Flashpoint Release 200 #35268

crestdatasystems · 2024-07-05T12:11:46Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

fixes: link to the issue

Description

Added new integration Flashpoint Ignite

Must have

Tests
Documentation

content-bot · 2024-07-05T12:14:12Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @MosheEichler will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

…lashpoint-Release-200

…tween ports and services.

ssokolovich

Hey @crestdatasystems,

Thanks for contributing this content. The PR looks good! 🎉
Adding a couple of notes/comments from my side:

Please check again the known_words / secrets lists as they contain too much data. Assuming we can reduce those lists a bit.
Please re-check your newly added fields - some of them might already be available in OOTB (from a quick review -like Flashpoint Resource Type and OOTB field Resource Type).
If the previous integration is deprecated - should we deprecate the old content items such as the flashpoint mapper/classifier? Or even other items? just a thought...
Don't forget to add the default incident type and mapper values to the Ignite yml config, so new instances will have those values by default

Let me know if you have any questions.
Cheers!

ssokolovich · 2024-07-08T15:58:31Z

Packs/Flashpoint/IncidentFields/incidentfield-Flashpoint-Resource-URL.json

+    "name": "Flashpoint Resource URL",
+    "ownerOnly": false,
+    "description": "URL of Flashpoint Alert.",
+    "cliName": "flashpointresourceurl",


You can use the OOTB field Resource URL instead of creating new one...

OOTB is short text and client requirement was to be clickable url. That's why we've created new one.

so maybe the External Link field?

Your suggestion is good, but user can easily understand that it is going to redirect to the particular resource.

Packs/Flashpoint/IncidentTypes/incidenttype-Ignite_Alert.json

Packs/Flashpoint/Integrations/Ignite/Ignite.yml

ssokolovich · 2024-07-09T07:40:30Z

Packs/Flashpoint/.pack-ignore

can we reduce the size of the known_words list here? seems like there are some letters that we added accidentally like 'G'

The reason for too much data in known_words or in secret list is due to the, README and test data of deprecated integration.

@thefrieddan1 - R we good with this? anything we can do to avoid such an issue? seems odd to me that we can control that when it comes to hashes.

Packs/Flashpoint/Integrations/Ignite/Ignite.yml

Packs/Flashpoint/Playbooks/playbook-Compromised_Credentials_Match_-_Flashpoint.yml

Packs/Flashpoint/Playbooks/playbook-Compromised_Credentials_Match_-_Flashpoint_README.md

Packs/Flashpoint/ReleaseNotes/2_0_0.md

ShirleyDenkberg · 2024-07-15T05:44:29Z

@@ssokolovich @MLainer1 @thefrieddan1 Doc review completed.
@crestdatasystems After implementing/accepting my comments/edits, please regenerate the integration yml readme.

Packs/Flashpoint/Integrations/Ignite/README.md

crestdatasystems · 2024-07-15T06:46:33Z

Hey @crestdatasystems,

Thanks for contributing this content. The PR looks good! 🎉 Adding a couple of notes/comments from my side:

Please check again the known_words / secrets lists as they contain too much data. Assuming we can reduce those lists a bit.

Please re-check your newly added fields - some of them might already be available in OOTB (from a quick review -like Flashpoint Resource Type and OOTB field Resource Type).

If the previous integration is deprecated - should we deprecate the old content items such as the flashpoint mapper/classifier? Or even other items? just a thought...

Don't forget to add the default incident type and mapper values to the Ignite yml config, so new instances will have those values by default

Let me know if you have any questions. Cheers!

The reason for too much data in known_words or in secret list is due to the, README and test data of deprecated integration.
The type of the OOTB "Resource Type" field is the text. Due to that, we have created new field with the type set to the "URL".
We have used the existing mapper as the API response remains the same as per the previous API.
The pack has the two different incident type and the mappers. So by default, we haven't set any incident type or the mapper.

thefrieddan1 · 2024-07-16T07:08:46Z

@crestdatasystems lets please schedule a demo
You can DM me on DFIR slack Danny Fried.
Thanks

…hanges

…lashpoint-Release-200

…. of incident fields, Added default incident type and incoming mapper

…lashpoint-Release-200

ssokolovich · 2024-07-24T12:12:59Z

Packs/Flashpoint/Integrations/Ignite/Ignite.yml

+  subtype: python3
+tests:
+- Ignite-Test
+defaultmapperin: "Flashpoint Compromised Credentials - Incoming Mapper"


Suggested change

defaultmapperin: "Flashpoint Compromised Credentials - Incoming Mapper"

defaultmapperin: "Ignite Alert - Incoming Mapper"

github-actions · 2024-07-24T12:28:03Z

Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.

* Flashpoint Release 200 (#35268) * Added new integration: Flashpoint Ignite * Added latest context paths for the IP command * refactor: Updated the Ignite Alert incoming mapper for added space between ports and services. * Removed unwated description for the new incident fields in release notes * Updated the indicator extraction settings for the new incident type * docs: Updated the YML and README for the suggested changes * docs: Updated the release notes and help guide as per the requested changes * refactor: Updated the indicator extraction settings to the limited no. of incident fields, Added default incident type and incoming mapper --------- Co-authored-by: crestdatasystems <crestdatasystems@users.noreply.github.com> * bump docker image --------- Co-authored-by: Crest Data <60967033+crestdatasystems@users.noreply.github.com> Co-authored-by: crestdatasystems <crestdatasystems@users.noreply.github.com> Co-authored-by: Danny_Fried <dfried@paloaltonetworks.com>

* Flashpoint Release 200 (demisto#35268) * Added new integration: Flashpoint Ignite * Added latest context paths for the IP command * refactor: Updated the Ignite Alert incoming mapper for added space between ports and services. * Removed unwated description for the new incident fields in release notes * Updated the indicator extraction settings for the new incident type * docs: Updated the YML and README for the suggested changes * docs: Updated the release notes and help guide as per the requested changes * refactor: Updated the indicator extraction settings to the limited no. of incident fields, Added default incident type and incoming mapper --------- Co-authored-by: crestdatasystems <crestdatasystems@users.noreply.github.com> * bump docker image --------- Co-authored-by: Crest Data <60967033+crestdatasystems@users.noreply.github.com> Co-authored-by: crestdatasystems <crestdatasystems@users.noreply.github.com> Co-authored-by: Danny_Fried <dfried@paloaltonetworks.com>

crestdatasystems added 3 commits July 5, 2024 15:55

Added new integration: Flashpoint Ignite

a11c595

Merge https://github.com/demisto/content into Flashpoint-Release-200

904a48a

Added latest context paths for the IP command

d5d8b7d

content-bot added Contribution Form Filled Whether contribution form filled or not. Partner Contribution Thank you! Contributions are always welcome! External PR Partner Support Level Indicates that the contribution is for Partner supported pack labels Jul 5, 2024

content-bot changed the base branch from master to contrib/crestdatasystems_Flashpoint-Release-200 July 5, 2024 12:14

content-bot assigned MosheEichler and ssokolovich Jul 5, 2024

content-bot added Security Review TIM Review labels Jul 5, 2024

content-bot requested a review from MLainer1 July 5, 2024 12:14

content-bot requested review from MosheEichler and ssokolovich July 5, 2024 12:14

edik24 added the Partner-Approved label Jul 7, 2024

crestdatasystems and others added 2 commits July 8, 2024 12:47

Merge branch 'contrib/crestdatasystems_Flashpoint-Release-200' into F…

d41f9bf

…lashpoint-Release-200

refactor: Updated the Ignite Alert incoming mapper for added space be…

9dbff80

…tween ports and services.

MosheEichler mentioned this pull request Jul 8, 2024

Added new integration: Flashpoint Ignite Feed #35228

Merged

5 tasks

ssokolovich reviewed Jul 9, 2024

View reviewed changes

thefrieddan1 requested review from thefrieddan1 and removed request for MosheEichler July 9, 2024 11:24

thefrieddan1 assigned thefrieddan1 and unassigned MosheEichler Jul 9, 2024

crestdatasystems added 2 commits July 9, 2024 17:32

Removed unwated description for the new incident fields in release notes

e92ed6c

Updated the indicator extraction settings for the new incident type

e168ad3

thefrieddan1 requested a review from ShirleyDenkberg July 14, 2024 11:21

thefrieddan1 assigned ShirleyDenkberg Jul 14, 2024

ShirleyDenkberg reviewed Jul 15, 2024

View reviewed changes

ShirleyDenkberg added the docs-approved label Jul 15, 2024

ShirleyDenkberg reviewed Jul 15, 2024

View reviewed changes

crestdatasystems and others added 3 commits July 16, 2024 12:42

docs: Updated the YML and README for the suggested changes

72f8f22

docs: Updated the release notes and help guide as per the requested c…

0bf4f6a

…hanges

Merge branch 'contrib/crestdatasystems_Flashpoint-Release-200' into F…

0cc30d0

…lashpoint-Release-200

thefrieddan1 added the post-demo label Jul 21, 2024

crestdatasystems and others added 2 commits July 22, 2024 14:57

refactor: Updated the indicator extraction settings to the limited no…

1f80944

…. of incident fields, Added default incident type and incoming mapper

Merge branch 'contrib/crestdatasystems_Flashpoint-Release-200' into F…

5a86e64

…lashpoint-Release-200

ssokolovich reviewed Jul 24, 2024

View reviewed changes

thefrieddan1 approved these changes Jul 24, 2024

View reviewed changes

thefrieddan1 merged commit 24f254f into demisto:contrib/crestdatasystems_Flashpoint-Release-200 Jul 24, 2024
15 checks passed

content-bot mentioned this pull request Jul 24, 2024

Flashpoint Release 200 #35587

Merged

5 tasks

	defaultmapperin: "Flashpoint Compromised Credentials - Incoming Mapper"
	defaultmapperin: "Ignite Alert - Incoming Mapper"

Flashpoint Release 200 #35268

Flashpoint Release 200 #35268

Uh oh!

Conversation

crestdatasystems commented Jul 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contributing to Cortex XSOAR Content

Status

Related Issues

Description

Must have

Uh oh!

content-bot commented Jul 5, 2024

Uh oh!

ssokolovich left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ShirleyDenkberg commented Jul 15, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

crestdatasystems commented Jul 15, 2024

Uh oh!

thefrieddan1 commented Jul 16, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Jul 24, 2024

Uh oh!

Uh oh!

crestdatasystems commented Jul 5, 2024 •

edited

Loading