Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Stamus integration v1.0.0 #29426

Merged
merged 21 commits into from
Sep 7, 2023
Merged

Stamus integration v1.0.0 #29426

merged 21 commits into from
Sep 7, 2023

Conversation

content-bot
Copy link
Collaborator

Original External PR

external pull request

Contributor

@regit

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

  • In Progress
  • Ready
  • In Hold - (Reason for hold)

Related Issues

Linked issue: https://github.com/demisto/content/issues/26285

Description

This integration provides interaction with Stamus Security Platform. It provides a way to fetch detection from the solution and
also getting information and context from the Stamus Security Platform.

Screenshots

Screenshot from 2023-05-03 20-07-15

Minimum version of Cortex XSOAR

  • 6.0.0
  • 6.1.0
  • 6.2.0
  • 6.5.0

Does it break backward compatibility?

  • Yes
    • Further details:
  • No

Must have

  • Tests
  • Documentation

@regit @sonicold
@GuyAfik @pevma
Stamus integration v1.0.0 (#26286)
3987e11 
* packs: add stamus pack to xsoar content

Implement a new set of commands to interact with
Stamus Security Platform.

* Stamus: remove dummy test

* Stamus: use StamusIntegration prefix

* Stamus: fix some descriptions

* Stamus: update result to return markdown

* Stamus: rename commands

* Stamus: update pack metadata

* Stamus: homogeneize message

* Stamus: really basic README

* Stamus: fix some linters warning

* Stamus: import playbook and mapper

* Stamus: more import

Import Stamus' IncidentFields, IncidentFields and Layouts

* Stamus: add playbook documentation

* Stamus: more documentation

* Stamus: add generated docs

* Stamus: remove template comment

* Stamus: use f-string

* Stamus: simply test connection

* Stamus: remove commented code

* Stamus: docstring on escape function

* Stamus: fix to have one context for each command

* Stamus: refactoring

* Stamus: remove useless code

* Stamus: get default value in results if no results

* Stamus: run demisto format on yaml files

* Stamus: update README

* Stamus: fix missing description and format

* Stamus: fix following validation

* Stamus: add missing playbook image

* Stamus: remove marketplacev2 support

* Stamus: fix info extraction in get DoC command

* Stamus: use getter function

Co-authored-by: Guy Afik <[email protected]>

* Stamus: command should be lower case

* Stamus: avoid double read of event

* Stamus: little optimization

* Stamus: add docstring

* Stamus: remove not needed files

* Stamus: add basic integration doc

* Stamus: fix JSON format

* Stamus: fix some name in playbook

* Stamus: rename IOC params

* Stamus: fix demisto sdk validation

validation: demisto-sdk validate -i Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json
validation: fix: demisto-sdk format -i /home/snuser/cortex/Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json

* Stamus: fix params name gotten from conf

* Stamus: fix stamus extra data playbook following new naming

* Stamus: fix playbook ID

* Stamus: Add descriptions

* Stamus: move constants with other constants

* Stamus: use getter function + fix linter

* Stamus: use fstring

* Stamus: unit tests impl

* Stamus: remove template doc

Co-authored-by: Guy Afik <[email protected]>

* Stamus: add test data to secret-ignore

* Stamus: fix event type

* Stamus: update demisto docker image

* Stamus: fix reference in classifier

* Stamus: update README.md

Runned demisto-sdk generate-docs -i Packs/Stamus/Integrations/Stamus/Stamus.yml
and fixed the version string.

* Stamus: fix linter error

* Stamus: fix linter warning

* Stamus: fix a playbook param

* Stamus: fix key value

* Stamus: set default value for incident

* Stamus: update from version

* Stamus: set default incoming mapper

* Stamus: improve layout

* Stamus: some more layout work

* Stamus: use already defined fields

* Stamus: don't extract indicators

Most fields are information and we should not extract indicators.

* Stamus: display threat info in layout

* Stamus: don't try to display removed field

* Stamus: add host first seen

* Stamus: add host insight info in incident layout

This is the first pass, we need to add the role.

* Stamus: display major host insight information

* Stamus: retry policy and fix a field

Host insight info can be available after some time if ever the
host has not be seen before.

* Stamus: update to fix validation

* Stamus: add description to mapper

* Stamus: add integration as 'start time' user

---------

Co-authored-by: Nicolas Frisoni <[email protected]>
Co-authored-by: Guy Afik <[email protected]>
Co-authored-by: Peter <[email protected]>
@content-bot content-bot added Contribution Thank you! Contributions are always welcome! docs-approved Partner post-demo Contribution Form Filled Whether contribution form filled or not. pending-contributor The PR is pending the response of its creator Partner Support Level Indicates that the contribution is for Partner supported pack Partner-Approved labels Sep 4, 2023
@content-bot content-bot requested a review from GuyAfik September 4, 2023 08:49
@content-bot
Copy link
Collaborator Author

This PR was automatically updated by a GitHub Action

  • CommonTypes pack version was bumped to 3.3.85.

To stop automatic version bumps, add the ignore-auto-bump-version label to the github PR.

@GuyAfik GuyAfik merged commit 50f0dbb into master Sep 7, 2023
@GuyAfik GuyAfik deleted the contrib/StamusNetworks_stamus-integration-v1.0.0 branch September 7, 2023 05:53
moishce pushed a commit that referenced this pull request Sep 14, 2023
@content-bot @regit
@sonicold @GuyAfik @pevma @moishce
Stamus integration v1.0.0 (#29426)
8e03ad7 
* Stamus integration v1.0.0 (#26286)

* packs: add stamus pack to xsoar content

Implement a new set of commands to interact with
Stamus Security Platform.

* Stamus: remove dummy test

* Stamus: use StamusIntegration prefix

* Stamus: fix some descriptions

* Stamus: update result to return markdown

* Stamus: rename commands

* Stamus: update pack metadata

* Stamus: homogeneize message

* Stamus: really basic README

* Stamus: fix some linters warning

* Stamus: import playbook and mapper

* Stamus: more import

Import Stamus' IncidentFields, IncidentFields and Layouts

* Stamus: add playbook documentation

* Stamus: more documentation

* Stamus: add generated docs

* Stamus: remove template comment

* Stamus: use f-string

* Stamus: simply test connection

* Stamus: remove commented code

* Stamus: docstring on escape function

* Stamus: fix to have one context for each command

* Stamus: refactoring

* Stamus: remove useless code

* Stamus: get default value in results if no results

* Stamus: run demisto format on yaml files

* Stamus: update README

* Stamus: fix missing description and format

* Stamus: fix following validation

* Stamus: add missing playbook image

* Stamus: remove marketplacev2 support

* Stamus: fix info extraction in get DoC command

* Stamus: use getter function

Co-authored-by: Guy Afik <[email protected]>

* Stamus: command should be lower case

* Stamus: avoid double read of event

* Stamus: little optimization

* Stamus: add docstring

* Stamus: remove not needed files

* Stamus: add basic integration doc

* Stamus: fix JSON format

* Stamus: fix some name in playbook

* Stamus: rename IOC params

* Stamus: fix demisto sdk validation

validation: demisto-sdk validate -i Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json
validation: fix: demisto-sdk format -i /home/snuser/cortex/Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json

* Stamus: fix params name gotten from conf

* Stamus: fix stamus extra data playbook following new naming

* Stamus: fix playbook ID

* Stamus: Add descriptions

* Stamus: move constants with other constants

* Stamus: use getter function + fix linter

* Stamus: use fstring

* Stamus: unit tests impl

* Stamus: remove template doc

Co-authored-by: Guy Afik <[email protected]>

* Stamus: add test data to secret-ignore

* Stamus: fix event type

* Stamus: update demisto docker image

* Stamus: fix reference in classifier

* Stamus: update README.md

Runned demisto-sdk generate-docs -i Packs/Stamus/Integrations/Stamus/Stamus.yml
and fixed the version string.

* Stamus: fix linter error

* Stamus: fix linter warning

* Stamus: fix a playbook param

* Stamus: fix key value

* Stamus: set default value for incident

* Stamus: update from version

* Stamus: set default incoming mapper

* Stamus: improve layout

* Stamus: some more layout work

* Stamus: use already defined fields

* Stamus: don't extract indicators

Most fields are information and we should not extract indicators.

* Stamus: display threat info in layout

* Stamus: don't try to display removed field

* Stamus: add host first seen

* Stamus: add host insight info in incident layout

This is the first pass, we need to add the role.

* Stamus: display major host insight information

* Stamus: retry policy and fix a field

Host insight info can be available after some time if ever the
host has not be seen before.

* Stamus: update to fix validation

* Stamus: add description to mapper

* Stamus: add integration as 'start time' user

---------

Co-authored-by: Nicolas Frisoni <[email protected]>
Co-authored-by: Guy Afik <[email protected]>
Co-authored-by: Peter <[email protected]>

* bump rn

* rn

* pre-commit

* Bump pack from version CommonTypes to 3.3.85.

* update mapper

* bump rn

* update rn

* Empty-Commit

* bump rn

* ds108 validation fixes

* fix validation

* ds108

---------

Co-authored-by: Eric Leblond <[email protected]>
Co-authored-by: Nicolas Frisoni <[email protected]>
Co-authored-by: Guy Afik <[email protected]>
Co-authored-by: Peter <[email protected]>
Co-authored-by: GuyAfik <[email protected]>
Co-authored-by: Content Bot <[email protected]>
xsoar-bot pushed a commit to xsoar-contrib/content that referenced this pull request Oct 5, 2023
@content-bot @regit
@sonicold @GuyAfik @pevma @xsoar-bot
Stamus integration v1.0.0 (demisto#29426)
0c5ad62 
* Stamus integration v1.0.0 (demisto#26286)

* packs: add stamus pack to xsoar content

Implement a new set of commands to interact with
Stamus Security Platform.

* Stamus: remove dummy test

* Stamus: use StamusIntegration prefix

* Stamus: fix some descriptions

* Stamus: update result to return markdown

* Stamus: rename commands

* Stamus: update pack metadata

* Stamus: homogeneize message

* Stamus: really basic README

* Stamus: fix some linters warning

* Stamus: import playbook and mapper

* Stamus: more import

Import Stamus' IncidentFields, IncidentFields and Layouts

* Stamus: add playbook documentation

* Stamus: more documentation

* Stamus: add generated docs

* Stamus: remove template comment

* Stamus: use f-string

* Stamus: simply test connection

* Stamus: remove commented code

* Stamus: docstring on escape function

* Stamus: fix to have one context for each command

* Stamus: refactoring

* Stamus: remove useless code

* Stamus: get default value in results if no results

* Stamus: run demisto format on yaml files

* Stamus: update README

* Stamus: fix missing description and format

* Stamus: fix following validation

* Stamus: add missing playbook image

* Stamus: remove marketplacev2 support

* Stamus: fix info extraction in get DoC command

* Stamus: use getter function

Co-authored-by: Guy Afik <[email protected]>

* Stamus: command should be lower case

* Stamus: avoid double read of event

* Stamus: little optimization

* Stamus: add docstring

* Stamus: remove not needed files

* Stamus: add basic integration doc

* Stamus: fix JSON format

* Stamus: fix some name in playbook

* Stamus: rename IOC params

* Stamus: fix demisto sdk validation

validation: demisto-sdk validate -i Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json
validation: fix: demisto-sdk format -i /home/snuser/cortex/Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json

* Stamus: fix params name gotten from conf

* Stamus: fix stamus extra data playbook following new naming

* Stamus: fix playbook ID

* Stamus: Add descriptions

* Stamus: move constants with other constants

* Stamus: use getter function + fix linter

* Stamus: use fstring

* Stamus: unit tests impl

* Stamus: remove template doc

Co-authored-by: Guy Afik <[email protected]>

* Stamus: add test data to secret-ignore

* Stamus: fix event type

* Stamus: update demisto docker image

* Stamus: fix reference in classifier

* Stamus: update README.md

Runned demisto-sdk generate-docs -i Packs/Stamus/Integrations/Stamus/Stamus.yml
and fixed the version string.

* Stamus: fix linter error

* Stamus: fix linter warning

* Stamus: fix a playbook param

* Stamus: fix key value

* Stamus: set default value for incident

* Stamus: update from version

* Stamus: set default incoming mapper

* Stamus: improve layout

* Stamus: some more layout work

* Stamus: use already defined fields

* Stamus: don't extract indicators

Most fields are information and we should not extract indicators.

* Stamus: display threat info in layout

* Stamus: don't try to display removed field

* Stamus: add host first seen

* Stamus: add host insight info in incident layout

This is the first pass, we need to add the role.

* Stamus: display major host insight information

* Stamus: retry policy and fix a field

Host insight info can be available after some time if ever the
host has not be seen before.

* Stamus: update to fix validation

* Stamus: add description to mapper

* Stamus: add integration as 'start time' user

---------

Co-authored-by: Nicolas Frisoni <[email protected]>
Co-authored-by: Guy Afik <[email protected]>
Co-authored-by: Peter <[email protected]>

* bump rn

* rn

* pre-commit

* Bump pack from version CommonTypes to 3.3.85.

* update mapper

* bump rn

* update rn

* Empty-Commit

* bump rn

* ds108 validation fixes

* fix validation

* ds108

---------

Co-authored-by: Eric Leblond <[email protected]>
Co-authored-by: Nicolas Frisoni <[email protected]>
Co-authored-by: Guy Afik <[email protected]>
Co-authored-by: Peter <[email protected]>
Co-authored-by: GuyAfik <[email protected]>
Co-authored-by: Content Bot <[email protected]>
tkatzir pushed a commit that referenced this pull request Dec 20, 2023
@content-bot @regit
@sonicold @GuyAfik @pevma @moishce
Stamus integration v1.0.0 (#29426)
d700387 
* Stamus integration v1.0.0 (#26286)

* packs: add stamus pack to xsoar content

Implement a new set of commands to interact with
Stamus Security Platform.

* Stamus: remove dummy test

* Stamus: use StamusIntegration prefix

* Stamus: fix some descriptions

* Stamus: update result to return markdown

* Stamus: rename commands

* Stamus: update pack metadata

* Stamus: homogeneize message

* Stamus: really basic README

* Stamus: fix some linters warning

* Stamus: import playbook and mapper

* Stamus: more import

Import Stamus' IncidentFields, IncidentFields and Layouts

* Stamus: add playbook documentation

* Stamus: more documentation

* Stamus: add generated docs

* Stamus: remove template comment

* Stamus: use f-string

* Stamus: simply test connection

* Stamus: remove commented code

* Stamus: docstring on escape function

* Stamus: fix to have one context for each command

* Stamus: refactoring

* Stamus: remove useless code

* Stamus: get default value in results if no results

* Stamus: run demisto format on yaml files

* Stamus: update README

* Stamus: fix missing description and format

* Stamus: fix following validation

* Stamus: add missing playbook image

* Stamus: remove marketplacev2 support

* Stamus: fix info extraction in get DoC command

* Stamus: use getter function

Co-authored-by: Guy Afik <[email protected]>

* Stamus: command should be lower case

* Stamus: avoid double read of event

* Stamus: little optimization

* Stamus: add docstring

* Stamus: remove not needed files

* Stamus: add basic integration doc

* Stamus: fix JSON format

* Stamus: fix some name in playbook

* Stamus: rename IOC params

* Stamus: fix demisto sdk validation

validation: demisto-sdk validate -i Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json
validation: fix: demisto-sdk format -i /home/snuser/cortex/Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json

* Stamus: fix params name gotten from conf

* Stamus: fix stamus extra data playbook following new naming

* Stamus: fix playbook ID

* Stamus: Add descriptions

* Stamus: move constants with other constants

* Stamus: use getter function + fix linter

* Stamus: use fstring

* Stamus: unit tests impl

* Stamus: remove template doc

Co-authored-by: Guy Afik <[email protected]>

* Stamus: add test data to secret-ignore

* Stamus: fix event type

* Stamus: update demisto docker image

* Stamus: fix reference in classifier

* Stamus: update README.md

Runned demisto-sdk generate-docs -i Packs/Stamus/Integrations/Stamus/Stamus.yml
and fixed the version string.

* Stamus: fix linter error

* Stamus: fix linter warning

* Stamus: fix a playbook param

* Stamus: fix key value

* Stamus: set default value for incident

* Stamus: update from version

* Stamus: set default incoming mapper

* Stamus: improve layout

* Stamus: some more layout work

* Stamus: use already defined fields

* Stamus: don't extract indicators

Most fields are information and we should not extract indicators.

* Stamus: display threat info in layout

* Stamus: don't try to display removed field

* Stamus: add host first seen

* Stamus: add host insight info in incident layout

This is the first pass, we need to add the role.

* Stamus: display major host insight information

* Stamus: retry policy and fix a field

Host insight info can be available after some time if ever the
host has not be seen before.

* Stamus: update to fix validation

* Stamus: add description to mapper

* Stamus: add integration as 'start time' user

---------

Co-authored-by: Nicolas Frisoni <[email protected]>
Co-authored-by: Guy Afik <[email protected]>
Co-authored-by: Peter <[email protected]>

* bump rn

* rn

* pre-commit

* Bump pack from version CommonTypes to 3.3.85.

* update mapper

* bump rn

* update rn

* Empty-Commit

* bump rn

* ds108 validation fixes

* fix validation

* ds108

---------

Co-authored-by: Eric Leblond <[email protected]>
Co-authored-by: Nicolas Frisoni <[email protected]>
Co-authored-by: Guy Afik <[email protected]>
Co-authored-by: Peter <[email protected]>
Co-authored-by: GuyAfik <[email protected]>
Co-authored-by: Content Bot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@GuyAfik GuyAfik GuyAfik approved these changes

@michalgold michalgold Awaiting requested review from michalgold

@idovandijk idovandijk Awaiting requested review from idovandijk idovandijk is a code owner

Assignees

@GuyAfik GuyAfik

@edik24 edik24

@efelmandar efelmandar

Labels
Contribution Form Filled Whether contribution form filled or not. Contribution Thank you! Contributions are always welcome! docs-approved Partner Support Level Indicates that the contribution is for Partner supported pack Partner Partner-Approved pending-contributor The PR is pending the response of its creator post-demo
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@content-bot @GuyAfik @edik24 @efelmandar @regit