Skip to content

Commit 09270bb

Browse files
author
Juliya Smith
authored
Merge pull request #7 from code42/field-mappings
2 parents f40394c + 720fda7 commit 09270bb

11 files changed

+767
-379
lines changed

‎Packs/Code42/IncidentFields/incidentfield-Code42_Alert_Description.json

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"associatedToAll": false,
3+
"associatedTypes": [
4+
"Code42 Security Alert"
5+
],
6+
"breachScript": "",
7+
"caseInsensitive": true,
8+
"cliName": "code42alertdescription",
9+
"closeForm": false,
10+
"columns": null,
11+
"content": false,
12+
"defaultRows": null,
13+
"description": "",
14+
"editForm": true,
15+
"fieldCalcScript": "",
16+
"group": 0,
17+
"hidden": false,
18+
"id": "incident_code42alertdescription",
19+
"isReadOnly": false,
20+
"locked": false,
21+
"mergeStrategy": "",
22+
"name": "Code42 Alert Description",
23+
"neverSetAsRequired": false,
24+
"ownerOnly": false,
25+
"placeholder": "",
26+
"required": false,
27+
"script": "",
28+
"selectValues": null,
29+
"sla": 0,
30+
"sortValues": null,
31+
"system": false,
32+
"systemAssociatedTypes": null,
33+
"threshold": 72,
34+
"type": "shortText",
35+
"unmapped": false,
36+
"unsearchable": false,
37+
"useAsKpi": false,
38+
"validatedError": "",
39+
"validationRegex": "",
40+
"version": -1
41+
}

‎Packs/Code42/IncidentFields/incidentfield-Code42_Alert_ID.json

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"associatedToAll": false,
3+
"associatedTypes": [
4+
"Code42 Security Alert"
5+
],
6+
"breachScript": "",
7+
"caseInsensitive": true,
8+
"cliName": "code42alertid",
9+
"closeForm": false,
10+
"columns": null,
11+
"content": false,
12+
"defaultRows": null,
13+
"description": "",
14+
"editForm": true,
15+
"fieldCalcScript": "",
16+
"group": 0,
17+
"hidden": false,
18+
"id": "incident_code42alertid",
19+
"isReadOnly": false,
20+
"locked": false,
21+
"mergeStrategy": "",
22+
"name": "Code42 Alert ID",
23+
"neverSetAsRequired": false,
24+
"ownerOnly": false,
25+
"placeholder": "",
26+
"required": false,
27+
"script": "",
28+
"selectValues": null,
29+
"sla": 0,
30+
"sortValues": null,
31+
"system": false,
32+
"systemAssociatedTypes": null,
33+
"threshold": 72,
34+
"type": "shortText",
35+
"unmapped": false,
36+
"unsearchable": false,
37+
"useAsKpi": false,
38+
"validatedError": "",
39+
"validationRegex": "",
40+
"version": -1
41+
}

‎Packs/Code42/IncidentFields/incidentfield-Code42_Alert_Name.json

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"associatedToAll": false,
3+
"associatedTypes": [
4+
"Code42 Security Alert"
5+
],
6+
"breachScript": "",
7+
"caseInsensitive": true,
8+
"cliName": "code42alertname",
9+
"closeForm": false,
10+
"columns": null,
11+
"content": false,
12+
"defaultRows": null,
13+
"description": "",
14+
"editForm": true,
15+
"fieldCalcScript": "",
16+
"group": 0,
17+
"hidden": false,
18+
"id": "incident_code42alertname",
19+
"isReadOnly": false,
20+
"locked": false,
21+
"mergeStrategy": "",
22+
"name": "Code42 Alert Name",
23+
"neverSetAsRequired": false,
24+
"ownerOnly": false,
25+
"placeholder": "",
26+
"required": false,
27+
"script": "",
28+
"selectValues": null,
29+
"sla": 0,
30+
"sortValues": null,
31+
"system": false,
32+
"systemAssociatedTypes": null,
33+
"threshold": 72,
34+
"type": "shortText",
35+
"unmapped": false,
36+
"unsearchable": false,
37+
"useAsKpi": false,
38+
"validatedError": "",
39+
"validationRegex": "",
40+
"version": -1
41+
}

‎Packs/Code42/IncidentFields/incidentfield-Code42_Alert_State.json

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"associatedToAll": false,
3+
"associatedTypes": [
4+
"Code42 Security Alert"
5+
],
6+
"breachScript": "",
7+
"caseInsensitive": true,
8+
"cliName": "code42alertstate",
9+
"closeForm": false,
10+
"columns": null,
11+
"content": false,
12+
"defaultRows": null,
13+
"description": "",
14+
"editForm": true,
15+
"fieldCalcScript": "",
16+
"group": 0,
17+
"hidden": false,
18+
"id": "incident_code42alertstate",
19+
"isReadOnly": false,
20+
"locked": false,
21+
"mergeStrategy": "",
22+
"name": "Code42 Alert State",
23+
"neverSetAsRequired": false,
24+
"ownerOnly": false,
25+
"placeholder": "",
26+
"required": false,
27+
"script": "",
28+
"selectValues": [],
29+
"sla": 0,
30+
"sortValues": null,
31+
"system": false,
32+
"systemAssociatedTypes": null,
33+
"threshold": 72,
34+
"type": "shortText",
35+
"unmapped": false,
36+
"unsearchable": false,
37+
"useAsKpi": false,
38+
"validatedError": "",
39+
"validationRegex": "",
40+
"version": -1
41+
}

‎Packs/Code42/IncidentFields/incidentfield-Code42_Alert_Timestamp.json

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"associatedToAll": false,
3+
"associatedTypes": [
4+
"Code42 Security Alert"
5+
],
6+
"breachScript": "",
7+
"caseInsensitive": true,
8+
"cliName": "code42alerttimestamp",
9+
"closeForm": false,
10+
"columns": null,
11+
"content": false,
12+
"defaultRows": null,
13+
"description": "",
14+
"editForm": true,
15+
"fieldCalcScript": "",
16+
"group": 0,
17+
"hidden": false,
18+
"id": "incident_code42alerttimestamp",
19+
"isReadOnly": false,
20+
"locked": false,
21+
"mergeStrategy": "",
22+
"name": "Code42 Alert Timestamp",
23+
"neverSetAsRequired": false,
24+
"ownerOnly": false,
25+
"placeholder": "",
26+
"required": false,
27+
"script": "",
28+
"selectValues": null,
29+
"sla": 0,
30+
"sortValues": null,
31+
"system": false,
32+
"systemAssociatedTypes": null,
33+
"threshold": 72,
34+
"type": "shortText",
35+
"unmapped": false,
36+
"unsearchable": false,
37+
"useAsKpi": false,
38+
"validatedError": "",
39+
"validationRegex": "",
40+
"version": -1
41+
}

‎Packs/Code42/IncidentFields/incidentfield-Code42_Severity.json

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"associatedToAll": false,
3+
"associatedTypes": [
4+
"Code42 Security Alert"
5+
],
6+
"breachScript": "",
7+
"caseInsensitive": true,
8+
"cliName": "code42severity",
9+
"closeForm": false,
10+
"columns": null,
11+
"content": false,
12+
"defaultRows": null,
13+
"description": "",
14+
"editForm": true,
15+
"fieldCalcScript": "",
16+
"group": 0,
17+
"hidden": false,
18+
"id": "incident_code42severity",
19+
"isReadOnly": false,
20+
"locked": false,
21+
"mergeStrategy": "",
22+
"name": "Code42 Severity",
23+
"neverSetAsRequired": false,
24+
"ownerOnly": false,
25+
"placeholder": "",
26+
"required": false,
27+
"script": "",
28+
"selectValues": [],
29+
"sla": 0,
30+
"sortValues": null,
31+
"system": false,
32+
"systemAssociatedTypes": null,
33+
"threshold": 72,
34+
"type": "shortText",
35+
"unmapped": false,
36+
"unsearchable": false,
37+
"useAsKpi": false,
38+
"validatedError": "",
39+
"validationRegex": "",
40+
"version": -1
41+
}

‎Packs/Code42/IncidentFields/incidentfield-Code42_Username.json

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"associatedToAll": true,
3+
"associatedTypes": null,
4+
"breachScript": "",
5+
"caseInsensitive": true,
6+
"cliName": "code42username",
7+
"closeForm": false,
8+
"columns": null,
9+
"content": false,
10+
"defaultRows": null,
11+
"description": "",
12+
"editForm": true,
13+
"fieldCalcScript": "",
14+
"group": 0,
15+
"hidden": false,
16+
"id": "incident_code42username",
17+
"isReadOnly": false,
18+
"locked": false,
19+
"mergeStrategy": "",
20+
"name": "Code42 Username",
21+
"neverSetAsRequired": false,
22+
"ownerOnly": false,
23+
"placeholder": "",
24+
"required": false,
25+
"script": "",
26+
"selectValues": null,
27+
"sla": 0,
28+
"sortValues": null,
29+
"system": false,
30+
"systemAssociatedTypes": null,
31+
"threshold": 72,
32+
"type": "shortText",
33+
"unmapped": false,
34+
"unsearchable": false,
35+
"useAsKpi": false,
36+
"validatedError": "",
37+
"validationRegex": "",
38+
"version": -1
39+
}

‎Packs/Code42/IncidentTypes/incidenttype-Code42_Security_Alert.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,5 +21,4 @@
2121
"weeks": 0,
2222
"weeksR": 0,
2323
"fromVersion": "5.0.0"
24-
2524
}

‎Packs/Code42/Integrations/Code42/Code42.py

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -725,11 +725,11 @@ def _stringify_lists_if_needed(event):
725725
event["sharedWith"] = str(shared_list)
726726
if private_ip_addresses:
727727
event["privateIpAddresses"] = str(private_ip_addresses)
728+
return event
728729

729730

730731
def _process_event_from_observation(event):
731-
_stringify_lists_if_needed(event)
732-
return event
732+
return _stringify_lists_if_needed(event)
733733

734734

735735
class Code42SecurityIncidentFetcher(object):
@@ -795,7 +795,7 @@ def _fetch_alerts(self, start_query_time):
795795
def _create_incident_from_alert(self, alert):
796796
details = self._client.get_alert_details(alert["id"])
797797
incident = _create_incident_from_alert_details(details)
798-
self._relate_files_to_alert(details)
798+
details = self._relate_files_to_alert(details)
799799
incident["rawJSON"] = json.dumps(details)
800800
return incident
801801

@@ -807,6 +807,7 @@ def _relate_files_to_alert(self, alert_details):
807807
for obs in observations:
808808
file_events = self._get_file_events_from_alert_details(obs, alert_details)
809809
alert_details["fileevents"] = [_process_event_from_observation(e) for e in file_events]
810+
return alert_details
810811

811812
def _get_file_events_from_alert_details(self, observation, alert_details):
812813
security_data_query = map_observation_to_security_query(observation, alert_details["actor"])
@@ -857,7 +858,7 @@ def main():
857858
# Remove trailing slash to prevent wrong URL path to service
858859
verify_certificate = not demisto.params().get("insecure", False)
859860
proxy = demisto.params().get("proxy", False)
860-
LOG(f"Command being called is {demisto.command()}")
861+
LOG("Command being called is {0}.".format(demisto.command()))
861862
try:
862863
client = Code42Client(
863864
base_url=base_url,
@@ -905,7 +906,7 @@ def main():
905906
return_outputs(*commands[command](client, demisto.args()))
906907
# Log exceptions
907908
except Exception as e:
908-
return_error(f"Failed to execute {demisto.command()} command. Error: {str(e)}")
909+
return_error("Failed to execute {0} command. Error: {1}".format(demisto.command(), str(e)))
909910

910911

911912
if __name__ in ("__main__", "__builtin__", "builtins"):

‎Packs/Code42/Integrations/Code42/integration-Code42.yml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -813,11 +813,11 @@ script:
813813
event["sharedWith"] = str(shared_list)
814814
if private_ip_addresses:
815815
event["privateIpAddresses"] = str(private_ip_addresses)
816+
return event
816817
817818
818819
def _process_event_from_observation(event):
819-
_stringify_lists_if_needed(event)
820-
return event
820+
return _stringify_lists_if_needed(event)
821821
822822
823823
class Code42SecurityIncidentFetcher(object):
@@ -883,7 +883,7 @@ script:
883883
def _create_incident_from_alert(self, alert):
884884
details = self._client.get_alert_details(alert["id"])
885885
incident = _create_incident_from_alert_details(details)
886-
self._relate_files_to_alert(details)
886+
details = self._relate_files_to_alert(details)
887887
incident["rawJSON"] = json.dumps(details)
888888
return incident
889889
@@ -895,6 +895,7 @@ script:
895895
for obs in observations:
896896
file_events = self._get_file_events_from_alert_details(obs, alert_details)
897897
alert_details["fileevents"] = [_process_event_from_observation(e) for e in file_events]
898+
return alert_details
898899
899900
def _get_file_events_from_alert_details(self, observation, alert_details):
900901
security_data_query = map_observation_to_security_query(observation, alert_details["actor"])

0 commit comments

Comments
 (0)