing rule filter * Modified the parsing rule.

Update content_roles.json (demisto#30964)

f7873fd

[Prisma Cloud V2] Fix Namespace Extraction (demisto#30996)

0e463f3

* fix * update docker

Detonate_URL_-_ThreatStream (demisto#30992)

905b34a

* Detonate_URL_-_ThreatStream * RN * RN * RN

Added CIRCL CVE Search (demisto#30997)

569536f

Added cortex xdr to be mandatory dependency for Capture the flag 01 p…

1b7e537

…ack (demisto#30999)

set to false field Threat Name (demisto#30949) (demisto#31006)

cd7a15a

* set to false field Threat Name Co-authored-by: franciscojavierfernandezjim <127735202+franciscojavierfernandezjim@users.noreply.github.com>

Workday fix successfully (demisto#30932)

ac2719f

* Fixed the modeling rule and the schema file, in reference to the boolean fields. * Fixed the modeling rule and the schema file, in reference to the boolean fields. * Added release notes. * Fixed the schema file

remove legacy rn generator (demisto#31009)

f8e0194

Release a new base pack (demisto#31014)

24d375e

israelpoli and others added 4 commits December 7, 2023 22:21

Merge branch 'master' into pr/xsoar-bot/31239

389b303

rebase with current pack version

a906af0

MLainer1 requested changes Dec 10, 2023

View reviewed changes

Packs/PAN-OS/Integrations/Panorama/Panorama.py Outdated Show resolved Hide resolved

Packs/PAN-OS/Integrations/Panorama/Panorama.py Outdated Show resolved Hide resolved

MLainer1 added pending-demo Demo pending pending-contributor The PR is pending the response of its creator and removed pending-demo Demo pending labels Dec 10, 2023

amkoppad and others added 2 commits December 12, 2023 14:56

Update Packs/PAN-OS/Integrations/Panorama/Panorama.py

4e20021

Co-authored-by: MLainer1 <93524335+MLainer1@users.noreply.github.com>

Update Packs/PAN-OS/Integrations/Panorama/Panorama.py

9199fc1

Co-authored-by: MLainer1 <93524335+MLainer1@users.noreply.github.com>

MLainer1 added pending-demo Demo pending and removed pending-contributor The PR is pending the response of its creator labels Dec 14, 2023

jlevypaloalto reviewed Dec 18, 2023

View reviewed changes

tkatzir force-pushed the contrib/xsoar-contrib_amkoppad-contrib-PAN-OS branch from 10bf8d8 to 66ceee9 Compare December 20, 2023 22:21

xsoar-bot requested review from ilaner, dansterenson, dorschw and Ni-Knight as code owners December 20, 2023 22:21

MLainer1 removed request for GuyAfik, ilaner, dansterenson, dorschw and Ni-Knight December 31, 2023 08:04

amkoppad mentioned this pull request Jan 4, 2024

[Marketplace Contribution] PAN-OS by Palo Alto Networks - Content Pack Update #31985

Merged

3 tasks

MLainer1 closed this Jan 9, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Marketplace Contribution] PAN-OS by Palo Alto Networks - Content Pack Update #31239

[Marketplace Contribution] PAN-OS by Palo Alto Networks - Content Pack Update #31239

xsoar-bot commented Dec 1, 2023

MLainer1 left a comment •

edited

amkoppad commented Dec 11, 2023

amkoppad commented Dec 12, 2023 •

edited

jlevypaloalto left a comment

jlevypaloalto Dec 18, 2023

amkoppad Jan 4, 2024

jlevypaloalto Dec 18, 2023

amkoppad Jan 4, 2024

MLainer1 commented Dec 24, 2023

MLainer1 commented Dec 26, 2023

amkoppad commented Jan 4, 2024 •

edited

[Marketplace Contribution] PAN-OS by Palo Alto Networks - Content Pack Update #31239

[Marketplace Contribution] PAN-OS by Palo Alto Networks - Content Pack Update #31239

Conversation

xsoar-bot commented Dec 1, 2023

Status

Contributor

Notes

Video Link

MLainer1 left a comment • edited

Choose a reason for hiding this comment

amkoppad commented Dec 11, 2023

amkoppad commented Dec 12, 2023 • edited

jlevypaloalto left a comment

Choose a reason for hiding this comment

jlevypaloalto Dec 18, 2023

Choose a reason for hiding this comment

amkoppad Jan 4, 2024

Choose a reason for hiding this comment

jlevypaloalto Dec 18, 2023

Choose a reason for hiding this comment

amkoppad Jan 4, 2024

Choose a reason for hiding this comment

MLainer1 commented Dec 24, 2023

MLainer1 commented Dec 26, 2023

amkoppad commented Jan 4, 2024 • edited

MLainer1 left a comment •

edited

amkoppad commented Dec 12, 2023 •

edited

amkoppad commented Jan 4, 2024 •

edited