Connection Test added & SDK Bump (#2710)

rapid7 · Aug 15, 2024 · 0c50e20 · 0c50e20
1 parent f89bc0b
commit 0c50e20
Show file tree

Hide file tree

Showing 9 changed files with 42 additions and 13 deletions.
diff --git a/plugins/proofpoint_tap/.CHECKSUM b/plugins/proofpoint_tap/.CHECKSUM
@@ -1,11 +1,11 @@
 {
-	"spec": "a65c8ecd8c967527f4bd29dc6425fa4c",
-	"manifest": "7e45678a67b4746af3bbadb2ca1a6792",
-	"setup": "a3a30970e5940892651190f3bf806148",
+	"spec": "4f4cf87a14acd42a4774ec339c868929",
+	"manifest": "28e4d2cb40027a13b74ccd2156ed9798",
+	"setup": "c7621059ff603f9c8aa42bbbe2ce39e8",
 	"schemas": [
 		{
 			"identifier": "fetch_forensics/schema.py",
-			"hash": "849a5f341763abd494eabc8c5d0f5b3d"
+			"hash": "3e6464033f9ac63796d17fc8888396d3"
 		},
 		{
 			"identifier": "get_all_threats/schema.py",
@@ -33,7 +33,7 @@
 		},
 		{
 			"identifier": "parse_tap_alert/schema.py",
-			"hash": "0fac96bc8bc665ecca2c0ab3b98f7896"
+			"hash": "bcdf571cf4713538e71040aebb4200df"
 		},
 		{
 			"identifier": "url_decode/schema.py",

diff --git a/plugins/proofpoint_tap/Dockerfile b/plugins/proofpoint_tap/Dockerfile
@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 rapid7/insightconnect-python-3-slim-plugin:5.4.9
+FROM --platform=linux/amd64 rapid7/insightconnect-python-3-slim-plugin:6.1.0
 
 LABEL organization=rapid7
 LABEL sdk=python

diff --git a/plugins/proofpoint_tap/bin/komand_proofpoint_tap b/plugins/proofpoint_tap/bin/komand_proofpoint_tap
@@ -6,7 +6,7 @@ from sys import argv
 
 Name = "Proofpoint TAP"
 Vendor = "rapid7"
-Version = "4.1.9"
+Version = "4.1.10"
 Description = "[Proofpoint Targeted Attack Protection](https://www.proofpoint.com/us/products/ransomware-and-targeted-attack-protection) (TAP) helps you stay ahead of attackers with an innovative approach that detects, analyzes and blocks advanced threats before they reach your inbox. This plugin enables users to parse TAP alerts"
 
 

diff --git a/plugins/proofpoint_tap/help.md b/plugins/proofpoint_tap/help.md
@@ -1171,10 +1171,11 @@ Example output:
 
 ## Troubleshooting
 
-*There is no troubleshooting for this plugin.*
+*This plugin does not contain a troubleshooting.*
 
 # Version History
 
+* 4.1.10 - SDK Bump to 6.1.0 | Task Connection test added
 * 4.1.9 - Update connection fields to be required.
 * 4.1.8 - Include SDK 5.4.9 | Task - Use cutoff of 7 days for first query, use cutoff of 1 hours for subsequent queries
 * 4.1.7 - Include SDK 5.4.5 | Task - enforce query cutoff based on Proofpoint API max lookback | Task - toggle pagination when backfilling | Task - only store previous page of hashes.

diff --git a/plugins/proofpoint_tap/komand_proofpoint_tap/actions/fetch_forensics/schema.py b/plugins/proofpoint_tap/komand_proofpoint_tap/actions/fetch_forensics/schema.py
@@ -4,7 +4,7 @@
 
 
 class Component:
-    DESCRIPTION = "Fetch Forensics allows users to pull detailed forensic evidence about individual threats or campaigns. Either 'threatId' or 'campaignId' should be specified"
+    DESCRIPTION = "Pull detailed forensic evidence about individual threats or campaigns. Either 'threatId' or 'campaignId' should be specified"
 
 
 class Input:

diff --git a/plugins/proofpoint_tap/komand_proofpoint_tap/actions/parse_tap_alert/schema.py b/plugins/proofpoint_tap/komand_proofpoint_tap/actions/parse_tap_alert/schema.py
@@ -4,7 +4,7 @@
 
 
 class Component:
-    DESCRIPTION = "Parses a TAP alert"
+    DESCRIPTION = "Parse a TAP alert"
 
 
 class Input:

diff --git a/plugins/proofpoint_tap/komand_proofpoint_tap/connection/connection.py b/plugins/proofpoint_tap/komand_proofpoint_tap/connection/connection.py
@@ -1,9 +1,13 @@
 import insightconnect_plugin_runtime
 from .schema import ConnectionSchema, Input
+from datetime import datetime, timedelta, timezone
 
 # Custom imports below
 from komand_proofpoint_tap.util.api import ProofpointTapApi
 from insightconnect_plugin_runtime.exceptions import PluginException, ConnectionTestException
+from komand_proofpoint_tap.util.exceptions import ApiException
+from komand_proofpoint_tap.util.api import Endpoint
+from komand_proofpoint_tap.util.util import SiemUtils
 
 
 class Connection(insightconnect_plugin_runtime.Connection):
@@ -28,3 +32,26 @@ def test(self):
                     assistance="Please check that your service principal and secret are correct.",
                 )
         return {"status": "Success"}
+
+    def test_task(self):
+        self.logger.info("Running a connection test to Proofpoint")
+        return_message = "The connection test to Proofpoint was unsuccessful \n"
+        try:
+            end_time = datetime.now(timezone.utc) - timedelta(minutes=1)
+            start_time = datetime.now(timezone.utc) - timedelta(minutes=6)
+
+            parameters = SiemUtils.prepare_time_range(start_time.isoformat(), end_time.isoformat(), {"format": "JSON"})
+
+            _ = self.client.siem_action(Endpoint.get_all_threats(), parameters)
+            message = "The connection test to Proofpoint was successful"
+            self.logger.info(message)
+            return {"success": True}, message
+        except ApiException as error:
+            cause_msg = f"The connection test to Proofpoint failed because: {error.cause}"
+            return_message += f"{cause_msg} \n"
+            self.logger.info(cause_msg)
+            self.logger.info(error.assistance)
+            return_message += f"{error.assistance} \n"
+            self.logger.error(error)
+
+            raise ConnectionTestException(cause=error.cause, assistance=error.assistance, data=return_message)
diff --git a/plugins/proofpoint_tap/plugin.spec.yaml b/plugins/proofpoint_tap/plugin.spec.yaml
@@ -6,12 +6,12 @@ title: Proofpoint TAP
 description: "[Proofpoint Targeted Attack Protection](https://www.proofpoint.com/us/products/ransomware-and-targeted-attack-protection)
 (TAP) helps you stay ahead of attackers with an innovative approach that detects, analyzes and blocks advanced
 threats before they reach your inbox. This plugin enables users to parse TAP alerts"
-version: 4.1.9
+version: 4.1.10
 connection_version: 4
 supported_versions: ["Proofpoint TAP API v2", "Tested on 2024-06-04"]
 sdk:
   type: slim
-  version: 5.4.9
+  version: 6.1.0
   user: nobody
 vendor: rapid7
 support: community
@@ -46,6 +46,7 @@ links:
 references:
   - "[Proofpoint TAP](https://www.proofpoint.com/us/products/ransomware-and-targeted-attack-protection)"
 version_history:
+  - "4.1.10 - SDK Bump to 6.1.0 | Task Connection test added"
   - "4.1.9 - Update connection fields to be required."
   - "4.1.8 - Include SDK 5.4.9 | Task - Use cutoff of 7 days for first query, use cutoff of 1 hours for subsequent queries"
   - "4.1.7 - Include SDK 5.4.5 | Task - enforce query cutoff based on Proofpoint API max lookback | Task - toggle pagination when backfilling | Task - only store previous page of hashes."

diff --git a/plugins/proofpoint_tap/setup.py b/plugins/proofpoint_tap/setup.py
@@ -3,7 +3,7 @@
 
 
 setup(name="proofpoint_tap-rapid7-plugin",
-      version="4.1.9",
+      version="4.1.10",
       description="[Proofpoint Targeted Attack Protection](https://www.proofpoint.com/us/products/ransomware-and-targeted-attack-protection) (TAP) helps you stay ahead of attackers with an innovative approach that detects, analyzes and blocks advanced threats before they reach your inbox. This plugin enables users to parse TAP alerts",
       author="rapid7",
       author_email="",