Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[PrismaCloudV2] Add retries to fetch-incidents API calls #32433

Merged
merged 10 commits into from Jan 25, 2024
8 changes: 6 additions & 2 deletions Packs/PrismaCloud/Integrations/PrismaCloudV2/PrismaCloudV2.py
Expand Up @@ -111,15 +111,17 @@ def generate_auth_token(self, username: str, password: str) -> None:
The token is valid for 10 minutes.
"""
data = {'username': username, 'password': password}
demisto.debug("Sending request to get the auth token")

response = self._http_request('POST', 'login', json_data=data)
response = self._http_request('POST', 'login', json_data=data, retries=2)
try:
token = response.get('token')
if not token:
raise DemistoException(f'Could not retrieve token from server: {response.get("message")}', res=response)
except ValueError as exception:
raise DemistoException('Could not parse API response.', exception=exception) from exception

demisto.debug("Successfully got the auth token")
self._headers[REQUEST_CSPM_AUTH_HEADER] = token

def alert_filter_list_request(self):
Expand All @@ -137,7 +139,7 @@ def alert_search_request(self, time_range: Dict[str, Any], filters: List[str], l
})
demisto.info(f'Executing Prisma Cloud alert search with payload: {data}')

return self._http_request('POST', 'v2/alert', params=params, json_data=data)
return self._http_request('POST', 'v2/alert', params=params, json_data=data, retries=2)

def alert_get_details_request(self, alert_id: str, detailed: Optional[str] = None):
params = assign_params(detailed=detailed)
Expand Down Expand Up @@ -588,6 +590,7 @@ def fetch_request(client: Client, fetched_ids: Dict[str, int], filters: List[str
sort_by=['alertTime:asc'], # adding sort by 'id:asc' doesn't work
limit=limit + len(fetched_ids),
)
demisto.debug(f"Finished request, got response: {response}")
response_items = response.get('items', [])
updated_last_run_time_epoch = response_items[-1].get('alertTime') if response_items else now
incidents = filter_alerts(client, fetched_ids, response_items, limit)
Expand All @@ -603,6 +606,7 @@ def fetch_request(client: Client, fetched_ids: Dict[str, int], filters: List[str
limit=limit + len(fetched_ids),
page_token=response.get('nextPageToken'),
)
demisto.debug(f"Finished another request, got response: {response}")
response_items = response.get('items', [])
updated_last_run_time_epoch = \
response_items[-1].get('alertTime') if response_items else updated_last_run_time_epoch
Expand Down
Expand Up @@ -112,7 +112,7 @@ script:
script: ''
type: python
subtype: python3
dockerimage: demisto/python3:3.10.13.84405
dockerimage: demisto/python3:3.10.13.85667
isfetch: true
isremotesyncin: true
isremotesyncout: true
Expand Down
Expand Up @@ -61,7 +61,8 @@ def test_alert_search_command_no_next_token(mocker, prisma_cloud_v2_client):
{'name': 'policy.remediable', 'operator': '=', 'value': 'true'},
{'name': 'cloud.type', 'operator': '=', 'value': 'gcp'},
{'name': 'policy.type', 'operator': '=', 'value': 'config'}],
'timeRange': {'type': 'relative', 'value': {'amount': 3, 'unit': 'week'}}})
'timeRange': {'type': 'relative', 'value': {'amount': 3, 'unit': 'week'}}},
retries=2)


def test_alert_search_command_with_next_token(mocker, prisma_cloud_v2_client):
Expand All @@ -83,7 +84,7 @@ def test_alert_search_command_with_next_token(mocker, prisma_cloud_v2_client):
http_request.assert_called_with('POST', 'v2/alert', params={'detailed': 'true'},
json_data={'limit': 10,
'timeRange': {'type': 'relative', 'value': {'amount': 3, 'unit': 'week'}},
'pageToken': 'TOKEN'})
'pageToken': 'TOKEN'}, retries=2)


def test_alert_get_details_command(mocker, prisma_cloud_v2_client):
Expand Down
7 changes: 7 additions & 0 deletions Packs/PrismaCloud/ReleaseNotes/4_2_20.md
@@ -0,0 +1,7 @@

#### Integrations

##### Prisma Cloud v2

- Added a retries mechanism to the ***fetch-incidents*** command API calls.
yaakovpraisler marked this conversation as resolved.
Show resolved Hide resolved
- Updated the Docker image to: *demisto/python3:3.10.13.85667*.
2 changes: 1 addition & 1 deletion Packs/PrismaCloud/pack_metadata.json
Expand Up @@ -2,7 +2,7 @@
"name": "Prisma Cloud by Palo Alto Networks",
"description": "Automate and unify security incident response across your cloud environments, while still giving a degree of control to dedicated cloud teams.",
"support": "xsoar",
"currentVersion": "4.2.19",
"currentVersion": "4.2.20",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down