diff --git a/Packs/Cyberint/Classifiers/classifier-mapper-incoming-CyberInt.json b/Packs/Cyberint/Classifiers/classifier-mapper-incoming-CyberInt.json index 3d777de8538d..ef24511cf383 100644 --- a/Packs/Cyberint/Classifiers/classifier-mapper-incoming-CyberInt.json +++ b/Packs/Cyberint/Classifiers/classifier-mapper-incoming-CyberInt.json @@ -1,60 +1,46 @@ { "description": "", "feed": false, - "id": "abcd-5678", + "id": "Cyberint (mapper)", "mapping": { "Cyberint Incident": { "dontMapEventToLabels": false, "internalMapping": { + "Alert URL ID": { + "simple": "id" + }, "Alert ID": { "simple": "ref_id" }, "Alert Name": { "simple": "title" }, - "CyberInt Alert Data": { - "complex": { - "filters": [], - "root": "alert_data", - "transformers": [ - { - "args": { - "headers": {}, - "is_auto_json_transform": {}, - "json_transform_properties": {}, - "title": {} - }, - "operator": "JsonToTable" - } - ] - } - }, - "CyberInt Alert ID": { + "Cyberint Alert ID": { "simple": "ref_id" }, - "CyberInt Attachments": { + "Cyberint Attachments": { "complex": { "filters": [], "root": "attachments", "transformers": [] } }, - "CyberInt Closure reason": { + "Cyberint Closure reason": { "simple": "closure_reason" }, - "CyberInt Closure reason Description": { + "Cyberint Closure reason Description": { "simple": "closure_reason_description" }, - "CyberInt Confidence": { + "Cyberint Confidence": { "simple": "confidence" }, - "CyberInt Created by": { + "Cyberint Created by": { "simple": "created_by.email" }, - "CyberInt Created date": { + "Cyberint Created date": { "simple": "created_date" }, - "CyberInt Credentials Exposed CSV": { + "Cyberint Credentials Exposed CSV": { "complex": { "accessor": "content", "filters": [], @@ -62,7 +48,7 @@ "transformers": [] } }, - "CyberInt Description": { + "Cyberint Description": { "complex": { "filters": [], "root": "description", @@ -73,30 +59,13 @@ ] } }, - "CyberInt Expert Analysis": { + "Cyberint Expert Analysis": { "simple": "analysis_report.name" }, - "CyberInt File Type": { + "Cyberint File Type": { "simple": "attachments.mimetype" }, - "CyberInt Impact": { - "complex": { - "filters": [], - "root": "impacts", - "transformers": [ - { - "args": { - "delimiter": { - "value": { - "simple": "," - } - } - }, - "operator": "splitAndTrim" - } - ] - } - },"CyberInt Impacts": { + "Cyberint Impact": { "complex": { "filters": [], "root": "impacts", @@ -114,70 +83,54 @@ ] } }, - "CyberInt Payment Card Exposed CSV": { + "Cyberint Payment Card Exposed CSV": { "simple": "attachments.content" }, - "CyberInt Recommendation": { + "Cyberint Recommendation": { "complex": { "filters": [], "root": "recommendation", "transformers": [] } }, - "CyberInt Related IOCs": { + "Cyberint Related IOCs": { "simple": "iocs" }, - "CyberInt Related entities": { + "Cyberint Related entities": { "simple": "related_entities" }, - "CyberInt Related Entity": { - "simple": "related_entities" - }, - "CyberInt Source": { + "Cyberint Source": { "simple": "source" }, - "CyberInt Source category": { + "Cyberint Source category": { "simple": "source_category" }, - "CyberInt Status": { + "Cyberint Status": { "simple": "status" }, - "CyberInt Tags": { + "Cyberint Tags": { "simple": "tags" }, - "CyberInt Descriptors": { - "simple": "tags" - }, - "CyberInt Targeted Brand": { - "complex": { - "filters": [], - "root": "targeted_brands", - "transformers": [] - } - }, - "CyberInt Targeted Brands": { + "Cyberint Targeted Brand": { "complex": { "filters": [], "root": "targeted_brands", "transformers": [] } }, - "CyberInt Targeted Vector": { - "simple": "targeted_vectors" - }, - "CyberInt Targeted Vectors": { + "Cyberint Targeted Vector": { "simple": "targeted_vectors" }, - "CyberInt Threat Actor": { + "Cyberint Threat Actor": { "simple": "threat_actor" }, - "CyberInt Ticket ID": { + "Cyberint Ticket ID": { "simple": "ticket_id" }, - "CyberInt Title": { + "Cyberint Title": { "simple": "title" }, - "CyberInt Type": { + "Cyberint Type": { "simple": "type" }, "Cyberint Category": { @@ -219,9 +172,6 @@ "Threat Actor": { "simple": "threat_actor" }, - "name": { - "simple": "alert_name" - }, "occurred": { "complex": { "filters": [], @@ -242,7 +192,31 @@ } }, "severity": { - "simple": "severity" + "complex": { + "filters": [], + "root": "severity", + "transformers": [ + { + "args": { + "input_values": { + "isContext": false, + "value": { + "complex": null, + "simple": "low,medium,high,very_high" + } + }, + "mapped_values": { + "isContext": false, + "value": { + "complex": null, + "simple": "1,2,3,4" + } + } + }, + "operator": "MapValuesTransformer" + } + ] + } }, "source": { "simple": "source" @@ -252,35 +226,38 @@ "dbot_classification_incident_type_all": { "dontMapEventToLabels": false, "internalMapping": { + "Alert URL ID": { + "simple": "id" + }, "Alert ID": { "simple": "ref_id" }, "Alert Name": { "simple": "title" }, - "CyberInt Alert ID": { + "Cyberint Alert ID": { "simple": "ref_id" }, - "CyberInt Attachments": { + "Cyberint Attachments": { "complex": { "filters": [], "root": "attachments", "transformers": [] } }, - "CyberInt Closure reason": { + "Cyberint Closure reason": { "simple": "closure_reason" }, - "CyberInt Confidence": { + "Cyberint Confidence": { "simple": "confidence" }, - "CyberInt Created by": { + "Cyberint Created by": { "simple": "created_by.email" }, - "CyberInt Created date": { + "Cyberint Created date": { "simple": "created_date" }, - "CyberInt Description": { + "Cyberint Description": { "complex": { "filters": [], "root": "description", @@ -291,31 +268,10 @@ ] } }, - "CyberInt Expert Analysis": { + "Cyberint Expert Analysis": { "simple": "analysis_report.name" }, - "CyberInt Impact": { - "complex": { - "filters": [], - "root": "impacts", - "transformers": [ - { - "operator": "Stringify" - }, - { - "args": { - "delimiter": { - "value": { - "simple": "," - } - } - }, - "operator": "splitAndTrim" - } - ] - } - }, - "CyberInt Impacts": { + "Cyberint Impact": { "complex": { "filters": [], "root": "impacts", @@ -336,60 +292,36 @@ ] } }, - "CyberInt Recommendation": { + "Cyberint Recommendation": { "simple": "recommendation" }, - "CyberInt Related IOCs": { + "Cyberint Related IOCs": { "simple": "iocs" }, - "CyberInt Related entities": { + "Cyberint Related entities": { "complex": { "filters": [], "root": "related_entities", "transformers": [] } }, - "CyberInt Related Entity": { - "complex": { - "filters": [], - "root": "related_entities", - "transformers": [] - } - }, - "CyberInt Source": { + "Cyberint Source": { "simple": "source" }, - "CyberInt Source category": { + "Cyberint Source category": { "simple": "source_category" }, "CyberInt Status": { "simple": "status" }, - "CyberInt Tags": { + "Cyberint Tags": { "complex": { "filters": [], "root": "tags", "transformers": [] } - },"CyberInt Descriptors": { - "complex": { - "filters": [], - "root": "tags", - "transformers": [] - } - }, - "CyberInt Targeted Brand": { - "complex": { - "filters": [], - "root": "targeted_brands", - "transformers": [ - { - "operator": "ConvertToSingleElementArray" - } - ] - } }, - "CyberInt Targeted Brands": { + "Cyberint Targeted Brand": { "complex": { "filters": [], "root": "targeted_brands", @@ -400,37 +332,30 @@ ] } }, - "CyberInt Targeted Vector": { - "complex": { - "filters": [], - "root": "targeted_vectors", - "transformers": [] - } - }, - "CyberInt Targeted Vectors": { + "Cyberint Targeted Vector": { "complex": { "filters": [], "root": "targeted_vectors", "transformers": [] } }, - "CyberInt Threat Actor": { + "Cyberint Threat Actor": { "simple": "threat_actor" }, - "CyberInt Ticket ID": { + "Cyberint Ticket ID": { "complex": { "filters": [], "root": "ticket_id", "transformers": [] } }, - "CyberInt Title": { + "Cyberint Title": { "simple": "title" }, - "CyberInt Type": { + "Cyberint Type": { "simple": "type" }, - "CyberInt Vulnerable CName Record": { + "Cyberint Vulnerable CName Record": { "simple": "alert_data.vulnerable_cname_record" }, "Cyberint Category": { @@ -479,7 +404,7 @@ "simple": "mirror_instance" }, "name": { - "simple": "alert_name" + "simple": "title" }, "occurred": { "complex": { @@ -504,7 +429,27 @@ "complex": { "filters": [], "root": "severity", - "transformers": [] + "transformers": [ + { + "args": { + "input_values": { + "isContext": false, + "value": { + "complex": null, + "simple": "low,medium,high,very_high" + } + }, + "mapped_values": { + "isContext": false, + "value": { + "complex": null, + "simple": "1,2,3,4" + } + } + }, + "operator": "MapValuesTransformer" + } + ] } }, "source": { @@ -513,7 +458,7 @@ } } }, - "name": "CyberInt (mapper)", + "name": "Cyberint (mapper)", "type": "mapping-incoming", "version": -1, "fromVersion": "6.0.0" diff --git a/Packs/Cyberint/Classifiers/classifier-mapper-outgoing-CyberInt.json b/Packs/Cyberint/Classifiers/classifier-mapper-outgoing-CyberInt.json index 57c7e879de00..f2822ebac2fc 100644 --- a/Packs/Cyberint/Classifiers/classifier-mapper-outgoing-CyberInt.json +++ b/Packs/Cyberint/Classifiers/classifier-mapper-outgoing-CyberInt.json @@ -1,34 +1,56 @@ { - "description": "", - "feed": false, - "id": "CyberInt Outgoing (mapper)", - "mapping": { - "Cyberint Incident": { - "dontMapEventToLabels": true, - "internalMapping": { - "closure_reason": { - "simple": "cyberintclosurereason" - }, - "closure_reason_description": { - "simple": "cyberintclosurereasondescription" - }, - "mirror_direction": { - "simple": "dbotMirrorDirection" - }, - "mirror_instance": { - "simple": "dbotMirrorInstance" - }, - "ref_id": { - "simple": "dbotMirrorId" - }, - "status": { - "simple": "cyberintstatus" - } - } - } - }, - "name": "CyberInt Outgoing (mapper)", - "type": "mapping-outgoing", - "version": -1, - "fromVersion": "6.0.0" -} \ No newline at end of file + "brands": null, + "cacheVersn": 0, + "defaultIncidentType": "", + "definitionId": "", + "description": "", + "feed": false, + "fromServerVersion": "", + "id": "46139b6e-d1e4-4f17-88bb-cf3b4bb5b6df", + "incidentSamples": null, + "indicatorSamples": null, + "instanceIds": null, + "itemVersion": "", + "keyTypeMap": {}, + "locked": false, + "logicalVersion": 5, + "mapping": { + "Cyberint Incident": { + "dontMapEventToLabels": true, + "internalMapping": { + "closure_reason": { + "simple": "cyberintclosurereason" + }, + "closure_reason_description": { + "simple": "cyberintclosurereasondescription" + }, + "mirror_direction": { + "simple": "dbotMirrorDirection" + }, + "mirror_instance": { + "simple": "dbotMirrorInstance" + }, + "ref_id": { + "simple": "dbotMirrorId" + }, + "status": { + "simple": "cyberintstatus" + } + } + } + }, + "name": "Cyberint Outgoing (mapper)", + "nameRaw": "Cyberint Outgoing (mapper)", + "packID": "", + "packName": "", + "propagationLabels": [ + "all" + ], + "sourceClassifierId": "", + "system": false, + "toServerVersion": "", + "transformer": {}, + "type": "mapping-outgoing", + "unclassifiedCases": null, + "version": -1 +} diff --git a/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_File_Type.json b/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_File_Type.json index d17930ea723e..325c199aedfb 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_File_Type.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_File_Type.json @@ -13,7 +13,7 @@ "id": "incident_cyberintfiletype", "isReadOnly": false, "locked": false, - "name": "CyberInt File Type", + "name": "Cyberint File Type", "neverSetAsRequired": false, "openEnded": false, "ownerOnly": false, diff --git a/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Related_entity.json b/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Related_entity.json index 0ba52913b75f..7c3cef01ade0 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Related_entity.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Related_entity.json @@ -1,7 +1,7 @@ { "id": "incident_cyberintrelatedentity", "version": -1, - "name": "CyberInt Related Entity", + "name": "Cyberint Related Entity", "ownerOnly": false, "cliName": "cyberintrelatedentity", "type": "multiSelect", @@ -27,4 +27,4 @@ "threshold": 72, "fromVersion": "6.0.0", "openEnded": true -} +} \ No newline at end of file diff --git a/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Targeted_Brands.json b/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Targeted_Brands.json index 62fc973edefe..8926f4f4136d 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Targeted_Brands.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Targeted_Brands.json @@ -1,7 +1,7 @@ { "id": "incident_cyberinttargetedbrands", "version": -1, - "name": "CyberInt Targeted Brands", + "name": "Cyberint Targeted Brands", "ownerOnly": false, "cliName": "cyberinttargetedbrands", "type": "multiSelect", diff --git a/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Targeted_Vectors.json b/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Targeted_Vectors.json index 5704e9123fc1..825702d12447 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Targeted_Vectors.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-CyberInt_Targeted_Vectors.json @@ -1,7 +1,7 @@ { "id": "incident_cyberinttargetedvectors", "version": -1, - "name": "CyberInt Targeted Vectors", + "name": "Cyberint Targeted Vectors", "ownerOnly": false, "cliName": "cyberinttargetedvectors", "type": "multiSelect", diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_Closure_reason.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_Closure_reason.json index 01d6fa4cd931..859c67faddba 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_Closure_reason.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_Closure_reason.json @@ -13,7 +13,7 @@ "id": "incident_cyberintclosurereason", "isReadOnly": false, "locked": false, - "name": "CyberInt Closure reason", + "name": "Cyberint Closure reason", "neverSetAsRequired": false, "openEnded": false, "ownerOnly": false, diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_Closure_reason_Description.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_Closure_reason_Description.json index 0ad99a97df41..5ddc6a323166 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_Closure_reason_Description.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_Closure_reason_Description.json @@ -24,7 +24,7 @@ "threshold": 72, "type": "shortText", "unmapped": false, - "unsearchable": true, + "unsearchable": false, "useAsKpi": false, "version": -1, "fromVersion": "6.0.0" diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Alert_ID.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Alert_ID.json index 982634dc03c1..de027309a889 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Alert_ID.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Alert_ID.json @@ -2,7 +2,7 @@ "id": "incident_cyberintalertid", "version": -1, "modified": "2021-02-22T21:50:43.871414193+02:00", - "name": "CyberInt Alert ID", + "name": "Cyberint Alert ID", "ownerOnly": false, "cliName": "cyberintalertid", "type": "shortText", diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Confidence.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Confidence.json index 35a60b4eab6e..33e2220b4f62 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Confidence.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Confidence.json @@ -2,7 +2,7 @@ "id": "incident_cyberintconfidence", "version": -1, "modified": "2021-02-22T21:51:24.438436947+02:00", - "name": "CyberInt Confidence", + "name": "Cyberint Confidence", "ownerOnly": false, "cliName": "cyberintconfidence", "type": "shortText", diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Description.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Description.json index 1a1c0d3454f7..04be5aa8542a 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Description.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Description.json @@ -2,7 +2,7 @@ "id": "incident_cyberintdescription", "version": -1, "modified": "2021-02-22T21:51:53.226184184+02:00", - "name": "CyberInt Description", + "name": "Cyberint Description", "ownerOnly": false, "cliName": "cyberintdescription", "type": "shortText", diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_ID.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_ID.json new file mode 100644 index 000000000000..272190241a7c --- /dev/null +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_ID.json @@ -0,0 +1,30 @@ +{ + "id": "incident_id", + "version": -1, + "modified": "2024-10-27T20:50:43.871414193+02:00", + "name": "Alert URL ID", + "ownerOnly": false, + "cliName": "id", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "useAsKpi": false, + "locked": false, + "system": false, + "content": true, + "group": 0, + "hidden": false, + "associatedTypes": [ + "Cyberint Incident" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "6.0.0" +} \ No newline at end of file diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Tags.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Tags.json index ab2ea9c9df68..9eabef809041 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Tags.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Tags.json @@ -2,7 +2,7 @@ "id": "incident_cyberinttags", "version": -1, "modified": "2021-02-22T21:54:24.562891889+02:00", - "name": "CyberInt Tags", + "name": "Cyberint Tags", "ownerOnly": false, "cliName": "cyberinttags", "type": "shortText", diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Threat_Actor.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Threat_Actor.json index 829f5e337126..3518dfe5a14e 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Threat_Actor.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Threat_Actor.json @@ -2,7 +2,7 @@ "id": "incident_cyberintthreatactor", "version": -1, "modified": "2021-02-22T21:55:13.479151489+02:00", - "name": "CyberInt Threat Actor", + "name": "Cyberint Threat Actor", "ownerOnly": false, "cliName": "cyberintthreatactor", "type": "shortText", diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Ticket_ID.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Ticket_ID.json index fee1e5a2f49a..33576b1dc3c7 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Ticket_ID.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Ticket_ID.json @@ -2,7 +2,7 @@ "id": "incident_cyberintticketid", "version": -1, "modified": "2021-02-22T21:55:22.750862583+02:00", - "name": "CyberInt Ticket ID", + "name": "Cyberint Ticket ID", "ownerOnly": false, "cliName": "cyberintticketid", "type": "shortText", diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Title.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Title.json index 6bc2597e4654..2f9acd30c69d 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Title.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Title.json @@ -2,7 +2,7 @@ "id": "incident_cyberinttitle", "version": -1, "modified": "2021-02-22T21:55:35.77661741+02:00", - "name": "CyberInt Title", + "name": "Cyberint Title", "ownerOnly": false, "cliName": "cyberinttitle", "type": "shortText", diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Type.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Type.json index 2ccd07c852e4..36d65314db8d 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Type.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Type.json @@ -2,7 +2,7 @@ "id": "incident_cyberinttype", "version": -1, "modified": "2021-02-22T21:56:26.928862533+02:00", - "name": "CyberInt Type", + "name": "Cyberint Type", "ownerOnly": false, "cliName": "cyberinttype", "type": "shortText", diff --git a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Vulnerable_CName_Record.json b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Vulnerable_CName_Record.json index 1004b2cfa117..c062559e01d0 100644 --- a/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Vulnerable_CName_Record.json +++ b/Packs/Cyberint/IncidentFields/incidentfield-Cyberint_CyberInt_Vulnerable_CName_Record.json @@ -2,7 +2,7 @@ "id": "incident_cyberinvulnerablecnamerecord", "version": -1, "modified": "2021-02-22T21:50:43.871414193+02:00", - "name": "CyberInt Vulnerable CName Record", + "name": "Cyberint Vulnerable CName Record", "ownerOnly": false, "cliName": "vulnerablecnamerecord", "type": "shortText", diff --git a/Packs/Cyberint/Integrations/Cyberint/Cyberint.py b/Packs/Cyberint/Integrations/Cyberint/Cyberint.py index 1e5ef9971a17..2865cb663217 100644 --- a/Packs/Cyberint/Integrations/Cyberint/Cyberint.py +++ b/Packs/Cyberint/Integrations/Cyberint/Cyberint.py @@ -4,8 +4,7 @@ import copy import json from contextlib import closing -from typing import Any -from collections.abc import Iterable +from typing import Any, Dict, Iterable, List, Optional, Tuple import dateparser from CommonServerPython import * @@ -23,12 +22,24 @@ "Incoming And Outgoing": "Both", } -MIRRORING_FIELDS = [ +MIRRORING_FIELDS_XSOAR = [ + "cyberintstatus", + "cyberintclosurereason", + "cyberintclosurereasondescription", +] + +MIRRORING_FIELDS_ARGOS = [ "status", "closure_reason", "closure_reason_description", ] +MIRRORING_FIELDS_MAPPER = { + "cyberintstatus": "status", + "cyberintclosurereason": "closure_reason", + "cyberintclosurereasondescription": "closure_reason_description", +} + class Client(BaseClient): """ @@ -37,7 +48,7 @@ class Client(BaseClient): def __init__(self, base_url: str, access_token: str, verify_ssl: bool, proxy: bool): """ - Client for CyberInt RESTful API. + Client for Cyberint RESTful API. Args: base_url (str): URL to access when getting alerts. @@ -45,25 +56,34 @@ def __init__(self, base_url: str, access_token: str, verify_ssl: bool, proxy: bo verify_ssl (bool): specifies whether to verify the SSL certificate or not. proxy (bool): specifies if to use XSOAR proxy settings. """ + params = demisto.params() self._cookies = {"access_token": access_token} - self.headers = {"x-integration-source": f"XSOAR;{demisto.integrationInstance()}"} + self._headers = { + "X-Integration-Type": "XSOAR", + "X-Integration-Instance-Name": demisto.integrationInstance(), + "X-Integration-Instance-Id": "", + "X-Integration-Customer-Name": params.get("client_name", ""), + "X-Integration-Version": "1.1.4" + } super().__init__(base_url=base_url, verify=verify_ssl, proxy=proxy) + + @logger def list_alerts( self, - page: str | None, - page_size: int | None, - created_date_from: str | None, - created_date_to: str | None, - modification_date_from: str | None, - modification_date_to: str | None, - update_date_from: str | None, - update_date_to: str | None, - environments: list[str] | None, - statuses: list[str] | None, - severities: list[str] | None, - types: list[str] | None, - ) -> dict: + page: Optional[str], + page_size: Optional[int], + created_date_from: Optional[str], + created_date_to: Optional[str], + modification_date_from: Optional[str], + modification_date_to: Optional[str], + update_date_from: Optional[str], + update_date_to: Optional[str], + environments: Optional[List[str]], + statuses: Optional[List[str]], + severities: Optional[List[str]], + types: Optional[List[str]], + ) -> Dict: """ Retrieve a list of alerts according to parameters. @@ -74,6 +94,8 @@ def list_alerts( created_date_to (str): Maximal ISO-Formatted creation date. modification_date_from (str): Minimal ISO-Formatted modification date. modification_date_to (str): Maximal ISO-Formatted modification date. + update_date_from (str): Minimal ISO-Formatted update date. + update_date_to (str): Maximal ISO-Formatted update date. environments (list(str)): Environments in which the alerts were created. statuses (list(str)): Alerts statuses. severities (list(str)): Alerts severities. @@ -102,11 +124,11 @@ def list_alerts( def update_alerts( self, - alerts: list[str], - status: str | None, - closure_reason: str | None = None, - closure_reason_description: str | None = None, - ) -> dict: + alerts: List[str], + status: Optional[str], + closure_reason: Optional[str] = None, + closure_reason_description: Optional[str] = None, + ) -> Dict: """ Update the status of one or more alerts @@ -114,6 +136,7 @@ def update_alerts( alerts (list(str)): Reference IDs for the alert(s) status (str): Desired status to update for the alert(s) closure_reason (str): Reason for updating the alerts status to closed. + closure_reason_description (str): Reason for updating the alerts status to closed. Returns: response (Response): API response from Cyberint. @@ -169,13 +192,12 @@ def get_alert_attachment(self, alert_ref_id: str, attachment_id: str) -> Respons def get_alert( self, alert_ref_id: str, - ) -> dict: + ) -> Dict: """ Retrieve attachment by alert reference ID and attachment ID. Args: alert_ref_id (str): Reference ID of the alert. - attachment_id (str): The ID of the attachment. Returns: Response: API response from Cyberint. @@ -216,7 +238,7 @@ def test_module(client: Client): except DemistoException as exception: if "Invalid token or token expired" in str(exception): error_message = ( - "Error verifying access token and / or environment, make sure the " + "Error verifying access token and / or URL, make sure the " "configuration parameters are correct." ) else: @@ -224,7 +246,7 @@ def test_module(client: Client): raise DemistoException(error_message) -def verify_input_date_format(date: str | None) -> str | None: +def verify_input_date_format(date: Optional[str]) -> Optional[str]: """ Make sure a date entered by the user is in the correct string format (with a Z at the end). @@ -240,8 +262,8 @@ def verify_input_date_format(date: str | None) -> str | None: def set_date_pair( - start_date_arg: str | None, end_date_arg: str | None, date_range_arg: str | None -) -> tuple[str | None, str | None]: + start_date_arg: Optional[str], end_date_arg: Optional[str], date_range_arg: Optional[str] +) -> Tuple[Optional[str], Optional[str]]: """ Calculate the date range to send to the API based on the arguments from the user. @@ -269,7 +291,7 @@ def set_date_pair( def extract_data_from_csv_stream( client: Client, alert_id: str, attachment_id: str, delimiter: bytes = b"\r\n" -) -> list[dict]: +) -> List[dict]: """ Call the attachment download API and parse required fields. @@ -363,9 +385,9 @@ def cyberint_alerts_fetch_command(client: Client, args: dict) -> CommandResults: alert["alert_data"]["csv"] = extracted_csv_data outputs.append(alert) total_alerts = result.get("total") - table_headers = ["ref_id", "title", "status", "severity", "created_date", "update_date", "type", "environment"] + table_headers = ["id", "ref_id", "title", "status", "severity", "created_date", "update_date", "type", "environment"] readable_output = f'Total alerts: {total_alerts}\nCurrent page: {args.get("page", 1)}\n' - readable_output += tableToMarkdown(name="CyberInt alerts:", t=outputs, headers=table_headers, removeNull=True) + readable_output += tableToMarkdown(name="Cyberint alerts:", t=outputs, headers=table_headers, removeNull=True) return CommandResults( outputs_key_field="ref_id", outputs_prefix="Cyberint.Alert", @@ -416,7 +438,7 @@ def cyberint_alerts_status_update(client: Client, args: dict) -> CommandResults: ) readable_output = tableToMarkdown( - name="CyberInt alerts updated information:", t=outputs, headers=table_headers, removeNull=True + name="Cyberint alerts updated information:", t=outputs, headers=table_headers, removeNull=True ) return CommandResults( outputs_key_field="ref_id", @@ -429,7 +451,7 @@ def cyberint_alerts_status_update(client: Client, args: dict) -> CommandResults: def cyberint_alerts_get_attachment_command( client: Client, alert_ref_id: str, attachment_id: str, attachment_name: str -) -> dict: +) -> Dict: """ Retrieve attachment by alert reference ID and attachment internal ID. Attachments includes: CSV files , Screenshots, and alert attachments files. @@ -450,7 +472,7 @@ def cyberint_alerts_get_attachment_command( return fileResult(filename=attachment_name, data=raw_response.content) -def cyberint_alerts_get_analysis_report_command(client: Client, alert_ref_id: str, report_name: str) -> dict: +def cyberint_alerts_get_analysis_report_command(client: Client, alert_ref_id: str, report_name: str) -> Dict: """ Retrieve expert analysis report by alert reference ID and report name. @@ -504,7 +526,7 @@ def create_fetch_incident_attachment(raw_response: Response, attachment_file_nam return {"path": file_result["FileID"], "name": attachment_name, "showMediaFile": True} -def get_alert_attachments(client: Client, attachment_list: list, attachment_type: str, alert_id: str) -> list: +def get_alert_attachments(client: Client, attachment_list: List, attachment_type: str, alert_id: str) -> List: """ Retrieve all alert attachments files - Attachments, CSV, Screenshot, and Analysis report. For each attachment, we save and return the relevant fields in order to represent the attachment in the layout. @@ -545,13 +567,12 @@ def convert_date_time_args(date_time: str) -> str: Returns: str: The updated datetime. """ - datetime_arg = arg_to_datetime(date_time, required=False) - if datetime_arg: + if datetime_arg := arg_to_datetime(date_time, required=False): return datetime_arg.strftime(DATE_FORMAT) return "" -def get_modified_remote_data(client: Client, args: dict[str, Any]) -> GetModifiedRemoteDataResponse: +def get_modified_remote_data(client: Client, args: Dict[str, Any]) -> GetModifiedRemoteDataResponse: """ Queries for incidents that were modified since the last update. @@ -565,10 +586,10 @@ def get_modified_remote_data(client: Client, args: dict[str, Any]) -> GetModifie remote_args = GetModifiedRemoteDataArgs(args) last_update = remote_args.last_update - demisto.debug(f"Get modified remote data from {last_update}") + demisto.debug(f"******** Get modified remote data from {last_update}") update_date_from = convert_date_time_args(last_update) update_date_to = datetime.strftime(datetime.now(), DATE_FORMAT) - demisto.debug(f"Get modified remote data {update_date_from=}, {update_date_to=}") + demisto.debug(f"******** Get modified remote data {update_date_from=} {update_date_to=}") modified_tickets = [] response = client.list_alerts( @@ -589,7 +610,7 @@ def get_modified_remote_data(client: Client, args: dict[str, Any]) -> GetModifie for ticket in response["alerts"]: modified_tickets.append(ticket["ref_id"]) - demisto.debug(f"There are {len(modified_tickets)} modified incidents from Cyberint") + demisto.debug(f"******** There are {len(modified_tickets)} modified incidents from Cyberint") return GetModifiedRemoteDataResponse(modified_tickets) @@ -601,12 +622,12 @@ def get_mapping_fields_command() -> GetMappingFieldsResponse: Returns: GetMappingFieldsResponse: Dictionary with keys as field names. """ - demisto.debug("Get Cyberint mapping fields") + demisto.debug("******** Get Cyberint mapping fields") mapping_response = GetMappingFieldsResponse() incident_type_scheme = SchemeTypeMapping(type_name="Cyberint Incident") - for field in MIRRORING_FIELDS: + for field in MIRRORING_FIELDS_ARGOS: incident_type_scheme.add_field(field) mapping_response.add_scheme_type(incident_type_scheme) @@ -616,7 +637,7 @@ def get_mapping_fields_command() -> GetMappingFieldsResponse: def update_remote_system( client: Client, - args: dict[str, Any], + args: Dict[str, Any], ) -> str: """ This command pushes local changes to the remote system. @@ -634,37 +655,46 @@ def update_remote_system( incident_id = parsed_args.remote_incident_id demisto.debug( - f"Got the following delta keys {str(list(parsed_args.delta.keys()))}" + f"******** Got the following delta keys {str(list(parsed_args.delta.keys()))}" if parsed_args.delta - else "There is no delta fields in Cyberint" + else "******** There is no delta fields in Cyberint" ) try: if parsed_args.incident_changed: - demisto.debug(f"Incident changed: {parsed_args.incident_changed}, {parsed_args.delta=}") + demisto.debug(f"******** Incident changed: {parsed_args.incident_changed}, {parsed_args.delta=}") update_args = parsed_args.delta - demisto.debug(f"Sending incident with remote ID [{incident_id}] to Cyberint\n") + demisto.debug(f"******** Sending incident with remote ID [{incident_id}] to Cyberint\n") updated_arguments = {} if updated_status := update_args.get("status"): + closure_reason = update_args.get("closure_reason", "other") + closure_reason_description = update_args.get("closure_reason_description", "user wasn't specified closure reason when closed alert") if updated_status != "closed": updated_arguments["status"] = updated_status else: - for key, value in update_args.items(): - if key in MIRRORING_FIELDS: - updated_arguments[key] = value + updated_arguments["status"] = updated_status + updated_arguments["closure_reason"] = closure_reason + updated_arguments["closure_reason_description"] = closure_reason_description + else: + cyberint_response = client.get_alert(alert_ref_id=incident_id) + cyberint_alert: Dict[str, Any] = cyberint_response["alert"] + cyberint_status = cyberint_alert.get("status") + updated_arguments["status"] = cyberint_status updated_arguments["alerts"] = [incident_id] - demisto.debug(f"Remote ID [{incident_id}] to Cyberint. {updated_arguments=}|| {update_args=}") + demisto.debug(f"******** Remote ID [{incident_id}] to Cyberint. {updated_arguments=}|| {update_args=}") client.update_alerts(**updated_arguments) - demisto.info(f"Remote data of {incident_id}: {parsed_args.data}") + demisto.debug(f"******** Remote data of {incident_id}: {parsed_args.data}") except Exception as error: - demisto.info(f"Error in Cyberint outgoing mirror for incident {incident_id} \n Error message: {error}") + demisto.error( + f"Error in Cyberint outgoing mirror for incident {incident_id} \n" f"Error message: {error}" + ) finally: return incident_id @@ -672,8 +702,8 @@ def update_remote_system( def get_remote_data_command( client: Client, - args: dict[str, Any], - params: dict[str, Any], + args: Dict[str, Any], + params: Dict[str, Any], ) -> GetRemoteDataResponse: """ Gets new information about the incidents in the remote system @@ -687,13 +717,17 @@ def get_remote_data_command( parsed_args = GetRemoteDataArgs(args) incident_id = parsed_args.remote_incident_id last_update = date_to_epoch_for_fetch(arg_to_datetime(parsed_args.last_update)) - demisto.debug(f"Check {incident_id} update from {last_update}") + demisto.debug(f"******** Check {incident_id} update from {last_update}") response = client.get_alert(alert_ref_id=incident_id) - mirrored_ticket: dict[str, Any] = response["alert"] + mirrored_ticket: Dict[str, Any] = response["alert"] ticket_last_update = date_to_epoch_for_fetch(arg_to_datetime(mirrored_ticket.get("update_date"))) - demisto.debug(f"Alert {incident_id} - {ticket_last_update=} {last_update=}") + mirrored_ticket["cyberintstatus"] = MIRRORING_FIELDS_MAPPER.get(mirrored_ticket["status"]) + mirrored_ticket["cyberintclosurereason"] = mirrored_ticket["closure_reason"] + mirrored_ticket["cyberintclosurereasondescription"] = mirrored_ticket["closure_reason_description"] + + demisto.debug(f"******** Alert {incident_id} - {ticket_last_update=} {last_update=}") entries = [] @@ -712,7 +746,7 @@ def get_remote_data_command( return GetRemoteDataResponse(mirrored_ticket, entries) -def date_to_epoch_for_fetch(date: datetime | None) -> int: +def date_to_epoch_for_fetch(date: Optional[datetime]) -> int: """ Converts datetime object to date in epoch timestamp (in seconds), for fetch command. @@ -728,16 +762,17 @@ def date_to_epoch_for_fetch(date: datetime | None) -> int: def fetch_incidents( client: Client, - last_run: dict[str, int], + last_run: Dict[str, int], first_fetch_time: str, - fetch_severity: list[str] | None, - fetch_status: list[str] | None, - fetch_type: list[str] | None, - fetch_environment: list[str] | None, - max_fetch: int | None, + fetch_severity: Optional[List[str]], + fetch_status: Optional[List[str]], + fetch_type: Optional[List[str]], + fetch_environment: Optional[List[str]], + max_fetch: Optional[int], duplicate_alert: bool, - mirror_direction: str | None, -) -> tuple[dict[str, int], list[dict]]: + mirror_direction: Optional[str], + close_alert: bool, +) -> Tuple[Dict[str, int], List[dict]]: """ Fetch incidents (alerts) each minute (by default). Args: @@ -750,6 +785,9 @@ def fetch_incidents( fetch_type (list(str)): Types to fetch. fetch_environment (list(str)): Environments to fetch. max_fetch (int): Max number of alerts to fetch. + duplicate_alert (bool): Whether to duplicate alerts. + mirror_direction (str): Direction to mirror. + close_alert (bool): Whether to close alerts. Returns: Tuple of next_run (seconds timestamp) and the incidents list """ @@ -825,8 +863,7 @@ def fetch_incidents( alert_name = f"Cyberint alert {alert_id}: {alert_title}" alert.update({"alert_name": alert_name}) - alert["closure_reason_description"] = "None" - alert["id"] = alert_id + alert["closure_reason_description"] = "none" alert["incident_id"] = alert_id alert["mirror_direction"] = mirror_direction alert["mirror_instance"] = demisto.integrationInstance() @@ -854,6 +891,14 @@ def fetch_incidents( else: incidents.append(incident) + # close Cyberint alert if required + if close_alert: + client.update_alerts( + alerts=argToList(alert_id), + status="closed", + closure_reason="resolved", + ) + if incidents: # Update the time for the next fetch so that there won't be duplicates. last_incident_time = max(incidents, key=lambda item: item["occurred"]) @@ -870,12 +915,12 @@ def main(): params = demisto.params() command = demisto.command() access_token = params.get("access_token") - environment = params.get("environment") + url = params.get("url") verify_certificate = not params.get("insecure", False) first_fetch_time = params.get("first_fetch", "3 days").strip() proxy = params.get("proxy", False) - base_url = f"https://{environment}.cyberint.io/alert/" + base_url = f"{url}/alert/" demisto.info(f"Command being called is {command}") try: client = Client( @@ -901,6 +946,7 @@ def main(): if params.get("mirror_direction") == "None" else MIRROR_DIRECTION_MAPPING[params["mirror_direction"]] ) + close_alert = params.get("close_alert", False) next_run, incidents = fetch_incidents( client, demisto.getLastRun(), @@ -912,6 +958,7 @@ def main(): max_fetch, duplicate_alert, mirror_direction, + close_alert, ) demisto.setLastRun(next_run) demisto.incidents(incidents) @@ -938,7 +985,7 @@ def main(): except Exception as e: if "Invalid token or token expired" in str(e): error_message = ( - "Error verifying access token and / or environment, make sure the " + "Error verifying access token and / or URL, make sure the " "configuration parameters are correct." ) elif "datetime" in str(e).lower(): diff --git a/Packs/Cyberint/Integrations/Cyberint/Cyberint.yml b/Packs/Cyberint/Integrations/Cyberint/Cyberint.yml index 0c28b65a802b..28452bea4b65 100644 --- a/Packs/Cyberint/Integrations/Cyberint/Cyberint.yml +++ b/Packs/Cyberint/Integrations/Cyberint/Cyberint.yml @@ -3,18 +3,23 @@ commonfields: id: cyberint version: -1 configuration: +- display: Company Name + additionalinfo: Company (client) name associated with Cyberint instance. + name: client_name + required: true + type: 0 - display: Cyberint Access Token name: access_token type: 4 required: true additionalinfo: Cyberint API access token. -- additionalinfo: Cyberint environment on which the services run (i.e http://{environment}.cyberint.io/...) - display: Cyberint API Environment - name: environment +- display: Cyberint API URL + additionalinfo: Cyberint API URL on which the services run (i.e https://your-company.cyberint.io) + name: url required: true type: 0 -- additionalinfo: An incident will be created with the originated Alert details per CSV file record. - display: Create an incident per CSV record +- display: Create an incident per CSV record + additionalinfo: An incident will be created with the originated Alert details per CSV file record. name: duplicate_alert required: false type: 8 @@ -32,8 +37,8 @@ configuration: - medium - high - very_high -- additionalinfo: Statuses to fetch. If none is chosen, all statuses will be returned. - display: Fetch Status +- display: Fetch Status + additionalinfo: Statuses to fetch. If none is chosen, all statuses will be returned. name: fetch_status options: - open @@ -41,13 +46,13 @@ configuration: - closed type: 16 required: false -- additionalinfo: Environments to fetch (comma separated). If empty, all available environments will be returned. - display: Fetch Environment +- display: Fetch Environment + additionalinfo: Environments to fetch (comma separated). If empty, all available environments will be returned. name: fetch_environment type: 0 required: false -- additionalinfo: 'Choose the direction to mirror the incident: Incoming (from Cyberint to Cortex XSOAR), Outgoing (from Cortex XSOAR to Cyberint), or Incoming and Outgoing (from/to Cortex XSOAR and Cyberint).' - display: Incident Mirroring Direction +- display: Incident Mirroring Direction + additionalinfo: 'Choose the direction to mirror the incident: Incoming (from Cyberint to Cortex XSOAR), Outgoing (from Cortex XSOAR to Cyberint), or Incoming and Outgoing (from/to Cortex XSOAR and Cyberint).' name: mirror_direction type: 15 required: false @@ -61,8 +66,8 @@ configuration: name: incidentType type: 13 required: false -- defaultvalue: 'false' - display: Close Mirrored XSOAR Incident +- display: Close Mirrored XSOAR Incident + defaultvalue: 'false' name: close_incident type: 8 additionalinfo: When selected, closing the Cyberint alert is mirrored in Cortex XSOAR. @@ -126,8 +131,8 @@ configuration: required: false additionalinfo: Max number of alerts per fetch. Defaults to the minimum 10, max is 100. defaultvalue: '10' -- defaultvalue: 7 days - display: First fetch timestamp (