Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ASM] - Expander - Remediation Confirmation Scan #27780

Merged
merged 2 commits into from
Jun 28, 2023
Merged

[ASM] - Expander - Remediation Confirmation Scan #27780

merged 2 commits into from
Jun 28, 2023

Conversation

content-bot
Copy link
Collaborator

Original External PR

external pull request

Contributor

@BigEasyJ

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

  • In Progress
  • Ready
  • In Hold - (Reason for hold)

Related Issues

EXPANDR-3175
EXPANDR-3350

Description

  • Adds support for Remediation Confirmation Scan in the Cortex ASM - ASM Alert playbook and the Cortex ASM Integration
  • Replace SNMP, NMAP, and HTTP request (for S3) from Cortex ASM - Detect Service playbook
  • Deprecates Cortex ASM - SNMP Check playbook
  • Increase unit test coverage of Cortex ASM Integration
  • Reformats layout of Cortex ASM - ASM Alert playbook

Screenshots

Cortex_ASM_-_Remediation_Confirmation_Scan

Minimum version of Cortex XSOAR

  • 6.0.0
  • 6.1.0
  • 6.2.0
  • 6.5.0

Does it break backward compatibility?

  • Yes
    • Further details:
  • No

Must have

  • Tests
  • Documentation

@BigEasyJ
[ASM] - Expander - Remediation Confirmation Scan (#27605)
d503e43 
* Add command for starting scan.

Add function and error handling for call the new scan endpoint.
Add function for new command to scan.

* Update rcs get or create endpoint

* Refactor client code to fixture

* Update status code check and error handling

Move error handling and status code checking to RCS start scan to command function
Update start_remediation_confirmation_scan to retrun full response object

* Refactor Cortex ASM tests & Add success tests for RCS

Reducing imports should speed up tests
Add test cases for RCS start scan
Add results and responses for RCS scan

* Update Cortex ASM intgration tests

- Add failure scenario test for starting RCS scan
- Add general 500 waitress error
- Update test data

* Update Cortex ASM integration

- Add error_handler to all request
- Add new function to handle api errors, "get_api_error"

* Update Cortex ASM integration custom exceptions

* Update tests for Cortex ASM integration

- Add test for getting RCS 200 response scan status for IN_PROGRESS|SUCCESS|FAILED_ERROR|FAILED_TIMEOUT statuses.
- Add test for getting RCS 500 response scan status.
- Add response and results test data.
- Update existing response and results test data names.
- Move test_general_500_error.
- Add missing docstrings.

* Add asm-get-remediation-confirmation-scan-status command to Cortex ASM integration

* Update incorrect raw_responses in Cortex ASM integration

* Update get_remediation_confirmation_scan_status_command context outputs

* Update get_api_error in ASM integration

* Update tests and get_error_api

- Update test_get_remediation_confirmation_scan_status_failure exception and error message.
- Update test_start_remediation_confirmation_failure_codes error message.
- Update get_api_error to check for 'message' in response error json.

* Add ASM RCS playbook and update Detect Service playbook …Add ASM RCS playbook and update Detect Service playbook

- Replaced all logic, including NMAP scan from Cortex_ASM_-_Detect_Service with Cortex_ASM_-_Remediation_Confirmation_Scan
- Cteaded new Cortex_ASM_-_Remediation_Confirmation_Scan playbook that starts a scan and polls for scan status
- New PNG files
- Updated ReadMe files

* Update docker image for ASM integration

* Update Pack README

- Add section for Cortex ASM - Remediation Confirmation Scan
- Fix minor grammar

* Update ASM integration (Remove comments)

* Format and Update CortexAttackSurfaceManagement

- Format with Flake8 and Black
- Update output status key for get_remediation_confirmation_scan_status_command
- Update request for start_remediation_confirmation_scan

* Output keys for retrieving status

* Update ASM integration README

* Update functions for scanning and errors

Update get_remediation_confirmation_scan_status_command to use polling.
Update yml with polling and hide_polling_output.
Update get_api_error with 400 and new err_extra, reduced logic to make it simpler.

* Update ASM Alert Playbook

- Remove Detect Service initialize step
- Re-format playbook

* Update Detect Service playbook and remove inputs

* Update ASM RCS playbook

* Update ASM Detect Service playbook

* Add S3 to AWS Enrichment

* Update Cortex ASM integration

- Rename command asm-start-remediation-confirmation-scan from remediation_confirmation_scan
- Add default polling and polling related parameters

* Update Cortex ASM integration

Remove prints and stale comments

* Update unit tests and get_api_error function

- Update expected and raw results test data
- Update unit tests to reflect updated integration
- Remove status code logic from get_api_error function

* Add tests and update get_error_api

- Increase code coverage
- Update doc strings
- Update logic of get_error_api function

* Address linting and formatting

* Deprecate Cortex ASM - SNMP Check

* Add release notes

* Update Cortex ASM integration docker version

* Fix validation errors

* Update Cortex ASM - ASM Alert playbook

* Update get_api_error

Remove Value Error from second exception
Change message of NotFoundError exception

* Update brands on Cortex ASM - RCS playbook

* Address validations and deprecate SNMPDetection

- Update readme
- Update release notes
- Deprecate SNMPDetection
- Remove fromversion from SeviceOwnership.yml (Validation code BC106)

* Update Cortex ASM - ASM Alert with latest

* Update Cortex ASM - ASM Alert png

* Address PR comments.

- Update Cortex ASM - AWS Enrichment readme.
- Fix Cortex ASM - AWS Enrichment typos from versions ago.
- Move Cortex Attack Surface Management down a fromversion

* Update Cortex ASM - ASM Alert

- Update 21 to "What to do if RCS is inconclusive?"
- Update "Service exposure still observable?" conditional

* Address doc review comments and validation

* Update RCS PNG to PR link

* Update release notes

* Undo non-essential file changes

* Fix validation errors.
@content-bot content-bot added Contribution Thank you! Contributions are always welcome! docs-approved ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. Contribution Form Filled Whether contribution form filled or not. Community Xsoar Support Level Indicates that the contribution is for XSOAR supported pack labels Jun 28, 2023
@content-bot content-bot requested a review from RotemAmit June 28, 2023 06:37
@RotemAmit RotemAmit merged commit 32061d5 into master Jun 28, 2023
@RotemAmit RotemAmit deleted the contrib/BigEasyJ_expander-3175-3350-rcs-integration-polling branch June 28, 2023 09:10
MosheEichler pushed a commit that referenced this pull request Jul 2, 2023
@content-bot @BigEasyJ
@RotemAmit @MosheEichler
[ASM] - Expander - Remediation Confirmation Scan (#27605) (#27780)
e20ae79 
* Add command for starting scan.

Add function and error handling for call the new scan endpoint.
Add function for new command to scan.

* Update rcs get or create endpoint

* Refactor client code to fixture

* Update status code check and error handling

Move error handling and status code checking to RCS start scan to command function
Update start_remediation_confirmation_scan to retrun full response object

* Refactor Cortex ASM tests & Add success tests for RCS

Reducing imports should speed up tests
Add test cases for RCS start scan
Add results and responses for RCS scan

* Update Cortex ASM intgration tests

- Add failure scenario test for starting RCS scan
- Add general 500 waitress error
- Update test data

* Update Cortex ASM integration

- Add error_handler to all request
- Add new function to handle api errors, "get_api_error"

* Update Cortex ASM integration custom exceptions

* Update tests for Cortex ASM integration

- Add test for getting RCS 200 response scan status for IN_PROGRESS|SUCCESS|FAILED_ERROR|FAILED_TIMEOUT statuses.
- Add test for getting RCS 500 response scan status.
- Add response and results test data.
- Update existing response and results test data names.
- Move test_general_500_error.
- Add missing docstrings.

* Add asm-get-remediation-confirmation-scan-status command to Cortex ASM integration

* Update incorrect raw_responses in Cortex ASM integration

* Update get_remediation_confirmation_scan_status_command context outputs

* Update get_api_error in ASM integration

* Update tests and get_error_api

- Update test_get_remediation_confirmation_scan_status_failure exception and error message.
- Update test_start_remediation_confirmation_failure_codes error message.
- Update get_api_error to check for 'message' in response error json.

* Add ASM RCS playbook and update Detect Service playbook …Add ASM RCS playbook and update Detect Service playbook

- Replaced all logic, including NMAP scan from Cortex_ASM_-_Detect_Service with Cortex_ASM_-_Remediation_Confirmation_Scan
- Cteaded new Cortex_ASM_-_Remediation_Confirmation_Scan playbook that starts a scan and polls for scan status
- New PNG files
- Updated ReadMe files

* Update docker image for ASM integration

* Update Pack README

- Add section for Cortex ASM - Remediation Confirmation Scan
- Fix minor grammar

* Update ASM integration (Remove comments)

* Format and Update CortexAttackSurfaceManagement

- Format with Flake8 and Black
- Update output status key for get_remediation_confirmation_scan_status_command
- Update request for start_remediation_confirmation_scan

* Output keys for retrieving status

* Update ASM integration README

* Update functions for scanning and errors

Update get_remediation_confirmation_scan_status_command to use polling.
Update yml with polling and hide_polling_output.
Update get_api_error with 400 and new err_extra, reduced logic to make it simpler.

* Update ASM Alert Playbook

- Remove Detect Service initialize step
- Re-format playbook

* Update Detect Service playbook and remove inputs

* Update ASM RCS playbook

* Update ASM Detect Service playbook

* Add S3 to AWS Enrichment

* Update Cortex ASM integration

- Rename command asm-start-remediation-confirmation-scan from remediation_confirmation_scan
- Add default polling and polling related parameters

* Update Cortex ASM integration

Remove prints and stale comments

* Update unit tests and get_api_error function

- Update expected and raw results test data
- Update unit tests to reflect updated integration
- Remove status code logic from get_api_error function

* Add tests and update get_error_api

- Increase code coverage
- Update doc strings
- Update logic of get_error_api function

* Address linting and formatting

* Deprecate Cortex ASM - SNMP Check

* Add release notes

* Update Cortex ASM integration docker version

* Fix validation errors

* Update Cortex ASM - ASM Alert playbook

* Update get_api_error

Remove Value Error from second exception
Change message of NotFoundError exception

* Update brands on Cortex ASM - RCS playbook

* Address validations and deprecate SNMPDetection

- Update readme
- Update release notes
- Deprecate SNMPDetection
- Remove fromversion from SeviceOwnership.yml (Validation code BC106)

* Update Cortex ASM - ASM Alert with latest

* Update Cortex ASM - ASM Alert png

* Address PR comments.

- Update Cortex ASM - AWS Enrichment readme.
- Fix Cortex ASM - AWS Enrichment typos from versions ago.
- Move Cortex Attack Surface Management down a fromversion

* Update Cortex ASM - ASM Alert

- Update 21 to "What to do if RCS is inconclusive?"
- Update "Service exposure still observable?" conditional

* Address doc review comments and validation

* Update RCS PNG to PR link

* Update release notes

* Undo non-essential file changes

* Fix validation errors.

Co-authored-by: John <[email protected]>
Co-authored-by: RotemAmit <[email protected]>
xsoar-bot pushed a commit to xsoar-contrib/content that referenced this pull request Jul 26, 2023
@content-bot @BigEasyJ
@RotemAmit @xsoar-bot
[ASM] - Expander - Remediation Confirmation Scan (demisto#27605) (dem…
d1d00c5 
…isto#27780)

* Add command for starting scan.

Add function and error handling for call the new scan endpoint.
Add function for new command to scan.

* Update rcs get or create endpoint

* Refactor client code to fixture

* Update status code check and error handling

Move error handling and status code checking to RCS start scan to command function
Update start_remediation_confirmation_scan to retrun full response object

* Refactor Cortex ASM tests & Add success tests for RCS

Reducing imports should speed up tests
Add test cases for RCS start scan
Add results and responses for RCS scan

* Update Cortex ASM intgration tests

- Add failure scenario test for starting RCS scan
- Add general 500 waitress error
- Update test data

* Update Cortex ASM integration

- Add error_handler to all request
- Add new function to handle api errors, "get_api_error"

* Update Cortex ASM integration custom exceptions

* Update tests for Cortex ASM integration

- Add test for getting RCS 200 response scan status for IN_PROGRESS|SUCCESS|FAILED_ERROR|FAILED_TIMEOUT statuses.
- Add test for getting RCS 500 response scan status.
- Add response and results test data.
- Update existing response and results test data names.
- Move test_general_500_error.
- Add missing docstrings.

* Add asm-get-remediation-confirmation-scan-status command to Cortex ASM integration

* Update incorrect raw_responses in Cortex ASM integration

* Update get_remediation_confirmation_scan_status_command context outputs

* Update get_api_error in ASM integration

* Update tests and get_error_api

- Update test_get_remediation_confirmation_scan_status_failure exception and error message.
- Update test_start_remediation_confirmation_failure_codes error message.
- Update get_api_error to check for 'message' in response error json.

* Add ASM RCS playbook and update Detect Service playbook …Add ASM RCS playbook and update Detect Service playbook

- Replaced all logic, including NMAP scan from Cortex_ASM_-_Detect_Service with Cortex_ASM_-_Remediation_Confirmation_Scan
- Cteaded new Cortex_ASM_-_Remediation_Confirmation_Scan playbook that starts a scan and polls for scan status
- New PNG files
- Updated ReadMe files

* Update docker image for ASM integration

* Update Pack README

- Add section for Cortex ASM - Remediation Confirmation Scan
- Fix minor grammar

* Update ASM integration (Remove comments)

* Format and Update CortexAttackSurfaceManagement

- Format with Flake8 and Black
- Update output status key for get_remediation_confirmation_scan_status_command
- Update request for start_remediation_confirmation_scan

* Output keys for retrieving status

* Update ASM integration README

* Update functions for scanning and errors

Update get_remediation_confirmation_scan_status_command to use polling.
Update yml with polling and hide_polling_output.
Update get_api_error with 400 and new err_extra, reduced logic to make it simpler.

* Update ASM Alert Playbook

- Remove Detect Service initialize step
- Re-format playbook

* Update Detect Service playbook and remove inputs

* Update ASM RCS playbook

* Update ASM Detect Service playbook

* Add S3 to AWS Enrichment

* Update Cortex ASM integration

- Rename command asm-start-remediation-confirmation-scan from remediation_confirmation_scan
- Add default polling and polling related parameters

* Update Cortex ASM integration

Remove prints and stale comments

* Update unit tests and get_api_error function

- Update expected and raw results test data
- Update unit tests to reflect updated integration
- Remove status code logic from get_api_error function

* Add tests and update get_error_api

- Increase code coverage
- Update doc strings
- Update logic of get_error_api function

* Address linting and formatting

* Deprecate Cortex ASM - SNMP Check

* Add release notes

* Update Cortex ASM integration docker version

* Fix validation errors

* Update Cortex ASM - ASM Alert playbook

* Update get_api_error

Remove Value Error from second exception
Change message of NotFoundError exception

* Update brands on Cortex ASM - RCS playbook

* Address validations and deprecate SNMPDetection

- Update readme
- Update release notes
- Deprecate SNMPDetection
- Remove fromversion from SeviceOwnership.yml (Validation code BC106)

* Update Cortex ASM - ASM Alert with latest

* Update Cortex ASM - ASM Alert png

* Address PR comments.

- Update Cortex ASM - AWS Enrichment readme.
- Fix Cortex ASM - AWS Enrichment typos from versions ago.
- Move Cortex Attack Surface Management down a fromversion

* Update Cortex ASM - ASM Alert

- Update 21 to "What to do if RCS is inconclusive?"
- Update "Service exposure still observable?" conditional

* Address doc review comments and validation

* Update RCS PNG to PR link

* Update release notes

* Undo non-essential file changes

* Fix validation errors.

Co-authored-by: John <[email protected]>
Co-authored-by: RotemAmit <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@RotemAmit RotemAmit RotemAmit approved these changes

Assignees

@RotemAmit RotemAmit

Labels
Community Contribution Form Filled Whether contribution form filled or not. Contribution Thank you! Contributions are always welcome! docs-approved ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. Xsoar Support Level Indicates that the contribution is for XSOAR supported pack
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@content-bot @RotemAmit @ShirleyDenkberg @BigEasyJ