Update SplunkPy README Configuration/Commands Sections #31693

kgal-pan · 2023-12-24T12:12:03Z

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-9307

Description

As part of working on demisto/demisto-sdk#3820 I tested out the README update and noticed that the SplunkPy integration README was missing 2 tagging parameters added for mirroring in #28198.

The two added parameters overwrite a comment under the configuration options table that referred to two parameters that were removed in #14365 and no longer exist in the integrations.

Must have

Tests
Documentation

kgal-pan · 2023-12-24T13:59:40Z

@ShahafBenYakir @ilappe - I also noticed that some command sections are descriptions while others have the actual command name (as it's generated by the SDK).

For example, we have a command section titled Get Mapping Fields and another command section is in the form of the command name such as splunk-kv-store-collection-create. Should I standardize these command section to conform to command name or leave as is?

ShahafBenYakir · 2023-12-24T15:47:51Z

@kgal-pan regarding the command naming convention, when you generate the README for this command what is the format it is created? A B or a-b?

kgal-pan · 2023-12-24T16:35:27Z

@kgal-pan regarding the command naming convention, when you generate the README for this command what is the format it is created? A B or a-b?

a-b

* Add Xpanse Scope for XDR Integration (#31539) * update xpanse mp and docker * RN * Update Packs/CortexXDR/ReleaseNotes/6_0_11.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> --------- Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update CortexXDRIR.yml * Update Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR.yml Co-authored-by: johnnywilkes <32227961+johnnywilkes@users.noreply.github.com> * Update CortexXDRIR.yml --------- Co-authored-by: johnnywilkes <32227961+johnnywilkes@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> Co-authored-by: Adi Daud <46249224+adi88d@users.noreply.github.com> Co-authored-by: adi88d <adaud@paloaltonetworks.com>

* SentinelOneV2 (#31595) * removing the empty fields from a payload of remote-script * bumped version * updated release notes * Update Packs/SentinelOne/ReleaseNotes/3_2_15.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> --------- Co-authored-by: munna-metron <82433049+munna-metron@users.noreply.github.com> Co-authored-by: Adi Daud <46249224+adi88d@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Updated file variable revert test variable

* Init test.py/sh to run in unittests-and-lint * add location commands to bash script * Remove running script with python3 * Restructure imports * Restructure imports * Show hidden files and permissions in test script * Temporarily comment out test.py script in CI * remove test.py script * remove commented out python test script * disable darwin service startup in bash script * Add execution permissions and update darwin command * Fix microsocks_darwin path * Add microsocks executable and enable netstat * Re-enable whois integration tests * Add tempfile, time and subprocess imports * Add sys import * Update Tests/scripts/test.sh * Update Tests/scripts/test.sh * Empty commit * Update test.sh with whois commands * Fix echo command * script fix * Add dig command * Empty commit * Empty commit * Empty commit * Empty commit * [VirusTotal] Fix missing suspicious value for running instances (#31684) * Fix missing suspicious value for running instances (#31648) * Update docker * Update docker * Update pack_metadata.json * Update pack_metadata.json --------- Co-authored-by: Daniel Pascual <danielvazquez@google.com> Co-authored-by: Adi Daud <46249224+adi88d@users.noreply.github.com> * un-skip test_socks_proxy UT * revert to origin * un-skip test_socks_proxy UT * Remove unnecessary files * Add necessary imports --------- Co-authored-by: Koby Meir <kobymeir@users.noreply.github.com> Co-authored-by: content-bot <55035720+content-bot@users.noreply.github.com> Co-authored-by: Daniel Pascual <danielvazquez@google.com> Co-authored-by: Adi Daud <46249224+adi88d@users.noreply.github.com>

* update docker * update rn * update rn * revert * update version

* Change the field to be searchable * RN * Added missing scripts * Added new layout rule Added new layout updated scripts * UPDATED SCRIPT * Fixed more pre-commit errors * Updated RN Fixed issue with the widget * Removed un-required script * Removed un-required script * Removed un-required script * Removed un-required script * Added tests * Added a test for main * Added a test for main * Added a test for main * Added a test for main * Updated main test * Updated main test * Updated main test * Updated main test * removed main tests * removed main tests * fixed tests * added MP * added MP * Updated README.md * Updated README.md * removed unrequited import * pre-commit * Updated RN description * Bump pack from version CloudIncidentResponse to 1.0.10. * alert source * Added missing scripts * Added new layout rule Added new layout updated scripts * UPDATED SCRIPT * Fixed more pre-commit errors * Removed un-required script * Removed un-required script * Removed un-required script * Removed un-required script * Added tests * Added a test for main * Added a test for main * Added a test for main * Added a test for main * Updated main test * Updated main test * Updated main test * Updated main test * removed main tests * removed main tests * fixed tests * added MP * added MP * Updated README.md * Updated README.md * removed unrequited import * pre-commit * Updated RN description * alert source * Bump pack from version CloudIncidentResponse to 1.0.10. * [SanePdfReport] - Increase resourceTimeout (#31513) * added random.randint * pre-commit * added a retry * added a retry2 * added a retry3 * flake8 * fixed * test * Reverted to master --------- Co-authored-by: MLainer1 <93524335+MLainer1@users.noreply.github.com> Co-authored-by: Content Bot <bot@demisto.com> Co-authored-by: michal-dagan <109464765+michal-dagan@users.noreply.github.com>

kgal-pan · 2023-12-24T17:15:39Z

Rebase to resolve https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/jobs/3996720#L812.

ShahafBenYakir · 2023-12-24T18:26:07Z

@kgal-pan go by the convention created by the command.

ilappe

great catch!

kgal-pan · 2023-12-26T12:45:26Z

Splunk UTs are failing:

Looking into it.

kgal-pan · 2023-12-28T09:46:08Z

In artifacts/xsoar/logs/Run_Tests.log, found that SplunkPy Test Playbook is failing because it exceeded 100MB memory threshold:

[2023-12-27 10:09:43] - [Thread-1 (execute_tests)] - [ERROR] - Failed docker resource test. Docker container demistoserver_pyexec-578a8fd1-3a17-45c7-8cfb-0e29fddf7ceb-demistosplunksdk-py31.0.0.83421--13 exceeded the memory threshold, configured: 100 MiB and actual memory usage is 135.2 MiB.
Fix container memory usage or add `memory_threshold` key to failed test in conf.json with value th
at is greater than 135.2

[2023-12-27 10:09:43] - [Thread-1 (execute_tests)] - [ERROR] - Test failed: playbook: "SplunkPy parse-raw - Test" with integration(s): ["SplunkPy"]

@ilappe is looking into it.

* update integration * update readme * rm test conf * added eof newline * Add Xpanse Scope for XDR Integration (#31582) * Add Xpanse Scope for XDR Integration (#31539) * update xpanse mp and docker * RN * Update Packs/CortexXDR/ReleaseNotes/6_0_11.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> --------- Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update CortexXDRIR.yml * Update Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR.yml Co-authored-by: johnnywilkes <32227961+johnnywilkes@users.noreply.github.com> * Update CortexXDRIR.yml --------- Co-authored-by: johnnywilkes <32227961+johnnywilkes@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> Co-authored-by: Adi Daud <46249224+adi88d@users.noreply.github.com> Co-authored-by: adi88d <adaud@paloaltonetworks.com> * [pre-commit] fix script runner (#31592) * SentinelOneV2 (#31687) * SentinelOneV2 (#31595) * removing the empty fields from a payload of remote-script * bumped version * updated release notes * Update Packs/SentinelOne/ReleaseNotes/3_2_15.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> --------- Co-authored-by: munna-metron <82433049+munna-metron@users.noreply.github.com> Co-authored-by: Adi Daud <46249224+adi88d@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Updated file variable revert test variable (#30846) Updated file variable revert test variable * [Whois] test_socks_proxy UT failed (#31395) * Init test.py/sh to run in unittests-and-lint * add location commands to bash script * Remove running script with python3 * Restructure imports * Restructure imports * Show hidden files and permissions in test script * Temporarily comment out test.py script in CI * remove test.py script * remove commented out python test script * disable darwin service startup in bash script * Add execution permissions and update darwin command * Fix microsocks_darwin path * Add microsocks executable and enable netstat * Re-enable whois integration tests * Add tempfile, time and subprocess imports * Add sys import * Update Tests/scripts/test.sh * Update Tests/scripts/test.sh * Empty commit * Update test.sh with whois commands * Fix echo command * script fix * Add dig command * Empty commit * Empty commit * Empty commit * Empty commit * [VirusTotal] Fix missing suspicious value for running instances (#31684) * Fix missing suspicious value for running instances (#31648) * Update docker * Update docker * Update pack_metadata.json * Update pack_metadata.json --------- Co-authored-by: Daniel Pascual <danielvazquez@google.com> Co-authored-by: Adi Daud <46249224+adi88d@users.noreply.github.com> * un-skip test_socks_proxy UT * revert to origin * un-skip test_socks_proxy UT * Remove unnecessary files * Add necessary imports --------- Co-authored-by: Koby Meir <kobymeir@users.noreply.github.com> Co-authored-by: content-bot <55035720+content-bot@users.noreply.github.com> Co-authored-by: Daniel Pascual <danielvazquez@google.com> Co-authored-by: Adi Daud <46249224+adi88d@users.noreply.github.com> * delete test data files from repo (#31658) * NetskopeAPIv2 `alert_query` argument (#31690) * ParseEmailFiles: Update docker (#31683) * update docker * update rn * update rn * revert * update version * Adding Cloud Alerts Layout (#31118) * Change the field to be searchable * RN * Added missing scripts * Added new layout rule Added new layout updated scripts * UPDATED SCRIPT * Fixed more pre-commit errors * Updated RN Fixed issue with the widget * Removed un-required script * Removed un-required script * Removed un-required script * Removed un-required script * Added tests * Added a test for main * Added a test for main * Added a test for main * Added a test for main * Updated main test * Updated main test * Updated main test * Updated main test * removed main tests * removed main tests * fixed tests * added MP * added MP * Updated README.md * Updated README.md * removed unrequited import * pre-commit * Updated RN description * Bump pack from version CloudIncidentResponse to 1.0.10. * alert source * Added missing scripts * Added new layout rule Added new layout updated scripts * UPDATED SCRIPT * Fixed more pre-commit errors * Removed un-required script * Removed un-required script * Removed un-required script * Removed un-required script * Added tests * Added a test for main * Added a test for main * Added a test for main * Added a test for main * Updated main test * Updated main test * Updated main test * Updated main test * removed main tests * removed main tests * fixed tests * added MP * added MP * Updated README.md * Updated README.md * removed unrequited import * pre-commit * Updated RN description * alert source * Bump pack from version CloudIncidentResponse to 1.0.10. * [SanePdfReport] - Increase resourceTimeout (#31513) * added random.randint * pre-commit * added a retry * added a retry2 * added a retry3 * flake8 * fixed * test * Reverted to master --------- Co-authored-by: MLainer1 <93524335+MLainer1@users.noreply.github.com> Co-authored-by: Content Bot <bot@demisto.com> Co-authored-by: michal-dagan <109464765+michal-dagan@users.noreply.github.com> * fixed output typo * rm closing parenthesis * updated cmd sections to cmd names * rm closing bracket from arg description * changed default for kv collection to auto-generated * update rn * Update pack_metadata.json * raised memory threshold for parse-raw tpb --------- Co-authored-by: content-bot <55035720+content-bot@users.noreply.github.com> Co-authored-by: johnnywilkes <32227961+johnnywilkes@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> Co-authored-by: Adi Daud <46249224+adi88d@users.noreply.github.com> Co-authored-by: adi88d <adaud@paloaltonetworks.com> Co-authored-by: ilaner <88267954+ilaner@users.noreply.github.com> Co-authored-by: munna-metron <82433049+munna-metron@users.noreply.github.com> Co-authored-by: michal-dagan <109464765+michal-dagan@users.noreply.github.com> Co-authored-by: samuelFain <65926551+samuelFain@users.noreply.github.com> Co-authored-by: Koby Meir <kobymeir@users.noreply.github.com> Co-authored-by: Daniel Pascual <danielvazquez@google.com> Co-authored-by: yasta5 <112320333+yasta5@users.noreply.github.com> Co-authored-by: dorschw <81086590+dorschw@users.noreply.github.com> Co-authored-by: Moshe Galitzky <112559840+moishce@users.noreply.github.com> Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com> Co-authored-by: MLainer1 <93524335+MLainer1@users.noreply.github.com> Co-authored-by: Content Bot <bot@demisto.com>

kgal-pan added 3 commits December 24, 2023 14:02

update integration

fba35cc

update readme

79cc1aa

rm test conf

464d85b

kgal-pan requested a review from ShahafBenYakir December 24, 2023 12:12

kgal-pan requested a review from ilappe as a code owner December 24, 2023 12:12

added eof newline

01958db

content-bot and others added 9 commits December 24, 2023 19:15

[pre-commit] fix script runner (#31592)

809fe2f

Updated file variable revert test variable (#30846)

b421b7f

Updated file variable revert test variable

delete test data files from repo (#31658)

3756300

NetskopeAPIv2 alert_query argument (#31690)

516359c

ParseEmailFiles: Update docker (#31683)

1c38a14

* update docker * update rn * update rn * revert * update version

kgal-pan requested review from dansterenson, daryakoval, yucohen and michal-dagan as code owners December 24, 2023 17:15

Merge branch 'master' into splunk-update-integration-conf-doc

3ce7844

kgal-pan removed request for dansterenson, daryakoval, yucohen and michal-dagan December 24, 2023 17:16

kgal-pan self-assigned this Dec 24, 2023

fixed output typo

f8ae2fe

rm closing parenthesis

55736d7

ilappe approved these changes Dec 25, 2023

View reviewed changes

kgal-pan and others added 5 commits December 25, 2023 09:28

updated cmd sections to cmd names

8efe7e9

rm closing bracket from arg description

df2c195

changed default for kv collection to auto-generated

da578fb

Merge branch 'master' into splunk-update-integration-conf-doc

fdd3e46

Merge branch 'master' into splunk-update-integration-conf-doc

b83e6ea

kgal-pan added the docs-approved label Dec 26, 2023

kgal-pan and others added 2 commits December 26, 2023 12:00

update rn

6eb569d

Update pack_metadata.json

9cedbda

kgal-pan added 3 commits December 26, 2023 14:59

Merge branch 'master' into splunk-update-integration-conf-doc

5fe933e

Merge branch 'master' into splunk-update-integration-conf-doc

98ae80e

Merge branch 'master' into splunk-update-integration-conf-doc

e3879d0

kgal-pan changed the title ~~Update SplunkPy README Configuration Section~~ Update SplunkPy README Configuration/Commands Sections Dec 27, 2023

raised memory threshold for parse-raw tpb

063966e

kgal-pan requested a review from sapirshuker as a code owner December 28, 2023 10:57

kgal-pan merged commit c7c3682 into master Dec 28, 2023
17 checks passed

kgal-pan deleted the splunk-update-integration-conf-doc branch December 28, 2023 14:11

kgal-pan mentioned this pull request Jan 1, 2024

Fix SplunkPy splunk-kv-store-collection-data-list description #31877

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update SplunkPy README Configuration/Commands Sections #31693

Update SplunkPy README Configuration/Commands Sections #31693

kgal-pan commented Dec 24, 2023 •

edited

kgal-pan commented Dec 24, 2023 •

edited

ShahafBenYakir commented Dec 24, 2023 •

edited

kgal-pan commented Dec 24, 2023

kgal-pan commented Dec 24, 2023

ShahafBenYakir commented Dec 24, 2023

ilappe left a comment

kgal-pan commented Dec 26, 2023

kgal-pan commented Dec 28, 2023 •

edited

Update SplunkPy README Configuration/Commands Sections #31693

Update SplunkPy README Configuration/Commands Sections #31693

Conversation

kgal-pan commented Dec 24, 2023 • edited

Status

Related Issues

Description

Must have

kgal-pan commented Dec 24, 2023 • edited

ShahafBenYakir commented Dec 24, 2023 • edited

kgal-pan commented Dec 24, 2023

kgal-pan commented Dec 24, 2023

ShahafBenYakir commented Dec 24, 2023

ilappe left a comment

Choose a reason for hiding this comment

kgal-pan commented Dec 26, 2023

kgal-pan commented Dec 28, 2023 • edited

kgal-pan commented Dec 24, 2023 •

edited

kgal-pan commented Dec 24, 2023 •

edited

ShahafBenYakir commented Dec 24, 2023 •

edited

kgal-pan commented Dec 28, 2023 •

edited