Skip to content

Commit 2892d2b

Browse files
author
shabina-metron
committed
bump app version
1 parent 2baeb65 commit 2892d2b

File tree

5 files changed

+57
-33
lines changed

5 files changed

+57
-33
lines changed

‎Packs/Cybereason/Integrations/Cybereason/Cybereason.py

Lines changed: 33 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
'GUID', 'Link', 'CreationTime', 'Status', 'LastUpdateTime', 'DecisionFailure', 'Suspects', 'AffectedMachine', 'InvolvedHash']
6565

6666
SINGLE_MALOP_HEADERS = [
67-
'GUID', 'Link', 'CreationTime', 'Status', 'LastUpdateTime', 'InvolvedHash', 'Severity', 'Machines', 'Users', "DecisionStatuses", "DetectionTypes", "DetectionEngines" ,"MitreTechniques", "MalopCloserName"]
67+
'GUID', 'Link', 'CreationTime', 'Status', 'LastUpdateTime', 'InvolvedHash', 'Severity', 'Machines', 'Users', "DecisionStatuses", "DetectionTypes", "DetectionEngines", "MitreTechniques", "MalopCloserName"]
6868

6969
DOMAIN_HEADERS = [
7070
'Name', 'Reputation', 'IsInternalDomain', 'WasEverResolved', 'WasEverResolvedAsASecondLevelDomain', 'Malicious',
@@ -572,9 +572,6 @@ def poll_malops(client: Client, start_time):
572572
return api_response
573573

574574

575-
576-
577-
578575
def query_malops(
579576
client: Client, total_result_limit: int = None, per_group_limit: int = None, template_context: str = None,
580577
filters: list = None, guid_list: str = None) -> Any:
@@ -1502,9 +1499,9 @@ def malop_to_incident(malop: str) -> dict:
15021499
status = 0
15031500
malopStatus = ""
15041501
if malop.get('status', ''):
1505-
malopStatus = (malop.get('status', 'UNREAD'))
1502+
malopStatus = malop.get('status', 'UNREAD')
15061503
elif malop.get('simpleValues', ''):
1507-
malopStatus = (malop.get('simpleValues', {}).get('managementStatus', {}).get('values', ['UNREAD'])[0])
1504+
malopStatus = malop.get('simpleValues', {}).get('managementStatus', {}).get('values', ['UNREAD'])[0]
15081505
if (malopStatus == "Active") or (malopStatus == "UNREAD"):
15091506
status = 0
15101507
elif (malopStatus == "Remediated") or (malopStatus == "TODO"):
@@ -1548,7 +1545,7 @@ def malop_to_incident(malop: str) -> dict:
15481545
if malop.get('malopDetectionType'):
15491546
detectionType = malop.get('malopDetectionType', '')
15501547
else:
1551-
detectionType = (malop.get('simpleValues', {}).get('detectionType', {}).get('values', [''])[0])
1548+
detectionType = malop.get('simpleValues', {}).get('detectionType', {}).get('values', [''])[0]
15521549

15531550
malopGroup = malop.get('group', '')
15541551

@@ -1619,7 +1616,8 @@ def fetch_incidents(client: Client):
16191616
offset = 0
16201617
if not total_malops_fetched:
16211618
total_malops_fetched = 0
1622-
demisto.debug(f"Polling starts.total_malops_fetched: {total_malops_fetched} offset: {offset} start_time: {start_time} end_time:{end_time}")
1619+
demisto.debug(
1620+
f"Polling starts.total_malops_fetched: {total_malops_fetched} offset: {offset} start_time: {start_time} end_time:{end_time}")
16231621
malop_management_response = get_malop_management_data(client, start_time, end_time, offset)
16241622
demisto.info(f"mmng/v2 response: {malop_management_response}")
16251623
edr_guid_list, non_edr_guid_list = [], []
@@ -1629,7 +1627,8 @@ def fetch_incidents(client: Client):
16291627
# has_more_results = False
16301628
# continue
16311629
malop_count_per_poll = len(malop_management_response)
1632-
demisto.info(f"Malop stats: Malop per paginated call {malop_count_per_poll}. Malops per polling cycle {total_malops_available}")
1630+
demisto.info(
1631+
f"Malop stats: Malop per paginated call {malop_count_per_poll}. Malops per polling cycle {total_malops_available}")
16331632
total_malops_fetched += malop_count_per_poll
16341633
for malop in malop_management_response:
16351634
demisto.info(f"inside for loop mmng/v2. malop: {malop}")
@@ -1641,12 +1640,14 @@ def fetch_incidents(client: Client):
16411640
demisto.info(f"non_edr_guid_list: {non_edr_guid_list}")
16421641
incidents = []
16431642
if edr_guid_list:
1644-
malop_process_type, malop_loggon_session_type = query_malops(client, total_result_limit=10000, per_group_limit=10000,
1645-
guid_list=edr_guid_list)
1643+
malop_process_type, malop_loggon_session_type = query_malops(
1644+
client, total_result_limit=10000, per_group_limit=10000, guid_list=edr_guid_list
1645+
)
16461646

16471647
for response in (malop_process_type, malop_loggon_session_type):
1648-
malops = dict_safe_get(response, ['data', 'resultIdToElementDataMap'], default_return_value={},
1649-
return_type=dict)
1648+
malops = dict_safe_get(
1649+
response, ['data', 'resultIdToElementDataMap'], default_return_value={}, return_type=dict
1650+
)
16501651

16511652
for malop in list(malops.values()):
16521653
simple_values = dict_safe_get(malop, ['simpleValues'], default_return_value={}, return_type=dict)
@@ -1669,7 +1670,7 @@ def fetch_incidents(client: Client):
16691670
incidents.append(incident)
16701671
demisto.info(f"edr malop got appended in incidents: {incidents}")
16711672

1672-
demisto.info(f"non edr if start...")
1673+
demisto.info("non edr if start...")
16731674
if IS_EPP_ENABLED and non_edr_guid_list:
16741675
demisto.info("inside if non_edr_guid_list")
16751676
for non_edr_malop in non_edr_guid_list:
@@ -1692,20 +1693,21 @@ def fetch_incidents(client: Client):
16921693

16931694
if total_malops_fetched < total_malops_available:
16941695
offset += malop_count_per_poll
1695-
demisto.debug(f"Total malop fetched: {total_malops_fetched} is less than total malops available: {total_malops_available}")
1696+
demisto.debug(
1697+
f"Total malop fetched: {total_malops_fetched} is less than total malops available: {total_malops_available}")
16961698
demisto.debug(f"updating offset to {offset}")
16971699
else:
16981700
offset = 0
1699-
demisto.debug(f"No more results")
1701+
demisto.debug("No more results")
17001702

17011703
integration_context['total_malops_fetched'] = total_malops_fetched
17021704
integration_context['start_time'] = str(start_time)
17031705
integration_context['end_time'] = end_time
17041706
integration_context['offset'] = offset
17051707
set_integration_context(integration_context)
17061708
demisto.debug("Saved integration context data for mmng/v2")
1707-
demisto.debug(f"Polling ends. total_malops_available:{total_malops_available} total_malops_fetched: {total_malops_fetched} offset:{offset}")
1708-
1709+
demisto.debug(
1710+
f"Polling ends. total_malops_available:{total_malops_available} total_malops_fetched: {total_malops_fetched} offset:{offset}")
17091711

17101712

17111713
def login(client: Client):
@@ -2183,8 +2185,8 @@ def query_malop_management_command(client: Client, args: dict):
21832185
malop_last_update_time = single_malop.get("lastUpdateTime", "")
21842186
management_status = single_malop.get("investigationStatus", "")
21852187
involved_hashes = single_malop.get("rootCauseElementHashes", [])
2186-
malop_severity = single_malop.get("severity","")
2187-
machines = single_malop.get("machines",[])
2188+
malop_severity = single_malop.get("severity", "")
2189+
machines = single_malop.get("machines", [])
21882190
filtered_machines = [
21892191
{
21902192
"guid": machine.get("guid"),
@@ -2194,16 +2196,16 @@ def query_malop_management_command(client: Client, args: dict):
21942196
for machine in machines
21952197
]
21962198

2197-
users = single_malop.get("users",[])
2199+
users = single_malop.get("users", [])
21982200
filtered_users = [
21992201
{
22002202
"guid": user.get("guid"),
22012203
"displayName": user.get("displayName"),
22022204
}
22032205
for user in users
22042206
]
2205-
decision_statuses = single_malop.get("decisionStatuses",[])
2206-
dectection_types = single_malop.get("detectionTypes",[])
2207+
decision_statuses = single_malop.get("decisionStatuses", [])
2208+
dectection_types = single_malop.get("detectionTypes", [])
22072209
detection_engines = single_malop.get("detectionEngines", [])
22082210
mitre_techniques = single_malop.get("mitreTechniques")
22092211
closer_name = single_malop.get("closerName")
@@ -2218,14 +2220,14 @@ def query_malop_management_command(client: Client, args: dict):
22182220
'LastUpdateTime': malop_last_update_time,
22192221
'Status': management_status,
22202222
'InvolvedHash': involved_hashes,
2221-
'Severity' : malop_severity,
2222-
'Machines' : filtered_machines,
2223-
'Users' : filtered_users,
2224-
"DecisionStatuses" : decision_statuses,
2225-
"DetectionTypes" : dectection_types,
2226-
"DetectionEngines" : detection_engines,
2227-
"MitreTechniques" : mitre_techniques,
2228-
"MalopCloserName" : closer_name
2223+
'Severity': malop_severity,
2224+
'Machines': filtered_machines,
2225+
'Users': filtered_users,
2226+
"DecisionStatuses": decision_statuses,
2227+
"DetectionTypes": dectection_types,
2228+
"DetectionEngines": detection_engines,
2229+
"MitreTechniques": mitre_techniques,
2230+
"MalopCloserName": closer_name
22292231

22302232
}
22312233
outputs.append(malop_output)

‎Packs/Cybereason/Integrations/Cybereason/Cybereason.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -407,6 +407,7 @@ script:
407407
type: string
408408
- contextPath: Cybereason.Malops.MitreTechniques
409409
description: List of Mitre Techniques involved in this Malop.
410+
type: string
410411
- contextPath: Cybereason.Malops.MalopCloserName
411412
description: List of Malop Closer Name involved in this Malop.
412413
type: string

‎Packs/Cybereason/Integrations/Cybereason/README.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ This involves the mapping of response fields to XSOAR incidents, enhancing the a
2929

3030
1. **Incident Mapping:** The integration maps specific response fields to corresponding incident fields within XSOAR, ensuring that all relevant information is captured accurately.
3131
2. **Custom Fields:** In addition to standard incident fields, custom fields have been introduced to accommodate unique data requirements specific to our workflow. These fields provide flexibility and enhance the granularity of the incident information.
32+
3233
- `malopcreationtime`
3334
- `malopupdatetime`
3435
- `maloprootcauseelementname`
@@ -45,7 +46,7 @@ These custom fields provide flexibility and enhance the granularity of the incid
4546

4647
The functionality for fetching MalOps is implemented through the `fetch_incidents` function. This function is responsible for retrieving MalOps and subsequently converting them into XSOAR incidents.
4748

48-
* **Conversion Process:** The conversion from MalOps to incidents is handled by the `malop_to_incident` function. This function processes MalOps one by one, ensuring each is correctly mapped to its corresponding incident structure.
49+
- **Conversion Process:** The conversion from MalOps to incidents is handled by the `malop_to_incident` function. This function processes MalOps one by one, ensuring each is correctly mapped to its corresponding incident structure.
4950

5051
### Usage
5152

@@ -1665,6 +1666,14 @@ Get the results related to machines.
16651666
| Cybereason.Malops.LastUpdatedTime | string | Last updated time of malop |
16661667
| Cybereason.Malops.InvolvedHash | string | List of file hashes involved in this Malop |
16671668
| Cybereason.Malops.Status | string | Malop managemant status |
1669+
| Cybereason.Malops.MalopCloserName | string | List of Malop Closer Name involved in this Malop |
1670+
| Cybereason.Malops.Machines | string | List of Machines involved in this Malop |
1671+
| Cybereason.Malops.Severity | string | Severity of Malop |
1672+
| Cybereason.Malops.MitreTechniques | string | List of Mitre Techniques involved in this Malop |
1673+
| Cybereason.Malops.Users | string | List of Users involved in this Malop |
1674+
| Cybereason.Malops.DetectionTypes | string | List of Detection Types involved in this Malop |
1675+
| Cybereason.Malops.DecisionStatuses | string | List of Decision Statuses involved in this Malop |
1676+
| Cybereason.Malops.DetectionEngines | string | List of Detection Engines involved in this Malop |
16681677

16691678
#### Command example
16701679

‎Packs/Cybereason/ReleaseNotes/2_1_21.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
2+
#### Integrations
3+
4+
##### Cybereason
5+
6+
- Updated cybereason-query-malop-management
7+
8+
#### Scripts
9+
10+
##### CybereasonPreProcessingExample
11+
12+
- %%UPDATE_RN%%

‎Packs/Cybereason/pack_metadata.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Cybereason",
33
"description": "Endpoint detection and response to manage and query malops, connections and processes.",
44
"support": "partner",
5-
"currentVersion": "2.1.18",
5+
"currentVersion": "2.1.21",
66
"author": "Cybereason",
77
"url": "https://nest.cybereason.com/",
88
"email": "[email protected]",

0 commit comments

Comments
 (0)