New features for emails

Packs/CheckPointHEC/.pack-ignore

@@ -0,0 +1,14 @@
+[file:incidentfield-CheckPointHEC_Farm.json]
+ignore=IF113
+
+[file:incidentfield-CheckPointHEC_Email_Sender.json]
+ignore=IF113
+
+[file:incidentfield-CheckPointHEC_Email_Subject.json]
+ignore=IF113
+
+[file:incidentfield-CheckPointHEC_Reported.json]
+ignore=IF113
+
+[file:incidentfield-CheckPointHEC_Task.json]
+ignore=IF113

Packs/CheckPointHEC/.secrets-ignore

@@ -1,3 +1,76 @@
 [email protected]
 24dfc0f6bd9c7f2eaf5f8457b8c593d3
 54.240.9.35
+AM7PR04MB71438400038BF6FE5BEB9429C9689@AM7PR04MB7143.eurprd04.prod.outlook.com
+[email protected]
+30513361.20230807000123.64d0345363c605.47739801@mail145-17.atl61.mandrillapp.com
+30513361.20230807000122.64d03452cd23f6.94622736@mail145-17.atl61.mandrillapp.com
+https://yardiasp14.com
+3.209.122.29
+130.176.134.78
+54.240.9.99
+http://operatf.xyz
+54.240.9.32
+[email protected]
+[email protected]
+30513361.20230807000124.64d0345481e4e3.21266022@mail145-17.atl61.mandrillapp.com
+30513361.20230807000125.64d034551bdcb5.97151020@mail133-16.atl131.mandrillapp.com
+30513361.20230807000124.64d0345400b5a1.15341582@mail145-17.atl61.mandrillapp.com
+54.240.9.34
+30513361.20230807001119.64d036a7203923.64499517@mail133-16.atl131.mandrillapp.com
+30513361.20230807001119.64d036a775d955.17657338@mail132-16.atl131.mandrillapp.com
+30513361.20230807001120.64d036a8a16c21.99140407@mail179-15.suw41.mandrillapp.com
+30513361.20230807001121.64d036a937cc54.02181762@mail145-17.atl61.mandrillapp.com
+30513361.20230807001120.64d036a80b9b11.15374800@mail132-16.atl131.mandrillapp.com
+30513361.20230807001416.64d03758751760.84928021@mail179-15.suw41.mandrillapp.com
+54.240.9.37
+54.240.9.31
+54.240.9.30
+30513361.20230807002122.64d0390265f6c8.35282031@mail132-16.atl131.mandrillapp.com
+30513361.20230807002121.64d039016a0f09.00432454@mail132-16.atl131.mandrillapp.com
+30513361.20230807002120.64d03900d2b4c1.70782279@mail133-16.atl131.mandrillapp.com
+30513361.20230807002120.64d039004cf9d2.19684529@mail179-15.suw41.mandrillapp.com
+30513361.20230807002121.64d03901cefd05.64285678@mail145-17.atl61.mandrillapp.com
+30513361.20230807002348.64d03994f31828.17353453@mail133-16.atl131.mandrillapp.com
+54.240.9.46
+30513361.20230807003118.64d03b56562816.28060831@mail132-16.atl131.mandrillapp.com
+130.176.134.146
+30513361.20230807003119.64d03b576da9d4.34383728@mail145-17.atl61.mandrillapp.com
+30513361.20230807003118.64d03b56bbd611.33153096@mail145-17.atl61.mandrillapp.com
+30513361.20230807003119.64d03b571935d2.92264052@mail179-15.suw41.mandrillapp.com
+30513361.20230807003119.64d03b57c5d704.10670196@mail145-17.atl61.mandrillapp.com
+30513361.20230807004049.64d03d91274550.45933474@mail132-16.atl131.mandrillapp.com
+30513361.20230807004118.64d03daed23da7.61984506@mail179-15.suw41.mandrillapp.com
+30513361.20230807004119.64d03daf37d8f9.55649785@mail132-16.atl131.mandrillapp.com
+30513361.20230807004119.64d03db000d309.39575175@mail145-17.atl61.mandrillapp.com
+30513361.20230807004119.64d03daf9e6944.71886289@mail179-15.suw41.mandrillapp.com
+30513361.20230807004120.64d03db05166a2.37279038@mail145-17.atl61.mandrillapp.com
+30513361.20230807004444.64d03e7ca4f884.89001235@mail133-16.atl131.mandrillapp.com
+54.240.9.36
+54.240.9.114
+30513361.20230807005121.64d0400906d4c8.58542060@mail179-15.suw41.mandrillapp.com
+30513361.20230807005120.64d040089621d4.86620087@mail133-16.atl131.mandrillapp.com
+130.176.134.137
+30513361.20230807005121.64d04009555e69.08626488@mail179-15.suw41.mandrillapp.com
+30513361.20230807005122.64d0400a1b5dc0.66531144@mail133-16.atl131.mandrillapp.com
+30513361.20230807005121.64d04009aba690.45725300@mail133-16.atl131.mandrillapp.com
+30513361.20230807005115.64d040033af1a9.02893864@mail133-16.atl131.mandrillapp.com
+54.240.9.112
+54.240.9.54
+30513361.20230807010104.64d04250a251f4.73559998@mail132-16.atl131.mandrillapp.com
+30513361.20230807010118.64d0425e815f48.45985517@mail145-17.atl61.mandrillapp.com
+130.176.134.141
+30513361.20230807010118.64d0425eeb25f1.46354810@mail179-15.suw41.mandrillapp.com
+30513361.20230807010119.64d0425f482e72.63158788@mail133-16.atl131.mandrillapp.com
+30513361.20230807010119.64d0425ff1a028.93242369@mail132-16.atl131.mandrillapp.com
+30513361.20230807010119.64d0425f9a0bc0.01785295@mail133-16.atl131.mandrillapp.com
+54.240.9.92
+30513361.20230807011118.64d044b68a3b67.73922838@mail145-17.atl61.mandrillapp.com
+30513361.20230807011118.64d044b6f27029.15766983@mail179-15.suw41.mandrillapp.com
+30513361.20230807011117.64d044b5dc92f7.91529357@mail179-15.suw41.mandrillapp.com
+30513361.20230807011119.64d044b7649295.55975001@mail132-16.atl131.mandrillapp.com
+30513361.20230807011118.64d044b639a369.53729202@mail133-16.atl131.mandrillapp.com
+54.240.9.33
+30513361.20230807011455.64d0458f915be0.04682379@mail133-16.atl131.mandrillapp.com
+30513361.20230807012117.64d0470d28f941.46575979@mail179-15.suw41.mandrillapp.com
+30513361.20230807012117.64d0470d81eb49.37810983@mail133-16.atl131.mandrillapp.com

Packs/CheckPointHEC/IncidentFields/incidentfield-CheckPointHEC_Customer.json

@@ -1,8 +1,8 @@
 {
     "id": "incident_checkpointheccustomer",
     "version": -1,
-    "modified": "2023-07-02T03:39:22.498231281Z",
-    "name": "CheckPointHEC Customer",
+    "modified": "2023-08-01T19:26:46.346683Z",
+    "name": "CP HEC Customer",
     "ownerOnly": false,
     "placeholder": "CP Customer",
     "description": "Customer portal name",

Packs/CheckPointHEC/IncidentFields/incidentfield-CheckPointHEC_Email_Sender.json

@@ -0,0 +1,33 @@
+{
+    "id": "incident_checkpointhecemailsender",
+    "version": -1,
+    "modified": "2023-08-07T15:36:49.667762Z",
+    "name": "CP HEC Email Sender",
+    "ownerOnly": false,
+    "placeholder": "Email Sender",
+    "description": "Sender of the email",
+    "cliName": "checkpointhecemailsender",
+    "type": "shortText",
+    "closeForm": false,
+    "editForm": true,
+    "required": false,
+    "neverSetAsRequired": false,
+    "isReadOnly": false,
+    "useAsKpi": false,
+    "locked": false,
+    "system": false,
+    "content": true,
+    "group": 0,
+    "hidden": false,
+    "openEnded": false,
+    "associatedTypes": [
+        "CheckPointHEC Security Event"
+    ],
+    "associatedToAll": false,
+    "unmapped": false,
+    "unsearchable": true,
+    "caseInsensitive": true,
+    "sla": 0,
+    "threshold": 72,
+    "fromVersion": "6.9.0"
+}

Packs/CheckPointHEC/IncidentFields/incidentfield-CheckPointHEC_Email_Subject.json

@@ -0,0 +1,33 @@
+{
+    "id": "incident_checkpointhecemailsubject",
+    "version": -1,
+    "modified": "2023-08-07T15:36:49.667762Z",
+    "name": "CP HEC Email Subject",
+    "ownerOnly": false,
+    "placeholder": "Email Subject",
+    "description": "Subject of the email",
+    "cliName": "checkpointhecemailsubject",
+    "type": "shortText",
+    "closeForm": false,
+    "editForm": true,
+    "required": false,
+    "neverSetAsRequired": false,
+    "isReadOnly": false,
+    "useAsKpi": false,
+    "locked": false,
+    "system": false,
+    "content": true,
+    "group": 0,
+    "hidden": false,
+    "openEnded": false,
+    "associatedTypes": [
+        "CheckPointHEC Security Event"
+    ],
+    "associatedToAll": false,
+    "unmapped": false,
+    "unsearchable": true,
+    "caseInsensitive": true,
+    "sla": 0,
+    "threshold": 72,
+    "fromVersion": "6.9.0"
+}

Packs/CheckPointHEC/IncidentFields/incidentfield-CheckPointHEC_Entity.json

@@ -1,8 +1,8 @@
 {
     "id": "incident_checkpointhecentity",
     "version": -1,
-    "modified": "2023-07-02T04:30:15.829662037Z",
-    "name": "CheckPointHEC Entity",
+    "modified": "2023-08-01T19:26:46.346683Z",
+    "name": "CP HEC Entity",
     "ownerOnly": false,
     "placeholder": "CP Entity ID",
     "description": "Internal entity ID of email with leak",

Packs/CheckPointHEC/IncidentFields/incidentfield-CheckPointHEC_Farm.json

@@ -0,0 +1,33 @@
+{
+    "id": "incident_checkpointhecfarm",
+    "version": -1,
+    "modified": "2023-08-07T15:36:49.667762Z",
+    "name": "CP HEC Farm",
+    "ownerOnly": false,
+    "placeholder": "CP Farm",
+    "description": "Customer farm",
+    "cliName": "checkpointhecfarm",
+    "type": "shortText",
+    "closeForm": false,
+    "editForm": true,
+    "required": false,
+    "neverSetAsRequired": false,
+    "isReadOnly": false,
+    "useAsKpi": false,
+    "locked": false,
+    "system": false,
+    "content": true,
+    "group": 0,
+    "hidden": false,
+    "openEnded": false,
+    "associatedTypes": [
+        "CheckPointHEC Security Event"
+    ],
+    "associatedToAll": false,
+    "unmapped": false,
+    "unsearchable": true,
+    "caseInsensitive": true,
+    "sla": 0,
+    "threshold": 72,
+    "fromVersion": "6.9.0"
+}

Packs/CheckPointHEC/IncidentFields/incidentfield-CheckPointHEC_Reported.json

@@ -0,0 +1,33 @@
+{
+    "id": "incident_checkpointhecreported",
+    "version": -1,
+    "modified": "2023-08-07T15:36:49.667762Z",
+    "name": "CP HEC Reported",
+    "ownerOnly": false,
+    "placeholder": "CP HEC Reported",
+    "description": "Incident is manually reported",
+    "cliName": "checkpointhecreported",
+    "type": "boolean",
+    "closeForm": false,
+    "editForm": true,
+    "required": false,
+    "neverSetAsRequired": false,
+    "isReadOnly": false,
+    "useAsKpi": false,
+    "locked": false,
+    "system": false,
+    "content": true,
+    "group": 0,
+    "hidden": false,
+    "openEnded": false,
+    "associatedTypes": [
+        "CheckPointHEC Security Event"
+    ],
+    "associatedToAll": false,
+    "unmapped": false,
+    "unsearchable": true,
+    "caseInsensitive": true,
+    "sla": 0,
+    "threshold": 72,
+    "fromVersion": "6.9.0"
+}

Packs/CheckPointHEC/IncidentFields/incidentfield-CheckPointHEC_Saas.json

@@ -1,8 +1,8 @@
 {
     "id": "incident_checkpointhecsaas",
     "version": -1,
-    "modified": "2023-07-02T04:30:00.142598958Z",
-    "name": "CheckPointHEC Saas",
+    "modified": "2023-08-01T19:26:46.346683Z",
+    "name": "CP HEC Saas",
     "ownerOnly": false,
     "placeholder": "CP Saas Identifier",
     "description": "Internal SaaS Identifier",

Packs/CheckPointHEC/IncidentFields/incidentfield-CheckPointHEC_Task.json

@@ -0,0 +1,32 @@
+{
+    "id": "incident_checkpointhectask",
+    "version": -1,
+    "modified": "2023-08-07T15:36:49.667762Z",
+    "name": "CP HEC Task",
+    "ownerOnly": false,
+    "description": "Action task id to get results",
+    "cliName": "checkpointhectask",
+    "type": "shortText",
+    "closeForm": false,
+    "editForm": true,
+    "required": false,
+    "neverSetAsRequired": false,
+    "isReadOnly": false,
+    "useAsKpi": false,
+    "locked": false,
+    "system": false,
+    "content": true,
+    "group": 0,
+    "hidden": false,
+    "openEnded": false,
+    "associatedTypes": [
+        "CheckPointHEC Security Event"
+    ],
+    "associatedToAll": false,
+    "unmapped": false,
+    "unsearchable": true,
+    "caseInsensitive": true,
+    "sla": 0,
+    "threshold": 72,
+    "fromVersion": "6.9.0"
+}

Packs/CheckPointHEC/IncidentFields/incidentfield-CheckPointHEC_Type.json

@@ -1,8 +1,8 @@
 {
     "id": "incident_checkpointhectype",
     "version": -1,
-    "modified": "2023-07-02T04:30:44.192922335Z",
-    "name": "CheckPointHEC Type",
+    "modified": "2023-08-01T19:26:46.346683Z",
+    "name": "CP HEC Type",
     "ownerOnly": false,
     "placeholder": "CP Event Type",
     "description": "Detection type (dlp, phishing, malware, spam)",

Packs/CheckPointHEC/IncidentTypes/incidenttype-CheckPointHEC_Security_Event.json

@@ -19,7 +19,7 @@
     "disabled": false,
     "reputationCalc": 0,
     "onChangeRepAlg": 0,
-    "layout": "CheckPointHEC Security Event Layout",
+    "layout": "CP HEC Security Event Layout",
     "detached": false,
     "extractSettings": {
         "mode": "Specific",