Skip to content

Commit 71920bd

Browse files
YuvHayuninbalapt1
YuvHayun
authored and
inbalapt1
committed
IBM HA - add "haIntegrationEventID" to multiple integrations (demisto#38846)
* add haIntegrationEventID key to qradar incidents * added rn * fixes * in progress * reverts & preperation * tests fixes * added haIntegrationEventID to more itnegrations * added rns * fixes * fixes * added sections to uptycs * work in progress, save before testing * working windows integration * done all 9 integrations * added rns * fix proof point * fix unit test * validations fixes * validations fixes * reverts * update uptycs contacts * update rns * update rns * revert ms atp * reverts * reverts * updated docker * fixed empty offset issue * added rn * reverts
1 parent 4cc82ce commit 71920bd

File tree

17 files changed

+74
-15
lines changed

17 files changed

+74
-15
lines changed

‎Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.py

+2
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,8 @@ async def get_events_concurrently(
181181
events: list[str] = raw_response.split("\n")
182182
new_offset = None
183183
try:
184+
if events and events[-1] == "":
185+
events.pop()
184186
offset_context = events.pop()
185187
loaded_offset_context = json.loads(offset_context)
186188
new_offset = loaded_offset_context.get("offset")

‎Packs/Akamai_SIEM/ParsingRules/Akamai_WAF_ParsingRules/Akamai_WAF_ParsingRules.xif

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
[INGEST:vendor="Akamai", product="WAF", target_dataset="akamai_waf_raw", no_hit=keep]
22
// Support only 10 digit epoch date time format. For example: "1669420445".
3-
alter _time = httpMessage -> start;
3+
alter _time = httpMessage -> start
4+
| alter haIntegrationEventID = httpMessage -> requestId;

‎Packs/Akamai_SIEM/ReleaseNotes/1_2_6.md

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
2+
#### Parsing Rules
3+
4+
##### Akamai_WAF Parsing Rule
5+
6+
- Updated the Akamai_WAF Parsing Rule to include the **haIntegrationEventID** field.
7+
8+
#### Integrations
9+
10+
##### Akamai WAF SIEM
11+
12+
- Fixed an issue where the offset extraction would fail on the long-running execution due to empty response.

‎Packs/Akamai_SIEM/pack_metadata.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Akamai WAF SIEM",
33
"description": "Use the Akamai WAF SIEM integration to retrieve security events from Akamai Web Application Firewall (WAF) service.",
44
"support": "xsoar",
5-
"currentVersion": "1.2.5",
5+
"currentVersion": "1.2.6",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",

‎Packs/IBMSecurityVerify/ParsingRules/IBM_Security_Verify_ParsingRules/IBM_Security_Verify_ParsingRules.xif

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[INGEST:vendor="ibm", product="security verify", target_dataset="ibm_security_verify_raw", no_hit=keep]
2+
alter haIntegrationEventID = id;

‎Packs/IBMSecurityVerify/ParsingRules/IBM_Security_Verify_ParsingRules/IBM_Security_Verify_ParsingRules.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: IBM_Security_Verify Parsing Rule
2+
id: IBM_Security_Verify_ParsingRule
3+
fromversion: 6.10.0
4+
tags: []
5+
rules: ''
6+
samples: ''

‎Packs/IBMSecurityVerify/ReleaseNotes/1_0_3.md

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
2+
#### Parsing Rules
3+
4+
##### New: IBM_Security_Verify Parsing Rule
5+
6+
<~XSIAM> Added parsing rule for haIntegrationEventID extraction.</~XSIAM>

‎Packs/IBMSecurityVerify/pack_metadata.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "IBM Security Verify",
33
"description": "Centralize and streamline your identity and access management processes with IBM Security Verify. This content pack provides comprehensive tools and integrations to manage and protect user identities, enforce security policies, and ensure compliance across your organization. Leverage automated workflows and API integrations to enhance your security posture and simplify identity governance and administration.",
44
"support": "xsoar",
5-
"currentVersion": "1.0.2",
5+
"currentVersion": "1.0.3",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",

‎Packs/QRadar/Integrations/QRadar_v3/QRadar_v3.py

+2-1
Original file line numberDiff line numberDiff line change
@@ -2460,7 +2460,8 @@ def create_incidents_from_offenses(offenses: List[dict], incident_type: Optional
24602460
'name': f'''{offense.get('id')} {offense.get('description', '')}''',
24612461
'rawJSON': json.dumps(offense),
24622462
'occurred': get_time_parameter(offense.get('start_time'), iso_format=True),
2463-
'type': incident_type
2463+
'type': incident_type,
2464+
"haIntegrationEventID": str(offense.get("id"))
24642465
} for offense in offenses]
24652466

24662467

‎Packs/QRadar/Integrations/QRadar_v3/QRadar_v3_test.py

+2-1
Original file line numberDiff line numberDiff line change
@@ -616,7 +616,8 @@ def test_create_incidents_from_offenses():
616616
'name': f'''{offense.get('id')} {offense.get('description', '')}''',
617617
'rawJSON': json.dumps(offense),
618618
'occurred': get_time_parameter(offense.get('start_time'), iso_format=True),
619-
'type': 'QRadar Incident'
619+
'type': 'QRadar Incident',
620+
'haIntegrationEventID': str(offense.get('id'))
620621
} for offense in offenses]
621622

622623

‎Packs/QRadar/Integrations/QRadar_v3/test_data/integration_context_tests.json

+8-4
Original file line numberDiff line numberDiff line change
@@ -648,13 +648,15 @@
648648
"name": "16 Session Closed\n",
649649
"rawJSON": "{\"username_count\": 1, \"description\": \"Session Closed\\n\", \"rules\": [{\"id\": 100405, \"type\": \"CRE_RULE\"}], \"event_count\": 1, \"flow_count\": 0, \"security_category_count\": 1, \"follow_up\": false, \"source_address_ids\": [10], \"source_count\": 1, \"inactive\": true, \"protected\": false, \"destination_networks\": [\"Net-16-182-192.Net_182_10_0_0\"], \"source_network\": \"other\", \"category_count\": 1, \"remote_destination_count\": 0, \"start_time\": \"2021-02-15T14:24:11.536000+00:00\", \"magnitude\": 1, \"last_updated_time\": \"2021-02-15T14:24:11.536000+00:00\", \"credibility\": 2, \"id\": 16, \"categories\": [\"Session Closed\"], \"severity\": 2, \"policy_category_count\": 0, \"log_sources\": [{\"type_name\": \"WindowsAuthServer\", \"type_id\": 12, \"name\": \"WindowsAuthServer @ 192.168.1.3\", \"id\": 112}], \"device_count\": 1, \"offense_type\": 0, \"relevance\": 0, \"domain_id\": 0, \"offense_source\": \"192.168.1.3\", \"local_destination_address_ids\": [1], \"local_destination_count\": 1, \"status\": \"OPEN\"}",
650650
"occurred": "2021-02-15T14:24:11.536000+00:00",
651-
"type": null
651+
"type": null,
652+
"haIntegrationEventID": "16"
652653
},
653654
{
654655
"name": "15 Multiple Login Failures for the Same User\n containing Failure Audit: The domain controller failed to validate the credentials for an account\n",
655656
"rawJSON": "{\"username_count\": 1, \"description\": \"Multiple Login Failures for the Same User\\n containing Failure Audit: The domain controller failed to validate the credentials for an account\\n\", \"rules\": [{\"id\": 100056, \"type\": \"CRE_RULE\"}], \"event_count\": 15, \"flow_count\": 0, \"security_category_count\": 2, \"follow_up\": false, \"source_address_ids\": [2, 1], \"source_count\": 2, \"inactive\": true, \"protected\": false, \"destination_networks\": [\"Net-16-182-192.Net_182_10_0_0\"], \"source_network\": \"Net-16-182-192.Net_182_10_0_0\", \"category_count\": 2, \"remote_destination_count\": 0, \"start_time\": \"2021-02-15T13:21:36.537000+00:00\", \"magnitude\": 1, \"last_updated_time\": \"2021-02-15T13:21:46.948000+00:00\", \"credibility\": 2, \"id\": 15, \"categories\": [\"General Authentication Failed\", \"User Login Failure\"], \"severity\": 3, \"policy_category_count\": 0, \"log_sources\": [{\"type_name\": \"WindowsAuthServer\", \"type_id\": 12, \"name\": \"WindowsAuthServer @ 192.168.1.3\", \"id\": 112}, {\"type_name\": \"EventCRE\", \"type_id\": 18, \"name\": \"Custom Rule Engine-8 :: ip-162-21-12-77\", \"id\": 63}], \"device_count\": 2, \"offense_type\": 3, \"relevance\": 0, \"domain_id\": 0, \"offense_source\": \"yarden\", \"local_destination_address_ids\": [1], \"local_destination_count\": 1, \"status\": \"OPEN\"}",
656657
"occurred": "2021-02-15T13:21:36.537000+00:00",
657-
"type": null
658+
"type": null,
659+
"haIntegrationEventID": "15"
658660
}
659661
],
660662
"id": 15
@@ -665,13 +667,15 @@
665667
"name": "18 Session Closed\n",
666668
"rawJSON": "{\"username_count\": 1, \"description\": \"Session Closed\\n\", \"rules\": [{\"id\": 100405, \"type\": \"CRE_RULE\"}], \"event_count\": 1, \"flow_count\": 0, \"security_category_count\": 1, \"follow_up\": false, \"source_address_ids\": [10], \"source_count\": 1, \"inactive\": true, \"protected\": false, \"destination_networks\": [\"Net-16-182-192.Net_182_10_0_0\"], \"source_network\": \"other\", \"category_count\": 1, \"remote_destination_count\": 0, \"start_time\": \"2021-02-15T14:24:11.536000+00:00\", \"magnitude\": 1, \"last_updated_time\": \"2021-02-15T14:24:11.536000+00:00\", \"credibility\": 2, \"id\": 18, \"categories\": [\"Session Closed\"], \"severity\": 2, \"policy_category_count\": 0, \"log_sources\": [{\"type_name\": \"WindowsAuthServer\", \"type_id\": 12, \"name\": \"WindowsAuthServer @ 192.168.1.3\", \"id\": 112}], \"device_count\": 1, \"offense_type\": 0, \"relevance\": 0, \"domain_id\": 0, \"offense_source\": \"192.168.1.3\", \"local_destination_address_ids\": [1], \"local_destination_count\": 1, \"status\": \"OPEN\"}",
667669
"occurred": "2021-02-15T14:24:11.536000+00:00",
668-
"type": null
670+
"type": null,
671+
"haIntegrationEventID": "18"
669672
},
670673
{
671674
"name": "19 Multiple Login Failures for the Same User\n containing Failure Audit: The domain controller failed to validate the credentials for an account\n",
672675
"rawJSON": "{\"username_count\": 1, \"description\": \"Multiple Login Failures for the Same User\\n containing Failure Audit: The domain controller failed to validate the credentials for an account\\n\", \"rules\": [{\"id\": 100056, \"type\": \"CRE_RULE\"}], \"event_count\": 15, \"flow_count\": 0, \"security_category_count\": 2, \"follow_up\": false, \"source_address_ids\": [2, 1], \"source_count\": 2, \"inactive\": true, \"protected\": false, \"destination_networks\": [\"Net-16-182-192.Net_182_10_0_0\"], \"source_network\": \"Net-16-182-192.Net_182_10_0_0\", \"category_count\": 2, \"remote_destination_count\": 0, \"start_time\": \"2021-02-15T13:21:36.537000+00:00\", \"magnitude\": 1, \"last_updated_time\": \"2021-02-15T13:21:46.948000+00:00\", \"credibility\": 2, \"id\": 19, \"categories\": [\"General Authentication Failed\", \"User Login Failure\"], \"severity\": 3, \"policy_category_count\": 0, \"log_sources\": [{\"type_name\": \"WindowsAuthServer\", \"type_id\": 12, \"name\": \"WindowsAuthServer @ 192.168.1.3\", \"id\": 112}, {\"type_name\": \"EventCRE\", \"type_id\": 18, \"name\": \"Custom Rule Engine-8 :: ip-162-21-12-77\", \"id\": 63}], \"device_count\": 2, \"offense_type\": 3, \"relevance\": 0, \"domain_id\": 0, \"offense_source\": \"yarden\", \"local_destination_address_ids\": [1], \"local_destination_count\": 1, \"status\": \"OPEN\"}",
673676
"occurred": "2021-02-15T13:21:36.537000+00:00",
674-
"type": null
677+
"type": null,
678+
"haIntegrationEventID": "19"
675679
}
676680
],
677681
"id": 19

‎Packs/QRadar/ReleaseNotes/2_5_14.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#### Integrations
2+
3+
##### IBM QRadar v3
4+
5+
- Added the **haIntegrationEventID** field to qradar incidents.

‎Packs/QRadar/pack_metadata.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "IBM QRadar",
33
"description": "Fetch offenses as incidents and search QRadar",
44
"support": "xsoar",
5-
"currentVersion": "2.5.13",
5+
"currentVersion": "2.5.14",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",

‎Packs/Uptycs/Integrations/Uptycs/Uptycs.py

+2-1
Original file line numberDiff line numberDiff line change
@@ -2401,7 +2401,8 @@ def uptycs_fetch_incidents():
24012401
"Occurred": alert_time,
24022402
"Severity": severity_to_int(context.get('severity')),
24032403
"Details": json.dumps(context, indent=4),
2404-
"rawJSON": json.dumps(context)
2404+
"rawJSON": json.dumps(context),
2405+
"haIntegrationEventID": context.get('alertId')
24052406
}
24062407
incidents.insert(0, incident)
24072408

‎Packs/Uptycs/Integrations/Uptycs/Uptycs.yml

+13-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
fromversion: 5.0.0
2+
sectionOrder:
3+
- Connect
4+
- Collect
25
category: Analytics & SIEM
36
commonfields:
47
id: Uptycs
@@ -8,39 +11,48 @@ configuration:
811
name: key
912
required: true
1013
type: 4
14+
section: Connect
1115
- display: API secret
1216
name: secret
1317
required: true
1418
type: 4
19+
section: Connect
1520
- display: API domain (e.g. teststack.uptycs.io)
1621
name: domain
1722
required: true
1823
type: 0
24+
section: Connect
1925
- display: API Customer ID
2026
name: customer_id
2127
required: true
2228
type: 4
29+
section: Connect
2330
- display: Fetch incidents
2431
name: isFetch
2532
type: 8
2633
required: false
34+
section: Collect
2735
- display: Incident type
2836
name: incidentType
2937
type: 13
3038
required: false
39+
section: Collect
3140
- display: Trust any certificate (not secure)
3241
name: insecure
3342
type: 8
3443
required: false
44+
section: Connect
3545
- display: Use system proxy settings
3646
name: proxy
3747
type: 8
3848
required: false
49+
section: Connect
3950
- defaultvalue: 1 day
4051
display: First fetch since (<number> <time unit>, e.g., 12 hours, 7 days)
4152
name: fetch_time
4253
type: 0
4354
required: false
55+
section: Collect
4456
description: Fetches data from the Uptycs database.
4557
display: Uptycs
4658
name: Uptycs
@@ -1518,7 +1530,7 @@ script:
15181530
- name: filename
15191531
required: true
15201532
description: The name of the file being uploaded. This file should be uploaded to Cortex XSOAR in the Playground War Room using the paperclip icon next to the CLI.
1521-
dockerimage: demisto/auth-utils:1.0.0.1839651
1533+
dockerimage: demisto/auth-utils:1.0.0.2025089
15221534
isfetch: true
15231535
runonce: true
15241536
script: '-'

‎Packs/Uptycs/ReleaseNotes/1_0_17.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
2+
#### Integrations
3+
4+
##### Uptycs
5+
6+
- Added the **haIntegrationEventID** field to Uptycs alerts.
7+
- Updated the Docker image to: *demisto/auth-utils:1.0.0.2025089*.

‎Packs/Uptycs/pack_metadata.json

+2-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Uptycs",
33
"description": "Fetches data from the Uptycs database.",
44
"support": "partner",
5-
"currentVersion": "1.0.16",
5+
"currentVersion": "1.0.17",
66
"author": "Uptycs Inc.",
77
"url": "https://www.uptycs.com",
88
"email": "support@uptycs.com",
@@ -14,8 +14,7 @@
1414
"useCases": [],
1515
"keywords": [],
1616
"githubUser": [
17-
"bkschmoll-uptycs",
18-
"cgadde-uptycs"
17+
"bkschmoll-uptycs"
1918
],
2019
"certification": "certified",
2120
"marketplaces": [

0 commit comments

Comments
 (0)