Italy is a major cycling destination from folks from around the world. As part of the Giro coverage also highlight routes and places of interest for casual travelers.
" - } + }, + "ideas": [ + { + "id": "6877998175658332354", + "reference_num": "DEMO-I-299", + "name": "Highlight places of interest for casual travelers.", + "workflow_status": { + "id": "7142047390668922035", + "name": "Open", + "position": 7, + "complete": false, + "color": "#7f7f7f" + } + }] }, { "id": "7142047390531708532", @@ -48,7 +61,8 @@ "description": { "id": "7142047390570897954", "body": "Enhance the mobile getting started guide with a picture diagram that explains how best to get started.
" - } + }, + "ideas" : [] }, { "id": "7142047390632056703", @@ -73,7 +87,33 @@ "description": { "id": "7142047390668922035", "body": "Many cities want to make their roads safer and more convenient for cyclists, but they have a problem. They have very little data on where people ride and what influences their choices. We have tons of data that we can make anonymous and sell to these cities.
" - } + }, + "ideas": [ + { + "id": "6877998175658332354", + "reference_num": "DEMO-I-301", + "name": "make roads more convenient", + "workflow_status": { + "id": "7142047390668922035", + "name": "Shipped", + "position": 7, + "complete": false, + "color": "#7f7f7f" + } + }, + { + "id": "6852713789499497935", + "reference_num": "DEMO-I-41", + "name": "[Feature Request] make roads safer", + "workflow_status": { + "id": "7142047390668922035", + "name": "Shipped", + "position": 7, + "complete": false, + "color": "#7f7f7f" + } + } + ] } ], "pagination": { diff --git a/Packs/AHA/Integrations/AHA/test_data/get_all_ideas.json b/Packs/AHA/Integrations/AHA/test_data/get_all_ideas.json new file mode 100644 index 000000000000..2a4561ec154e --- /dev/null +++ b/Packs/AHA/Integrations/AHA/test_data/get_all_ideas.json @@ -0,0 +1,89 @@ +{ + "ideas": [ + { + "id": "7172566722654275503", + "reference_num": "DEMO-I-3078", + "name": "Create an alert exception command", + "created_at": "2022-12-02T15:02:06.684Z", + "updated_at": "2022-12-02T15:32:15.214Z", + "workflow_status": { + "id": "6836873525456343266", + "name": "Request Received", + "position": 1, + "complete": false, + "color": "#c1e39d" + }, + "description": { + "id": "7172566723341028779", + "body": "Some analysts needs to add regularly alerts exception.", + "created_at": "2022-12-02T15:02:06.844Z", + "attachments": [] + } + }, + { + "id": "7172551313548762563", + "reference_num": "DEMO-I-3077", + "name": "Adding MFA feature on local admin account. only", + "created_at": "2022-12-02T14:02:18.971Z", + "updated_at": "2022-12-02T19:27:20.486Z", + "workflow_status": { + "id": "6836873525456343266", + "name": "Request Received", + "position": 1, + "complete": false, + "color": "#c1e39d" + }, + "description": { + "id": "7172551313663237690", + "body": "Hello,
We would like to see a new feature in order to enforce security.", + "created_at": "2022-12-02T14:02:18.998Z", + "attachments": [] + } + }, + { + "id": "7172480677120868256", + "reference_num": "DEMO-I-3076", + "name": "Ability to amend the color of the favicons", + "created_at": "2022-12-02T09:28:12.646Z", + "updated_at": "2022-12-03T01:24:37.165Z", + "workflow_status": { + "id": "6836873525456343266", + "name": "Request Received", + "position": 1, + "complete": false, + "color": "#c1e39d" + }, + "description": { + "id": "7172480677226219366", + "body": "
Ability to amend the color of the favicons.
", + "created_at": "2022-12-02T09:28:12.671Z", + "attachments": [] + } + }, + { + "id": "7172305193792846103", + "reference_num": "DEMO-I-3075", + "name": "Include a creation timestamp for API Keys", + "created_at": "2022-12-01T22:07:14.749Z", + "updated_at": "2022-12-03T01:24:30.489Z", + "workflow_status": { + "id": "6836873525456343266", + "name": "Request Received", + "position": 1, + "complete": false, + "color": "#c1e39d" + }, + "description": { + "id": "7172305193907051640", + "body": "It would be helpful to see a timestamp of when an API key was created.
", + "created_at": "2022-12-01T22:07:14.776Z", + "attachments": [] + } + } + ], + "pagination": { + "total_records": 3021, + "total_pages": 101, + "current_page": 1 + } +} \ No newline at end of file diff --git a/Packs/AHA/Integrations/AHA/test_data/get_specific_idea.json b/Packs/AHA/Integrations/AHA/test_data/get_specific_idea.json new file mode 100644 index 000000000000..011723553abf --- /dev/null +++ b/Packs/AHA/Integrations/AHA/test_data/get_specific_idea.json @@ -0,0 +1,15 @@ +{ + "idea": { + "id": "7144646026151911047", + "name": "[Test] Mirroring", + "reference_num": "DEMO-I-2895", + "product_id": "6836114877834670881", + "workflow_status": { + "id": "6836873525456343266", + "name": "Request Received", + "position": 1, + "complete": false, + "color": "#c1e39d" + } + } +} \ No newline at end of file diff --git a/Packs/AHA/Integrations/AHA/test_data/update_feature_field.json b/Packs/AHA/Integrations/AHA/test_data/update_feature_field.json index a97a355426e4..e7d0afbb43c1 100644 --- a/Packs/AHA/Integrations/AHA/test_data/update_feature_field.json +++ b/Packs/AHA/Integrations/AHA/test_data/update_feature_field.json @@ -1,7 +1,7 @@ { "feature": { "id": "7142047393121670680", - "name": "Demo-10", + "name": "change just name", "reference_num": "DEMO-10", "created_by_user": { "id": "7142047370286614216", @@ -21,7 +21,7 @@ }, "description": { "id": "7142047393165357275", - "body": "change just description" + "body": "description" } } } \ No newline at end of file diff --git a/Packs/AHA/Integrations/AHA/test_data/update_idea_status.json b/Packs/AHA/Integrations/AHA/test_data/update_idea_status.json new file mode 100644 index 000000000000..4d21faab9c4b --- /dev/null +++ b/Packs/AHA/Integrations/AHA/test_data/update_idea_status.json @@ -0,0 +1,79 @@ +{ + "idea": { + "id": "7144646026151911047", + "name": "[Test] Mirroring", + "reference_num": "DEMO-I-2895", + "score": 3, + "created_at": "2022-09-18T09:15:32.943Z", + "updated_at": "2022-12-05T10:17:47.065Z", + "product_id": "6836114877834670881", + "votes": 2, + "status_changed_at": "2022-12-05T10:17:47.065Z", + "workflow_status": { + "id": "6904419099755086274", + "name": "Shipped", + "position": 7, + "complete": false, + "color": "#7f7f7f" + }, + "description": { + "id": "7144646026273598263", + "body": "Aha Jira Mirroring", + "created_at": "2022-09-18T09:15:32.971Z", + "attachments": [] + }, + "visibility": "Visible to all ideas portal users", + "url": "test/ideas/ideas/DEMO-I-2895", + "resource": "test/api/v1/ideas/DEMO-I-2895", + "product": { + "id": "6836114877834670881", + "reference_prefix": "DEMO", + "name": "Customer Feature Requests", + "product_line": false, + "created_at": "2020-06-08T22:57:07.099Z", + "workspace_type": "product_workspace" + }, + "created_by_portal_user": { + "id": "6866738214309336808", + "name": "Test Tester", + "email": "user@email.com", + "created_at": "2020-08-30T11:31:18.238Z" + }, + "created_by_idea_user": { + "id": "6951900696067621885", + "name": "Test Tester", + "email": "user@email.com", + "created_at": "2021-04-16T23:25:13.678Z" + }, + "assigned_to_user": { + "id": "6878244936949625239", + "name": "Test Tester", + "email": "user@email.com", + "created_at": "2020-09-30T11:43:15.879Z", + "updated_at": "2022-12-02T09:46:27.293Z", + "default_assignee": false + }, + "feature": { + "id": "7144646339649854720", + "reference_num": "DEMO-1019", + "name": "[Test] Mirroring", + "created_at": "2022-09-18T09:16:45.939Z", + "url": "test/features/DEMO-1019", + "resource": "test/api/v1/features/DEMO-1019", + "product_id": "6836114877834670881" + }, + "endorsements_count": 2, + "comments_count": 0, + "score_facts": [], + "tags": [], + "full_tags": [], + "categories": [ + { + "id": "6871298164875917780", + "name": "New Integration Request", + "parent_id": null, + "created_at": "2020-09-11T18:26:14.464Z" + } + ] + } +} \ No newline at end of file diff --git a/Packs/AHA/ReleaseNotes/1_0_3.md b/Packs/AHA/ReleaseNotes/1_0_3.md new file mode 100644 index 000000000000..de3d5f5b74d0 --- /dev/null +++ b/Packs/AHA/ReleaseNotes/1_0_3.md @@ -0,0 +1,3 @@ +#### Integrations +##### Aha +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AHA/ReleaseNotes/1_0_4.md b/Packs/AHA/ReleaseNotes/1_0_4.md new file mode 100644 index 000000000000..137720104d82 --- /dev/null +++ b/Packs/AHA/ReleaseNotes/1_0_4.md @@ -0,0 +1,3 @@ +#### Integrations +##### Aha +- Added support for get ideas and edit ideas. \ No newline at end of file diff --git a/Packs/AHA/pack_metadata.json b/Packs/AHA/pack_metadata.json index bd0b244f803e..ad709cf22669 100644 --- a/Packs/AHA/pack_metadata.json +++ b/Packs/AHA/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AHA", "description": "Use the Aha! integration to edit name/title description and status of features in Aha! according to their status in Jira", "support": "xsoar", - "currentVersion": "1.0.2", + "currentVersion": "1.0.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/ANYRUN/Integrations/ANYRUN/ANYRUN.py b/Packs/ANYRUN/Integrations/ANYRUN/ANYRUN.py index 4a0c01a487ad..180f152f53c0 100644 --- a/Packs/ANYRUN/Integrations/ANYRUN/ANYRUN.py +++ b/Packs/ANYRUN/Integrations/ANYRUN/ANYRUN.py @@ -9,6 +9,7 @@ import os import json import requests +import urllib3 from base64 import b64encode ''' GLOBAL VARS / INSTANCE CONFIGURATION ''' @@ -47,7 +48,7 @@ ''' SETUP ''' # Disable insecure warnings -requests.packages.urllib3.disable_warnings() +urllib3.disable_warnings() # Remove proxy if not set to true in params if not PROXY: diff --git a/Packs/ANYRUN/Integrations/ANYRUN/ANYRUN.yml b/Packs/ANYRUN/Integrations/ANYRUN/ANYRUN.yml index 2686afef4bf3..70489ee1e97f 100644 --- a/Packs/ANYRUN/Integrations/ANYRUN/ANYRUN.yml +++ b/Packs/ANYRUN/Integrations/ANYRUN/ANYRUN.yml @@ -425,7 +425,7 @@ script: - contextPath: ANYRUN.Task.ID description: ID of the task created to analyze the submission. type: String - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 subtype: python3 isfetch: false runonce: false diff --git a/Packs/ANYRUN/ReleaseNotes/1_0_11.md b/Packs/ANYRUN/ReleaseNotes/1_0_11.md new file mode 100644 index 000000000000..1f49c33eb284 --- /dev/null +++ b/Packs/ANYRUN/ReleaseNotes/1_0_11.md @@ -0,0 +1,3 @@ +#### Integrations +##### ANY.RUN +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/ANYRUN/pack_metadata.json b/Packs/ANYRUN/pack_metadata.json index eb230a80cf19..cbd0b2f52b2a 100644 --- a/Packs/ANYRUN/pack_metadata.json +++ b/Packs/ANYRUN/pack_metadata.json @@ -2,7 +2,7 @@ "name": "ANY.RUN", "description": "ANY.RUN is a cloud-based sandbox with interactive access.", "support": "xsoar", - "currentVersion": "1.0.10", + "currentVersion": "1.0.11", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/APIVoid/Integrations/APIVoid/APIVoid.yml b/Packs/APIVoid/Integrations/APIVoid/APIVoid.yml index d3c003fad274..aa104fa3e824 100644 --- a/Packs/APIVoid/Integrations/APIVoid/APIVoid.yml +++ b/Packs/APIVoid/Integrations/APIVoid/APIVoid.yml @@ -1614,7 +1614,7 @@ script: description: '' type: boolean description: A smart API that accurately checks a website's trustworthiness. - dockerimage: demisto/python3:3.10.8.39276 + dockerimage: demisto/python3:3.10.9.42476 runonce: false subtype: python3 fromversion: 5.0.0 diff --git a/Packs/APIVoid/ReleaseNotes/1_0_25.md b/Packs/APIVoid/ReleaseNotes/1_0_25.md new file mode 100644 index 000000000000..25d2d833f14b --- /dev/null +++ b/Packs/APIVoid/ReleaseNotes/1_0_25.md @@ -0,0 +1,3 @@ +#### Integrations +##### APIVoid +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/APIVoid/ReleaseNotes/1_0_26.md b/Packs/APIVoid/ReleaseNotes/1_0_26.md new file mode 100644 index 000000000000..8cc78d2e0d2d --- /dev/null +++ b/Packs/APIVoid/ReleaseNotes/1_0_26.md @@ -0,0 +1,3 @@ +#### Integrations +##### APIVoid +- Updated the Docker image to: *demisto/python3:3.10.9.42476*. diff --git a/Packs/APIVoid/pack_metadata.json b/Packs/APIVoid/pack_metadata.json index bd32db307817..e5531f6c5b11 100644 --- a/Packs/APIVoid/pack_metadata.json +++ b/Packs/APIVoid/pack_metadata.json @@ -2,7 +2,7 @@ "name": "APIVoid", "description": "APIVoid wraps up a number of services such as ipvoid & urlvoid", "support": "xsoar", - "currentVersion": "1.0.24", + "currentVersion": "1.0.26", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/ARIAPacketIntelligence/Integrations/ARIAPacketIntelligence/ARIAPacketIntelligence.py b/Packs/ARIAPacketIntelligence/Integrations/ARIAPacketIntelligence/ARIAPacketIntelligence.py index 8d7346273a1c..0d18e5c96022 100644 --- a/Packs/ARIAPacketIntelligence/Integrations/ARIAPacketIntelligence/ARIAPacketIntelligence.py +++ b/Packs/ARIAPacketIntelligence/Integrations/ARIAPacketIntelligence/ARIAPacketIntelligence.py @@ -4,6 +4,7 @@ import requests import time import re +import urllib3 class ParameterError(Exception): @@ -2224,7 +2225,7 @@ def mute_alert_src_subnet_command(instance, args): def main(): # disable insecure warnings - requests.packages.urllib3.disable_warnings() + urllib3.disable_warnings() # IP address or FQDN of your SDSo node SDSO = demisto.params().get('sdso') diff --git a/Packs/ARIAPacketIntelligence/Integrations/ARIAPacketIntelligence/ARIAPacketIntelligence.yml b/Packs/ARIAPacketIntelligence/Integrations/ARIAPacketIntelligence/ARIAPacketIntelligence.yml index 70f1017e2fc5..1ad3de3be8ec 100755 --- a/Packs/ARIAPacketIntelligence/Integrations/ARIAPacketIntelligence/ARIAPacketIntelligence.yml +++ b/Packs/ARIAPacketIntelligence/Integrations/ARIAPacketIntelligence/ARIAPacketIntelligence.yml @@ -906,7 +906,7 @@ script: description: 'Endpoint information, such as the IP address, about the SIAs that were modified based on the rule change.' type: string description: Removes a named rule from the source subnet logic block, disabling the alerts. - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 runonce: false tests: - No test diff --git a/Packs/ARIAPacketIntelligence/ReleaseNotes/2_0_10.md b/Packs/ARIAPacketIntelligence/ReleaseNotes/2_0_10.md new file mode 100644 index 000000000000..06619d9062eb --- /dev/null +++ b/Packs/ARIAPacketIntelligence/ReleaseNotes/2_0_10.md @@ -0,0 +1,3 @@ +#### Integrations +##### ARIA Packet Intelligence +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/ARIAPacketIntelligence/pack_metadata.json b/Packs/ARIAPacketIntelligence/pack_metadata.json index b431bbe0717c..9fc7939203d7 100755 --- a/Packs/ARIAPacketIntelligence/pack_metadata.json +++ b/Packs/ARIAPacketIntelligence/pack_metadata.json @@ -2,7 +2,7 @@ "name": "ARIAPacketIntelligence", "description": "Manage Packet Intelligence rules in response to incidents. Instantly block conversations, redirect packets, generate alerts, or perform other actions.", "support": "partner", - "currentVersion": "2.0.9", + "currentVersion": "2.0.10", "author": "ARIA Cybersecurity Solutions", "url": "https://www.ariacybersecurity.com/cybersecurity-products/aria-packet-intelligence", "email": "ARIA_support@ariacybersecurity.com", diff --git a/Packs/AWS-ACM/ReleaseNotes/1_1_28.md b/Packs/AWS-ACM/ReleaseNotes/1_1_28.md new file mode 100644 index 000000000000..149b2a205aef --- /dev/null +++ b/Packs/AWS-ACM/ReleaseNotes/1_1_28.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - ACM +- Fixed an issue where the **region** argument was not being taken into account in some commands. diff --git a/Packs/AWS-ACM/ReleaseNotes/1_1_29.md b/Packs/AWS-ACM/ReleaseNotes/1_1_29.md new file mode 100644 index 000000000000..167d43916dea --- /dev/null +++ b/Packs/AWS-ACM/ReleaseNotes/1_1_29.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - ACM +- Fixed a typo in **AWSApiModule**. diff --git a/Packs/AWS-ACM/pack_metadata.json b/Packs/AWS-ACM/pack_metadata.json index 29d5c4d28fe8..9bb5c43e58f9 100644 --- a/Packs/AWS-ACM/pack_metadata.json +++ b/Packs/AWS-ACM/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AWS - ACM", "description": "Amazon Web Services Certificate Manager Service (acm)", "support": "xsoar", - "currentVersion": "1.1.27", + "currentVersion": "1.1.29", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AWS-CloudWatchLogs/ReleaseNotes/1_2_12.md b/Packs/AWS-CloudWatchLogs/ReleaseNotes/1_2_12.md new file mode 100644 index 000000000000..244637374a74 --- /dev/null +++ b/Packs/AWS-CloudWatchLogs/ReleaseNotes/1_2_12.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - CloudWatchLogs +- Fixed an issue where the **region** argument was not being taken into account in some commands. diff --git a/Packs/AWS-CloudWatchLogs/ReleaseNotes/1_2_13.md b/Packs/AWS-CloudWatchLogs/ReleaseNotes/1_2_13.md new file mode 100644 index 000000000000..2936d9af9405 --- /dev/null +++ b/Packs/AWS-CloudWatchLogs/ReleaseNotes/1_2_13.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - CloudWatchLogs +- Fixed a typo in **AWSApiModule**. diff --git a/Packs/AWS-CloudWatchLogs/pack_metadata.json b/Packs/AWS-CloudWatchLogs/pack_metadata.json index 5093b319650a..02e1888cd21b 100644 --- a/Packs/AWS-CloudWatchLogs/pack_metadata.json +++ b/Packs/AWS-CloudWatchLogs/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AWS - CloudWatchLogs", "description": "Amazon Web Services CloudWatch Logs (logs).", "support": "xsoar", - "currentVersion": "1.2.11", + "currentVersion": "1.2.13", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2.py b/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2.py index 6c276cf6ac69..224fdd1c30c7 100644 --- a/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2.py +++ b/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2.py @@ -1553,8 +1553,8 @@ def create_policy_kwargs_dict(args): policy_kwargs_keys = (('fromPort', 'FromPort'), ('toPort', 'ToPort')) policy_kwargs = {} for args_key, dict_key in policy_kwargs_keys: - if int(args.get(args_key)) is not None: - policy_kwargs.update({dict_key: int(args.get(args_key))}) + if key := args.get(args_key): + policy_kwargs.update({dict_key: arg_to_number(key)}) policy_kwargs_keys = (('cidrIp', 'CidrIp'), ('ipProtocol', 'IpProtocol'), ('sourceSecurityGroupName', 'SourceSecurityGroupName'), ('SourceSecurityGroupOwnerId', 'SourceSecurityGroupOwnerId'), diff --git a/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2.yml b/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2.yml index 773e7ac47ab0..88237a34cf31 100644 --- a/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2.yml +++ b/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2.yml @@ -6362,7 +6362,7 @@ script: description: Release on demand dedicated host. execution: false name: aws-ec2-release-hosts - dockerimage: demisto/boto3py3:1.0.0.41082 + dockerimage: demisto/boto3py3:1.0.0.41554 feed: false isfetch: false longRunning: false diff --git a/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2_test.py b/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2_test.py index 41189e200769..ffef7572a1da 100644 --- a/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2_test.py +++ b/Packs/AWS-EC2/Integrations/AWS-EC2/AWS-EC2_test.py @@ -79,3 +79,18 @@ def test_aws_ec2_authorize_security_group_egress_rule(mocker, args, expected_res else: results = demisto.results.call_args[0][0] assert results == expected_results + + +def test_create_policy_kwargs_dict(): + """ + Given + - empty policy kwargs + + When + - running create_policy_kwargs_dict function + + Then + - make sure that create_policy_kwargs_dict does not fail on any exception + + """ + assert AWS_EC2.create_policy_kwargs_dict({}) == {} diff --git a/Packs/AWS-EC2/ReleaseNotes/1_2_24.md b/Packs/AWS-EC2/ReleaseNotes/1_2_24.md new file mode 100644 index 000000000000..1b26250697ad --- /dev/null +++ b/Packs/AWS-EC2/ReleaseNotes/1_2_24.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - EC2 +- Fixed an issue where the **region** argument was not being taken into account in some commands. diff --git a/Packs/AWS-EC2/ReleaseNotes/1_2_25.md b/Packs/AWS-EC2/ReleaseNotes/1_2_25.md new file mode 100644 index 000000000000..0d125dffba43 --- /dev/null +++ b/Packs/AWS-EC2/ReleaseNotes/1_2_25.md @@ -0,0 +1,4 @@ +#### Integrations +##### AWS - EC2 +- Fixed an issue where the **aws-ec2-authorize-security-group-ingress-rule** failed. +- Updated the Docker image to: *demisto/boto3py3:1.0.0.41554*. \ No newline at end of file diff --git a/Packs/AWS-EC2/ReleaseNotes/1_2_26.md b/Packs/AWS-EC2/ReleaseNotes/1_2_26.md new file mode 100644 index 000000000000..5b7b48eba170 --- /dev/null +++ b/Packs/AWS-EC2/ReleaseNotes/1_2_26.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - EC2 +- Fixed a typo in **AWSApiModule**. diff --git a/Packs/AWS-EC2/pack_metadata.json b/Packs/AWS-EC2/pack_metadata.json index a17b489e24e8..b37aaa6e3128 100644 --- a/Packs/AWS-EC2/pack_metadata.json +++ b/Packs/AWS-EC2/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AWS - EC2", "description": "Amazon Web Services Elastic Compute Cloud (EC2)", "support": "xsoar", - "currentVersion": "1.2.23", + "currentVersion": "1.2.26", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AWS-GuardDuty/Integrations/AWSGuardDuty/AWSGuardDuty.yml b/Packs/AWS-GuardDuty/Integrations/AWSGuardDuty/AWSGuardDuty.yml index 2e47270706f8..b5a05cddec49 100644 --- a/Packs/AWS-GuardDuty/Integrations/AWSGuardDuty/AWSGuardDuty.yml +++ b/Packs/AWS-GuardDuty/Integrations/AWSGuardDuty/AWSGuardDuty.yml @@ -1497,7 +1497,7 @@ script: - contextPath: AWS.GuardDuty.Members.UpdatedAt description: The time a member was last updated. type: string - dockerimage: demisto/boto3py3:1.0.0.38849 + dockerimage: demisto/boto3py3:1.0.0.41464 feed: false isfetch: true longRunning: false diff --git a/Packs/AWS-GuardDuty/Integrations/AWSGuardDutyEventCollector/AWSGuardDutyEventCollector.yml b/Packs/AWS-GuardDuty/Integrations/AWSGuardDutyEventCollector/AWSGuardDutyEventCollector.yml index d3a6d9dc7c95..d01ee117dae4 100644 --- a/Packs/AWS-GuardDuty/Integrations/AWSGuardDutyEventCollector/AWSGuardDutyEventCollector.yml +++ b/Packs/AWS-GuardDuty/Integrations/AWSGuardDutyEventCollector/AWSGuardDutyEventCollector.yml @@ -112,7 +112,7 @@ script: description: Manual command used to fetch events and display them. execution: false name: aws-gd-get-events - dockerimage: demisto/boto3py3:1.0.0.37755 + dockerimage: demisto/boto3py3:1.0.0.41464 isfetchevents: true runonce: false subtype: python3 diff --git a/Packs/AWS-GuardDuty/ReleaseNotes/1_3_7.md b/Packs/AWS-GuardDuty/ReleaseNotes/1_3_7.md new file mode 100644 index 000000000000..b9e787430d69 --- /dev/null +++ b/Packs/AWS-GuardDuty/ReleaseNotes/1_3_7.md @@ -0,0 +1,5 @@ +#### Integrations +##### AWS - GuardDuty +- Updated the Docker image to: *demisto/boto3py3:1.0.0.41464*. +##### AWS - GuardDuty Event Collector +- Updated the Docker image to: *demisto/boto3py3:1.0.0.41464*. diff --git a/Packs/AWS-GuardDuty/ReleaseNotes/1_3_8.md b/Packs/AWS-GuardDuty/ReleaseNotes/1_3_8.md new file mode 100644 index 000000000000..3164d22a2e60 --- /dev/null +++ b/Packs/AWS-GuardDuty/ReleaseNotes/1_3_8.md @@ -0,0 +1,6 @@ +#### Integrations +##### AWS - GuardDuty Event Collector +- Fixed an issue where the **region** argument was not being taken into account in some commands. + +##### AWS - GuardDuty +- Fixed an issue where the **region** argument was not being taken into account in some commands. diff --git a/Packs/AWS-GuardDuty/ReleaseNotes/1_3_9.md b/Packs/AWS-GuardDuty/ReleaseNotes/1_3_9.md new file mode 100644 index 000000000000..532f3aa1bc2b --- /dev/null +++ b/Packs/AWS-GuardDuty/ReleaseNotes/1_3_9.md @@ -0,0 +1,7 @@ + +#### Integrations +##### AWS - GuardDuty Event Collector +- Fixed a typo in **AWSApiModule**. + +##### AWS - GuardDuty +- Fixed a typo in **AWSApiModule**. diff --git a/Packs/AWS-GuardDuty/pack_metadata.json b/Packs/AWS-GuardDuty/pack_metadata.json index f7e0defb1a65..13af2ad222a3 100644 --- a/Packs/AWS-GuardDuty/pack_metadata.json +++ b/Packs/AWS-GuardDuty/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AWS - GuardDuty", "description": "Amazon Web Services Guard Duty Service (gd)", "support": "xsoar", - "currentVersion": "1.3.6", + "currentVersion": "1.3.9", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", @@ -10,9 +10,7 @@ "categories": [ "Cloud Services" ], - "tags": [ - "marketplacev2:Data Source" - ], + "tags": [], "itemPrefix": [ "AWS", "AWS GuardDuty" diff --git a/Packs/AWS-IAM/ReleaseNotes/1_1_18.md b/Packs/AWS-IAM/ReleaseNotes/1_1_18.md new file mode 100644 index 000000000000..350a8e718e0b --- /dev/null +++ b/Packs/AWS-IAM/ReleaseNotes/1_1_18.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - Identity and Access Management +- Fixed an issue where the **region** argument was not being taken into account in some commands. diff --git a/Packs/AWS-IAM/ReleaseNotes/1_1_19.md b/Packs/AWS-IAM/ReleaseNotes/1_1_19.md new file mode 100644 index 000000000000..c7beef88e8c8 --- /dev/null +++ b/Packs/AWS-IAM/ReleaseNotes/1_1_19.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - Identity and Access Management +- Fixed a typo in **AWSApiModule**. diff --git a/Packs/AWS-IAM/pack_metadata.json b/Packs/AWS-IAM/pack_metadata.json index d9be426b1f67..9f26e991ab65 100644 --- a/Packs/AWS-IAM/pack_metadata.json +++ b/Packs/AWS-IAM/pack_metadata.json @@ -3,7 +3,7 @@ "description": "Amazon Web Services Identity and Access Management (IAM)", "support": "xsoar", "author": "Cortex XSOAR", - "currentVersion": "1.1.17", + "currentVersion": "1.1.19", "url": "https://www.paloaltonetworks.com/cortex", "email": "", "created": "2020-04-14T00:00:00Z", diff --git a/Packs/AWS-Lambda/ReleaseNotes/1_2_30.md b/Packs/AWS-Lambda/ReleaseNotes/1_2_30.md new file mode 100644 index 000000000000..1741035308c2 --- /dev/null +++ b/Packs/AWS-Lambda/ReleaseNotes/1_2_30.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - Lambda +- Fixed an issue where the **region** argument was not being taken into account in some commands. diff --git a/Packs/AWS-Lambda/ReleaseNotes/1_2_31.md b/Packs/AWS-Lambda/ReleaseNotes/1_2_31.md new file mode 100644 index 000000000000..5cec64f0cafe --- /dev/null +++ b/Packs/AWS-Lambda/ReleaseNotes/1_2_31.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - Lambda +- Fixed a typo in **AWSApiModule**. diff --git a/Packs/AWS-Lambda/pack_metadata.json b/Packs/AWS-Lambda/pack_metadata.json index 0b575f833f7e..ff669e22f08b 100644 --- a/Packs/AWS-Lambda/pack_metadata.json +++ b/Packs/AWS-Lambda/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AWS - Lambda", "description": "Amazon Web Services Serverless Compute service (lambda)", "support": "xsoar", - "currentVersion": "1.2.29", + "currentVersion": "1.2.31", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AWS-S3/ReleaseNotes/1_2_11.md b/Packs/AWS-S3/ReleaseNotes/1_2_11.md new file mode 100644 index 000000000000..069ec9fff4cb --- /dev/null +++ b/Packs/AWS-S3/ReleaseNotes/1_2_11.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - S3 +- Fixed an issue where the **region** argument was not being taken into account in some commands. diff --git a/Packs/AWS-S3/ReleaseNotes/1_2_12.md b/Packs/AWS-S3/ReleaseNotes/1_2_12.md new file mode 100644 index 000000000000..912fbf49e695 --- /dev/null +++ b/Packs/AWS-S3/ReleaseNotes/1_2_12.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - S3 +- Fixed a typo in **AWSApiModule**. diff --git a/Packs/AWS-S3/pack_metadata.json b/Packs/AWS-S3/pack_metadata.json index be800c14f096..ae4898079420 100644 --- a/Packs/AWS-S3/pack_metadata.json +++ b/Packs/AWS-S3/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AWS - S3", "description": "Amazon Web Services Simple Storage Service (S3)", "support": "xsoar", - "currentVersion": "1.2.10", + "currentVersion": "1.2.12", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AWS-SNS/ReleaseNotes/1_0_3.md b/Packs/AWS-SNS/ReleaseNotes/1_0_3.md new file mode 100644 index 000000000000..d255423ddc58 --- /dev/null +++ b/Packs/AWS-SNS/ReleaseNotes/1_0_3.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - SNS +- Fixed an issue where the **region** argument was not being taken into account in some commands. diff --git a/Packs/AWS-SNS/ReleaseNotes/1_0_4.md b/Packs/AWS-SNS/ReleaseNotes/1_0_4.md new file mode 100644 index 000000000000..f9bdf06d7ed3 --- /dev/null +++ b/Packs/AWS-SNS/ReleaseNotes/1_0_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - SNS +- Fixed a typo in **AWSApiModule**. diff --git a/Packs/AWS-SNS/pack_metadata.json b/Packs/AWS-SNS/pack_metadata.json index b40c92aa36c9..1842bb3d407a 100644 --- a/Packs/AWS-SNS/pack_metadata.json +++ b/Packs/AWS-SNS/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AWS - SNS", "description": "This is the integration content pack which can create or delete topic/subscription on AWS Simple Notification System and send the message via SNS as well.", "support": "community", - "currentVersion": "1.0.2", + "currentVersion": "1.0.4", "author": "Jie Liau", "url": "", "email": "", diff --git a/Packs/AWS-SQS/ReleaseNotes/1_2_18.md b/Packs/AWS-SQS/ReleaseNotes/1_2_18.md new file mode 100644 index 000000000000..9d8495ef73bf --- /dev/null +++ b/Packs/AWS-SQS/ReleaseNotes/1_2_18.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - SQS +- Fixed an issue where the **region** argument was not being taken into account in some commands. diff --git a/Packs/AWS-SQS/ReleaseNotes/1_2_19.md b/Packs/AWS-SQS/ReleaseNotes/1_2_19.md new file mode 100644 index 000000000000..165d55722488 --- /dev/null +++ b/Packs/AWS-SQS/ReleaseNotes/1_2_19.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - SQS +- Fixed a typo in **AWSApiModule**. diff --git a/Packs/AWS-SQS/pack_metadata.json b/Packs/AWS-SQS/pack_metadata.json index 92845f6992ae..18d1565817b4 100644 --- a/Packs/AWS-SQS/pack_metadata.json +++ b/Packs/AWS-SQS/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AWS - SQS", "description": "Amazon Web Services Simple Queuing Service (SQS)", "support": "xsoar", - "currentVersion": "1.2.17", + "currentVersion": "1.2.19", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", @@ -10,9 +10,7 @@ "categories": [ "Cloud Services" ], - "tags": [ - "marketplacev2:Data Source" - ], + "tags": [], "useCases": [], "keywords": [], "marketplaces": [ diff --git a/Packs/AWS-SecurityHub/ReleaseNotes/1_1_28.md b/Packs/AWS-SecurityHub/ReleaseNotes/1_1_28.md new file mode 100644 index 000000000000..e0cc64b6f9ab --- /dev/null +++ b/Packs/AWS-SecurityHub/ReleaseNotes/1_1_28.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - Security Hub +- Fixed an issue where the **region** argument was not being taken into account in some commands. diff --git a/Packs/AWS-SecurityHub/ReleaseNotes/1_1_29.md b/Packs/AWS-SecurityHub/ReleaseNotes/1_1_29.md new file mode 100644 index 000000000000..cbe25ac0bd9d --- /dev/null +++ b/Packs/AWS-SecurityHub/ReleaseNotes/1_1_29.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AWS - Security Hub +- Fixed a typo in **AWSApiModule**. diff --git a/Packs/AWS-SecurityHub/pack_metadata.json b/Packs/AWS-SecurityHub/pack_metadata.json index 01368e9688c8..d3a2d29564e4 100644 --- a/Packs/AWS-SecurityHub/pack_metadata.json +++ b/Packs/AWS-SecurityHub/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AWS - Security Hub", "description": "Amazon Web Services Security Hub Service .", "support": "xsoar", - "currentVersion": "1.1.27", + "currentVersion": "1.1.29", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", @@ -10,9 +10,7 @@ "categories": [ "Cloud Services" ], - "tags": [ - "marketplacev2:Data Source" - ], + "tags": [], "useCases": [], "keywords": [], "marketplaces": [ diff --git a/Packs/AWS_DynamoDB/Integrations/AWS_DynamoDB/AWS_DynamoDB.yml b/Packs/AWS_DynamoDB/Integrations/AWS_DynamoDB/AWS_DynamoDB.yml index 98b352fb8f0f..32aa79a8b953 100644 --- a/Packs/AWS_DynamoDB/Integrations/AWS_DynamoDB/AWS_DynamoDB.yml +++ b/Packs/AWS_DynamoDB/Integrations/AWS_DynamoDB/AWS_DynamoDB.yml @@ -6236,7 +6236,7 @@ script: for items in the table. - contextPath: AWS-DynamoDB.TimeToLiveSpecification description: Represents the output of an UpdateTimeToLive operation. - dockerimage: demisto/boto3py3:1.0.0.41082 + dockerimage: demisto/boto3py3:1.0.0.41926 runonce: false script: '' subtype: python3 diff --git a/Packs/AWS_DynamoDB/ReleaseNotes/1_0_31.md b/Packs/AWS_DynamoDB/ReleaseNotes/1_0_31.md new file mode 100644 index 000000000000..d40204950569 --- /dev/null +++ b/Packs/AWS_DynamoDB/ReleaseNotes/1_0_31.md @@ -0,0 +1,3 @@ +#### Integrations +##### Amazon DynamoDB +- Updated the Docker image to: *demisto/boto3py3:1.0.0.41926*. diff --git a/Packs/AWS_DynamoDB/pack_metadata.json b/Packs/AWS_DynamoDB/pack_metadata.json index c45c987d1d47..3eeacd1d9d23 100644 --- a/Packs/AWS_DynamoDB/pack_metadata.json +++ b/Packs/AWS_DynamoDB/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Amazon DynamoDB", "description": "Amazon DynamoDB Amazon DynamoDB is a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability. DynamoDB lets you offload the administrative burdens of operating and scaling a distributed database, so that you don't have to worry about hardware provisioning, setup and configuration, replication, software patching, or cluster scaling. With DynamoDB, you can create database tables that can store and retrieve any amount of data, and serve any level of request traffic. You can scale up or scale down your tables' throughput capacity without downtime or performance degradation, and use the AWS Management Console to monitor resource utilization and performance metrics. DynamoDB automatically spreads the data and traffic for your tables over a sufficient number of servers to handle your throughput and storage requirements, while maintaining consistent and fast performance. All of your data is stored on solid state disks (SSDs) and automatically replicated across multiple Availability Zones in an AWS region, providing built-in high availability and data durability. ", "support": "xsoar", - "currentVersion": "1.0.30", + "currentVersion": "1.0.31", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AbnormalSecurity/Integrations/AbnormalSecurity/AbnormalSecurity.py b/Packs/AbnormalSecurity/Integrations/AbnormalSecurity/AbnormalSecurity.py index 1671e058f924..124713bf4da8 100644 --- a/Packs/AbnormalSecurity/Integrations/AbnormalSecurity/AbnormalSecurity.py +++ b/Packs/AbnormalSecurity/Integrations/AbnormalSecurity/AbnormalSecurity.py @@ -1,9 +1,9 @@ import demistomock as demisto from CommonServerPython import * -import requests +import urllib3 -requests.packages.urllib3.disable_warnings() +urllib3.disable_warnings() class Client(BaseClient): diff --git a/Packs/AbnormalSecurity/Integrations/AbnormalSecurity/AbnormalSecurity.yml b/Packs/AbnormalSecurity/Integrations/AbnormalSecurity/AbnormalSecurity.yml index 50ee7c9f8957..22ffd1bcf28c 100644 --- a/Packs/AbnormalSecurity/Integrations/AbnormalSecurity/AbnormalSecurity.yml +++ b/Packs/AbnormalSecurity/Integrations/AbnormalSecurity/AbnormalSecurity.yml @@ -576,7 +576,7 @@ script: required: false description: Get the latest threat intel feed. name: abnormal-security-get-latest-threat-intel-feed - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 isfetch: false script: '' subtype: python3 diff --git a/Packs/AbnormalSecurity/Integrations/AbnormalSecurityEventCollector/AbnormalSecurityEventCollector.yml b/Packs/AbnormalSecurity/Integrations/AbnormalSecurityEventCollector/AbnormalSecurityEventCollector.yml index 0b3588b142a9..14a791e2ecf0 100644 --- a/Packs/AbnormalSecurity/Integrations/AbnormalSecurityEventCollector/AbnormalSecurityEventCollector.yml +++ b/Packs/AbnormalSecurity/Integrations/AbnormalSecurityEventCollector/AbnormalSecurityEventCollector.yml @@ -41,7 +41,7 @@ script: - 'True' - 'False' required: true - dockerimage: demisto/python3:3.10.7.33922 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/AbnormalSecurity/ReleaseNotes/2_0_3.md b/Packs/AbnormalSecurity/ReleaseNotes/2_0_3.md new file mode 100644 index 000000000000..3dd931793022 --- /dev/null +++ b/Packs/AbnormalSecurity/ReleaseNotes/2_0_3.md @@ -0,0 +1,3 @@ +#### Integrations +##### Abnormal Security +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AbnormalSecurity/ReleaseNotes/2_0_4.md b/Packs/AbnormalSecurity/ReleaseNotes/2_0_4.md new file mode 100644 index 000000000000..8c44b1bcb5ff --- /dev/null +++ b/Packs/AbnormalSecurity/ReleaseNotes/2_0_4.md @@ -0,0 +1,3 @@ +#### Integrations +##### Abnormal Security Event Collector +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AbnormalSecurity/pack_metadata.json b/Packs/AbnormalSecurity/pack_metadata.json index 1f1f7fb3d740..2cd2ed7fb9f2 100644 --- a/Packs/AbnormalSecurity/pack_metadata.json +++ b/Packs/AbnormalSecurity/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Abnormal Security", "description": "Abnormal Security detects and protects against the whole spectrum of email attacks", "support": "partner", - "currentVersion": "2.0.2", + "currentVersion": "2.0.4", "author": "Abnormal Security", "url": "", "email": "support@abnormalsecurity.com", diff --git a/Packs/Absolute/Integrations/Absolute/Absolute.yml b/Packs/Absolute/Integrations/Absolute/Absolute.yml index 041375e6c654..cec1ddcc11a7 100644 --- a/Packs/Absolute/Integrations/Absolute/Absolute.yml +++ b/Packs/Absolute/Integrations/Absolute/Absolute.yml @@ -922,7 +922,7 @@ script: script: '-' type: python subtype: python3 - dockerimage: demisto/python3:3.10.8.39276 + dockerimage: demisto/python3:3.10.9.42476 fromversion: 6.0.0 tests: - Absolute_TestPlaybook diff --git a/Packs/Absolute/ReleaseNotes/1_0_12.md b/Packs/Absolute/ReleaseNotes/1_0_12.md new file mode 100644 index 000000000000..c7a4c7ae71ec --- /dev/null +++ b/Packs/Absolute/ReleaseNotes/1_0_12.md @@ -0,0 +1,3 @@ +#### Integrations +##### Absolute +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/Absolute/ReleaseNotes/1_0_13.md b/Packs/Absolute/ReleaseNotes/1_0_13.md new file mode 100644 index 000000000000..08c0aa1fc7aa --- /dev/null +++ b/Packs/Absolute/ReleaseNotes/1_0_13.md @@ -0,0 +1,3 @@ +#### Integrations +##### Absolute +- Updated the Docker image to: *demisto/python3:3.10.9.42476*. diff --git a/Packs/Absolute/pack_metadata.json b/Packs/Absolute/pack_metadata.json index fbe788057caa..009f3e2ce029 100644 --- a/Packs/Absolute/pack_metadata.json +++ b/Packs/Absolute/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Absolute", "description": "Absolute is an adaptive endpoint security solution that delivers device security, data security and asset management of endpoints", "support": "xsoar", - "currentVersion": "1.0.11", + "currentVersion": "1.0.13", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.py b/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.py index 148e6cd8f345..028bb197a3a5 100644 --- a/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.py +++ b/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.py @@ -4,11 +4,11 @@ ''' IMPORTS ''' import csv import os - +import urllib3 import requests # disable insecure warnings -requests.packages.urllib3.disable_warnings() +urllib3.disable_warnings() ''' GLOBALS ''' VERBOSE = True diff --git a/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.yml b/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.yml index 2401bb80f4d4..4b973c82d803 100644 --- a/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.yml +++ b/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.yml @@ -257,7 +257,7 @@ script: script: '' subtype: python3 type: python - dockerimage: demisto/python3:3.10.7.33922 + dockerimage: demisto/python3:3.10.9.40422 fromversion: 5.0.0 tests: - AbuseIPDB Test diff --git a/Packs/AbuseDB/ReleaseNotes/1_0_16.md b/Packs/AbuseDB/ReleaseNotes/1_0_16.md new file mode 100644 index 000000000000..3e3e99726ead --- /dev/null +++ b/Packs/AbuseDB/ReleaseNotes/1_0_16.md @@ -0,0 +1,3 @@ +#### Integrations +##### AbuseIPDB +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AbuseDB/pack_metadata.json b/Packs/AbuseDB/pack_metadata.json index 65bbf5c9691b..afcd5d5c25a8 100644 --- a/Packs/AbuseDB/pack_metadata.json +++ b/Packs/AbuseDB/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AbuseIPDB", "description": "Central repository to report and identify IP addresses that have been associated with malicious activity online. Check the Detailed Information section for more information on how to configure the integration.", "support": "xsoar", - "currentVersion": "1.0.15", + "currentVersion": "1.0.16", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AcalvioShadowplex/Integrations/acalvioapp/acalvioapp.py b/Packs/AcalvioShadowplex/Integrations/acalvioapp/acalvioapp.py index 0ad767f528fe..050e13272980 100644 --- a/Packs/AcalvioShadowplex/Integrations/acalvioapp/acalvioapp.py +++ b/Packs/AcalvioShadowplex/Integrations/acalvioapp/acalvioapp.py @@ -1,8 +1,9 @@ import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 +import urllib3 # Disable insecure warnings -requests.packages.urllib3.disable_warnings() +urllib3.disable_warnings() ''' CONSTANTS ''' OK_HTTP_CODES = (200, 201) diff --git a/Packs/AcalvioShadowplex/Integrations/acalvioapp/acalvioapp.yml b/Packs/AcalvioShadowplex/Integrations/acalvioapp/acalvioapp.yml index 94beba35a938..4a160260aa04 100644 --- a/Packs/AcalvioShadowplex/Integrations/acalvioapp/acalvioapp.yml +++ b/Packs/AcalvioShadowplex/Integrations/acalvioapp/acalvioapp.yml @@ -192,7 +192,7 @@ script: - contextPath: Acalvio.UnmuteDeceptionEndpoint.DateTime description: Date including Time type: String - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/AcalvioShadowplex/ReleaseNotes/1_0_8.md b/Packs/AcalvioShadowplex/ReleaseNotes/1_0_8.md new file mode 100644 index 000000000000..f9b9988983c8 --- /dev/null +++ b/Packs/AcalvioShadowplex/ReleaseNotes/1_0_8.md @@ -0,0 +1,3 @@ +#### Integrations +##### Acalvio ShadowPlex +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AcalvioShadowplex/pack_metadata.json b/Packs/AcalvioShadowplex/pack_metadata.json index 5513adc19684..48b36189e168 100644 --- a/Packs/AcalvioShadowplex/pack_metadata.json +++ b/Packs/AcalvioShadowplex/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Acalvio ShadowPlex", "description": "Acalvio ShadowPlex Autonomous Deception Solution", "support": "partner", - "currentVersion": "1.0.7", + "currentVersion": "1.0.8", "author": "Acalvio Technologies", "url": "https://www.acalvio.com", "email": "support@acalvio.com", diff --git a/Packs/AccentureCTI/Integrations/ACTIIndicatorQuery/ACTIIndicatorQuery.yml b/Packs/AccentureCTI/Integrations/ACTIIndicatorQuery/ACTIIndicatorQuery.yml index 11ec81040be5..3f95b6ed2340 100644 --- a/Packs/AccentureCTI/Integrations/ACTIIndicatorQuery/ACTIIndicatorQuery.yml +++ b/Packs/AccentureCTI/Integrations/ACTIIndicatorQuery/ACTIIndicatorQuery.yml @@ -404,7 +404,7 @@ script: description: The actual score. type: String - dockerimage: demisto/python3:3.10.8.39276 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/AccentureCTI/Integrations/ACTIVulnerabilityQuery/ACTIVulnerabilityQuery.py b/Packs/AccentureCTI/Integrations/ACTIVulnerabilityQuery/ACTIVulnerabilityQuery.py index 1f88389cd5f7..74f59c384f23 100644 --- a/Packs/AccentureCTI/Integrations/ACTIVulnerabilityQuery/ACTIVulnerabilityQuery.py +++ b/Packs/AccentureCTI/Integrations/ACTIVulnerabilityQuery/ACTIVulnerabilityQuery.py @@ -1,11 +1,11 @@ import demistomock as demisto from CommonServerPython import * # noqa # pylint: disable=unused-wildcard-import -import requests +import urllib3 import traceback from typing import List # Disable insecure warnings -requests.packages.urllib3.disable_warnings() # pylint: disable=no-member +urllib3.disable_warnings() # pylint: disable=no-member ''' CONSTANTS ''' diff --git a/Packs/AccentureCTI/Integrations/ACTIVulnerabilityQuery/ACTIVulnerabilityQuery.yml b/Packs/AccentureCTI/Integrations/ACTIVulnerabilityQuery/ACTIVulnerabilityQuery.yml index 7aacd055ec0e..e6357134101f 100644 --- a/Packs/AccentureCTI/Integrations/ACTIVulnerabilityQuery/ACTIVulnerabilityQuery.yml +++ b/Packs/AccentureCTI/Integrations/ACTIVulnerabilityQuery/ACTIVulnerabilityQuery.yml @@ -88,7 +88,7 @@ script: script: '-' type: python subtype: python3 - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 feed: false longRunning: false longRunningPort: false diff --git a/Packs/AccentureCTI/Playbooks/playbook-ACTI_Create_Report-Indicator_Associations_README.md b/Packs/AccentureCTI/Playbooks/playbook-ACTI_Create_Report-Indicator_Associations_README.md index dc692b97bcd7..d5a64492e32e 100644 --- a/Packs/AccentureCTI/Playbooks/playbook-ACTI_Create_Report-Indicator_Associations_README.md +++ b/Packs/AccentureCTI/Playbooks/playbook-ACTI_Create_Report-Indicator_Associations_README.md @@ -25,14 +25,14 @@ This playbook does not use any commands. | **Name** | **Description** | **Default Value** | **Required** | | --- | --- | --- | --- | | IP | The extracted IP address. | ${IP.Address} | Optional | -| IA | The Intelligence Alert associated with the indicator. | ${intelligence_alerts}.None | Optional | -| IR | The Intelligence Report associated with the indicator. | ${intelligence_reports}.None | Optional | +| IA | The Intelligence Alert associated with the indicator. | ${intelligence_alerts} | Optional | +| IR | The Intelligence Report associated with the indicator. | ${intelligence_reports} | Optional | | URL | The extracted URL. | ${URL.Data} | Optional | | Domain | The extracted Domain. | ${Domain.Name} | Optional | -| MFam | The Malware Family associated with the indicator. | acti_malware_family_uuid.None | Optional | -| TA | The Threat Actor associated with the indicator. | acti_threat_actors_uuid.None | Optional | -| TG | The Threat Group associated with the indicator. | acti_threat_groups_uuid.None | Optional | -| TC | The Threat Campaign associated with the indicator. | acti_threat_campaigns_uuid.None | Optional | +| MFam | The Malware Family associated with the indicator. | acti_malware_family_uuid | Optional | +| TA | The Threat Actor associated with the indicator. | acti_threat_actors_uuid | Optional | +| TG | The Threat Group associated with the indicator. | acti_threat_groups_uuid | Optional | +| TC | The Threat Campaign associated with the indicator. | acti_threat_campaigns_uuid | Optional | ## Playbook Outputs --- diff --git a/Packs/AccentureCTI/Playbooks/playbook-ACTI_Incident_Enrichment_README.md b/Packs/AccentureCTI/Playbooks/playbook-ACTI_Incident_Enrichment_README.md index 035145726d3f..1473a5b987bb 100644 --- a/Packs/AccentureCTI/Playbooks/playbook-ACTI_Incident_Enrichment_README.md +++ b/Packs/AccentureCTI/Playbooks/playbook-ACTI_Incident_Enrichment_README.md @@ -21,12 +21,12 @@ This playbook does not use any scripts. | **Name** | **Description** | **Default Value** | **Required** | | --- | --- | --- | --- | -| ia_uuid | Intelligence Alert unique ID. | ${intelligence_alerts}.None | Optional | -| ir_uuid | Intelligence Report unique ID. | ${intelligence_reports}.None | Optional | -| MalwareFamily_uuid | Malware Family unique ID. | ${acti_malware_family_uuid}.None | Optional | -| ThreatGroup_uuid | Threat Group unique ID. | ${acti_threat_groups_uuid}.None | Optional | -| ThreatCampaign_uuid | Threat Campaign unique ID. | ${acti_threat_campaigns_uuid}.None | Optional | -| ThreatActor_uuid | Threat Actor unique ID. | ${acti_threat_actors_uuid}.None | Optional | +| ia_uuid | Intelligence Alert unique ID. | ${intelligence_alerts} | Optional | +| ir_uuid | Intelligence Report unique ID. | ${intelligence_reports} | Optional | +| MalwareFamily_uuid | Malware Family unique ID. | ${acti_malware_family_uuid} | Optional | +| ThreatGroup_uuid | Threat Group unique ID. | ${acti_threat_groups_uuid} | Optional | +| ThreatCampaign_uuid | Threat Campaign unique ID. | ${acti_threat_campaigns_uuid} | Optional | +| ThreatActor_uuid | Threat Actor unique ID. | ${acti_threat_actors_uuid} | Optional | ## Playbook Image --- diff --git a/Packs/AccentureCTI/Playbooks/playbook-ACTI_Report_Enrichment_README.md b/Packs/AccentureCTI/Playbooks/playbook-ACTI_Report_Enrichment_README.md index 097e017cae30..d89e30934009 100644 --- a/Packs/AccentureCTI/Playbooks/playbook-ACTI_Report_Enrichment_README.md +++ b/Packs/AccentureCTI/Playbooks/playbook-ACTI_Report_Enrichment_README.md @@ -22,8 +22,8 @@ This playbook does not use any scripts. | **Name** | **Description** | **Default Value** | **Required** | | --- | --- | --- | --- | -| ia_uuid | The Intelligence Alert uuid. | ${intelligence_alerts}.None | Optional | -| ir_uuid | The Intelligence Report uuid. | ${intelligence_reports}.None | Optional | +| ia_uuid | The Intelligence Alert uuid. | ${intelligence_alerts} | Optional | +| ir_uuid | The Intelligence Report uuid. | ${intelligence_reports} | Optional | | Domain | The extarcted Domain. | ${Domain} | Optional | | IP | The extracted IP. | ${IP} | Optional | | URL | The extracted URL. | ${URL} | Optional | diff --git a/Packs/AccentureCTI/ReleaseNotes/2_2_3.md b/Packs/AccentureCTI/ReleaseNotes/2_2_3.md new file mode 100644 index 000000000000..2360a65cc2f6 --- /dev/null +++ b/Packs/AccentureCTI/ReleaseNotes/2_2_3.md @@ -0,0 +1,5 @@ +#### Integrations +##### ACTI Indicator Query +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. +##### ACTI Vulnerability Query +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AccentureCTI/pack_metadata.json b/Packs/AccentureCTI/pack_metadata.json index 0e00ff6a5e95..056e9c80c6c5 100644 --- a/Packs/AccentureCTI/pack_metadata.json +++ b/Packs/AccentureCTI/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Accenture CTI v2", "description": "Accenture CTI provides intelligence regarding security threats and vulnerabilities.", "support": "partner", - "currentVersion": "2.2.2", + "currentVersion": "2.2.3", "author": "Accenture", "url": "https://www.accenture.com/us-en/services/security/cyber-defense", "email": "CTI.AcctManagement@accenture.com", diff --git a/Packs/AccentureCTI_Feed/Integrations/ACTIIndicatorFeed/ACTIIndicatorFeed.yml b/Packs/AccentureCTI_Feed/Integrations/ACTIIndicatorFeed/ACTIIndicatorFeed.yml index e4c9dd147e06..2d14bbd8acc0 100644 --- a/Packs/AccentureCTI_Feed/Integrations/ACTIIndicatorFeed/ACTIIndicatorFeed.yml +++ b/Packs/AccentureCTI_Feed/Integrations/ACTIIndicatorFeed/ACTIIndicatorFeed.yml @@ -176,7 +176,7 @@ script: description: Gets the feed indicators. execution: false name: acti-get-indicators - dockerimage: demisto/jmespath:1.0.0.23980 + dockerimage: demisto/py3-tools:1.0.0.41100 feed: true isfetch: false longRunning: false diff --git a/Packs/AccentureCTI_Feed/ReleaseNotes/1_1_2.md b/Packs/AccentureCTI_Feed/ReleaseNotes/1_1_2.md new file mode 100644 index 000000000000..a6427a18c6f7 --- /dev/null +++ b/Packs/AccentureCTI_Feed/ReleaseNotes/1_1_2.md @@ -0,0 +1,3 @@ +#### Integrations +##### ACTI Indicator Feed +- Updated the Docker image to: *demisto/py3-tools:1.0.0.41100*. diff --git a/Packs/AccentureCTI_Feed/ReleaseNotes/1_1_3.md b/Packs/AccentureCTI_Feed/ReleaseNotes/1_1_3.md new file mode 100644 index 000000000000..e95c8078d065 --- /dev/null +++ b/Packs/AccentureCTI_Feed/ReleaseNotes/1_1_3.md @@ -0,0 +1,4 @@ + +#### Integrations +##### ACTI Indicator Feed +Fixed an issue where an indicator did not have a tag. diff --git a/Packs/AccentureCTI_Feed/pack_metadata.json b/Packs/AccentureCTI_Feed/pack_metadata.json index e0ce678dd5a2..6d99571625fc 100644 --- a/Packs/AccentureCTI_Feed/pack_metadata.json +++ b/Packs/AccentureCTI_Feed/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Accenture CTI Feed", "description": "Accenture Cyber Threat Intelligence Feed", "support": "partner", - "currentVersion": "1.1.1", + "currentVersion": "1.1.3", "author": "Accenture", "url": "https://www.accenture.com/us-en/services/security/cyber-defense", "email": "CTI.AcctManagement@accenture.com", diff --git a/Packs/ActiveMQ/Integrations/ActiveMQ/ActiveMQ.yml b/Packs/ActiveMQ/Integrations/ActiveMQ/ActiveMQ.yml index 84e87c5fbabd..3a21bcbf57c3 100644 --- a/Packs/ActiveMQ/Integrations/ActiveMQ/ActiveMQ.yml +++ b/Packs/ActiveMQ/Integrations/ActiveMQ/ActiveMQ.yml @@ -106,7 +106,7 @@ script: description: Subscribes to and reads messages from a topic or queue. Must provide either queue-name or topic-name. You can't provide both. execution: false name: activemq-subscribe - dockerimage: demisto/py3-tools:1.0.0.40800 + dockerimage: demisto/py3-tools:1.0.0.41748 feed: false isfetch: true longRunning: false diff --git a/Packs/ActiveMQ/ReleaseNotes/1_1_11.md b/Packs/ActiveMQ/ReleaseNotes/1_1_11.md new file mode 100644 index 000000000000..7b5753c5a20b --- /dev/null +++ b/Packs/ActiveMQ/ReleaseNotes/1_1_11.md @@ -0,0 +1,3 @@ +#### Integrations +##### ActiveMQ +- Updated the Docker image to: *demisto/py3-tools:1.0.0.41748*. diff --git a/Packs/ActiveMQ/pack_metadata.json b/Packs/ActiveMQ/pack_metadata.json index 067c91201d56..2427e038eb7c 100644 --- a/Packs/ActiveMQ/pack_metadata.json +++ b/Packs/ActiveMQ/pack_metadata.json @@ -2,7 +2,7 @@ "name": "ActiveMQ", "description": "Uses Durable Topic Subscribers to fetch messages and ingest them as incidents in Demisto.", "support": "xsoar", - "currentVersion": "1.1.10", + "currentVersion": "1.1.11", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Active_Directory_Query/.pack-ignore b/Packs/Active_Directory_Query/.pack-ignore index d00b84728824..bb91159cfd65 100644 --- a/Packs/Active_Directory_Query/.pack-ignore +++ b/Packs/Active_Directory_Query/.pack-ignore @@ -10,6 +10,10 @@ ignore=BA101 [file:classifier-User_Profile_-_Active_Directory_(Outgoing).json] ignore=BA101 +[file:IAMInitADUser.yml] +ignore=CJ105 + [known_words] LDAP -TLS \ No newline at end of file +TLS + diff --git a/Packs/Active_Directory_Query/Integrations/Active_Directory_Query/Pipfile.lock b/Packs/Active_Directory_Query/Integrations/Active_Directory_Query/Pipfile.lock index 9b9989a65503..15e7e5bc6d80 100644 --- a/Packs/Active_Directory_Query/Integrations/Active_Directory_Query/Pipfile.lock +++ b/Packs/Active_Directory_Query/Integrations/Active_Directory_Query/Pipfile.lock @@ -29,21 +29,11 @@ }, "pyasn1": { "hashes": [ - "sha256:014c0e9976956a08139dc0712ae195324a75e142284d5f87f1a87ee1b068a359", - "sha256:03840c999ba71680a131cfaee6fab142e1ed9bbd9c693e285cc6aca0d555e576", - "sha256:0458773cfe65b153891ac249bcf1b5f8f320b7c2ce462151f8fa74de8934becf", - "sha256:08c3c53b75eaa48d71cf8c710312316392ed40899cb34710d092e96745a358b7", - "sha256:39c7e2ec30515947ff4e87fb6f456dfc6e84857d34be479c9d4a4ba4bf46aa5d", - "sha256:5c9414dcfede6e441f7e8f81b43b34e834731003427e5b09e4e00e3172a10f00", - "sha256:6e7545f1a61025a4e58bb336952c5061697da694db1cae97b116e9c46abcf7c8", - "sha256:78fa6da68ed2727915c4767bb386ab32cdba863caa7dbe473eaae45f9959da86", - "sha256:7ab8a544af125fb704feadb008c99a88805126fb525280b2270bb25cc1d78a12", - "sha256:99fcc3c8d804d1bc6d9a099921e39d827026409a58f2a720dcdb89374ea0c776", - "sha256:aef77c9fb94a3ac588e87841208bdec464471d9871bd5050a287cc9a475cd0ba", - "sha256:e89bf84b5437b532b0803ba5c9a5e054d21fec423a89952a74f87fa2c9b7bce2", - "sha256:fec3e9d8e36808a28efb59b489e4528c10ad0f480e57dcc32b4de5c9d8c9fdf3" - ], - "version": "==0.4.8" + "sha256:760db2dafe04091b000af018c45dff6e3d7a204cd9341b760d72689217a611cc", + "sha256:8fcd953d1e34ef6db82a5296bb5ca3762ce4d17f2241c48ac0de2739b2e8fbf2" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", + "version": "==0.5.0rc2" } }, "develop": { @@ -57,11 +47,11 @@ }, "attrs": { "hashes": [ - "sha256:50f3c9b216dc9021042f71b392859a773b904ce1a029077f58f6598272432045", - "sha256:8f7335278dedd26b58c38e006338242cc0977f06d51579b2b8b87b9b33bff66c" + "sha256:29e95c7f6778868dbd49170f98f8818f78f3dc5e0e37c0b1f474e3561b240836", + "sha256:c9227bfc2f01993c03f68db37d1d15c9690188323c067c641f1a35ca58185f99" ], - "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'", - "version": "==21.3.0" + "markers": "python_version >= '3.6'", + "version": "==22.2.0" }, "flake8": { "hashes": [ @@ -80,54 +70,36 @@ }, "isort": { "hashes": [ - "sha256:6f62d78e2f89b4500b080fe3a81690850cd254227f27f75c3a0c491a1f351ba7", - "sha256:e8443a5e7a020e9d7f97f1d7d9cd17c88bcb3bc7e218bf9cf5095fe550be2951" + "sha256:6db30c5ded9815d813932c04c2f85a360bcdd35fed496f4d8f35495ef0a261b6", + "sha256:c033fd0edb91000a7f09527fe5c75321878f98322a77ddcc81adbd83724afb7b" ], - "markers": "python_version < '4.0' and python_full_version >= '3.6.1'", - "version": "==5.10.1" + "markers": "python_version >= '3.7'", + "version": "==5.11.4" }, "lazy-object-proxy": { "hashes": [ - "sha256:043651b6cb706eee4f91854da4a089816a6606c1428fd391573ef8cb642ae4f7", - "sha256:07fa44286cda977bd4803b656ffc1c9b7e3bc7dff7d34263446aec8f8c96f88a", - "sha256:12f3bb77efe1367b2515f8cb4790a11cffae889148ad33adad07b9b55e0ab22c", - "sha256:2052837718516a94940867e16b1bb10edb069ab475c3ad84fd1e1a6dd2c0fcfc", - "sha256:2130db8ed69a48a3440103d4a520b89d8a9405f1b06e2cc81640509e8bf6548f", - "sha256:39b0e26725c5023757fc1ab2a89ef9d7ab23b84f9251e28f9cc114d5b59c1b09", - "sha256:46ff647e76f106bb444b4533bb4153c7370cdf52efc62ccfc1a28bdb3cc95442", - "sha256:4dca6244e4121c74cc20542c2ca39e5c4a5027c81d112bfb893cf0790f96f57e", - "sha256:553b0f0d8dbf21890dd66edd771f9b1b5f51bd912fa5f26de4449bfc5af5e029", - "sha256:677ea950bef409b47e51e733283544ac3d660b709cfce7b187f5ace137960d61", - "sha256:6a24357267aa976abab660b1d47a34aaf07259a0c3859a34e536f1ee6e76b5bb", - "sha256:6a6e94c7b02641d1311228a102607ecd576f70734dc3d5e22610111aeacba8a0", - "sha256:6aff3fe5de0831867092e017cf67e2750c6a1c7d88d84d2481bd84a2e019ec35", - "sha256:6ecbb350991d6434e1388bee761ece3260e5228952b1f0c46ffc800eb313ff42", - "sha256:7096a5e0c1115ec82641afbdd70451a144558ea5cf564a896294e346eb611be1", - "sha256:70ed0c2b380eb6248abdef3cd425fc52f0abd92d2b07ce26359fcbc399f636ad", - "sha256:8561da8b3dd22d696244d6d0d5330618c993a215070f473b699e00cf1f3f6443", - "sha256:85b232e791f2229a4f55840ed54706110c80c0a210d076eee093f2b2e33e1bfd", - "sha256:898322f8d078f2654d275124a8dd19b079080ae977033b713f677afcfc88e2b9", - "sha256:8f3953eb575b45480db6568306893f0bd9d8dfeeebd46812aa09ca9579595148", - "sha256:91ba172fc5b03978764d1df5144b4ba4ab13290d7bab7a50f12d8117f8630c38", - "sha256:9d166602b525bf54ac994cf833c385bfcc341b364e3ee71e3bf5a1336e677b55", - "sha256:a57d51ed2997e97f3b8e3500c984db50a554bb5db56c50b5dab1b41339b37e36", - "sha256:b9e89b87c707dd769c4ea91f7a31538888aad05c116a59820f28d59b3ebfe25a", - "sha256:bb8c5fd1684d60a9902c60ebe276da1f2281a318ca16c1d0a96db28f62e9166b", - "sha256:c19814163728941bb871240d45c4c30d33b8a2e85972c44d4e63dd7107faba44", - "sha256:c4ce15276a1a14549d7e81c243b887293904ad2d94ad767f42df91e75fd7b5b6", - "sha256:c7a683c37a8a24f6428c28c561c80d5f4fd316ddcf0c7cab999b15ab3f5c5c69", - "sha256:d609c75b986def706743cdebe5e47553f4a5a1da9c5ff66d76013ef396b5a8a4", - "sha256:d66906d5785da8e0be7360912e99c9188b70f52c422f9fc18223347235691a84", - "sha256:dd7ed7429dbb6c494aa9bc4e09d94b778a3579be699f9d67da7e6804c422d3de", - "sha256:df2631f9d67259dc9620d831384ed7732a198eb434eadf69aea95ad18c587a28", - "sha256:e368b7f7eac182a59ff1f81d5f3802161932a41dc1b1cc45c1f757dc876b5d2c", - "sha256:e40f2013d96d30217a51eeb1db28c9ac41e9d0ee915ef9d00da639c5b63f01a1", - "sha256:f769457a639403073968d118bc70110e7dce294688009f5c24ab78800ae56dc8", - "sha256:fccdf7c2c5821a8cbd0a9440a456f5050492f2270bd54e94360cac663398739b", - "sha256:fd45683c3caddf83abbb1249b653a266e7069a09f486daa8863fb0e7496a9fdb" + "sha256:0c1c7c0433154bb7c54185714c6929acc0ba04ee1b167314a779b9025517eada", + "sha256:14010b49a2f56ec4943b6cf925f597b534ee2fe1f0738c84b3bce0c1a11ff10d", + "sha256:4e2d9f764f1befd8bdc97673261b8bb888764dfdbd7a4d8f55e4fbcabb8c3fb7", + "sha256:4fd031589121ad46e293629b39604031d354043bb5cdf83da4e93c2d7f3389fe", + "sha256:5b51d6f3bfeb289dfd4e95de2ecd464cd51982fe6f00e2be1d0bf94864d58acd", + "sha256:6850e4aeca6d0df35bb06e05c8b934ff7c533734eb51d0ceb2d63696f1e6030c", + "sha256:6f593f26c470a379cf7f5bc6db6b5f1722353e7bf937b8d0d0b3fba911998858", + "sha256:71d9ae8a82203511a6f60ca5a1b9f8ad201cac0fc75038b2dc5fa519589c9288", + "sha256:7e1561626c49cb394268edd00501b289053a652ed762c58e1081224c8d881cec", + "sha256:8f6ce2118a90efa7f62dd38c7dbfffd42f468b180287b748626293bf12ed468f", + "sha256:ae032743794fba4d171b5b67310d69176287b5bf82a21f588282406a79498891", + "sha256:afcaa24e48bb23b3be31e329deb3f1858f1f1df86aea3d70cb5c8578bfe5261c", + "sha256:b70d6e7a332eb0217e7872a73926ad4fdc14f846e85ad6749ad111084e76df25", + "sha256:c219a00245af0f6fa4e95901ed28044544f50152840c5b6a3e7b2568db34d156", + "sha256:ce58b2b3734c73e68f0e30e4e725264d4d6be95818ec0a0be4bb6bf9a7e79aa8", + "sha256:d176f392dbbdaacccf15919c77f526edf11a34aece58b55ab58539807b85436f", + "sha256:e20bfa6db17a39c706d24f82df8352488d2943a3b7ce7d4c22579cb89ca8896e", + "sha256:eac3a9a5ef13b332c059772fd40b4b1c3d45a3a2b05e33a361dee48e54a4dad0", + "sha256:eb329f8d8145379bf5dbe722182410fe8863d186e51bf034d2075eb8d85ee25b" ], - "markers": "python_version >= '3.6'", - "version": "==1.7.1" + "markers": "python_version >= '3.7'", + "version": "==1.8.0" }, "mccabe": { "hashes": [ @@ -138,11 +110,11 @@ }, "packaging": { "hashes": [ - "sha256:dd47c42927d89ab911e606518907cc2d3a1f38bbd026385970643f9c5b8ecfeb", - "sha256:ef103e05f519cdc783ae24ea4e2e0f508a9c99b2d4969652eed6a2e1ea5bd522" + "sha256:2198ec20bd4c017b8f9717e00f0c8714076fc2fd93816750ab48e2c41de2cfd3", + "sha256:957e2148ba0e1a3b282772e791ef1d8083648bc131c8ab0c1feba110ce1146c3" ], - "markers": "python_version >= '3.6'", - "version": "==21.3" + "markers": "python_version >= '3.7'", + "version": "==22.0" }, "pluggy": { "hashes": [ @@ -184,14 +156,6 @@ "index": "pypi", "version": "==3.0.0a4" }, - "pyparsing": { - "hashes": [ - "sha256:04ff808a5b90911829c55c4e26f75fa5ca8a2f5f36aa3a51f68e27033341d3e4", - "sha256:d9bdec0013ef1eb5a84ab39a3b3868911598afa494f5faa038647101504e2b81" - ], - "markers": "python_version >= '3.6'", - "version": "==3.0.6" - }, "pytest": { "hashes": [ "sha256:8fc363e0b7407a9397e660ef81e1634e4504faaeb6ad1d2416da4c38d29a0f45", @@ -210,11 +174,11 @@ }, "setuptools": { "hashes": [ - "sha256:a4377723c53721515f72a3dfc1bfacdcd61edfa19a4cccf82e72e4f50d9cecbd", - "sha256:ad0ea3d172404abb14d8f7bd7f54f2ccd4ed9dd00c9da0b1398862e69eb22c03" + "sha256:d0b9a8433464d5800cbe05094acf5c6d52a91bfac9b52bcfc4d41382be5d5d31", + "sha256:e197a19aa8ec9722928f2206f8de752def0e4c9fc6953527360d1c36d94ddb2f" ], - "markers": "python_version >= '3.7'", - "version": "==60.1.0" + "index": "pypi", + "version": "==65.5.1" }, "toml": { "hashes": [ @@ -226,11 +190,11 @@ }, "tomli": { "hashes": [ - "sha256:b5bde28da1fed24b9bd1d4d2b8cba62300bfb4ec9a6187a957e8ddb9434c5224", - "sha256:c292c34f58502a1eb2bbb9f5bbc9a5ebc37bee10ffb8c2d6bbdfa8eb13cc14e1" + "sha256:939de3e7a6161af0c887ef91b7d41a53e7c5a1ca976325f429cb46ea9bc30ecc", + "sha256:de526c12914f0c550d15924c62d72abc48d6fe7364aa87328337a31007fe8a4f" ], "markers": "python_version >= '3.7'", - "version": "==2.0.0" + "version": "==2.0.1" }, "wrapt": { "hashes": [ diff --git a/Packs/Active_Directory_Query/ReleaseNotes/1_6_0.md b/Packs/Active_Directory_Query/ReleaseNotes/1_6_0.md new file mode 100644 index 000000000000..11089e2d198d --- /dev/null +++ b/Packs/Active_Directory_Query/ReleaseNotes/1_6_0.md @@ -0,0 +1,4 @@ + +#### Scripts +##### IAMInitADUser +- Added arguments for configuring the complexity of the generated password. These arguments are applicable when using "GeneratePassword" as the password generation script. diff --git a/Packs/Active_Directory_Query/Scripts/IAMInitADUser/IAMInitADUser.py b/Packs/Active_Directory_Query/Scripts/IAMInitADUser/IAMInitADUser.py index dc3f13e04b1b..1e8ee678f30b 100644 --- a/Packs/Active_Directory_Query/Scripts/IAMInitADUser/IAMInitADUser.py +++ b/Packs/Active_Directory_Query/Scripts/IAMInitADUser/IAMInitADUser.py @@ -1,6 +1,8 @@ import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 +DEFAULT_PWD_GENERATION_SCRIPT = "GeneratePassword" + def main(): outputs: Dict[str, Any] = {} @@ -15,11 +17,30 @@ def main(): to_email = args.get("to_email") inc_id = args.get("inc_id") email_subject = args.get("email_subject") + min_lcase = args.get("min_lcase", 0) + max_lcase = args.get("max_lcase", 10) + min_ucase = args.get("min_ucase", 0) + max_ucase = args.get("max_ucase", 10) + min_digits = args.get("min_digits", 0) + max_digits = args.get("max_digits", 10) + min_symbols = args.get("min_symbols", 0) + max_symbols = args.get("max_symbols", 10) password = None try: # Generate a random password - pwd_generation_script_output = demisto.executeCommand(pwd_generation_script, {}) + if pwd_generation_script == DEFAULT_PWD_GENERATION_SCRIPT: + pwd_generation_script_output = demisto.executeCommand(pwd_generation_script, + {"min_lcase": min_lcase, + "max_lcase": max_lcase, + "min_ucase": min_ucase, + "max_ucase": max_ucase, + "min_digits": min_digits, + "max_digits": max_digits, + "min_symbols": min_symbols, + "max_symbols": max_symbols}) + else: + pwd_generation_script_output = demisto.executeCommand(pwd_generation_script, {}) if is_error(pwd_generation_script_output): raise Exception(f'An error occurred while trying to generate a new password for the user. ' f'Error is:\n{get_error(pwd_generation_script_output)}') diff --git a/Packs/Active_Directory_Query/Scripts/IAMInitADUser/IAMInitADUser.yml b/Packs/Active_Directory_Query/Scripts/IAMInitADUser/IAMInitADUser.yml index b4ab55a2db2c..d9216ae31622 100644 --- a/Packs/Active_Directory_Query/Scripts/IAMInitADUser/IAMInitADUser.yml +++ b/Packs/Active_Directory_Query/Scripts/IAMInitADUser/IAMInitADUser.yml @@ -1,52 +1,51 @@ args: -- default: false - defaultValue: GeneratePassword +- defaultValue: GeneratePassword description: The password generator script. - isArray: false name: pwdGenerationScript - required: false - secret: false -- default: false - description: The sAMAccountName of the employee. - isArray: false +- description: The sAMAccountName of the employee. name: sAMAccountName required: true - secret: false -- default: false - description: The email of the employee. - isArray: false +- description: The email of the employee. name: email required: true - secret: false -- default: false - description: The display name of the employee. - isArray: false +- description: The display name of the employee. name: displayname - required: false - secret: false -- default: false - description: The email address that the password will send to. - isArray: false +- description: The email address that the password will send to. name: to_email required: true - secret: false -- default: false - description: The incident ID. - isArray: false +- description: The incident ID. name: inc_id - required: false - secret: false -- default: false - description: The subject of the email sent to IT. - isArray: false +- description: The subject of the email sent to IT. name: email_subject - required: false - secret: false +- name: min_lcase + description: Minimum number of lower case characters to include in password. Used with the GeneratePassword script. + defaultValue: "0" +- name: max_lcase + description: Maximum number of lower case characters to include in password. Used with the GeneratePassword script. + defaultValue: "10" +- name: min_ucase + description: Minimum number of upper case characters to include in password. Used with the GeneratePassword script. + defaultValue: "0" +- name: max_ucase + description: Maximum number of upper case characters to include in password. Used with the GeneratePassword script. + defaultValue: "10" +- name: min_digits + description: Minimum number of digits to include in password. Used with the GeneratePassword script. + defaultValue: "0" +- name: max_digits + description: Maximum number of digits to include in password. Used with the GeneratePassword script. + defaultValue: "10" +- name: min_symbols + description: Minimum number of symbols to include in password. Used with the GeneratePassword script. + defaultValue: "0" +- name: max_symbols + description: Maximum number of symbols to include in password. Used with the GeneratePassword script. + defaultValue: "10" comment: |- Generates password, Set an AD user account with this password. Enable the account. - Send mail to the user with tha account information. + Send mail to the user with the account information. This script is running `send-mail` command, make sure there is a matching Integration configurated. commonfields: id: IAMInitADUser @@ -55,12 +54,10 @@ enabled: true name: IAMInitADUser outputs: - contextPath: IAM.InitADUser.success - description: True if the Active Directory user was successfully activated, false - otherwise. + description: True if the Active Directory user was successfully activated, false otherwise. type: Boolean - contextPath: IAM.InitADUser.sentMail - description: True if the mail containing the information about the user activation - and its auto-generated password was successfully sent to IT, false otherwise. + description: True if the mail containing the information about the user activation and its auto-generated password was successfully sent to IT, false otherwise. type: Boolean - contextPath: IAM.InitADUser.errorDetails description: The error details, if exists. @@ -68,18 +65,21 @@ outputs: - contextPath: IAM.InitADUser.sendMailError description: The error received from send-mail command, if exists. type: String -script: '-' +script: '' subtype: python3 -system: false +system: true tags: - IAM - active directory - Utility -timeout: '0' type: python -dockerimage: demisto/python3:3.9.8.24399 +dockerimage: demisto/python3:3.10.9.40422 runas: DBotWeakRole runonce: false tests: -- No tests (auto formatted) +- Active Directory Test fromversion: 5.0.0 +contentitemexportablefields: + contentitemfields: + fromServerVersion: "" +scripttarget: 0 diff --git a/Packs/Active_Directory_Query/Scripts/IAMInitADUser/README.md b/Packs/Active_Directory_Query/Scripts/IAMInitADUser/README.md new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/Packs/Active_Directory_Query/pack_metadata.json b/Packs/Active_Directory_Query/pack_metadata.json index 5e9a1d5bd83a..ae2390b06b6d 100644 --- a/Packs/Active_Directory_Query/pack_metadata.json +++ b/Packs/Active_Directory_Query/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Active Directory Query", "description": "Active Directory Query integration enables you to access and manage Active Directory objects (users, contacts, and computers).", "support": "xsoar", - "currentVersion": "1.5.9", + "currentVersion": "1.6.0", "author": "Cortex XSOAR", "url": "", "email": "", diff --git a/Packs/AgariPhishingDefense/Integrations/AgariPhishingDefense/AgariPhishingDefense.yml b/Packs/AgariPhishingDefense/Integrations/AgariPhishingDefense/AgariPhishingDefense.yml index bb49fd376a6d..d6ec9b6ef816 100644 --- a/Packs/AgariPhishingDefense/Integrations/AgariPhishingDefense/AgariPhishingDefense.yml +++ b/Packs/AgariPhishingDefense/Integrations/AgariPhishingDefense/AgariPhishingDefense.yml @@ -443,7 +443,7 @@ script: description: Remediate suspected message. execution: false name: apd-remediate-message - dockerimage: demisto/python3:3.10.8.37233 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: true longRunning: false diff --git a/Packs/AgariPhishingDefense/ReleaseNotes/1_1_3.md b/Packs/AgariPhishingDefense/ReleaseNotes/1_1_3.md new file mode 100644 index 000000000000..2ca3932a40dd --- /dev/null +++ b/Packs/AgariPhishingDefense/ReleaseNotes/1_1_3.md @@ -0,0 +1,3 @@ +#### Integrations +##### Agari Phishing Defense +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AgariPhishingDefense/pack_metadata.json b/Packs/AgariPhishingDefense/pack_metadata.json index bd249581c039..dd3b23a5fc8d 100644 --- a/Packs/AgariPhishingDefense/pack_metadata.json +++ b/Packs/AgariPhishingDefense/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Agari Phishing Defense", "description": "Use the Agari Phishing Defense integration to retrieve Policy Events as Incidents, retrieve messages and remediate suspected messages.", "support": "partner", - "currentVersion": "1.1.2", + "currentVersion": "1.1.3", "author": "Agari", "url": "https://www.agari.com/support/", "email": "support@agari.com", diff --git a/Packs/Akamai_SIEM/.pack-ignore b/Packs/Akamai_SIEM/.pack-ignore index bbcc8ca5e05d..7fbf2c4801fa 100644 --- a/Packs/Akamai_SIEM/.pack-ignore +++ b/Packs/Akamai_SIEM/.pack-ignore @@ -1,2 +1,6 @@ [file:Akamai_SIEM.yml] ignore=IN126,BA108,BA109,IN145 + +[known_words] +Akamai +WAF diff --git a/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.py b/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.py index 009b4efbec38..54f7f05b20c7 100644 --- a/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.py +++ b/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM.py @@ -36,8 +36,8 @@ class Client(BaseClient): - def get_events(self, config_ids: str, offset: Optional[str] = None, limit: Optional[Union[str, int]] = None, - from_epoch: Optional[str] = None, to_epoch: Optional[str] = None) \ + def get_events(self, config_ids: str, offset: Optional[str] = '', limit: Optional[Union[str, int]] = None, + from_epoch: Optional[str] = '', to_epoch: Optional[str] = '') \ -> Tuple[List[Any], Any]: """ Get security events from Akamai WAF service by - https://developer.akamai.com/api/cloud_security/siem/v1.html, @@ -81,8 +81,10 @@ def get_events(self, config_ids: str, offset: Optional[str] = None, limit: Optio events: List = [] if '{ "total": 0' not in raw_response: events = [json.loads(event) for event in raw_response.split('\n')[:-2]] - offset_new = json.loads(raw_response.split('\n')[-2]).get('offset') - return events, offset_new + new_offset = str(max([int(event.get('httpMessage', {}).get('start')) for event in events])) + else: + new_offset = str(from_epoch) + return events, new_offset '''HELPER FUNCIONS''' @@ -269,15 +271,8 @@ def fetch_incidents_command( """ raw_response: Optional[List] = [] if not last_run: - datetime_new_last_run, _ = parse_date_range(date_range=fetch_time, - date_format='%s') - raw_response, offset = client.get_events(config_ids=config_ids, - from_epoch=datetime_new_last_run, - limit=fetch_limit) - else: - raw_response, offset = client.get_events(config_ids=config_ids, - offset=last_run, - limit=fetch_limit) + last_run, _ = parse_date_range(date_range=fetch_time, date_format='%s') + raw_response, offset = client.get_events(config_ids=config_ids, from_epoch=last_run, limit=fetch_limit) incidents = [] if raw_response: diff --git a/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM_test.py b/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM_test.py index da395300d5aa..6682104e38de 100644 --- a/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM_test.py +++ b/Packs/Akamai_SIEM/Integrations/Akamai_SIEM/Akamai_SIEM_test.py @@ -51,7 +51,7 @@ def test_fetch_incidents_command_1(self, client, datadir, requests_mock): config_ids='50170', last_run={}) expected_incidents = load_params_from_json(datadir['expected_fetch.json'], type='incidents') - expected_last_run = {'lastRun': "318d8"} + expected_last_run = {'lastRun': "1576002507"} assert expected_incidents == tested_incidents, "Incidents - No last time exsits and event available" assert tested_last_run == expected_last_run, "Last run - No last time exsits and event available" @@ -59,14 +59,14 @@ def test_fetch_incidents_command_1(self, client, datadir, requests_mock): def test_fetch_incidents_command_2(self, client, datadir, requests_mock): """Test - Last time exsits and events available""" from Akamai_SIEM import fetch_incidents_command - requests_mock.get(f'{BASE_URL}/50170?offset=318d8&limit=5', text=SEC_EVENTS_TXT) + requests_mock.get(f'{BASE_URL}/50170?from=1575966002&limit=5', text=SEC_EVENTS_TXT) tested_incidents, tested_last_run = fetch_incidents_command(client=client, fetch_time='12 hours', fetch_limit='5', config_ids='50170', - last_run='318d8') + last_run='1575966002') expected_incidents = load_params_from_json(datadir['expected_fetch.json'], type='incidents') - expected_last_run = {'lastRun': "318d8"} + expected_last_run = {'lastRun': "1576002507"} assert expected_incidents == tested_incidents, "Incidents - Last time exsits and events available" assert tested_last_run == expected_last_run, "Last run - No last time exsits and event available" @@ -74,13 +74,13 @@ def test_fetch_incidents_command_2(self, client, datadir, requests_mock): def test_fetch_incidents_command_3(self, client, datadir, requests_mock): """Test - Last time exsits and no available data""" from Akamai_SIEM import fetch_incidents_command - requests_mock.get(f'{BASE_URL}/50170?offset=318d8&limit=5', text=SEC_EVENTS_EMPTY_TXT) + requests_mock.get(f'{BASE_URL}/50170?from=1575966002&limit=5', text=SEC_EVENTS_EMPTY_TXT) tested_incidents, tested_last_run = fetch_incidents_command(client=client, fetch_time='12 hours', fetch_limit=5, config_ids='50170', - last_run='318d8') - expected_last_run = {'lastRun': "318d8"} + last_run='1575966002') + expected_last_run = {'lastRun': "1575966002"} expected_incidents = [] assert expected_incidents == tested_incidents, "Incidents - Last time exsits and no available data" assert tested_last_run == expected_last_run, "Last run - No last time exsits and event available" @@ -95,7 +95,7 @@ def test_fetch_incidents_command_4(self, client, datadir, requests_mock): fetch_limit=5, config_ids='50170', last_run={}) - expected_last_run = {'lastRun': "318d8"} + expected_last_run = {'lastRun': "1575966002"} expected_incidents = [] assert expected_incidents == tested_incidents, "Incidents - No last time exsits and no available data" assert tested_last_run == expected_last_run, "Last run - No last time exsits and no available data" diff --git a/Packs/Akamai_SIEM/ReleaseNotes/1_0_8.md b/Packs/Akamai_SIEM/ReleaseNotes/1_0_8.md new file mode 100644 index 000000000000..4f30efa43595 --- /dev/null +++ b/Packs/Akamai_SIEM/ReleaseNotes/1_0_8.md @@ -0,0 +1,5 @@ + +#### Integrations +##### Akamai WAF SIEM +- Fixed an issue with the ***fetch incidents*** command when the *offset* parameter was expired. + diff --git a/Packs/Akamai_SIEM/pack_metadata.json b/Packs/Akamai_SIEM/pack_metadata.json index dbe9217247ec..238007985d2e 100644 --- a/Packs/Akamai_SIEM/pack_metadata.json +++ b/Packs/Akamai_SIEM/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Akamai WAF SIEM", "description": "Use the Akamai WAF SIEM integration to retrieve security events from Akamai Web Application Firewall (WAF) service.", "support": "xsoar", - "currentVersion": "1.0.7", + "currentVersion": "1.0.8", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Alexa/Integrations/AlexaV2/AlexaV2.yml b/Packs/Alexa/Integrations/AlexaV2/AlexaV2.yml index 44613ea7ed28..3826b1959867 100644 --- a/Packs/Alexa/Integrations/AlexaV2/AlexaV2.yml +++ b/Packs/Alexa/Integrations/AlexaV2/AlexaV2.yml @@ -88,7 +88,7 @@ script: - contextPath: Alexa.Domain.Rank description: Alexa rank as determined by Amazon. type: String - dockerimage: demisto/python3:3.10.8.39276 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/Alexa/ReleaseNotes/2_0_21.md b/Packs/Alexa/ReleaseNotes/2_0_21.md new file mode 100644 index 000000000000..d0ebfaf9b5c2 --- /dev/null +++ b/Packs/Alexa/ReleaseNotes/2_0_21.md @@ -0,0 +1,3 @@ +#### Integrations +##### Alexa Rank Indicator v2 +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/Alexa/pack_metadata.json b/Packs/Alexa/pack_metadata.json index 80c27137795f..1240abfb811c 100644 --- a/Packs/Alexa/pack_metadata.json +++ b/Packs/Alexa/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Alexa Rank Indicator", "description": "Alexa provides website ranking information that can be useful in determining if the domain in question has a strong web presence.", "support": "xsoar", - "currentVersion": "2.0.20", + "currentVersion": "2.0.21", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AlibabaActionTrail/ModelingRules/AlibabaModelingRules_1_3/AlibabaModelingRules_1_3_schema.json b/Packs/AlibabaActionTrail/ModelingRules/AlibabaModelingRules_1_3/AlibabaModelingRules_1_3_schema.json index 52fd0e833c83..500d11389aac 100644 --- a/Packs/AlibabaActionTrail/ModelingRules/AlibabaModelingRules_1_3/AlibabaModelingRules_1_3_schema.json +++ b/Packs/AlibabaActionTrail/ModelingRules/AlibabaModelingRules_1_3/AlibabaModelingRules_1_3_schema.json @@ -39,10 +39,15 @@ "event_useridentity_principalid": { "type": "string", "is_array": false + }, + "event_errormessage": { + "type": "string", + "is_array": false }, "event_useridentity_username": { "type": "string", "is_array": false } + } } diff --git a/Packs/AlibabaActionTrail/ModelingRules/AlibabaModelingRules_1_3/AlibabaModelingRules_1_3_testdata.json b/Packs/AlibabaActionTrail/ModelingRules/AlibabaModelingRules_1_3/AlibabaModelingRules_1_3_testdata.json new file mode 100644 index 000000000000..393f36475489 --- /dev/null +++ b/Packs/AlibabaActionTrail/ModelingRules/AlibabaModelingRules_1_3/AlibabaModelingRules_1_3_testdata.json @@ -0,0 +1,26 @@ +{ + "data": [ + { + "test_data_event_id": "60ace5ee-448f-46dc-95e5-982a502bbe43", + "vendor": "alibaba", + "product": "action_trail", + "dataset": "alibaba_action_trail_raw", + "event_data": { "_time": "Nov 23rd 2022 23:26:15", "_insert_time": "Nov 23rd 2022 23:27:02", "_id": "x1-y1-a1-b1-abc123", "_tag": "[]", "event": "null", "_vendor": "alibaba", "__date__": "null", "__line__": "null", "__time__": "1669238775", "_product": "action-trail", "_raw_log": "", "__topic__": "actiontrail_audit_event", "_raw_json": "", "__source__": "actiontrail_internal", "__time___0": "1669238775", "__log_count__": "null", "event_eventid": "abc123", "event_eventrw": "Read", "__log_pattern__": "null", "_collector_name": "alibaba_action-trail", "_collector_type": "XSIAM", "event_acsregion": "TLV", "event_errorcode": "null", "event_eventname": "DescribeDBClusters", "event_eventtype": "ApiCall", "event_requestid": "abc123", "event_useragent": "audit.log.aliyuncs.com", "event_apiversion": "2017-08-01", "__log_signature__": "null", "event_eventsource": "polardb.aliyuncs.com", "event_servicename": "polardb", "event_errormessage": "null", "event_eventversion": "1", "event_resourcename": "null", "event_resourcetype": "null", "_reporting_device_ip": "8.8.8.8", "event_sourceipaddress": "audit.log.aliyuncs.com", "__sls_query_parameter__": "null", "event_useridentity_type": "testuser:Common_Data_Access", "_final_reporting_device_ip": "1.1.1.1", "event_requestparameterjson": "{\"stsTokenPrincipalName\":\"aliyunserviceroleforslsaudit/Common_Data_Access\",\"AcsProduct\":\"polardb\",\"PageSize\":30,\"PageNumber\":1,\"UserAgent\":\"AlibabaCloud (linux\",\"ClientPort\":2962,\"SignatureType\":\"\",\"RegionId\":\"TLV\",\"stsTokenPlayerUid\":abc123}", "event_useridentity_username": "aliyunserviceroleforslsaudit:Common_Data_Access", "event_requestparameters_name": "null", "event_useridentity_accountid": "abc123", "event_requestparameters_hostid": "null", "event_requestparameters_region": "null", "event_useridentity_accesskeyid": "abc123.abc123", "event_useridentity_principalid": "7067606:Common_Data_Access", "event_insightdetails_insighttype": "null", "event_additionaleventdata_mfachecked": "null", "event_insightdetails_sourceipaddress": "null", "event_insightdetails_insightcontext_statistics_insightcount": "null" }, + "expected_values": { + "xdm.event.type": "ApiCall", + "xdm.observer.product": "alibaba", + "xdm.observer.vendor": "action-trail", + "xdm.event.operation": "DescribeDBClusters", + "xdm.target.resource.name": null, + "xdm.target.resource.type": null, + "xdm.event.outcome": null, + "xdm.target.cloud.region": "TLV", + "xdm.source.user.username": "testuser:Common_Data_Access", + "xdm.source.user.user_type": "assumed-role", + "xdm.source.user.identifier": "7067606:Common_Data_Access", + "xdm.source.ipv4": "audit.log.aliyuncs.com", + "xdm.event.id": "abc123" + } + } + ] +} \ No newline at end of file diff --git a/Packs/AlibabaActionTrail/ReleaseNotes/1_0_11.md b/Packs/AlibabaActionTrail/ReleaseNotes/1_0_11.md new file mode 100644 index 000000000000..97ee14b2020d --- /dev/null +++ b/Packs/AlibabaActionTrail/ReleaseNotes/1_0_11.md @@ -0,0 +1,4 @@ + +#### Modeling Rules +##### Alibaba Modeling Rule +- Fixed XDM mapping diff --git a/Packs/AlibabaActionTrail/Triggers/Trigger_-Alibaba_ActionTrail_-_Multiple_Unauthorized_Action_Attempts_Detected_By_a_User.json b/Packs/AlibabaActionTrail/Triggers/Trigger_-Alibaba_ActionTrail_-_Multiple_Unauthorized_Action_Attempts_Detected_By_a_User.json index 7fc8988254a3..49e825f1cb82 100644 --- a/Packs/AlibabaActionTrail/Triggers/Trigger_-Alibaba_ActionTrail_-_Multiple_Unauthorized_Action_Attempts_Detected_By_a_User.json +++ b/Packs/AlibabaActionTrail/Triggers/Trigger_-Alibaba_ActionTrail_-_Multiple_Unauthorized_Action_Attempts_Detected_By_a_User.json @@ -1,6 +1,6 @@ { - "trigger_id": "73545719a1bdeba6ba91f6a16044c021", - "playbook_id": "Alibaba ActionTrail - multiple unauthorized action_attempts detected by a user.yml", + "trigger_id": "abfa084a92abfb031de08b57b3f78ec8", + "playbook_id": "Alibaba ActionTrail - multiple unauthorized action_attempts detected by a user", "suggestion_reason": "Recommended for multiple unauthorized action_attempts detected by a user related alerts", "description": "This trigger is responsible for handling 'Alibaba ActionTrail - multiple unauthorized action_attempts detected by a user' alerts", "trigger_name": "Alibaba ActionTrail - Multiple Unauthorized Action Attempts Detected By a User Alerts", @@ -10,7 +10,7 @@ { "SEARCH_FIELD": "alert_name", "SEARCH_TYPE": "EQ", - "SEARCH_VALUE": "Alibaba ActionTrail - multiple unauthorized action attempts detected by a user.yml" + "SEARCH_VALUE": "Alibaba ActionTrail - multiple unauthorized action attempts detected by a user" } ] } diff --git a/Packs/AlibabaActionTrail/pack_metadata.json b/Packs/AlibabaActionTrail/pack_metadata.json index b0dfb9c72903..977f1d20c7f6 100644 --- a/Packs/AlibabaActionTrail/pack_metadata.json +++ b/Packs/AlibabaActionTrail/pack_metadata.json @@ -2,16 +2,14 @@ "name": "Alibaba Action Trail", "description": "An Integration Pack to fetch Alibaba action trail events.", "support": "xsoar", - "currentVersion": "1.0.10", + "currentVersion": "1.0.11", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", "categories": [ "Analytics & SIEM" ], - "tags": [ - "marketplacev2:Data Source" - ], + "tags": [], "useCases": [], "keywords": [], "marketplaces": [ diff --git a/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.yml b/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.yml index 85cdd4f80882..f155a79709d6 100644 --- a/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.yml +++ b/Packs/AlienVault_OTX/Integrations/AlienVault_OTX_v2/AlienVault_OTX_v2.yml @@ -619,7 +619,7 @@ script: - contextPath: URL.Relationships.EntityBType description: The type of the destination of the relationship. type: string - dockerimage: demisto/python3:3.10.8.39276 + dockerimage: demisto/python3:3.10.9.40422 isfetch: false longRunning: false longRunningPort: false diff --git a/Packs/AlienVault_OTX/ReleaseNotes/1_1_26.md b/Packs/AlienVault_OTX/ReleaseNotes/1_1_26.md new file mode 100644 index 000000000000..5178b1462556 --- /dev/null +++ b/Packs/AlienVault_OTX/ReleaseNotes/1_1_26.md @@ -0,0 +1,3 @@ +#### Integrations +##### AlienVault OTX v2 +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AlienVault_OTX/pack_metadata.json b/Packs/AlienVault_OTX/pack_metadata.json index d0babe0502e4..664b0b53ac63 100644 --- a/Packs/AlienVault_OTX/pack_metadata.json +++ b/Packs/AlienVault_OTX/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AlienVault OTX", "description": "Query Indicators of Compromise in AlienVault OTX.", "support": "xsoar", - "currentVersion": "1.1.25", + "currentVersion": "1.1.26", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AlienVault_USM_Anywhere/Integrations/AlienVault_USM_Anywhere/AlienVault_USM_Anywhere.py b/Packs/AlienVault_USM_Anywhere/Integrations/AlienVault_USM_Anywhere/AlienVault_USM_Anywhere.py index bed91d5af5a6..9e6aa6b41dea 100644 --- a/Packs/AlienVault_USM_Anywhere/Integrations/AlienVault_USM_Anywhere/AlienVault_USM_Anywhere.py +++ b/Packs/AlienVault_USM_Anywhere/Integrations/AlienVault_USM_Anywhere/AlienVault_USM_Anywhere.py @@ -6,11 +6,12 @@ import json import requests import dateparser +import urllib3 from datetime import datetime from typing import Dict # Disable insecure warnings -requests.packages.urllib3.disable_warnings() +urllib3.disable_warnings() ''' GLOBALS/PARAMS ''' diff --git a/Packs/AlienVault_USM_Anywhere/Integrations/AlienVault_USM_Anywhere/AlienVault_USM_Anywhere.yml b/Packs/AlienVault_USM_Anywhere/Integrations/AlienVault_USM_Anywhere/AlienVault_USM_Anywhere.yml index 7eab5f8d29da..c97681d4a7de 100644 --- a/Packs/AlienVault_USM_Anywhere/Integrations/AlienVault_USM_Anywhere/AlienVault_USM_Anywhere.yml +++ b/Packs/AlienVault_USM_Anywhere/Integrations/AlienVault_USM_Anywhere/AlienVault_USM_Anywhere.yml @@ -412,7 +412,7 @@ script: - contextPath: AlienVault.Event.Subcategory description: The event subcategory. type: String - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 isfetch: true longRunning: false longRunningPort: false diff --git a/Packs/AlienVault_USM_Anywhere/ReleaseNotes/1_0_13.md b/Packs/AlienVault_USM_Anywhere/ReleaseNotes/1_0_13.md new file mode 100644 index 000000000000..16b09cf7a8b8 --- /dev/null +++ b/Packs/AlienVault_USM_Anywhere/ReleaseNotes/1_0_13.md @@ -0,0 +1,3 @@ +#### Integrations +##### AlienVault USM Anywhere +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AlienVault_USM_Anywhere/pack_metadata.json b/Packs/AlienVault_USM_Anywhere/pack_metadata.json index 3c4c6dd8d2d5..ef8dfad19d42 100644 --- a/Packs/AlienVault_USM_Anywhere/pack_metadata.json +++ b/Packs/AlienVault_USM_Anywhere/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AlienVault USM Anywhere", "description": "Searches for and monitors alarms and events from AlienVault USM Anywhere.", "support": "xsoar", - "currentVersion": "1.0.12", + "currentVersion": "1.0.13", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AlphaVantage/Integrations/AlphaVantage/AlphaVantage.yml b/Packs/AlphaVantage/Integrations/AlphaVantage/AlphaVantage.yml index db40ab10649f..2759e581e96e 100755 --- a/Packs/AlphaVantage/Integrations/AlphaVantage/AlphaVantage.yml +++ b/Packs/AlphaVantage/Integrations/AlphaVantage/AlphaVantage.yml @@ -117,7 +117,7 @@ script: - contextPath: AlphaVantage.StockHistory.Time Series description: 'List of all stock data samples' type: Unknown - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/AlphaVantage/ReleaseNotes/1_0_8.md b/Packs/AlphaVantage/ReleaseNotes/1_0_8.md new file mode 100644 index 000000000000..150bb121a4f2 --- /dev/null +++ b/Packs/AlphaVantage/ReleaseNotes/1_0_8.md @@ -0,0 +1,3 @@ +#### Integrations +##### AlphaVantage +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AlphaVantage/pack_metadata.json b/Packs/AlphaVantage/pack_metadata.json index 2bb38fb9b32b..c4342eb5ae13 100755 --- a/Packs/AlphaVantage/pack_metadata.json +++ b/Packs/AlphaVantage/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AlphaVantage", "description": "The Alpha Vantage content pack provides accessible APIs for financial market data such as stock prices. Utilize this pack to get open stock prices, high/low price, trade volume, and so on.", "support": "community", - "currentVersion": "1.0.7", + "currentVersion": "1.0.8", "author": "Ohad Valtzer", "url": "https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/bd-p/Cortex_XSOAR_Discussions", "email": "", diff --git a/Packs/Anomali_Enterprise/Integrations/Anomali_Enterprise/Anomali_Enterprise.yml b/Packs/Anomali_Enterprise/Integrations/Anomali_Enterprise/Anomali_Enterprise.yml index c05d1b3eb7b7..9ab916ae602a 100644 --- a/Packs/Anomali_Enterprise/Integrations/Anomali_Enterprise/Anomali_Enterprise.yml +++ b/Packs/Anomali_Enterprise/Integrations/Anomali_Enterprise/Anomali_Enterprise.yml @@ -205,7 +205,7 @@ script: - contextPath: Domain.Malicious.Description description: A description of the malicious domain. type: String - dockerimage: demisto/python3:3.10.8.39276 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/Anomali_Enterprise/ReleaseNotes/1_0_25.md b/Packs/Anomali_Enterprise/ReleaseNotes/1_0_25.md new file mode 100644 index 000000000000..23110f630470 --- /dev/null +++ b/Packs/Anomali_Enterprise/ReleaseNotes/1_0_25.md @@ -0,0 +1,3 @@ +#### Integrations +##### Anomali Match +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/Anomali_Enterprise/pack_metadata.json b/Packs/Anomali_Enterprise/pack_metadata.json index ea99af0b2ddb..2fbcea9ae78f 100644 --- a/Packs/Anomali_Enterprise/pack_metadata.json +++ b/Packs/Anomali_Enterprise/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Anomali Enterprise", "description": "Use Anomali Match to query IOCs and conduct forensic searches.", "support": "xsoar", - "currentVersion": "1.0.24", + "currentVersion": "1.0.25", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.yml b/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.yml index b7b3ddc589a6..8c9fcd66fc2e 100644 --- a/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.yml +++ b/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.yml @@ -4335,7 +4335,7 @@ script: - contextPath: ThreatStream.Intelligence.severity description: The severity of the intelligence. type: String - dockerimage: demisto/py3-tools:1.0.0.40800 + dockerimage: demisto/py3-tools:1.0.0.41748 feed: false isfetch: false longRunning: false diff --git a/Packs/Anomali_ThreatStream/ReleaseNotes/2_0_22.md b/Packs/Anomali_ThreatStream/ReleaseNotes/2_0_22.md new file mode 100644 index 000000000000..3e8a77b6f46a --- /dev/null +++ b/Packs/Anomali_ThreatStream/ReleaseNotes/2_0_22.md @@ -0,0 +1,3 @@ +#### Integrations +##### Anomali ThreatStream v3 +- Updated the Docker image to: *demisto/py3-tools:1.0.0.41748*. diff --git a/Packs/Anomali_ThreatStream/pack_metadata.json b/Packs/Anomali_ThreatStream/pack_metadata.json index 3259ebab9150..987989c6dff1 100644 --- a/Packs/Anomali_ThreatStream/pack_metadata.json +++ b/Packs/Anomali_ThreatStream/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Anomali ThreatStream", "description": "Use Anomali ThreatStream to query and submit threats.", "support": "xsoar", - "currentVersion": "2.0.21", + "currentVersion": "2.0.22", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AnsibleTower/Integrations/AnsibleTower/AnsibleTower.yml b/Packs/AnsibleTower/Integrations/AnsibleTower/AnsibleTower.yml index 5373c5425951..fd87289d970b 100644 --- a/Packs/AnsibleTower/Integrations/AnsibleTower/AnsibleTower.yml +++ b/Packs/AnsibleTower/Integrations/AnsibleTower/AnsibleTower.yml @@ -1655,7 +1655,7 @@ script: - contextPath: AnsibleAWX.JobEvents.event_data description: Job's raw event data type: String - dockerimage: demisto/python3:3.10.8.39276 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/AnsibleTower/ReleaseNotes/1_0_27.md b/Packs/AnsibleTower/ReleaseNotes/1_0_27.md new file mode 100644 index 000000000000..d94be062d8cf --- /dev/null +++ b/Packs/AnsibleTower/ReleaseNotes/1_0_27.md @@ -0,0 +1,3 @@ +#### Integrations +##### Ansible Tower +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AnsibleTower/pack_metadata.json b/Packs/AnsibleTower/pack_metadata.json index ef5f1a5aecc9..b5879762c0de 100644 --- a/Packs/AnsibleTower/pack_metadata.json +++ b/Packs/AnsibleTower/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Ansible Tower", "description": "Scale IT automation, manage complex deployments and speed productivity.", "support": "xsoar", - "currentVersion": "1.0.26", + "currentVersion": "1.0.27", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/ApiModules/ReleaseNotes/2_2_12.md b/Packs/ApiModules/ReleaseNotes/2_2_12.md new file mode 100644 index 000000000000..6dc40892253b --- /dev/null +++ b/Packs/ApiModules/ReleaseNotes/2_2_12.md @@ -0,0 +1,5 @@ + +#### Scripts +##### TAXII2ApiModule +- Added support for limiting the number of fetched indicators. +- Improved implementation for polling collections. \ No newline at end of file diff --git a/Packs/ApiModules/Scripts/AWSApiModule/AWSApiModule.py b/Packs/ApiModules/Scripts/AWSApiModule/AWSApiModule.py index 1acd7d1e77af..3a9bfb3b0cf3 100644 --- a/Packs/ApiModules/Scripts/AWSApiModule/AWSApiModule.py +++ b/Packs/ApiModules/Scripts/AWSApiModule/AWSApiModule.py @@ -18,14 +18,14 @@ def validate_params(aws_default_region, aws_role_arn, aws_role_session_name, aws raise DemistoException('Role session name is required when using role ARN.') -def extract_session_from_access(access_key, session_token): +def extract_session_from_secret(secret_key, session_token): """ - Extract the session token from the access_key field. + Extract the session token from the secret_key field. """ - if access_key and '@@@' in access_key and not session_token: - return access_key.split('@@@')[0], access_key.split('@@@')[1] + if secret_key and '@@@' in secret_key and not session_token: + return secret_key.split('@@@')[0], secret_key.split('@@@')[1] else: - return access_key, session_token + return secret_key, session_token class AWSClient: @@ -40,7 +40,7 @@ def __init__(self, aws_default_region, aws_role_arn, aws_role_session_name, aws_ self.aws_role_session_duration = aws_role_session_duration self.aws_role_policy = aws_role_policy self.aws_access_key_id = aws_access_key_id - self.aws_secret_access_key, self.aws_session_token = extract_session_from_access(aws_secret_access_key, aws_session_token) + self.aws_secret_access_key, self.aws_session_token = extract_session_from_secret(aws_secret_access_key, aws_session_token) self.verify_certificate = verify_certificate proxies = handle_proxy(proxy_param_name='proxy', checkbox_default_value=False) @@ -101,7 +101,7 @@ def aws_session(self, service, region=None, role_arn=None, role_session_name=Non if not self.aws_access_key_id: sts_client = boto3.client('sts', config=self.config, verify=self.verify_certificate, - region_name=self.aws_default_region) + region_name=region if region else self.aws_default_region) sts_response = sts_client.assume_role(**kwargs) client = boto3.client( service_name=service, @@ -127,7 +127,7 @@ def aws_session(self, service, region=None, role_arn=None, role_session_name=Non sts_response = sts_client.assume_role(**kwargs) client = boto3.client( service_name=service, - region_name=self.aws_default_region, + region_name=region if region else self.aws_default_region, aws_access_key_id=sts_response['Credentials']['AccessKeyId'], aws_secret_access_key=sts_response['Credentials']['SecretAccessKey'], aws_session_token=sts_response['Credentials']['SessionToken'], diff --git a/Packs/ApiModules/Scripts/AWSApiModule/AWSApiModule_test.py b/Packs/ApiModules/Scripts/AWSApiModule/AWSApiModule_test.py index b89f0f5c5dd4..be76ae92ec55 100644 --- a/Packs/ApiModules/Scripts/AWSApiModule/AWSApiModule_test.py +++ b/Packs/ApiModules/Scripts/AWSApiModule/AWSApiModule_test.py @@ -178,9 +178,9 @@ def test_AWSClient_without_session_token(): print('failed to create session:' + Exception) -@pytest.mark.parametrize('access_key, session_token, expected', +@pytest.mark.parametrize('secret_key, session_token, expected', [ - ('access_key@@@session_token', None, ('access_key', 'session_token')), + ('secret_key@@@session_token', None, ('secret_key', 'session_token')), ('test1', None, ('test1', None)), ('test1', 'test2', ('test1', 'test2')), ('test1@@@test2', 'test3', ('test1@@@test2', 'test3')), @@ -188,17 +188,17 @@ def test_AWSClient_without_session_token(): (None, '', (None, '')), (None, None, (None, None)) ]) -def test_extract_session_from_access(access_key, session_token, expected): +def test_extract_session_from_secret(secret_key, session_token, expected): """ Given - - Access key and session token + - Secret key and session token When - - Calling the extract_session_from_access function + - Calling the extract_session_from_secret function Then - - Check that the function returns the expected access key and session token + - Check that the function returns the expected secret key and session token """ - result = extract_session_from_access(access_key, session_token) + result = extract_session_from_secret(secret_key, session_token) assert result == expected diff --git a/Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py b/Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py index 0a30742b0c84..51fdfdd67f14 100644 --- a/Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py +++ b/Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py @@ -2040,7 +2040,7 @@ def blocklist_files_command(client, args): headers=['added_hashes'], headerTransform=pascalToSpace), outputs={f'{args.get("integration_context_brand", "CoreApiModule")}.' - f'blocklist.added_hashes.fileHash(val.fileHash == obj.fileHash)': hash_list}, + f'{args.get("prefix", "blocklist")}.added_hashes.fileHash(val.fileHash == obj.fileHash)': hash_list}, raw_response=res ) @@ -2077,7 +2077,7 @@ def allowlist_files_command(client, args): if detailed_response: return CommandResults( readable_output=tableToMarkdown('Allowlist Files', res), - outputs_prefix=f'{args.get("integration_context_brand", "CoreApiModule")}.blocklist', + outputs_prefix=f'{args.get("integration_context_brand", "CoreApiModule")}.allowlist', outputs=res, raw_response=res ) @@ -2090,7 +2090,7 @@ def allowlist_files_command(client, args): headers=['added_hashes'], headerTransform=pascalToSpace), outputs={f'{args.get("integration_context_brand", "CoreApiModule")}.' - f'allowlist.added_hashes.fileHash(val.fileHash == obj.fileHash)': hash_list}, + f'{args.get("prefix", "allowlist")}.added_hashes.fileHash(val.fileHash == obj.fileHash)': hash_list}, raw_response=res ) diff --git a/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule.py b/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule.py index 3d8c3153c755..42df452379a4 100644 --- a/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule.py +++ b/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule.py @@ -250,7 +250,10 @@ def fetch_indicators_command(client: Client, indicator_type: str, feedTags: list indicators_values_indexes[indicator_value] = len(indicators_values) indicators_values.add(indicator_value) else: - indicators[indicators_values_indexes[indicator_value]]['rawJSON']['service'] += f", {service_name}" + service = indicators[indicators_values_indexes[indicator_value]].get('rawJSON', {}).get('service', '') + if service and service_name not in service.split(','): + service_name += f', {service}' + indicators[indicators_values_indexes[indicator_value]]['rawJSON']['service'] = service_name continue indicators.extend( diff --git a/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule_test.py b/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule_test.py index f4d93eddd941..9df1aecdb911 100644 --- a/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule_test.py +++ b/Packs/ApiModules/Scripts/JSONFeedApiModule/JSONFeedApiModule_test.py @@ -1,5 +1,6 @@ from JSONFeedApiModule import Client, fetch_indicators_command, jmespath, get_no_update_value from CommonServerPython import * +import pytest import requests_mock import demistomock as demisto @@ -25,33 +26,62 @@ def test_json_feed_no_config(): assert len(jmespath.search(expression="[].rawJSON.service", data=indicators)) == 1117 -def test_json_feed_with_config(): +CONFIG_PARAMETERS = [ + ( + { + 'AMAZON': { + 'url': 'https://ip-ranges.amazonaws.com/ip-ranges.json', + 'extractor': "prefixes[?service=='AMAZON']", + 'indicator': 'ip_prefix', + 'indicator_type': FeedIndicatorType.CIDR, + 'fields': ['region', 'service'] + } + }, + 1117, + 0 + ), + ( + { + 'AMAZON': { + 'url': 'https://ip-ranges.amazonaws.com/ip-ranges.json', + 'extractor': "prefixes[?service=='AMAZON']", + 'indicator': 'ip_prefix', + 'indicator_type': FeedIndicatorType.CIDR, + 'fields': ['region', 'service'] + }, + 'CLOUDFRONT': { + 'url': 'https://ip-ranges.amazonaws.com/ip-ranges.json', + 'extractor': "prefixes[?service=='CLOUDFRONT']", + 'indicator': 'ip_prefix', + 'indicator_type': FeedIndicatorType.CIDR, + 'fields': ['region', 'service'] + } + }, + 1148, + 36 + ) +] + + +@pytest.mark.parametrize('config, total_indicators, indicator_with_several_tags', CONFIG_PARAMETERS) +def test_json_feed_with_config(config, total_indicators, indicator_with_several_tags): with open('test_data/amazon_ip_ranges.json') as ip_ranges_json: ip_ranges = json.load(ip_ranges_json) - feed_name_to_config = { - 'AMAZON': { - 'url': 'https://ip-ranges.amazonaws.com/ip-ranges.json', - 'extractor': "prefixes[?service=='AMAZON']", - 'indicator': 'ip_prefix', - 'indicator_type': FeedIndicatorType.CIDR, - 'fields': ['region', 'service'] - } - } - with requests_mock.Mocker() as m: m.get('https://ip-ranges.amazonaws.com/ip-ranges.json', json=ip_ranges) client = Client( url='https://ip-ranges.amazonaws.com/ip-ranges.json', credentials={'username': 'test', 'password': 'test'}, - feed_name_to_config=feed_name_to_config, + feed_name_to_config=config, insecure=True ) indicators, _ = fetch_indicators_command(client=client, indicator_type='CIDR', feedTags=['test'], auto_detect=False) - assert len(jmespath.search(expression="[].rawJSON.service", data=indicators)) == 1117 + assert len(jmespath.search(expression="[].rawJSON.service", data=indicators)) == total_indicators + assert len([i for i in indicators if ',' in i.get('rawJSON').get('service', '')]) == indicator_with_several_tags def test_json_feed_with_config_mapping(): diff --git a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py index 0b52fba9241a..68509c17402e 100644 --- a/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py +++ b/Packs/ApiModules/Scripts/MicrosoftApiModule/MicrosoftApiModule.py @@ -148,8 +148,12 @@ def __init__(self, tenant_id: str = '', def is_command_executed_from_integration(self): ctx = demisto.callingContext.get('context', {}) - executed_command = ctx.get('ExecutedCommands', [{'moduleBrand': 'Scripts'}])[0] - return executed_command.get('moduleBrand') != 'Scripts' + executed_commands = ctx.get('ExecutedCommands', [{'moduleBrand': 'Scripts'}]) + + if executed_commands: + return executed_commands[0].get('moduleBrand', "") != 'Scripts' + + return True def http_request( self, *args, resp_type='json', headers=None, diff --git a/Packs/ApiModules/Scripts/TAXII2ApiModule/TAXII2ApiModule.py b/Packs/ApiModules/Scripts/TAXII2ApiModule/TAXII2ApiModule.py index 5a44e13d9acb..3a1b54673369 100644 --- a/Packs/ApiModules/Scripts/TAXII2ApiModule/TAXII2ApiModule.py +++ b/Packs/ApiModules/Scripts/TAXII2ApiModule/TAXII2ApiModule.py @@ -2,7 +2,7 @@ from CommonServerPython import * from CommonServerUserPython import * -from typing import Union, Optional, List, Dict, Tuple +from typing import Optional, List, Dict, Tuple from requests.sessions import merge_setting, CaseInsensitiveDict import re import copy @@ -25,8 +25,6 @@ ERR_NO_COLL = "No collection is available for this user, please make sure you entered the configuration correctly" -DATE_FORMAT = '%Y-%m-%dT%H:%M:%S.%fZ' - # Pattern Regexes - used to extract indicator type and value INDICATOR_OPERATOR_VAL_FORMAT_PATTERN = r"(\w.*?{value}{operator})'(.*?)'" INDICATOR_EQUALS_VAL_PATTERN = INDICATOR_OPERATOR_VAL_FORMAT_PATTERN.format( @@ -175,6 +173,10 @@ 'ZA': 'South Africa', 'ZM': 'Zambia', 'ZW': 'Zimbabwe'} +def reached_limit(limit: int, element_count: int): + return element_count >= limit > -1 + + class Taxii2FeedClient: def __init__( self, @@ -314,12 +316,18 @@ def init_roots(self): logging.disable(logging.NOTSET) def set_api_root(self): - roots_to_api = {str(api_root.url).split('/')[-2]: api_root - for api_root in self.server.api_roots} # type: ignore[attr-defined] + roots_to_api = {} + for api_root in self.server.api_roots: # type: ignore[attr-defined] + # ApiRoots are initialized with wrong _conn because we are not providing auth or cert to Server + # closing wrong unused connections + api_root_name = str(api_root.url).split('/')[-2] + demisto.debug(f'closing api_root._conn for {api_root_name}') + api_root._conn.close() + roots_to_api[api_root_name] = api_root if self.default_api_root: if not roots_to_api.get(self.default_api_root): - raise DemistoException(f'The given default API root {self.default_api_root} doesn\'t exists.' + raise DemistoException(f'The given default API root {self.default_api_root} doesn\'t exist. ' f'Available API roots are {list(roots_to_api.keys())}.') self.api_root = roots_to_api.get(self.default_api_root) @@ -1001,7 +1009,6 @@ def build_iterator(self, limit: int = -1, **kwargs) -> List[Dict[str, str]]: :param limit: max amount of indicators to fetch :return: Cortex indicators list """ - if not isinstance(self.collection_to_fetch, (v20.Collection, v21.Collection)): raise DemistoException( "Could not find a collection to fetch from. " @@ -1018,7 +1025,7 @@ def build_iterator(self, limit: int = -1, **kwargs) -> List[Dict[str, str]]: return indicators - def load_stix_objects_from_envelope(self, envelopes: Dict[str, Any], limit: int = -1): + def load_stix_objects_from_envelope(self, envelopes: types.GeneratorType, limit: int = -1): parse_stix_2_objects = { "indicator": self.parse_indicator, @@ -1045,118 +1052,65 @@ def load_stix_objects_from_envelope(self, envelopes: Dict[str, Any], limit: int "location": self.parse_location, "vulnerability": self.parse_vulnerability } - indicators = [] - # TAXII 2.0 - if isinstance(list(envelopes.values())[0], types.GeneratorType): - indicators.extend(self.parse_generator_type_envelope(envelopes, parse_stix_2_objects)) - # TAXII 2.1 - else: - indicators.extend(self.parse_dict_envelope(envelopes, parse_stix_2_objects, limit)) + indicators, relationships_lst = self.parse_generator_type_envelope(envelopes, parse_stix_2_objects, limit) + if relationships_lst: + indicators.extend(self.parse_relationships(relationships_lst)) demisto.debug( f"TAXII 2 Feed has extracted {len(indicators)} indicators" ) - if limit > -1: - return indicators[:limit] + return indicators - def parse_generator_type_envelope(self, envelopes: Dict[str, Any], - parse_objects_func): + def parse_generator_type_envelope(self, envelopes: types.GeneratorType, parse_objects_func, limit: int = -1): indicators = [] relationships_lst = [] - for obj_type, envelope in envelopes.items(): - for sub_envelope in envelope: - stix_objects = sub_envelope.get("objects") - if not stix_objects: - # no fetched objects - break - # now we have a list of objects, go over each obj, save id with obj, parse the obj - if obj_type != "relationship": - for obj in stix_objects: - # we currently don't support extension object - if obj.get('type') == 'extension-definition': - continue - self.id_to_object[obj.get('id')] = obj - result = parse_objects_func[obj_type](obj) - if not result: - continue - indicators.extend(result) - self.update_last_modified_indicator_date(obj.get("modified")) - else: - relationships_lst.extend(stix_objects) - if relationships_lst: - indicators.extend(self.parse_relationships(relationships_lst)) + for envelope in envelopes: + stix_objects = envelope.get("objects") + if not stix_objects: + # no fetched objects + break - return indicators + # now we have a list of objects, go over each obj, save id with obj, parse the obj + for obj in stix_objects: + obj_type = obj.get('type') + + # we currently don't support extension object + if obj_type == 'extension-definition': + continue + elif obj_type == 'relationship': + relationships_lst.append(obj) + continue - def parse_dict_envelope(self, envelopes: Dict[str, Any], - parse_objects_func, limit: int = -1): - indicators: list = [] - relationships_list: List[Dict[str, Any]] = [] - for obj_type, envelope in envelopes.items(): - cur_limit = limit - stix_objects = envelope.get("objects", []) - if obj_type != "relationship": - for obj in stix_objects: - # we currently don't support extension object - if obj.get('type') == 'extension-definition': - continue - self.id_to_object[obj.get('id')] = obj - result = parse_objects_func[obj_type](obj) - if not result: - continue + self.id_to_object[obj.get('id')] = obj + if not parse_objects_func.get(obj_type): + demisto.debug(f'There is no parsing function for object type {obj_type}, ' + f'available parsing functions are for types: {",".join(parse_objects_func.keys())}.') + continue + if result := parse_objects_func[obj_type](obj): indicators.extend(result) self.update_last_modified_indicator_date(obj.get("modified")) - else: - relationships_list.extend(stix_objects) - while envelope.get("more", False): - page_size = self.get_page_size(limit, cur_limit) - envelope = self.collection_to_fetch.get_objects( - limit=page_size, next=envelope.get("next", ""), type=obj_type - ) - if isinstance(envelope, Dict): - stix_objects = envelope.get("objects") - if obj_type != "relationship": - for obj in stix_objects: - self.id_to_object[obj.get('id')] = obj - result = parse_objects_func[obj_type](obj) - if not result: - continue - indicators.extend(result) - self.update_last_modified_indicator_date(obj.get("modified")) - else: - relationships_list.extend(stix_objects) - else: - raise DemistoException( - "Error: TAXII 2 client received the following response while requesting " - f"indicators: {str(envelope)}\n\nExpected output is json" - ) + if reached_limit(limit, len(indicators)): + return indicators, relationships_lst - if relationships_list: - indicators.extend(self.parse_relationships(relationships_list)) - return indicators + return indicators, relationships_lst def poll_collection( self, page_size: int, **kwargs - ) -> Dict[str, Union[types.GeneratorType, Dict[str, str]]]: + ) -> types.GeneratorType: """ Polls a taxii collection :param page_size: size of the request page """ - types_envelopes = {} get_objects = self.collection_to_fetch.get_objects - if len(self.objects_to_fetch) > 1: # when fetching one type no need to fetch relationship + if 'relationship' not in self.objects_to_fetch and \ + len(self.objects_to_fetch) > 1: # when fetching one type no need to fetch relationship self.objects_to_fetch.append('relationship') - for obj_type in self.objects_to_fetch: - kwargs['type'] = obj_type - if isinstance(self.collection_to_fetch, v20.Collection): - envelope = v20.as_pages(get_objects, per_request=page_size, **kwargs) - else: - envelope = get_objects(limit=page_size, **kwargs) - if envelope: - types_envelopes[obj_type] = envelope - return types_envelopes + kwargs['type'] = self.objects_to_fetch + if isinstance(self.collection_to_fetch, v20.Collection): + return v20.as_pages(get_objects, per_request=page_size, **kwargs) + return v21.as_pages(get_objects, per_request=page_size, **kwargs) def get_page_size(self, max_limit: int, cur_limit: int) -> int: """ diff --git a/Packs/ApiModules/Scripts/TAXII2ApiModule/TAXII2ApiModule_test.py b/Packs/ApiModules/Scripts/TAXII2ApiModule/TAXII2ApiModule_test.py index 8b2def140cc4..934252ca3ecb 100644 --- a/Packs/ApiModules/Scripts/TAXII2ApiModule/TAXII2ApiModule_test.py +++ b/Packs/ApiModules/Scripts/TAXII2ApiModule/TAXII2ApiModule_test.py @@ -458,7 +458,7 @@ def test_21_empty(self): expected = [] mock_client = Taxii2FeedClient(url='', collection_to_fetch='', proxies=[], verify=False, objects_to_fetch=[]) - actual = mock_client.load_stix_objects_from_envelope({"indicator": STIX_ENVELOPE_NO_IOCS}, -1) + actual = mock_client.load_stix_objects_from_envelope(STIX_ENVELOPE_NO_IOCS, -1) assert len(actual) == 0 assert expected == actual @@ -481,7 +481,7 @@ def test_21_simple(self): mock_client = Taxii2FeedClient(url='', collection_to_fetch='', proxies=[], verify=False, tlp_color='GREEN', objects_to_fetch=[]) - actual = mock_client.load_stix_objects_from_envelope({"indicator": STIX_ENVELOPE_17_IOCS_19_OBJS}, -1) + actual = mock_client.load_stix_objects_from_envelope(STIX_ENVELOPE_17_IOCS_19_OBJS, -1) assert len(actual) == 17 assert expected == actual @@ -495,7 +495,7 @@ def test_21_complex_not_skipped(self): - skip is False When: - - extract_indicators_from_envelope_and_parse is called + - load_stix_objects_from_envelope is called Then: - Extract and parse the indicators from the envelope with the complex iocs @@ -505,7 +505,7 @@ def test_21_complex_not_skipped(self): mock_client = Taxii2FeedClient(url='', collection_to_fetch='', proxies=[], verify=False, tlp_color='GREEN', objects_to_fetch=[]) - actual = mock_client.load_stix_objects_from_envelope({"indicator": STIX_ENVELOPE_20_IOCS_19_OBJS}, -1) + actual = mock_client.load_stix_objects_from_envelope(STIX_ENVELOPE_20_IOCS_19_OBJS, -1) assert len(actual) == 20 assert actual == expected @@ -519,7 +519,7 @@ def test_21_complex_skipped(self): - skip is True When: - - extract_indicators_from_envelope_and_parse is called + - load_stix_objects_from_envelope is called Then: - Extract and parse the indicators from the envelope with the complex iocs @@ -529,7 +529,7 @@ def test_21_complex_skipped(self): mock_client = Taxii2FeedClient(url='', collection_to_fetch='', proxies=[], verify=False, skip_complex_mode=True, objects_to_fetch=[]) - actual = mock_client.load_stix_objects_from_envelope({"indicator": STIX_ENVELOPE_20_IOCS_19_OBJS}, -1) + actual = mock_client.load_stix_objects_from_envelope(STIX_ENVELOPE_20_IOCS_19_OBJS, -1) assert len(actual) == 14 assert actual == expected @@ -550,7 +550,6 @@ def test_load_stix_objects_from_envelope_v21(self): """ mock_client = Taxii2FeedClient(url='', collection_to_fetch='', proxies=[], verify=False, objects_to_fetch=[]) objects_envelopes = envelopes_v21 - mock_client.id_to_object = id_to_object result = mock_client.load_stix_objects_from_envelope(objects_envelopes, -1) assert mock_client.id_to_object == id_to_object @@ -564,29 +563,15 @@ def test_load_stix_objects_from_envelope_v20(self): - Envelope with indicators, arranged by object type. When: - - parse_generator_type_envelope is called (skipping condition from load_stix_objects_from_envelope). + - load_stix_objects_from_envelope is called. Then: - Load and parse objects from the envelope according to their object type and ignore extension-definition objects. """ mock_client = Taxii2FeedClient(url='', collection_to_fetch='', proxies=[], verify=False, objects_to_fetch=[]) - objects_envelopes = envelopes_v20 - mock_client.id_to_object = id_to_object - - parse_stix_2_objects = { - "indicator": mock_client.parse_indicator, - "attack-pattern": mock_client.parse_attack_pattern, - "malware": mock_client.parse_malware, - "report": mock_client.parse_report, - "course-of-action": mock_client.parse_course_of_action, - "campaign": mock_client.parse_campaign, - "intrusion-set": mock_client.parse_intrusion_set, - "tool": mock_client.parse_tool, - "threat-actor": mock_client.parse_threat_actor, - "infrastructure": mock_client.parse_infrastructure - } - result = mock_client.parse_generator_type_envelope(objects_envelopes, parse_stix_2_objects) + + result = mock_client.load_stix_objects_from_envelope(envelopes_v20) assert mock_client.id_to_object == id_to_object assert result == parsed_objects @@ -1083,3 +1068,21 @@ def test_parse_location(self, taxii_2_client, location_object, xsoar_expected_re - Make sure all the fields are being parsed correctly. """ assert taxii_2_client.parse_location(location_object) == xsoar_expected_response + + +@pytest.mark.parametrize('limit, element_count, return_value', + [(8, 8, True), + (8, 9, True), + (8, 0, False), + (-1, 10, False)]) +def test_reached_limit(limit, element_count, return_value): + """ + Given: + - A limit and element count. + When: + - Enforcing limit on the elements count. + Then: + - Assert that the element count is not exceeded. + """ + from TAXII2ApiModule import reached_limit + assert reached_limit(limit, element_count) == return_value diff --git a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/id_to_object_test.json b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/id_to_object_test.json index a94aaebc50e8..faedde0f0b98 100644 --- a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/id_to_object_test.json +++ b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/id_to_object_test.json @@ -201,23 +201,5 @@ "modified":"2016-05-07T11:22:30.000Z", "name":"Poison Ivy C2", "infrastructure_types": ["command-and-control"] - }, - "relationship--01a5a209-b94c-450b-b7f9-946497d91055": { - "created": "2018-08-03T21:03:51.484Z", - "id": "relationship--01a5a209-b94c-450b-b7f9-946497d91055", - "modified": "2018-08-03T21:03:51.484Z", - "relationship_type": "uses", - "source_ref": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", - "target_ref": "attack-pattern--4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", - "type": "relationship" - }, - "relationship--abc475d9-199c-4623-9e9a-02adf340a415": { - "created": "2018-08-03T20:31:03.780Z", - "id": "relationship--abc475d9-199c-4623-9e9a-02adf340a415", - "modified": "2018-08-22T12:36:32.248Z", - "relationship_type": "indicates", - "source_ref": "indicator--545928d9-bfe8-4320-bb98-751f38139892", - "target_ref": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", - "type": "relationship" } } \ No newline at end of file diff --git a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/objects_envelopes_v20.json b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/objects_envelopes_v20.json index 8d386f0baf97..35599e8a225a 100644 --- a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/objects_envelopes_v20.json +++ b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/objects_envelopes_v20.json @@ -1,281 +1,315 @@ -{ - "indicator": [{ +[ + { "objects": [ - { - "created": "2018-04-23T17:01:01.248Z", - "id": "indicator--545928d9-bfe8-4320-bb98-751f38139892", - "labels": ["malicious-activity"], - "modified": "2018-04-23T17:01:01.248Z", - "name": "windows-updates.com", - "pattern": "[domain-name:value = 'windows-updates.com']", - "type": "indicator", - "valid_from": "2018-04-23T17:01:01.248Z" + { + "created": "2018-04-23T17:01:01.248Z", + "id": "indicator--545928d9-bfe8-4320-bb98-751f38139892", + "labels": [ + "malicious-activity" + ], + "modified": "2018-04-23T17:01:01.248Z", + "name": "windows-updates.com", + "pattern": "[domain-name:value = 'windows-updates.com']", + "type": "indicator", + "valid_from": "2018-04-23T17:01:01.248Z" } ] - }], - "attack-pattern": [{ + }, + { "objects": [ + { + "created": "2017-10-25T14:48:11.535Z", + "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", + "description": "An adversary could call standard operating system APIs from a malicious application to gather contact list (i.e., address book) data, or with escalated privileges could directly access files containing contact list data.", + "external_references": [ + { + "external_id": "T1432", + "source_name": "mitre-mobile-attack", + "url": "https://attack.mitre.org/techniques/T1432" + }, + { + "external_id": "APP-13", + "source_name": "NIST Mobile Threat Catalogue", + "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html" + } + ], + "id": "attack-pattern--4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", + "kill_chain_phases": [ + { + "kill_chain_name": "lockheed", + "phase_name": "act-on-objectives" + }, { - "created": "2017-10-25T14:48:11.535Z", - "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", - "description": "An adversary could call standard operating system APIs from a malicious application to gather contact list (i.e., address book) data, or with escalated privileges could directly access files containing contact list data.", - "external_references": [ - { - "external_id": "T1432", - "source_name": "mitre-mobile-attack", - "url": "https://attack.mitre.org/techniques/T1432" - }, - { - "external_id": "APP-13", - "source_name": "NIST Mobile Threat Catalogue", - "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html" - } - ], - "id": "attack-pattern--4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", - "kill_chain_phases": [ - { - "kill_chain_name": "lockheed", - "phase_name": "act-on-objectives" - }, - { - "kill_chain_name": "mitre-mobile-attack", - "phase_name": "collection" - } - ], - "modified": "2018-10-17T00:14:20.652Z", - "name": "T1432: Access Contact List (Mobile)", - "object_marking_refs": [ - "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" - ], - "type": "attack-pattern", - "x_mitre_detection": "On both Android (6.0 and up) and iOS, the user can view which applications have permission to access contact list information through the device settings screen, and the user can choose to revoke the permissions.", - "x_mitre_platforms": ["Android", "iOS"], - "x_mitre_version": "1.0" - }, + "kill_chain_name": "mitre-mobile-attack", + "phase_name": "collection" + } + ], + "modified": "2018-10-17T00:14:20.652Z", + "name": "T1432: Access Contact List (Mobile)", + "object_marking_refs": [ + "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" + ], + "type": "attack-pattern", + "x_mitre_detection": "On both Android (6.0 and up) and iOS, the user can view which applications have permission to access contact list information through the device settings screen, and the user can choose to revoke the permissions.", + "x_mitre_platforms": [ + "Android", + "iOS" + ], + "x_mitre_version": "1.0" + }, { - "created": "2020-02-05T14:17:46.686Z", - "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", - "description": "Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) \n\nUtilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, (Citation: Wikipedia Exe Compression) but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses. ", - "external_references": [ - { - "external_id": "T1027.002", - "source_name": "mitre-attack", - "url": "https://attack.mitre.org/techniques/T1027/002" - }, - { - "external_id": "CAPEC-570", - "source_name": "capec", - "url": "https://example.example.com/data/definitions/570.html" - }, - { - "description": "Kafka, F. (2018, January). ESET's Guide to Deobfuscating and Devirtualizing FinFisher. Retrieved August 12, 2019.", - "source_name": "ESET FinFisher Jan 2018", - "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf" - }, - { - "description": "Executable compression. (n.d.). Retrieved December 4, 2014.", - "source_name": "Wikipedia Exe Compression", - "url": "http://en.wikipedia.org/wiki/Executable_compression" - } - ], - "id": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062", - "kill_chain_phases": [ - { - "kill_chain_name": "lockheed", - "phase_name": "installation" - }, - { - "kill_chain_name": "mitre-attack", - "phase_name": "defense-evasion" - } - ], - "modified": "2020-02-05T20:05:41.548Z", - "name": "T1027.002: Software Packing", - "object_marking_refs": ["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"], - "type": "attack-pattern", - "x_mitre_contributors": ["Filip Kafka, ESET"], - "x_mitre_data_sources": ["File: File Content", "File: File Metadata"], - "x_mitre_defense_bypassed": [ - "Anti-virus", - "Heuristic detection", - "Signature-based detection"], - "x_mitre_detection": "Use file scanning to look for known software packers or artifacts of packing techniques. Packing is not a definitive indicator of malicious activity, because legitimate software may use packing techniques to reduce binary size or to protect proprietary code.", - "x_mitre_is_subtechnique": true, - "x_mitre_platforms": ["macOS", "Windows"], - "x_mitre_version": "1.0", - "x_panw_parent_technique": "Obfuscated Files or Information", - "x_panw_parent_technique_subtechnique": "Obfuscated Files or Information: Software Packing" - }, + "created": "2020-02-05T14:17:46.686Z", + "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", + "description": "Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) \n\nUtilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, (Citation: Wikipedia Exe Compression) but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses. ", + "external_references": [ + { + "external_id": "T1027.002", + "source_name": "mitre-attack", + "url": "https://attack.mitre.org/techniques/T1027/002" + }, + { + "external_id": "CAPEC-570", + "source_name": "capec", + "url": "https://example.example.com/data/definitions/570.html" + }, + { + "description": "Kafka, F. (2018, January). ESET's Guide to Deobfuscating and Devirtualizing FinFisher. Retrieved August 12, 2019.", + "source_name": "ESET FinFisher Jan 2018", + "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf" + }, + { + "description": "Executable compression. (n.d.). Retrieved December 4, 2014.", + "source_name": "Wikipedia Exe Compression", + "url": "http://en.wikipedia.org/wiki/Executable_compression" + } + ], + "id": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062", + "kill_chain_phases": [ + { + "kill_chain_name": "lockheed", + "phase_name": "installation" + }, + { + "kill_chain_name": "mitre-attack", + "phase_name": "defense-evasion" + } + ], + "modified": "2020-02-05T20:05:41.548Z", + "name": "T1027.002: Software Packing", + "object_marking_refs": [ + "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" + ], + "type": "attack-pattern", + "x_mitre_contributors": [ + "Filip Kafka, ESET" + ], + "x_mitre_data_sources": [ + "File: File Content", + "File: File Metadata" + ], + "x_mitre_defense_bypassed": [ + "Anti-virus", + "Heuristic detection", + "Signature-based detection" + ], + "x_mitre_detection": "Use file scanning to look for known software packers or artifacts of packing techniques. Packing is not a definitive indicator of malicious activity, because legitimate software may use packing techniques to reduce binary size or to protect proprietary code.", + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "macOS", + "Windows" + ], + "x_mitre_version": "1.0", + "x_panw_parent_technique": "Obfuscated Files or Information", + "x_panw_parent_technique_subtechnique": "Obfuscated Files or Information: Software Packing" + }, { - "created": "2021-10-21T16:56:05.840605Z", - "created_by_ref": "identity--749249c0-f7c7-5428-a4ad-ea5e1627a221", - "description": "This schema adds TIM data to the object", - "extension_types": [ - "property-extension" - ], - "id": "extension-definition--fc572b8c-bbe3-444b-b40b-06d3b890cd79", - "modified": "2021-10-21T16:56:17.747194Z", - "name": "Cortex XSOAR TIM Attack Pattern", - "schema": "https://github.com/demisto/content/tree/master/Packs/TAXIIServer/doc_files/XSOAR_indicator_schema.json", - "spec_version": "2.0", - "type": "extension-definition", - "version": "1.0" - } + "created": "2021-10-21T16:56:05.840605Z", + "created_by_ref": "identity--749249c0-f7c7-5428-a4ad-ea5e1627a221", + "description": "This schema adds TIM data to the object", + "extension_types": [ + "property-extension" + ], + "id": "extension-definition--fc572b8c-bbe3-444b-b40b-06d3b890cd79", + "modified": "2021-10-21T16:56:17.747194Z", + "name": "Cortex XSOAR TIM Attack Pattern", + "schema": "https://github.com/demisto/content/tree/master/Packs/TAXIIServer/doc_files/XSOAR_indicator_schema.json", + "spec_version": "2.0", + "type": "extension-definition", + "version": "1.0" + } ] - }], - "malware": [{ + }, + { "objects": [ - { - "created": "2019-10-10T14:43:27.256Z", - "id": "malware--481d22d7-6dd8-4e37-a543-dd21cc1707c4", - "labels": ["backdoor"], - "modified": "2019-10-10T20:25:46.596Z", - "name": "Freenki", - "type": "malware" - } + { + "created": "2019-10-10T14:43:27.256Z", + "id": "malware--481d22d7-6dd8-4e37-a543-dd21cc1707c4", + "labels": [ + "backdoor" + ], + "modified": "2019-10-10T20:25:46.596Z", + "name": "Freenki", + "type": "malware" + } ] - }], - "report":[{ + }, + { "objects": [ - { - "created": "2018-08-03T20:31:05.060Z", - "description": "Sofacy (also known as Fancy Bear, APT 28, STRONTIUM, Pawn Storm) is a highly active actor with a Russian nexus. They have been active since the mid 2000s, and have been responsible for targeted intrusion campaigns against various industry vertical such as but not limited to Aerospace, Defense, Energy, Government and Media. Extensive observation and research of Sofacy's activities over time indicated a profile closely mirroring the strategic interests of the Russian government. More recently, this group has been attributed to the GRU, Russia's premier military intelligence service as reported by the US intelligence community within several declassified public documents.\n\nSeveral high profile intrusions have been publicly linked to the Sofacy group, such as the German Bundestag, France's TV5Monde TV station, the Democratic National Committee, the World Anti-Doping Agency, and the Ukrainian military.", - "id": "report--708d589b-8d99-48fd-bbb6-2d47648f807f", - "labels": ["intrusion-set"], - "modified": "2020-07-30T16:55:21.569Z", - "name": "Sofacy", - "object_refs": [ - "intrusion-set--75ac5bcc-3915-4815-b9a1-bf87277fc343", - "report--2791a5e0-d65a-43c0-936e-c15a6b7ba9d1", - "report--40aaefc2-3fe9-423b-a6eb-55abf11639b7", - "report--2f5734bf-4127-4997-9288-e9c5530aa737", - "report--ffe94621-b007-4115-ad49-fb7c8a26b66a" - ], - "published": "2020-07-30T16:55:21.569Z", - "type": "report" - } + { + "created": "2018-08-03T20:31:05.060Z", + "description": "Sofacy (also known as Fancy Bear, APT 28, STRONTIUM, Pawn Storm) is a highly active actor with a Russian nexus. They have been active since the mid 2000s, and have been responsible for targeted intrusion campaigns against various industry vertical such as but not limited to Aerospace, Defense, Energy, Government and Media. Extensive observation and research of Sofacy's activities over time indicated a profile closely mirroring the strategic interests of the Russian government. More recently, this group has been attributed to the GRU, Russia's premier military intelligence service as reported by the US intelligence community within several declassified public documents.\n\nSeveral high profile intrusions have been publicly linked to the Sofacy group, such as the German Bundestag, France's TV5Monde TV station, the Democratic National Committee, the World Anti-Doping Agency, and the Ukrainian military.", + "id": "report--708d589b-8d99-48fd-bbb6-2d47648f807f", + "labels": [ + "intrusion-set" + ], + "modified": "2020-07-30T16:55:21.569Z", + "name": "Sofacy", + "object_refs": [ + "intrusion-set--75ac5bcc-3915-4815-b9a1-bf87277fc343", + "report--2791a5e0-d65a-43c0-936e-c15a6b7ba9d1", + "report--40aaefc2-3fe9-423b-a6eb-55abf11639b7", + "report--2f5734bf-4127-4997-9288-e9c5530aa737", + "report--ffe94621-b007-4115-ad49-fb7c8a26b66a" + ], + "published": "2020-07-30T16:55:21.569Z", + "type": "report" + } ] - }], - "course-of-action": [{ + }, + { "objects": [ - { - "created": "2020-06-23T19:50:31.722Z", - "description": "Configure antivirus profiles to a value of 'block' for all decoders except imap and pop3 under both Action and WildFire Action. If required by the organization's email implementation, configure imap and pop3 decoders to 'alert' under both Action and WildFire Action.", - "id": "course-of-action--645c6c45-116e-4265-98d2-e30f56325bc6", - "modified": "2020-06-26T13:02:55.803Z", - "name": "Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3'", - "type": "course-of-action", - "x_panw_coa_bp_audit_procedure": "Navigate to `Objects > Security Profiles > Antivirus`\n\nVerify that antivirus profiles have all decoders set to `block` for both `Action` and `Wildfire Action`. If `imap` and `pop3` are required in the organization, verify that the `imap` and `pop3` decoders are set to `alert` for both `Action` and `Wildfire Action`.", - "x_panw_coa_bp_cis_controls": [ - "TITLE:Deploy Network-based Anti-malware Tools CONTROL:v6 8.5 DESCRIPTION:Use network-based anti-malware tools to identify executables in all network traffic and use techniques other than signature-based detection to identify and filter out malicious content before it arrives at the endpoint.;TITLE:Malware Defenses CONTROL:v7 8 DESCRIPTION:Malware Defenses;" - ], - "x_panw_coa_bp_description": "Configure antivirus profiles to a value of 'block' for all decoders except imap and pop3 under both Action and WildFire Action. If required by the organization's email implementation, configure imap and pop3 decoders to 'alert' under both Action and WildFire Action.", - "x_panw_coa_bp_rationale_statement": "Antivirus signatures produce low false positives. By blocking any detected malware through the specified decoders, the threat of malware propagation through the firewall is greatly reduced. It is recommended to mitigate malware found in pop3 and imap through a dedicated antivirus gateway. Due to the nature of the pop3 and imap protocols, the firewall is not able to block only a single email message containing malware. Instead, the entire session would be terminated, potentially affecting benign email messages.", - "x_panw_coa_bp_recommendation_number": "6.1", - "x_panw_coa_bp_references": [ - "\u201cThreat Prevention Deployment Tech Note\u201d - https://live.paloaltonetworks.com/docs/DOC-3094:\u201cPAN-OS Administrator's Guide 9.0 (English) - Security Profiles\u201d - https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles.html" - ], - "x_panw_coa_bp_remediation_procedure": "Navigate to `Objects > Security Profiles > Antivirus.`\n\nSet antivirus profiles to have all decoders set to `block` for both `Action` and `Wildfire Action`. If `imap` and `pop3` are required in the organization, set the `imap` and `pop3` decoders to `alert` for both `Action` and `Wildfire Action`.", - "x_panw_coa_bp_scoring_status": "full", - "x_panw_coa_bp_section_number": "6", - "x_panw_coa_bp_status": "published", - "x_panw_coa_bp_title": "Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3'" - } + { + "created": "2020-06-23T19:50:31.722Z", + "description": "Configure antivirus profiles to a value of 'block' for all decoders except imap and pop3 under both Action and WildFire Action. If required by the organization's email implementation, configure imap and pop3 decoders to 'alert' under both Action and WildFire Action.", + "id": "course-of-action--645c6c45-116e-4265-98d2-e30f56325bc6", + "modified": "2020-06-26T13:02:55.803Z", + "name": "Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3'", + "type": "course-of-action", + "x_panw_coa_bp_audit_procedure": "Navigate to `Objects > Security Profiles > Antivirus`\n\nVerify that antivirus profiles have all decoders set to `block` for both `Action` and `Wildfire Action`. If `imap` and `pop3` are required in the organization, verify that the `imap` and `pop3` decoders are set to `alert` for both `Action` and `Wildfire Action`.", + "x_panw_coa_bp_cis_controls": [ + "TITLE:Deploy Network-based Anti-malware Tools CONTROL:v6 8.5 DESCRIPTION:Use network-based anti-malware tools to identify executables in all network traffic and use techniques other than signature-based detection to identify and filter out malicious content before it arrives at the endpoint.;TITLE:Malware Defenses CONTROL:v7 8 DESCRIPTION:Malware Defenses;" + ], + "x_panw_coa_bp_description": "Configure antivirus profiles to a value of 'block' for all decoders except imap and pop3 under both Action and WildFire Action. If required by the organization's email implementation, configure imap and pop3 decoders to 'alert' under both Action and WildFire Action.", + "x_panw_coa_bp_rationale_statement": "Antivirus signatures produce low false positives. By blocking any detected malware through the specified decoders, the threat of malware propagation through the firewall is greatly reduced. It is recommended to mitigate malware found in pop3 and imap through a dedicated antivirus gateway. Due to the nature of the pop3 and imap protocols, the firewall is not able to block only a single email message containing malware. Instead, the entire session would be terminated, potentially affecting benign email messages.", + "x_panw_coa_bp_recommendation_number": "6.1", + "x_panw_coa_bp_references": [ + "\u201cThreat Prevention Deployment Tech Note\u201d - https://live.paloaltonetworks.com/docs/DOC-3094:\u201cPAN-OS Administrator's Guide 9.0 (English) - Security Profiles\u201d - https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles.html" + ], + "x_panw_coa_bp_remediation_procedure": "Navigate to `Objects > Security Profiles > Antivirus.`\n\nSet antivirus profiles to have all decoders set to `block` for both `Action` and `Wildfire Action`. If `imap` and `pop3` are required in the organization, set the `imap` and `pop3` decoders to `alert` for both `Action` and `Wildfire Action`.", + "x_panw_coa_bp_scoring_status": "full", + "x_panw_coa_bp_section_number": "6", + "x_panw_coa_bp_status": "published", + "x_panw_coa_bp_title": "Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3'" + } ] - }], - "campaign": [{ + }, + { "objects": [ - { - "created": "2018-08-03T21:03:51.484Z", - "description": "In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East. It was carried out by a previously unpublished threat group we track as DarkHydrus. Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016. This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy).", - "first_seen": "2018-07-15T00:00:00.000Z", - "id": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", - "last_seen": "2018-07-16T00:00:00.000Z", - "modified": "2018-08-03T21:03:51.484Z", - "name": "IQY Attachment E-mails", - "type": "campaign" - } + { + "created": "2018-08-03T21:03:51.484Z", + "description": "In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East. It was carried out by a previously unpublished threat group we track as DarkHydrus. Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016. This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy).", + "first_seen": "2018-07-15T00:00:00.000Z", + "id": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", + "last_seen": "2018-07-16T00:00:00.000Z", + "modified": "2018-08-03T21:03:51.484Z", + "name": "IQY Attachment E-mails", + "type": "campaign" + } ] - }], - "intrusion-set": [{ + }, + { "objects": [ - { - "created": "2018-08-03T20:30:50.665Z", - "id": "intrusion-set--8e11eaa4-1964-4b73-85c1-fcfa29159f9b", - "modified": "2018-08-03T20:30:50.665Z", - "name": "OilRig", - "type": "intrusion-set" - } + { + "created": "2018-08-03T20:30:50.665Z", + "id": "intrusion-set--8e11eaa4-1964-4b73-85c1-fcfa29159f9b", + "modified": "2018-08-03T20:30:50.665Z", + "name": "OilRig", + "type": "intrusion-set" + } ] - }], - "tool": [{ + }, + { "objects": [ - { - "type": "tool", - "spec_version": "2.1", - "id": "tool--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", - "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff", - "created": "2016-04-06T20:03:48.000Z", - "modified": "2016-04-06T20:03:48.000Z", - "tool_types": [ "remote-access"], - "name": "VNC" - } + { + "type": "tool", + "spec_version": "2.1", + "id": "tool--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", + "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff", + "created": "2016-04-06T20:03:48.000Z", + "modified": "2016-04-06T20:03:48.000Z", + "tool_types": [ + "remote-access" + ], + "name": "VNC" + } ] - }], - "threat-actor": [{ + }, + { "objects": [ { - "type": "threat-actor", - "spec_version": "2.1", - "id": "threat-actor--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", - "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff", - "created": "2016-04-06T20:03:48.000Z", - "modified": "2016-04-06T20:03:48.000Z", - "threat_actor_types": [ "crime-syndicate"], - "name": "Evil Org", - "description": "The Evil Org threat actor group", - "aliases": ["Syndicate 1", "Evil Syndicate 99"], - "roles": ["director"], - "goals": ["Steal bank money", "Steal credit cards"], - "sophistication": "advanced", - "resource_level": "team", - "primary_motivation": "organizational-gain" - } + "type": "threat-actor", + "spec_version": "2.1", + "id": "threat-actor--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", + "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff", + "created": "2016-04-06T20:03:48.000Z", + "modified": "2016-04-06T20:03:48.000Z", + "threat_actor_types": [ + "crime-syndicate" + ], + "name": "Evil Org", + "description": "The Evil Org threat actor group", + "aliases": [ + "Syndicate 1", + "Evil Syndicate 99" + ], + "roles": [ + "director" + ], + "goals": [ + "Steal bank money", + "Steal credit cards" + ], + "sophistication": "advanced", + "resource_level": "team", + "primary_motivation": "organizational-gain" + } ] - }], - "infrastructure": [{ - "objects": [ - { - "type":"infrastructure", - "spec_version": "2.1", - "id":"infrastructure--38c47d93-d984-4fd9-b87b-d69d0841628d", - "created":"2016-05-07T11:22:30.000Z", - "modified":"2016-05-07T11:22:30.000Z", - "name":"Poison Ivy C2", - "infrastructure_types": ["command-and-control"] - } - ] - }], - "relationship": [{ - "objects": [ - { - "created": "2018-08-03T21:03:51.484Z", - "id": "relationship--01a5a209-b94c-450b-b7f9-946497d91055", - "modified": "2018-08-03T21:03:51.484Z", - "relationship_type": "uses", - "source_ref": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", - "target_ref": "attack-pattern--4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", - "type": "relationship" - }, - { - "created": "2018-08-03T20:31:03.780Z", - "id": "relationship--abc475d9-199c-4623-9e9a-02adf340a415", - "modified": "2018-08-22T12:36:32.248Z", - "relationship_type": "indicates", - "source_ref": "indicator--545928d9-bfe8-4320-bb98-751f38139892", - "target_ref": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", - "type": "relationship" - } - ] - }] -} \ No newline at end of file + }, + { + "objects": [ + { + "type": "infrastructure", + "spec_version": "2.1", + "id": "infrastructure--38c47d93-d984-4fd9-b87b-d69d0841628d", + "created": "2016-05-07T11:22:30.000Z", + "modified": "2016-05-07T11:22:30.000Z", + "name": "Poison Ivy C2", + "infrastructure_types": [ + "command-and-control" + ] + } + ] + }, + { + "objects": [ + { + "created": "2018-08-03T21:03:51.484Z", + "id": "relationship--01a5a209-b94c-450b-b7f9-946497d91055", + "modified": "2018-08-03T21:03:51.484Z", + "relationship_type": "uses", + "source_ref": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", + "target_ref": "attack-pattern--4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", + "type": "relationship" + }, + { + "created": "2018-08-03T20:31:03.780Z", + "id": "relationship--abc475d9-199c-4623-9e9a-02adf340a415", + "modified": "2018-08-22T12:36:32.248Z", + "relationship_type": "indicates", + "source_ref": "indicator--545928d9-bfe8-4320-bb98-751f38139892", + "target_ref": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", + "type": "relationship" + } + ] + } +] \ No newline at end of file diff --git a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/objects_envelopes_v21.json b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/objects_envelopes_v21.json index c6364062233c..bd77afa8790c 100644 --- a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/objects_envelopes_v21.json +++ b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/objects_envelopes_v21.json @@ -1,281 +1,326 @@ -{ - "indicator": { +[ + { "objects": [ - { - "created": "2018-04-23T17:01:01.248Z", - "id": "indicator--545928d9-bfe8-4320-bb98-751f38139892", - "labels": ["malicious-activity"], - "modified": "2018-04-23T17:01:01.248Z", - "name": "windows-updates.com", - "pattern": "[domain-name:value = 'windows-updates.com']", - "type": "indicator", - "valid_from": "2018-04-23T17:01:01.248Z" + { + "created": "2018-04-23T17:01:01.248Z", + "id": "indicator--545928d9-bfe8-4320-bb98-751f38139892", + "labels": [ + "malicious-activity" + ], + "modified": "2018-04-23T17:01:01.248Z", + "name": "windows-updates.com", + "pattern": "[domain-name:value = 'windows-updates.com']", + "type": "indicator", + "valid_from": "2018-04-23T17:01:01.248Z" } - ] + ], + "more": true }, - "attack-pattern": { + { "objects": [ + { + "created": "2017-10-25T14:48:11.535Z", + "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", + "description": "An adversary could call standard operating system APIs from a malicious application to gather contact list (i.e., address book) data, or with escalated privileges could directly access files containing contact list data.", + "external_references": [ + { + "external_id": "T1432", + "source_name": "mitre-mobile-attack", + "url": "https://attack.mitre.org/techniques/T1432" + }, + { + "external_id": "APP-13", + "source_name": "NIST Mobile Threat Catalogue", + "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html" + } + ], + "id": "attack-pattern--4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", + "kill_chain_phases": [ { - "created": "2017-10-25T14:48:11.535Z", - "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", - "description": "An adversary could call standard operating system APIs from a malicious application to gather contact list (i.e., address book) data, or with escalated privileges could directly access files containing contact list data.", - "external_references": [ - { - "external_id": "T1432", - "source_name": "mitre-mobile-attack", - "url": "https://attack.mitre.org/techniques/T1432" - }, - { - "external_id": "APP-13", - "source_name": "NIST Mobile Threat Catalogue", - "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-13.html" - } - ], - "id": "attack-pattern--4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", - "kill_chain_phases": [ - { - "kill_chain_name": "lockheed", - "phase_name": "act-on-objectives" - }, - { - "kill_chain_name": "mitre-mobile-attack", - "phase_name": "collection" - } - ], - "modified": "2018-10-17T00:14:20.652Z", - "name": "T1432: Access Contact List (Mobile)", - "object_marking_refs": [ - "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" - ], - "type": "attack-pattern", - "x_mitre_detection": "On both Android (6.0 and up) and iOS, the user can view which applications have permission to access contact list information through the device settings screen, and the user can choose to revoke the permissions.", - "x_mitre_platforms": ["Android", "iOS"], - "x_mitre_version": "1.0" - }, + "kill_chain_name": "lockheed", + "phase_name": "act-on-objectives" + }, + { + "kill_chain_name": "mitre-mobile-attack", + "phase_name": "collection" + } + ], + "modified": "2018-10-17T00:14:20.652Z", + "name": "T1432: Access Contact List (Mobile)", + "object_marking_refs": [ + "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" + ], + "type": "attack-pattern", + "x_mitre_detection": "On both Android (6.0 and up) and iOS, the user can view which applications have permission to access contact list information through the device settings screen, and the user can choose to revoke the permissions.", + "x_mitre_platforms": [ + "Android", + "iOS" + ], + "x_mitre_version": "1.0" + }, { - "created": "2020-02-05T14:17:46.686Z", - "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", - "description": "Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) \n\nUtilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, (Citation: Wikipedia Exe Compression) but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses. ", - "external_references": [ - { - "external_id": "T1027.002", - "source_name": "mitre-attack", - "url": "https://attack.mitre.org/techniques/T1027/002" - }, - { - "external_id": "CAPEC-570", - "source_name": "capec", - "url": "https://example.example.com/data/definitions/570.html" - }, - { - "description": "Kafka, F. (2018, January). ESET's Guide to Deobfuscating and Devirtualizing FinFisher. Retrieved August 12, 2019.", - "source_name": "ESET FinFisher Jan 2018", - "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf" - }, - { - "description": "Executable compression. (n.d.). Retrieved December 4, 2014.", - "source_name": "Wikipedia Exe Compression", - "url": "http://en.wikipedia.org/wiki/Executable_compression" - } - ], - "id": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062", - "kill_chain_phases": [ - { - "kill_chain_name": "lockheed", - "phase_name": "installation" - }, - { - "kill_chain_name": "mitre-attack", - "phase_name": "defense-evasion" - } - ], - "modified": "2020-02-05T20:05:41.548Z", - "name": "T1027.002: Software Packing", - "object_marking_refs": ["marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"], - "type": "attack-pattern", - "x_mitre_contributors": ["Filip Kafka, ESET"], - "x_mitre_data_sources": ["File: File Content", "File: File Metadata"], - "x_mitre_defense_bypassed": [ - "Anti-virus", - "Heuristic detection", - "Signature-based detection"], - "x_mitre_detection": "Use file scanning to look for known software packers or artifacts of packing techniques. Packing is not a definitive indicator of malicious activity, because legitimate software may use packing techniques to reduce binary size or to protect proprietary code.", - "x_mitre_is_subtechnique": true, - "x_mitre_platforms": ["macOS", "Windows"], - "x_mitre_version": "1.0", - "x_panw_parent_technique": "Obfuscated Files or Information", - "x_panw_parent_technique_subtechnique": "Obfuscated Files or Information: Software Packing" - }, + "created": "2020-02-05T14:17:46.686Z", + "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", + "description": "Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) \n\nUtilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, (Citation: Wikipedia Exe Compression) but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses. ", + "external_references": [ + { + "external_id": "T1027.002", + "source_name": "mitre-attack", + "url": "https://attack.mitre.org/techniques/T1027/002" + }, + { + "external_id": "CAPEC-570", + "source_name": "capec", + "url": "https://example.example.com/data/definitions/570.html" + }, + { + "description": "Kafka, F. (2018, January). ESET's Guide to Deobfuscating and Devirtualizing FinFisher. Retrieved August 12, 2019.", + "source_name": "ESET FinFisher Jan 2018", + "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf" + }, + { + "description": "Executable compression. (n.d.). Retrieved December 4, 2014.", + "source_name": "Wikipedia Exe Compression", + "url": "http://en.wikipedia.org/wiki/Executable_compression" + } + ], + "id": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062", + "kill_chain_phases": [ + { + "kill_chain_name": "lockheed", + "phase_name": "installation" + }, + { + "kill_chain_name": "mitre-attack", + "phase_name": "defense-evasion" + } + ], + "modified": "2020-02-05T20:05:41.548Z", + "name": "T1027.002: Software Packing", + "object_marking_refs": [ + "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" + ], + "type": "attack-pattern", + "x_mitre_contributors": [ + "Filip Kafka, ESET" + ], + "x_mitre_data_sources": [ + "File: File Content", + "File: File Metadata" + ], + "x_mitre_defense_bypassed": [ + "Anti-virus", + "Heuristic detection", + "Signature-based detection" + ], + "x_mitre_detection": "Use file scanning to look for known software packers or artifacts of packing techniques. Packing is not a definitive indicator of malicious activity, because legitimate software may use packing techniques to reduce binary size or to protect proprietary code.", + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "macOS", + "Windows" + ], + "x_mitre_version": "1.0", + "x_panw_parent_technique": "Obfuscated Files or Information", + "x_panw_parent_technique_subtechnique": "Obfuscated Files or Information: Software Packing" + }, { - "created": "2021-10-21T16:56:05.840605Z", - "created_by_ref": "identity--749249c0-f7c7-5428-a4ad-ea5e1627a221", - "description": "This schema adds TIM data to the object", - "extension_types": [ - "property-extension" - ], - "id": "extension-definition--fc572b8c-bbe3-444b-b40b-06d3b890cd79", - "modified": "2021-10-21T16:56:17.747194Z", - "name": "Cortex XSOAR TIM Attack Pattern", - "schema": "https://github.com/demisto/content/tree/master/Packs/TAXIIServer/doc_files/XSOAR_indicator_schema.json", - "spec_version": "2.0", - "type": "extension-definition", - "version": "1.0" - } - ] + "created": "2021-10-21T16:56:05.840605Z", + "created_by_ref": "identity--749249c0-f7c7-5428-a4ad-ea5e1627a221", + "description": "This schema adds TIM data to the object", + "extension_types": [ + "property-extension" + ], + "id": "extension-definition--fc572b8c-bbe3-444b-b40b-06d3b890cd79", + "modified": "2021-10-21T16:56:17.747194Z", + "name": "Cortex XSOAR TIM Attack Pattern", + "schema": "https://github.com/demisto/content/tree/master/Packs/TAXIIServer/doc_files/XSOAR_indicator_schema.json", + "spec_version": "2.0", + "type": "extension-definition", + "version": "1.0" + } + ], + "more": true }, - "malware": { + { "objects": [ - { - "created": "2019-10-10T14:43:27.256Z", - "id": "malware--481d22d7-6dd8-4e37-a543-dd21cc1707c4", - "labels": ["backdoor"], - "modified": "2019-10-10T20:25:46.596Z", - "name": "Freenki", - "type": "malware" - } - ] + { + "created": "2019-10-10T14:43:27.256Z", + "id": "malware--481d22d7-6dd8-4e37-a543-dd21cc1707c4", + "labels": [ + "backdoor" + ], + "modified": "2019-10-10T20:25:46.596Z", + "name": "Freenki", + "type": "malware" + } + ], + "more": true }, - "report":{ + { "objects": [ - { - "created": "2018-08-03T20:31:05.060Z", - "description": "Sofacy (also known as Fancy Bear, APT 28, STRONTIUM, Pawn Storm) is a highly active actor with a Russian nexus. They have been active since the mid 2000s, and have been responsible for targeted intrusion campaigns against various industry vertical such as but not limited to Aerospace, Defense, Energy, Government and Media. Extensive observation and research of Sofacy's activities over time indicated a profile closely mirroring the strategic interests of the Russian government. More recently, this group has been attributed to the GRU, Russia's premier military intelligence service as reported by the US intelligence community within several declassified public documents.\n\nSeveral high profile intrusions have been publicly linked to the Sofacy group, such as the German Bundestag, France's TV5Monde TV station, the Democratic National Committee, the World Anti-Doping Agency, and the Ukrainian military.", - "id": "report--708d589b-8d99-48fd-bbb6-2d47648f807f", - "labels": ["intrusion-set"], - "modified": "2020-07-30T16:55:21.569Z", - "name": "Sofacy", - "object_refs": [ - "intrusion-set--75ac5bcc-3915-4815-b9a1-bf87277fc343", - "report--2791a5e0-d65a-43c0-936e-c15a6b7ba9d1", - "report--40aaefc2-3fe9-423b-a6eb-55abf11639b7", - "report--2f5734bf-4127-4997-9288-e9c5530aa737", - "report--ffe94621-b007-4115-ad49-fb7c8a26b66a" - ], - "published": "2020-07-30T16:55:21.569Z", - "type": "report" - } - ] + { + "created": "2018-08-03T20:31:05.060Z", + "description": "Sofacy (also known as Fancy Bear, APT 28, STRONTIUM, Pawn Storm) is a highly active actor with a Russian nexus. They have been active since the mid 2000s, and have been responsible for targeted intrusion campaigns against various industry vertical such as but not limited to Aerospace, Defense, Energy, Government and Media. Extensive observation and research of Sofacy's activities over time indicated a profile closely mirroring the strategic interests of the Russian government. More recently, this group has been attributed to the GRU, Russia's premier military intelligence service as reported by the US intelligence community within several declassified public documents.\n\nSeveral high profile intrusions have been publicly linked to the Sofacy group, such as the German Bundestag, France's TV5Monde TV station, the Democratic National Committee, the World Anti-Doping Agency, and the Ukrainian military.", + "id": "report--708d589b-8d99-48fd-bbb6-2d47648f807f", + "labels": [ + "intrusion-set" + ], + "modified": "2020-07-30T16:55:21.569Z", + "name": "Sofacy", + "object_refs": [ + "intrusion-set--75ac5bcc-3915-4815-b9a1-bf87277fc343", + "report--2791a5e0-d65a-43c0-936e-c15a6b7ba9d1", + "report--40aaefc2-3fe9-423b-a6eb-55abf11639b7", + "report--2f5734bf-4127-4997-9288-e9c5530aa737", + "report--ffe94621-b007-4115-ad49-fb7c8a26b66a" + ], + "published": "2020-07-30T16:55:21.569Z", + "type": "report" + } + ], + "more": true }, - "course-of-action": { + { "objects": [ - { - "created": "2020-06-23T19:50:31.722Z", - "description": "Configure antivirus profiles to a value of 'block' for all decoders except imap and pop3 under both Action and WildFire Action. If required by the organization's email implementation, configure imap and pop3 decoders to 'alert' under both Action and WildFire Action.", - "id": "course-of-action--645c6c45-116e-4265-98d2-e30f56325bc6", - "modified": "2020-06-26T13:02:55.803Z", - "name": "Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3'", - "type": "course-of-action", - "x_panw_coa_bp_audit_procedure": "Navigate to `Objects > Security Profiles > Antivirus`\n\nVerify that antivirus profiles have all decoders set to `block` for both `Action` and `Wildfire Action`. If `imap` and `pop3` are required in the organization, verify that the `imap` and `pop3` decoders are set to `alert` for both `Action` and `Wildfire Action`.", - "x_panw_coa_bp_cis_controls": [ - "TITLE:Deploy Network-based Anti-malware Tools CONTROL:v6 8.5 DESCRIPTION:Use network-based anti-malware tools to identify executables in all network traffic and use techniques other than signature-based detection to identify and filter out malicious content before it arrives at the endpoint.;TITLE:Malware Defenses CONTROL:v7 8 DESCRIPTION:Malware Defenses;" - ], - "x_panw_coa_bp_description": "Configure antivirus profiles to a value of 'block' for all decoders except imap and pop3 under both Action and WildFire Action. If required by the organization's email implementation, configure imap and pop3 decoders to 'alert' under both Action and WildFire Action.", - "x_panw_coa_bp_rationale_statement": "Antivirus signatures produce low false positives. By blocking any detected malware through the specified decoders, the threat of malware propagation through the firewall is greatly reduced. It is recommended to mitigate malware found in pop3 and imap through a dedicated antivirus gateway. Due to the nature of the pop3 and imap protocols, the firewall is not able to block only a single email message containing malware. Instead, the entire session would be terminated, potentially affecting benign email messages.", - "x_panw_coa_bp_recommendation_number": "6.1", - "x_panw_coa_bp_references": [ - "\u201cThreat Prevention Deployment Tech Note\u201d - https://live.paloaltonetworks.com/docs/DOC-3094:\u201cPAN-OS Administrator's Guide 9.0 (English) - Security Profiles\u201d - https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles.html" - ], - "x_panw_coa_bp_remediation_procedure": "Navigate to `Objects > Security Profiles > Antivirus.`\n\nSet antivirus profiles to have all decoders set to `block` for both `Action` and `Wildfire Action`. If `imap` and `pop3` are required in the organization, set the `imap` and `pop3` decoders to `alert` for both `Action` and `Wildfire Action`.", - "x_panw_coa_bp_scoring_status": "full", - "x_panw_coa_bp_section_number": "6", - "x_panw_coa_bp_status": "published", - "x_panw_coa_bp_title": "Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3'" - } - ] + { + "created": "2020-06-23T19:50:31.722Z", + "description": "Configure antivirus profiles to a value of 'block' for all decoders except imap and pop3 under both Action and WildFire Action. If required by the organization's email implementation, configure imap and pop3 decoders to 'alert' under both Action and WildFire Action.", + "id": "course-of-action--645c6c45-116e-4265-98d2-e30f56325bc6", + "modified": "2020-06-26T13:02:55.803Z", + "name": "Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3'", + "type": "course-of-action", + "x_panw_coa_bp_audit_procedure": "Navigate to `Objects > Security Profiles > Antivirus`\n\nVerify that antivirus profiles have all decoders set to `block` for both `Action` and `Wildfire Action`. If `imap` and `pop3` are required in the organization, verify that the `imap` and `pop3` decoders are set to `alert` for both `Action` and `Wildfire Action`.", + "x_panw_coa_bp_cis_controls": [ + "TITLE:Deploy Network-based Anti-malware Tools CONTROL:v6 8.5 DESCRIPTION:Use network-based anti-malware tools to identify executables in all network traffic and use techniques other than signature-based detection to identify and filter out malicious content before it arrives at the endpoint.;TITLE:Malware Defenses CONTROL:v7 8 DESCRIPTION:Malware Defenses;" + ], + "x_panw_coa_bp_description": "Configure antivirus profiles to a value of 'block' for all decoders except imap and pop3 under both Action and WildFire Action. If required by the organization's email implementation, configure imap and pop3 decoders to 'alert' under both Action and WildFire Action.", + "x_panw_coa_bp_rationale_statement": "Antivirus signatures produce low false positives. By blocking any detected malware through the specified decoders, the threat of malware propagation through the firewall is greatly reduced. It is recommended to mitigate malware found in pop3 and imap through a dedicated antivirus gateway. Due to the nature of the pop3 and imap protocols, the firewall is not able to block only a single email message containing malware. Instead, the entire session would be terminated, potentially affecting benign email messages.", + "x_panw_coa_bp_recommendation_number": "6.1", + "x_panw_coa_bp_references": [ + "\u201cThreat Prevention Deployment Tech Note\u201d - https://live.paloaltonetworks.com/docs/DOC-3094:\u201cPAN-OS Administrator's Guide 9.0 (English) - Security Profiles\u201d - https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles.html" + ], + "x_panw_coa_bp_remediation_procedure": "Navigate to `Objects > Security Profiles > Antivirus.`\n\nSet antivirus profiles to have all decoders set to `block` for both `Action` and `Wildfire Action`. If `imap` and `pop3` are required in the organization, set the `imap` and `pop3` decoders to `alert` for both `Action` and `Wildfire Action`.", + "x_panw_coa_bp_scoring_status": "full", + "x_panw_coa_bp_section_number": "6", + "x_panw_coa_bp_status": "published", + "x_panw_coa_bp_title": "Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3'" + } + ], + "more": true }, - "campaign": { + { "objects": [ - { - "created": "2018-08-03T21:03:51.484Z", - "description": "In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East. It was carried out by a previously unpublished threat group we track as DarkHydrus. Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016. This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy).", - "first_seen": "2018-07-15T00:00:00.000Z", - "id": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", - "last_seen": "2018-07-16T00:00:00.000Z", - "modified": "2018-08-03T21:03:51.484Z", - "name": "IQY Attachment E-mails", - "type": "campaign" - } - ] + { + "created": "2018-08-03T21:03:51.484Z", + "description": "In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East. It was carried out by a previously unpublished threat group we track as DarkHydrus. Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016. This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy).", + "first_seen": "2018-07-15T00:00:00.000Z", + "id": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", + "last_seen": "2018-07-16T00:00:00.000Z", + "modified": "2018-08-03T21:03:51.484Z", + "name": "IQY Attachment E-mails", + "type": "campaign" + } + ], + "more": true }, - "intrusion-set": { + { "objects": [ - { - "created": "2018-08-03T20:30:50.665Z", - "id": "intrusion-set--8e11eaa4-1964-4b73-85c1-fcfa29159f9b", - "modified": "2018-08-03T20:30:50.665Z", - "name": "OilRig", - "type": "intrusion-set" - } - ] + { + "created": "2018-08-03T20:30:50.665Z", + "id": "intrusion-set--8e11eaa4-1964-4b73-85c1-fcfa29159f9b", + "modified": "2018-08-03T20:30:50.665Z", + "name": "OilRig", + "type": "intrusion-set" + } + ], + "more": true }, - "tool": { + { "objects": [ - { - "type": "tool", - "spec_version": "2.1", - "id": "tool--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", - "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff", - "created": "2016-04-06T20:03:48.000Z", - "modified": "2016-04-06T20:03:48.000Z", - "tool_types": [ "remote-access"], - "name": "VNC" - } - ] + { + "type": "tool", + "spec_version": "2.1", + "id": "tool--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", + "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff", + "created": "2016-04-06T20:03:48.000Z", + "modified": "2016-04-06T20:03:48.000Z", + "tool_types": [ + "remote-access" + ], + "name": "VNC" + } + ], + "more": true }, - "threat-actor": { + { "objects": [ { - "type": "threat-actor", - "spec_version": "2.1", - "id": "threat-actor--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", - "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff", - "created": "2016-04-06T20:03:48.000Z", - "modified": "2016-04-06T20:03:48.000Z", - "threat_actor_types": [ "crime-syndicate"], - "name": "Evil Org", - "description": "The Evil Org threat actor group", - "aliases": ["Syndicate 1", "Evil Syndicate 99"], - "roles": ["director"], - "goals": ["Steal bank money", "Steal credit cards"], - "sophistication": "advanced", - "resource_level": "team", - "primary_motivation": "organizational-gain" - } - ] + "type": "threat-actor", + "spec_version": "2.1", + "id": "threat-actor--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f", + "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff", + "created": "2016-04-06T20:03:48.000Z", + "modified": "2016-04-06T20:03:48.000Z", + "threat_actor_types": [ + "crime-syndicate" + ], + "name": "Evil Org", + "description": "The Evil Org threat actor group", + "aliases": [ + "Syndicate 1", + "Evil Syndicate 99" + ], + "roles": [ + "director" + ], + "goals": [ + "Steal bank money", + "Steal credit cards" + ], + "sophistication": "advanced", + "resource_level": "team", + "primary_motivation": "organizational-gain" + } + ], + "more": true }, - "infrastructure": { - "objects": [ - { - "type":"infrastructure", - "spec_version": "2.1", - "id":"infrastructure--38c47d93-d984-4fd9-b87b-d69d0841628d", - "created":"2016-05-07T11:22:30.000Z", - "modified":"2016-05-07T11:22:30.000Z", - "name":"Poison Ivy C2", - "infrastructure_types": ["command-and-control"] - } - ] + { + "objects": [ + { + "type": "infrastructure", + "spec_version": "2.1", + "id": "infrastructure--38c47d93-d984-4fd9-b87b-d69d0841628d", + "created": "2016-05-07T11:22:30.000Z", + "modified": "2016-05-07T11:22:30.000Z", + "name": "Poison Ivy C2", + "infrastructure_types": [ + "command-and-control" + ] + } + ], + "more": true }, - "relationship": { - "objects": [ - { - "created": "2018-08-03T21:03:51.484Z", - "id": "relationship--01a5a209-b94c-450b-b7f9-946497d91055", - "modified": "2018-08-03T21:03:51.484Z", - "relationship_type": "uses", - "source_ref": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", - "target_ref": "attack-pattern--4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", - "type": "relationship" - }, - { - "created": "2018-08-03T20:31:03.780Z", - "id": "relationship--abc475d9-199c-4623-9e9a-02adf340a415", - "modified": "2018-08-22T12:36:32.248Z", - "relationship_type": "indicates", - "source_ref": "indicator--545928d9-bfe8-4320-bb98-751f38139892", - "target_ref": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", - "type": "relationship" - } - ] + { + "objects": [ + { + "created": "2018-08-03T21:03:51.484Z", + "id": "relationship--01a5a209-b94c-450b-b7f9-946497d91055", + "modified": "2018-08-03T21:03:51.484Z", + "relationship_type": "uses", + "source_ref": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", + "target_ref": "attack-pattern--4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", + "type": "relationship" + }, + { + "created": "2018-08-03T20:31:03.780Z", + "id": "relationship--abc475d9-199c-4623-9e9a-02adf340a415", + "modified": "2018-08-22T12:36:32.248Z", + "relationship_type": "indicates", + "source_ref": "indicator--545928d9-bfe8-4320-bb98-751f38139892", + "target_ref": "campaign--6320584e-3ef0-4a72-aaf8-0a49fa1d477c", + "type": "relationship" + } + ], + "more": false } -} \ No newline at end of file +] \ No newline at end of file diff --git a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_17-19.json b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_17-19.json index 7bf5797fe341..77a5a68ab1e5 100644 --- a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_17-19.json +++ b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_17-19.json @@ -1,433 +1,435 @@ -{ - "objects": [ - { - "id": "indicator--86fee2b1-807d-423d-9d0e-1117bab576ce", - "pattern": "[ipv4-addr:value = '195.123.227.186']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:33.126Z", - "modified": "2020-06-10T01:14:33.126Z", - "name": "bot_ip: 195.123.227.186", - "description": "TS ID: 55694549840; iType: bot_ip; Date First: 2020-06-05T08:42:19.170Z; State: active; Org: Layer6 Networks; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.779852Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--891207b3-bff4-4bc2-8c12-7fd2321c9f38", - "pattern": "[ipv4-addr:value = '134.209.37.102']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:52.501Z", - "modified": "2020-06-10T01:14:52.501Z", - "name": "bot_ip: 134.209.37.102", - "description": "TS ID: 55682983162; iType: bot_ip; Date First: 2020-06-02T07:26:06.274Z; State: active; Org: Covidien Lp; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.722754Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--8c726d5f-cb6b-45dc-8c2b-2be8596043cf", - "pattern": "[ipv4-addr:value = '117.141.112.155']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:54.684Z", - "modified": "2020-06-10T01:14:54.684Z", - "name": "bot_ip: 117.141.112.155", - "description": "TS ID: 55694549819; iType: bot_ip; Date First: 2020-06-05T08:42:17.907Z; State: active; Org: China Mobile Guangdong; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.775627Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--8e19a19c-cd66-4278-8bfb-c05c64977d12", - "pattern": "[ipv4-addr:value = '23.129.64.217']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:19.858Z", - "modified": "2020-06-10T01:14:19.858Z", - "name": "bot_ip: 23.129.64.217", - "description": "TS ID: 55682983514; iType: bot_ip; Date First: 2020-06-02T07:26:46.206Z; State: active; Org: Emerald Onion; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.731573Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--90a4f95d-1e35-4f47-b303-5651c93457f4", - "pattern": "[ipv4-addr:value = '45.142.213.11']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:10.753Z", - "modified": "2020-06-10T01:14:10.753Z", - "name": "bot_ip: 45.142.213.11", - "description": "TS ID: 55694549856; iType: bot_ip; Date First: 2020-06-05T08:45:37.178Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.808281Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--94f109aa-3ef2-4a8c-a847-dfb4c64f4f29", - "pattern": "[ipv4-addr:value = '157.245.250.190']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:15.950Z", - "modified": "2020-06-10T01:14:15.950Z", - "name": "bot_ip: 157.245.250.190", - "description": "TS ID: 55697907923; iType: bot_ip; Date First: 2020-06-06T09:32:01.051Z; State: active; Org: Datalogic ADC; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.818576Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--96d1737a-5565-49ac-8a91-52c2c7b38903", - "pattern": "[ipv4-addr:value = '144.91.106.47']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:15:00.764Z", - "modified": "2020-06-10T01:15:00.764Z", - "name": "bot_ip: 144.91.106.47", - "description": "TS ID: 55694549829; iType: bot_ip; Date First: 2020-06-05T08:44:22.790Z; State: active; Org: Mills College; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.791474Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--9c98d81b-b4a5-4b8d-8fd6-4b9beec0f1be", - "pattern": "[ipv4-addr:value = '141.98.81.208']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:39.995Z", - "modified": "2020-06-10T01:14:39.995Z", - "name": "bot_ip: 141.98.81.208", - "description": "TS ID: 55691320102; iType: bot_ip; Date First: 2020-06-04T10:33:13.398Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.766866Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--9cbf82af-8a54-478a-af76-b88a73a33d37", - "pattern": "[ipv4-addr:value = '51.81.53.159']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:15:01.999Z", - "modified": "2020-06-10T01:15:01.999Z", - "name": "bot_ip: 51.81.53.159", - "description": "TS ID: 55694549861; iType: bot_ip; Date First: 2020-06-05T08:42:44.478Z; State: active; Org: OVH SAS; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.781286Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--9ee9aecd-89e6-4dd6-9a24-4c610b33ebbb", - "pattern": "[ipv4-addr:value = '104.168.173.252']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:58.530Z", - "modified": "2020-06-10T01:14:58.530Z", - "name": "bot_ip: 104.168.173.252", - "description": "TS ID: 55691320097; iType: bot_ip; Date First: 2020-06-04T10:32:46.612Z; State: active; Org: Hostwinds LLC.; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.753603Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--9febf107-dd82-4727-bcb7-199291ec474c", - "pattern": "[ipv4-addr:value = '173.212.206.89']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:34.822Z", - "modified": "2020-06-10T01:14:34.822Z", - "name": "bot_ip: 173.212.206.89", - "description": "TS ID: 55697907953; iType: bot_ip; Date First: 2020-06-06T09:31:54.190Z; State: active; Org: Contabo GmbH; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.814015Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--a25904c8-0270-4d57-add5-64f5ed1485b5", - "pattern": "[ipv4-addr:value = '67.207.94.201']", - "confidence": 15, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:29.751Z", - "modified": "2020-06-10T01:14:29.751Z", - "name": "bot_ip: 67.207.94.201", - "description": "TS ID: 55697908164; iType: bot_ip; Date First: 2020-06-06T09:32:30.450Z; State: active; Org: Digital Ocean; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.837493Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--a5a1408d-ff8b-41b2-8c57-6678aa0c8688", - "pattern": "[ipv4-addr:value = '89.163.242.76']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:35.839Z", - "modified": "2020-06-10T01:14:35.839Z", - "name": "bot_ip: 89.163.242.76", - "description": "TS ID: 55694549874; iType: bot_ip; Date First: 2020-06-05T08:45:20.346Z; State: active; Org: myLoc managed IT AG; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.800264Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--a8cc5b11-3bbb-4fb2-970c-31a6f58e1374", - "pattern": "[ipv4-addr:value = '51.75.71.205']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:41.919Z", - "modified": "2020-06-10T01:14:41.919Z", - "name": "bot_ip: 51.75.71.205", - "description": "TS ID: 55686993979; iType: bot_ip; Date First: 2020-06-03T07:29:11.148Z; State: active; Org: OVH SAS; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.73608Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--a8ee1e5f-8c08-4135-878c-4973179cbac5", - "pattern": "[ipv4-addr:value = '140.224.183.58']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:11.651Z", - "modified": "2020-06-10T01:14:11.651Z", - "name": "bot_ip: 140.224.183.58", - "description": "TS ID: 55694549823; iType: bot_ip; Date First: 2020-06-05T08:45:24.055Z; State: active; Org: China Telecom FUJIAN NETWORK; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.801661Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--aa4ec99f-3c54-4e60-ab47-83ff78d76570", - "pattern": "[ipv4-addr:value = '161.35.22.86']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:49.620Z", - "modified": "2020-06-10T01:14:49.620Z", - "name": "bot_ip: 161.35.22.86", - "description": "TS ID: 55697907934; iType: bot_ip; Date First: 2020-06-06T09:32:22.615Z; State: active; Org: Racal-Redac; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.831549Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--ac4a9ca5-9f6e-4072-b568-46dbb03a3ace", - "pattern": "[ipv4-addr:value = '45.143.220.246']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:15:10.905Z", - "modified": "2020-06-10T01:15:10.905Z", - "name": "bot_ip: 45.143.220.246", - "description": "TS ID: 55691320117; iType: bot_ip; Date First: 2020-06-04T10:32:46.584Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.752185Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82", - "created": "2017-01-20T00:00:00.000Z", - "definition_type": "tlp", - "definition": { - "tlp": "amber" +[ + { + "objects": [ + { + "id": "indicator--86fee2b1-807d-423d-9d0e-1117bab576ce", + "pattern": "[ipv4-addr:value = '195.123.227.186']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:33.126Z", + "modified": "2020-06-10T01:14:33.126Z", + "name": "bot_ip: 195.123.227.186", + "description": "TS ID: 55694549840; iType: bot_ip; Date First: 2020-06-05T08:42:19.170Z; State: active; Org: Layer6 Networks; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.779852Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" }, - "type": "marking-definition", - "spec_version": "2.1" - }, - { - "id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da", - "created": "2017-01-20T00:00:00.000Z", - "definition_type": "tlp", - "definition": { - "tlp": "green" + { + "id": "indicator--891207b3-bff4-4bc2-8c12-7fd2321c9f38", + "pattern": "[ipv4-addr:value = '134.209.37.102']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:52.501Z", + "modified": "2020-06-10T01:14:52.501Z", + "name": "bot_ip: 134.209.37.102", + "description": "TS ID: 55682983162; iType: bot_ip; Date First: 2020-06-02T07:26:06.274Z; State: active; Org: Covidien Lp; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.722754Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" }, - "type": "marking-definition", - "spec_version": "2.1" - } - ], - "more": false -} + { + "id": "indicator--8c726d5f-cb6b-45dc-8c2b-2be8596043cf", + "pattern": "[ipv4-addr:value = '117.141.112.155']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:54.684Z", + "modified": "2020-06-10T01:14:54.684Z", + "name": "bot_ip: 117.141.112.155", + "description": "TS ID: 55694549819; iType: bot_ip; Date First: 2020-06-05T08:42:17.907Z; State: active; Org: China Mobile Guangdong; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.775627Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--8e19a19c-cd66-4278-8bfb-c05c64977d12", + "pattern": "[ipv4-addr:value = '23.129.64.217']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:19.858Z", + "modified": "2020-06-10T01:14:19.858Z", + "name": "bot_ip: 23.129.64.217", + "description": "TS ID: 55682983514; iType: bot_ip; Date First: 2020-06-02T07:26:46.206Z; State: active; Org: Emerald Onion; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.731573Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--90a4f95d-1e35-4f47-b303-5651c93457f4", + "pattern": "[ipv4-addr:value = '45.142.213.11']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:10.753Z", + "modified": "2020-06-10T01:14:10.753Z", + "name": "bot_ip: 45.142.213.11", + "description": "TS ID: 55694549856; iType: bot_ip; Date First: 2020-06-05T08:45:37.178Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.808281Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--94f109aa-3ef2-4a8c-a847-dfb4c64f4f29", + "pattern": "[ipv4-addr:value = '157.245.250.190']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:15.950Z", + "modified": "2020-06-10T01:14:15.950Z", + "name": "bot_ip: 157.245.250.190", + "description": "TS ID: 55697907923; iType: bot_ip; Date First: 2020-06-06T09:32:01.051Z; State: active; Org: Datalogic ADC; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.818576Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--96d1737a-5565-49ac-8a91-52c2c7b38903", + "pattern": "[ipv4-addr:value = '144.91.106.47']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:15:00.764Z", + "modified": "2020-06-10T01:15:00.764Z", + "name": "bot_ip: 144.91.106.47", + "description": "TS ID: 55694549829; iType: bot_ip; Date First: 2020-06-05T08:44:22.790Z; State: active; Org: Mills College; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.791474Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--9c98d81b-b4a5-4b8d-8fd6-4b9beec0f1be", + "pattern": "[ipv4-addr:value = '141.98.81.208']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:39.995Z", + "modified": "2020-06-10T01:14:39.995Z", + "name": "bot_ip: 141.98.81.208", + "description": "TS ID: 55691320102; iType: bot_ip; Date First: 2020-06-04T10:33:13.398Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.766866Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--9cbf82af-8a54-478a-af76-b88a73a33d37", + "pattern": "[ipv4-addr:value = '51.81.53.159']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:15:01.999Z", + "modified": "2020-06-10T01:15:01.999Z", + "name": "bot_ip: 51.81.53.159", + "description": "TS ID: 55694549861; iType: bot_ip; Date First: 2020-06-05T08:42:44.478Z; State: active; Org: OVH SAS; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.781286Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--9ee9aecd-89e6-4dd6-9a24-4c610b33ebbb", + "pattern": "[ipv4-addr:value = '104.168.173.252']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:58.530Z", + "modified": "2020-06-10T01:14:58.530Z", + "name": "bot_ip: 104.168.173.252", + "description": "TS ID: 55691320097; iType: bot_ip; Date First: 2020-06-04T10:32:46.612Z; State: active; Org: Hostwinds LLC.; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.753603Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--9febf107-dd82-4727-bcb7-199291ec474c", + "pattern": "[ipv4-addr:value = '173.212.206.89']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:34.822Z", + "modified": "2020-06-10T01:14:34.822Z", + "name": "bot_ip: 173.212.206.89", + "description": "TS ID: 55697907953; iType: bot_ip; Date First: 2020-06-06T09:31:54.190Z; State: active; Org: Contabo GmbH; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.814015Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--a25904c8-0270-4d57-add5-64f5ed1485b5", + "pattern": "[ipv4-addr:value = '67.207.94.201']", + "confidence": 15, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:29.751Z", + "modified": "2020-06-10T01:14:29.751Z", + "name": "bot_ip: 67.207.94.201", + "description": "TS ID: 55697908164; iType: bot_ip; Date First: 2020-06-06T09:32:30.450Z; State: active; Org: Digital Ocean; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.837493Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--a5a1408d-ff8b-41b2-8c57-6678aa0c8688", + "pattern": "[ipv4-addr:value = '89.163.242.76']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:35.839Z", + "modified": "2020-06-10T01:14:35.839Z", + "name": "bot_ip: 89.163.242.76", + "description": "TS ID: 55694549874; iType: bot_ip; Date First: 2020-06-05T08:45:20.346Z; State: active; Org: myLoc managed IT AG; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.800264Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--a8cc5b11-3bbb-4fb2-970c-31a6f58e1374", + "pattern": "[ipv4-addr:value = '51.75.71.205']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:41.919Z", + "modified": "2020-06-10T01:14:41.919Z", + "name": "bot_ip: 51.75.71.205", + "description": "TS ID: 55686993979; iType: bot_ip; Date First: 2020-06-03T07:29:11.148Z; State: active; Org: OVH SAS; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.73608Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--a8ee1e5f-8c08-4135-878c-4973179cbac5", + "pattern": "[ipv4-addr:value = '140.224.183.58']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:11.651Z", + "modified": "2020-06-10T01:14:11.651Z", + "name": "bot_ip: 140.224.183.58", + "description": "TS ID: 55694549823; iType: bot_ip; Date First: 2020-06-05T08:45:24.055Z; State: active; Org: China Telecom FUJIAN NETWORK; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.801661Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--aa4ec99f-3c54-4e60-ab47-83ff78d76570", + "pattern": "[ipv4-addr:value = '161.35.22.86']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:49.620Z", + "modified": "2020-06-10T01:14:49.620Z", + "name": "bot_ip: 161.35.22.86", + "description": "TS ID: 55697907934; iType: bot_ip; Date First: 2020-06-06T09:32:22.615Z; State: active; Org: Racal-Redac; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.831549Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--ac4a9ca5-9f6e-4072-b568-46dbb03a3ace", + "pattern": "[ipv4-addr:value = '45.143.220.246']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:15:10.905Z", + "modified": "2020-06-10T01:15:10.905Z", + "name": "bot_ip: 45.143.220.246", + "description": "TS ID: 55691320117; iType: bot_ip; Date First: 2020-06-04T10:32:46.584Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.752185Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82", + "created": "2017-01-20T00:00:00.000Z", + "definition_type": "tlp", + "definition": { + "tlp": "amber" + }, + "type": "marking-definition", + "spec_version": "2.1" + }, + { + "id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da", + "created": "2017-01-20T00:00:00.000Z", + "definition_type": "tlp", + "definition": { + "tlp": "green" + }, + "type": "marking-definition", + "spec_version": "2.1" + } + ], + "more": false + } +] diff --git a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_complex_20-19.json b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_complex_20-19.json index 5acaa155427a..53d1edab2468 100644 --- a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_complex_20-19.json +++ b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_complex_20-19.json @@ -1,433 +1,435 @@ -{ - "objects": [ - { - "id": "indicator--86fee2b1-807d-423d-9d0e-1117bab576ce", - "pattern": "[ipv4-addr:value = '195.123.227.186' AND ipv4-addr:value = '1.1.1.1']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:33.126Z", - "modified": "2020-06-10T01:14:33.126Z", - "name": "bot_ip: 195.123.227.186", - "description": "TS ID: 55694549840; iType: bot_ip; Date First: 2020-06-05T08:42:19.170Z; State: active; Org: Layer6 Networks; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.779852Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--891207b3-bff4-4bc2-8c12-7fd2321c9f38", - "pattern": "[ipv4-addr:value = '134.209.37.102' OR ipv4-addr:value = '2.2.2.2']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:52.501Z", - "modified": "2020-06-10T01:14:52.501Z", - "name": "bot_ip: 134.209.37.102", - "description": "TS ID: 55682983162; iType: bot_ip; Date First: 2020-06-02T07:26:06.274Z; State: active; Org: Covidien Lp; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.722754Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--8c726d5f-cb6b-45dc-8c2b-2be8596043cf", - "pattern": "[ipv4-addr:value = '117.141.112.155' FOLLOWEDBY ipv4-addr:value = '3.3.3.3']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:54.684Z", - "modified": "2020-06-10T01:14:54.684Z", - "name": "bot_ip: 117.141.112.155", - "description": "TS ID: 55694549819; iType: bot_ip; Date First: 2020-06-05T08:42:17.907Z; State: active; Org: China Mobile Guangdong; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.775627Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--8e19a19c-cd66-4278-8bfb-c05c64977d12", - "pattern": "[ipv4-addr:value = '23.129.64.217']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:19.858Z", - "modified": "2020-06-10T01:14:19.858Z", - "name": "bot_ip: 23.129.64.217", - "description": "TS ID: 55682983514; iType: bot_ip; Date First: 2020-06-02T07:26:46.206Z; State: active; Org: Emerald Onion; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.731573Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--90a4f95d-1e35-4f47-b303-5651c93457f4", - "pattern": "[ipv4-addr:value = '45.142.213.11']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:10.753Z", - "modified": "2020-06-10T01:14:10.753Z", - "name": "bot_ip: 45.142.213.11", - "description": "TS ID: 55694549856; iType: bot_ip; Date First: 2020-06-05T08:45:37.178Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.808281Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--94f109aa-3ef2-4a8c-a847-dfb4c64f4f29", - "pattern": "[ipv4-addr:value = '157.245.250.190']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:15.950Z", - "modified": "2020-06-10T01:14:15.950Z", - "name": "bot_ip: 157.245.250.190", - "description": "TS ID: 55697907923; iType: bot_ip; Date First: 2020-06-06T09:32:01.051Z; State: active; Org: Datalogic ADC; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.818576Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--96d1737a-5565-49ac-8a91-52c2c7b38903", - "pattern": "[ipv4-addr:value = '144.91.106.47']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:15:00.764Z", - "modified": "2020-06-10T01:15:00.764Z", - "name": "bot_ip: 144.91.106.47", - "description": "TS ID: 55694549829; iType: bot_ip; Date First: 2020-06-05T08:44:22.790Z; State: active; Org: Mills College; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.791474Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--9c98d81b-b4a5-4b8d-8fd6-4b9beec0f1be", - "pattern": "[ipv4-addr:value = '141.98.81.208']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:39.995Z", - "modified": "2020-06-10T01:14:39.995Z", - "name": "bot_ip: 141.98.81.208", - "description": "TS ID: 55691320102; iType: bot_ip; Date First: 2020-06-04T10:33:13.398Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.766866Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--9cbf82af-8a54-478a-af76-b88a73a33d37", - "pattern": "[ipv4-addr:value = '51.81.53.159']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:15:01.999Z", - "modified": "2020-06-10T01:15:01.999Z", - "name": "bot_ip: 51.81.53.159", - "description": "TS ID: 55694549861; iType: bot_ip; Date First: 2020-06-05T08:42:44.478Z; State: active; Org: OVH SAS; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.781286Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--9ee9aecd-89e6-4dd6-9a24-4c610b33ebbb", - "pattern": "[ipv4-addr:value = '104.168.173.252']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:58.530Z", - "modified": "2020-06-10T01:14:58.530Z", - "name": "bot_ip: 104.168.173.252", - "description": "TS ID: 55691320097; iType: bot_ip; Date First: 2020-06-04T10:32:46.612Z; State: active; Org: Hostwinds LLC.; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.753603Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--9febf107-dd82-4727-bcb7-199291ec474c", - "pattern": "[ipv4-addr:value = '173.212.206.89']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:34.822Z", - "modified": "2020-06-10T01:14:34.822Z", - "name": "bot_ip: 173.212.206.89", - "description": "TS ID: 55697907953; iType: bot_ip; Date First: 2020-06-06T09:31:54.190Z; State: active; Org: Contabo GmbH; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.814015Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--a25904c8-0270-4d57-add5-64f5ed1485b5", - "pattern": "[ipv4-addr:value = '67.207.94.201']", - "confidence": 15, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:29.751Z", - "modified": "2020-06-10T01:14:29.751Z", - "name": "bot_ip: 67.207.94.201", - "description": "TS ID: 55697908164; iType: bot_ip; Date First: 2020-06-06T09:32:30.450Z; State: active; Org: Digital Ocean; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.837493Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--a5a1408d-ff8b-41b2-8c57-6678aa0c8688", - "pattern": "[ipv4-addr:value = '89.163.242.76']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:35.839Z", - "modified": "2020-06-10T01:14:35.839Z", - "name": "bot_ip: 89.163.242.76", - "description": "TS ID: 55694549874; iType: bot_ip; Date First: 2020-06-05T08:45:20.346Z; State: active; Org: myLoc managed IT AG; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.800264Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--a8cc5b11-3bbb-4fb2-970c-31a6f58e1374", - "pattern": "[ipv4-addr:value = '51.75.71.205']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:41.919Z", - "modified": "2020-06-10T01:14:41.919Z", - "name": "bot_ip: 51.75.71.205", - "description": "TS ID: 55686993979; iType: bot_ip; Date First: 2020-06-03T07:29:11.148Z; State: active; Org: OVH SAS; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.73608Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--a8ee1e5f-8c08-4135-878c-4973179cbac5", - "pattern": "[ipv4-addr:value = '140.224.183.58']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:11.651Z", - "modified": "2020-06-10T01:14:11.651Z", - "name": "bot_ip: 140.224.183.58", - "description": "TS ID: 55694549823; iType: bot_ip; Date First: 2020-06-05T08:45:24.055Z; State: active; Org: China Telecom FUJIAN NETWORK; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.801661Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--aa4ec99f-3c54-4e60-ab47-83ff78d76570", - "pattern": "[ipv4-addr:value = '161.35.22.86']", - "confidence": 85, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:14:49.620Z", - "modified": "2020-06-10T01:14:49.620Z", - "name": "bot_ip: 161.35.22.86", - "description": "TS ID: 55697907934; iType: bot_ip; Date First: 2020-06-06T09:32:22.615Z; State: active; Org: Racal-Redac; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.831549Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "indicator--ac4a9ca5-9f6e-4072-b568-46dbb03a3ace", - "pattern": "[ipv4-addr:value = '45.143.220.246']", - "confidence": 50, - "lang": "en", - "type": "indicator", - "created": "2020-06-10T01:15:10.905Z", - "modified": "2020-06-10T01:15:10.905Z", - "name": "bot_ip: 45.143.220.246", - "description": "TS ID: 55691320117; iType: bot_ip; Date First: 2020-06-04T10:32:46.584Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", - "valid_from": "2020-06-10T01:00:33.752185Z", - "pattern_type": "stix", - "object_marking_refs": [ - "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" - ], - "labels": [ - "low" - ], - "indicator_types": [ - "anomalous-activity" - ], - "pattern_version": "2.1", - "spec_version": "2.1" - }, - { - "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82", - "created": "2017-01-20T00:00:00.000Z", - "definition_type": "tlp", - "definition": { - "tlp": "amber" +[ + { + "objects": [ + { + "id": "indicator--86fee2b1-807d-423d-9d0e-1117bab576ce", + "pattern": "[ipv4-addr:value = '195.123.227.186' AND ipv4-addr:value = '1.1.1.1']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:33.126Z", + "modified": "2020-06-10T01:14:33.126Z", + "name": "bot_ip: 195.123.227.186", + "description": "TS ID: 55694549840; iType: bot_ip; Date First: 2020-06-05T08:42:19.170Z; State: active; Org: Layer6 Networks; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.779852Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" }, - "type": "marking-definition", - "spec_version": "2.1" - }, - { - "id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da", - "created": "2017-01-20T00:00:00.000Z", - "definition_type": "tlp", - "definition": { - "tlp": "green" + { + "id": "indicator--891207b3-bff4-4bc2-8c12-7fd2321c9f38", + "pattern": "[ipv4-addr:value = '134.209.37.102' OR ipv4-addr:value = '2.2.2.2']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:52.501Z", + "modified": "2020-06-10T01:14:52.501Z", + "name": "bot_ip: 134.209.37.102", + "description": "TS ID: 55682983162; iType: bot_ip; Date First: 2020-06-02T07:26:06.274Z; State: active; Org: Covidien Lp; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.722754Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" }, - "type": "marking-definition", - "spec_version": "2.1" - } - ], - "more": false -} + { + "id": "indicator--8c726d5f-cb6b-45dc-8c2b-2be8596043cf", + "pattern": "[ipv4-addr:value = '117.141.112.155' FOLLOWEDBY ipv4-addr:value = '3.3.3.3']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:54.684Z", + "modified": "2020-06-10T01:14:54.684Z", + "name": "bot_ip: 117.141.112.155", + "description": "TS ID: 55694549819; iType: bot_ip; Date First: 2020-06-05T08:42:17.907Z; State: active; Org: China Mobile Guangdong; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.775627Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--8e19a19c-cd66-4278-8bfb-c05c64977d12", + "pattern": "[ipv4-addr:value = '23.129.64.217']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:19.858Z", + "modified": "2020-06-10T01:14:19.858Z", + "name": "bot_ip: 23.129.64.217", + "description": "TS ID: 55682983514; iType: bot_ip; Date First: 2020-06-02T07:26:46.206Z; State: active; Org: Emerald Onion; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.731573Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--90a4f95d-1e35-4f47-b303-5651c93457f4", + "pattern": "[ipv4-addr:value = '45.142.213.11']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:10.753Z", + "modified": "2020-06-10T01:14:10.753Z", + "name": "bot_ip: 45.142.213.11", + "description": "TS ID: 55694549856; iType: bot_ip; Date First: 2020-06-05T08:45:37.178Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.808281Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--94f109aa-3ef2-4a8c-a847-dfb4c64f4f29", + "pattern": "[ipv4-addr:value = '157.245.250.190']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:15.950Z", + "modified": "2020-06-10T01:14:15.950Z", + "name": "bot_ip: 157.245.250.190", + "description": "TS ID: 55697907923; iType: bot_ip; Date First: 2020-06-06T09:32:01.051Z; State: active; Org: Datalogic ADC; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.818576Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--96d1737a-5565-49ac-8a91-52c2c7b38903", + "pattern": "[ipv4-addr:value = '144.91.106.47']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:15:00.764Z", + "modified": "2020-06-10T01:15:00.764Z", + "name": "bot_ip: 144.91.106.47", + "description": "TS ID: 55694549829; iType: bot_ip; Date First: 2020-06-05T08:44:22.790Z; State: active; Org: Mills College; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.791474Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--9c98d81b-b4a5-4b8d-8fd6-4b9beec0f1be", + "pattern": "[ipv4-addr:value = '141.98.81.208']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:39.995Z", + "modified": "2020-06-10T01:14:39.995Z", + "name": "bot_ip: 141.98.81.208", + "description": "TS ID: 55691320102; iType: bot_ip; Date First: 2020-06-04T10:33:13.398Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.766866Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--9cbf82af-8a54-478a-af76-b88a73a33d37", + "pattern": "[ipv4-addr:value = '51.81.53.159']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:15:01.999Z", + "modified": "2020-06-10T01:15:01.999Z", + "name": "bot_ip: 51.81.53.159", + "description": "TS ID: 55694549861; iType: bot_ip; Date First: 2020-06-05T08:42:44.478Z; State: active; Org: OVH SAS; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.781286Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--9ee9aecd-89e6-4dd6-9a24-4c610b33ebbb", + "pattern": "[ipv4-addr:value = '104.168.173.252']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:58.530Z", + "modified": "2020-06-10T01:14:58.530Z", + "name": "bot_ip: 104.168.173.252", + "description": "TS ID: 55691320097; iType: bot_ip; Date First: 2020-06-04T10:32:46.612Z; State: active; Org: Hostwinds LLC.; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.753603Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--9febf107-dd82-4727-bcb7-199291ec474c", + "pattern": "[ipv4-addr:value = '173.212.206.89']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:34.822Z", + "modified": "2020-06-10T01:14:34.822Z", + "name": "bot_ip: 173.212.206.89", + "description": "TS ID: 55697907953; iType: bot_ip; Date First: 2020-06-06T09:31:54.190Z; State: active; Org: Contabo GmbH; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.814015Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--a25904c8-0270-4d57-add5-64f5ed1485b5", + "pattern": "[ipv4-addr:value = '67.207.94.201']", + "confidence": 15, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:29.751Z", + "modified": "2020-06-10T01:14:29.751Z", + "name": "bot_ip: 67.207.94.201", + "description": "TS ID: 55697908164; iType: bot_ip; Date First: 2020-06-06T09:32:30.450Z; State: active; Org: Digital Ocean; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.837493Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--a5a1408d-ff8b-41b2-8c57-6678aa0c8688", + "pattern": "[ipv4-addr:value = '89.163.242.76']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:35.839Z", + "modified": "2020-06-10T01:14:35.839Z", + "name": "bot_ip: 89.163.242.76", + "description": "TS ID: 55694549874; iType: bot_ip; Date First: 2020-06-05T08:45:20.346Z; State: active; Org: myLoc managed IT AG; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.800264Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--a8cc5b11-3bbb-4fb2-970c-31a6f58e1374", + "pattern": "[ipv4-addr:value = '51.75.71.205']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:41.919Z", + "modified": "2020-06-10T01:14:41.919Z", + "name": "bot_ip: 51.75.71.205", + "description": "TS ID: 55686993979; iType: bot_ip; Date First: 2020-06-03T07:29:11.148Z; State: active; Org: OVH SAS; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.73608Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--a8ee1e5f-8c08-4135-878c-4973179cbac5", + "pattern": "[ipv4-addr:value = '140.224.183.58']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:11.651Z", + "modified": "2020-06-10T01:14:11.651Z", + "name": "bot_ip: 140.224.183.58", + "description": "TS ID: 55694549823; iType: bot_ip; Date First: 2020-06-05T08:45:24.055Z; State: active; Org: China Telecom FUJIAN NETWORK; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.801661Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--aa4ec99f-3c54-4e60-ab47-83ff78d76570", + "pattern": "[ipv4-addr:value = '161.35.22.86']", + "confidence": 85, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:14:49.620Z", + "modified": "2020-06-10T01:14:49.620Z", + "name": "bot_ip: 161.35.22.86", + "description": "TS ID: 55697907934; iType: bot_ip; Date First: 2020-06-06T09:32:22.615Z; State: active; Org: Racal-Redac; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.831549Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "indicator--ac4a9ca5-9f6e-4072-b568-46dbb03a3ace", + "pattern": "[ipv4-addr:value = '45.143.220.246']", + "confidence": 50, + "lang": "en", + "type": "indicator", + "created": "2020-06-10T01:15:10.905Z", + "modified": "2020-06-10T01:15:10.905Z", + "name": "bot_ip: 45.143.220.246", + "description": "TS ID: 55691320117; iType: bot_ip; Date First: 2020-06-04T10:32:46.584Z; State: active; Source: Emerging Threats - Compromised; MoreDetail: imported by user 668", + "valid_from": "2020-06-10T01:00:33.752185Z", + "pattern_type": "stix", + "object_marking_refs": [ + "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + ], + "labels": [ + "low" + ], + "indicator_types": [ + "anomalous-activity" + ], + "pattern_version": "2.1", + "spec_version": "2.1" + }, + { + "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82", + "created": "2017-01-20T00:00:00.000Z", + "definition_type": "tlp", + "definition": { + "tlp": "amber" + }, + "type": "marking-definition", + "spec_version": "2.1" + }, + { + "id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da", + "created": "2017-01-20T00:00:00.000Z", + "definition_type": "tlp", + "definition": { + "tlp": "green" + }, + "type": "marking-definition", + "spec_version": "2.1" + } + ], + "more": false + } +] diff --git a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_no_indicators.json b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_no_indicators.json index 880413ab4b21..2106847d2956 100644 --- a/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_no_indicators.json +++ b/Packs/ApiModules/Scripts/TAXII2ApiModule/test_data/stix_envelope_no_indicators.json @@ -1,25 +1,27 @@ -{ - "objects": [ - { - "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82", - "created": "2017-01-20T00:00:00.000Z", - "definition_type": "tlp", - "definition": { - "tlp": "amber" +[ + { + "objects": [ + { + "id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82", + "created": "2017-01-20T00:00:00.000Z", + "definition_type": "tlp", + "definition": { + "tlp": "amber" + }, + "type": "marking-definition", + "spec_version": "2.1" }, - "type": "marking-definition", - "spec_version": "2.1" - }, - { - "id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da", - "created": "2017-01-20T00:00:00.000Z", - "definition_type": "tlp", - "definition": { - "tlp": "green" - }, - "type": "marking-definition", - "spec_version": "2.1" - } - ], - "more": false -} + { + "id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da", + "created": "2017-01-20T00:00:00.000Z", + "definition_type": "tlp", + "definition": { + "tlp": "green" + }, + "type": "marking-definition", + "spec_version": "2.1" + } + ], + "more": false + } +] diff --git a/Packs/ApiModules/pack_metadata.json b/Packs/ApiModules/pack_metadata.json index f4677b94d096..0a78c013cbdc 100644 --- a/Packs/ApiModules/pack_metadata.json +++ b/Packs/ApiModules/pack_metadata.json @@ -2,7 +2,7 @@ "name": "ApiModules", "description": "API Modules", "support": "xsoar", - "currentVersion": "2.2.11", + "currentVersion": "2.2.12", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AppNovi/Integrations/appNovi/appNovi.yml b/Packs/AppNovi/Integrations/appNovi/appNovi.yml index c9fef59d0b6d..c09577acff8e 100644 --- a/Packs/AppNovi/Integrations/appNovi/appNovi.yml +++ b/Packs/AppNovi/Integrations/appNovi/appNovi.yml @@ -401,7 +401,7 @@ script: type: textArea description: Server IP to search description: Search for servers using IP address - dockerimage: demisto/python3:3.10.8.37753 + dockerimage: demisto/python3:3.10.9.40422 tests: - No tests (auto formatted) fromversion: 6.5.0 diff --git a/Packs/AppNovi/ReleaseNotes/1_0_1.md b/Packs/AppNovi/ReleaseNotes/1_0_1.md new file mode 100644 index 000000000000..52dfc8748a7e --- /dev/null +++ b/Packs/AppNovi/ReleaseNotes/1_0_1.md @@ -0,0 +1,3 @@ +#### Integrations +##### appNovi +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AppNovi/pack_metadata.json b/Packs/AppNovi/pack_metadata.json index 1a40944c0035..f8d5c1c1f02d 100644 --- a/Packs/AppNovi/pack_metadata.json +++ b/Packs/AppNovi/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AppNovi", "description": "Search your combined security data in appNovi via simplified search or search via the appNovi security graph.", "support": "partner", - "currentVersion": "1.0.0", + "currentVersion": "1.0.1", "author": "appNovi", "url": "https://appnovi.com/support", "email": "", diff --git a/Packs/Arcanna/Integrations/ArcannaAI/ArcannaAI.yml b/Packs/Arcanna/Integrations/ArcannaAI/ArcannaAI.yml index 4fb95369563b..a8eda98aafbb 100644 --- a/Packs/Arcanna/Integrations/ArcannaAI/ArcannaAI.yml +++ b/Packs/Arcanna/Integrations/ArcannaAI/ArcannaAI.yml @@ -249,7 +249,7 @@ script: - contextPath: Arcanna.FeedbackField description: XSOAR field used to signal feedback/label for Arcanna. type: String - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/Arcanna/ReleaseNotes/1_1_5.md b/Packs/Arcanna/ReleaseNotes/1_1_5.md new file mode 100644 index 000000000000..64a7a98a893d --- /dev/null +++ b/Packs/Arcanna/ReleaseNotes/1_1_5.md @@ -0,0 +1,3 @@ +#### Integrations +##### Arcanna.AI +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/Arcanna/pack_metadata.json b/Packs/Arcanna/pack_metadata.json index 05c10001cab9..8649d83ee404 100644 --- a/Packs/Arcanna/pack_metadata.json +++ b/Packs/Arcanna/pack_metadata.json @@ -2,7 +2,7 @@ "name": "ArcannaAI", "description": "Siscale Arcanna.Ai Cognitive automation platform that provides AI assistance to IT & Cybersecurity teams", "support": "partner", - "currentVersion": "1.1.4", + "currentVersion": "1.1.5", "author": "Siscale Engineering", "created": "2021-06-16T20:46:43Z", "url": "https://www.arcanna.ai/contact", diff --git a/Packs/ArcherRSA/Integrations/ArcherV2/ArcherV2.yml b/Packs/ArcherRSA/Integrations/ArcherV2/ArcherV2.yml index 1e1cf900b9cb..4cec518b5d66 100644 --- a/Packs/ArcherRSA/Integrations/ArcherV2/ArcherV2.yml +++ b/Packs/ArcherRSA/Integrations/ArcherV2/ArcherV2.yml @@ -423,7 +423,7 @@ script: - arguments: [] description: Prints the Archer's integration cache. name: archer-print-cache - dockerimage: demisto/python3:3.10.8.37753 + dockerimage: demisto/python3:3.10.9.40422 isfetch: true runonce: false script: '' diff --git a/Packs/ArcherRSA/ReleaseNotes/1_2_4.md b/Packs/ArcherRSA/ReleaseNotes/1_2_4.md new file mode 100644 index 000000000000..70e6e2baa737 --- /dev/null +++ b/Packs/ArcherRSA/ReleaseNotes/1_2_4.md @@ -0,0 +1,3 @@ +#### Integrations +##### RSA Archer v2 +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/ArcherRSA/pack_metadata.json b/Packs/ArcherRSA/pack_metadata.json index b30a3a0c16c2..80cc9f30e677 100644 --- a/Packs/ArcherRSA/pack_metadata.json +++ b/Packs/ArcherRSA/pack_metadata.json @@ -2,7 +2,7 @@ "name": "RSA Archer", "description": "The RSA Archer GRC Platform provides a common foundation for managing policies, controls, risks, assessments and deficiencies across lines of business.", "support": "xsoar", - "currentVersion": "1.2.3", + "currentVersion": "1.2.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/ArcusTeam/Integrations/ArcusTeam/ArcusTeam.yml b/Packs/ArcusTeam/Integrations/ArcusTeam/ArcusTeam.yml index 7ea2dc167029..48a9c9a4a626 100644 --- a/Packs/ArcusTeam/Integrations/ArcusTeam/ArcusTeam.yml +++ b/Packs/ArcusTeam/Integrations/ArcusTeam/ArcusTeam.yml @@ -171,7 +171,7 @@ script: description: CVE url type: string description: ' Retrieve CVEs for an ArcusTeam device' - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 runonce: false subtype: python3 fromversion: 6.0.0 diff --git a/Packs/ArcusTeam/ReleaseNotes/1_0_5.md b/Packs/ArcusTeam/ReleaseNotes/1_0_5.md new file mode 100644 index 000000000000..2cb8702d43d3 --- /dev/null +++ b/Packs/ArcusTeam/ReleaseNotes/1_0_5.md @@ -0,0 +1,3 @@ +#### Integrations +##### ArcusTeam +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/ArcusTeam/pack_metadata.json b/Packs/ArcusTeam/pack_metadata.json index 1c01f2c402a0..91341ebe6e47 100644 --- a/Packs/ArcusTeam/pack_metadata.json +++ b/Packs/ArcusTeam/pack_metadata.json @@ -2,7 +2,7 @@ "name": "ArcusTeam", "description": "ArcusTeam's DeviceTotal Platform helps to identify and manage vulnerabilities found on IoT devices", "support": "partner", - "currentVersion": "1.0.4", + "currentVersion": "1.0.5", "author": "ArcusTeam", "url": "https://arcusteam.com/pa-partnership/", "email": "support@arcusteam.com", diff --git a/Packs/Arduino/Integrations/Arduino/Arduino.yml b/Packs/Arduino/Integrations/Arduino/Arduino.yml index efbf60574cd4..5b2dfd995a28 100644 --- a/Packs/Arduino/Integrations/Arduino/Arduino.yml +++ b/Packs/Arduino/Integrations/Arduino/Arduino.yml @@ -123,7 +123,7 @@ script: - contextPath: Arduino.DataSend.Received description: The data received type: string - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 runonce: false script: '' subtype: python3 diff --git a/Packs/Arduino/ReleaseNotes/1_0_7.md b/Packs/Arduino/ReleaseNotes/1_0_7.md new file mode 100644 index 000000000000..4da7b58cfb41 --- /dev/null +++ b/Packs/Arduino/ReleaseNotes/1_0_7.md @@ -0,0 +1,3 @@ +#### Integrations +##### Arduino +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/Arduino/pack_metadata.json b/Packs/Arduino/pack_metadata.json index 2c2afad9e658..3732e7a7697f 100644 --- a/Packs/Arduino/pack_metadata.json +++ b/Packs/Arduino/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Arduino", "description": "Communicate with an Arduino over a network. Sample code for the Arduino is provided to get up and running. There are functions in the Arduino code to handle setting and getting pin values as well as arbitrary data.", "support": "community", - "currentVersion": "1.0.6", + "currentVersion": "1.0.7", "author": "Adam Burt", "url": "", "email": "", diff --git a/Packs/Arkime/Integrations/Arkime/Arkime.yml b/Packs/Arkime/Integrations/Arkime/Arkime.yml index 07af9452d9cc..d9020d4e0676 100644 --- a/Packs/Arkime/Integrations/Arkime/Arkime.yml +++ b/Packs/Arkime/Integrations/Arkime/Arkime.yml @@ -29,7 +29,7 @@ script: script: '' type: python subtype: python3 - dockerimage: demisto/python3:3.10.8.39276 + dockerimage: demisto/python3:3.10.9.40422 isfetch: false commands: - name: arkime-connection-list diff --git a/Packs/Arkime/ReleaseNotes/1_0_8.md b/Packs/Arkime/ReleaseNotes/1_0_8.md new file mode 100644 index 000000000000..0f78d1d6cf21 --- /dev/null +++ b/Packs/Arkime/ReleaseNotes/1_0_8.md @@ -0,0 +1,3 @@ +#### Integrations +##### Arkime +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/Arkime/pack_metadata.json b/Packs/Arkime/pack_metadata.json index f6446c8aa85a..ab01594acf21 100644 --- a/Packs/Arkime/pack_metadata.json +++ b/Packs/Arkime/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Arkime", "description": "Arkime (formerly Moloch) is a large scale, open source, indexed packet capture and search tool.", "support": "xsoar", - "currentVersion": "1.0.7", + "currentVersion": "1.0.8", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Armis/pack_metadata.json b/Packs/Armis/pack_metadata.json index a66e7c81e922..c5852414ad53 100755 --- a/Packs/Armis/pack_metadata.json +++ b/Packs/Armis/pack_metadata.json @@ -9,9 +9,7 @@ "categories": [ "Network Security" ], - "tags": [ - "marketplacev2:Data Source" - ], + "tags": [], "created": "2021-01-02T18:00:53Z", "useCases": [], "keywords": [], diff --git a/Packs/Armorblox/pack_metadata.json b/Packs/Armorblox/pack_metadata.json index 53116c2f50e4..1e20ecd8ce88 100644 --- a/Packs/Armorblox/pack_metadata.json +++ b/Packs/Armorblox/pack_metadata.json @@ -10,9 +10,7 @@ "categories": [ "Analytics & SIEM" ], - "tags": [ - "marketplacev2:Data Source" - ], + "tags": [], "useCases": [], "keywords": [ "Email Security", diff --git a/Packs/AtlassianConfluenceCloud/Integrations/AtlassianConfluenceCloud/AtlassianConfluenceCloud.py b/Packs/AtlassianConfluenceCloud/Integrations/AtlassianConfluenceCloud/AtlassianConfluenceCloud.py index 597e16a649d6..e38d47b3267f 100644 --- a/Packs/AtlassianConfluenceCloud/Integrations/AtlassianConfluenceCloud/AtlassianConfluenceCloud.py +++ b/Packs/AtlassianConfluenceCloud/Integrations/AtlassianConfluenceCloud/AtlassianConfluenceCloud.py @@ -7,9 +7,10 @@ from CommonServerUserPython import * # noqa import requests +import urllib3 # Disable insecure warnings -requests.packages.urllib3.disable_warnings() # pylint: disable=no-member +urllib3.disable_warnings() # pylint: disable=no-member ''' CONSTANTS ''' diff --git a/Packs/AtlassianConfluenceCloud/Integrations/AtlassianConfluenceCloud/AtlassianConfluenceCloud.yml b/Packs/AtlassianConfluenceCloud/Integrations/AtlassianConfluenceCloud/AtlassianConfluenceCloud.yml index b18678be58fe..5ac39e665bb4 100644 --- a/Packs/AtlassianConfluenceCloud/Integrations/AtlassianConfluenceCloud/AtlassianConfluenceCloud.yml +++ b/Packs/AtlassianConfluenceCloud/Integrations/AtlassianConfluenceCloud/AtlassianConfluenceCloud.yml @@ -2140,7 +2140,7 @@ script: - contextPath: ConfluenceCloud.Group._links.self description: Link to the group. type: String - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/AtlassianConfluenceCloud/ReleaseNotes/1_0_5.md b/Packs/AtlassianConfluenceCloud/ReleaseNotes/1_0_5.md new file mode 100644 index 000000000000..a10b253c5bda --- /dev/null +++ b/Packs/AtlassianConfluenceCloud/ReleaseNotes/1_0_5.md @@ -0,0 +1,3 @@ +#### Integrations +##### Atlassian Confluence Cloud +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AtlassianConfluenceCloud/pack_metadata.json b/Packs/AtlassianConfluenceCloud/pack_metadata.json index 452b80dbc251..155067f79eea 100644 --- a/Packs/AtlassianConfluenceCloud/pack_metadata.json +++ b/Packs/AtlassianConfluenceCloud/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Atlassian Confluence Cloud", "description": "Atlassian Confluence Cloud allows users to interact with confluence entities like content, space, users and groups. Users can also manage the space permissions.", "support": "xsoar", - "currentVersion": "1.0.4", + "currentVersion": "1.0.5", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Auditd/.pack-ignore b/Packs/Auditd/.pack-ignore new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/Packs/Auditd/.secrets-ignore b/Packs/Auditd/.secrets-ignore new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3.xif b/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3.xif new file mode 100644 index 000000000000..22019683f21f --- /dev/null +++ b/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3.xif @@ -0,0 +1,28 @@ +[MODEL:dataset="unix_auditd_raw"] +alter eventid = arrayindex(regextract(_raw_log, "audit\([^\:]+\:([^\)]+)"),0), +hostname = arrayindex(regextract(_raw_log ,"\w+\s\d+\s\d+\:\d+\:\d+\s(\w+)\s"),0), +type = arrayindex(regextract(_raw_log , "type\=([^\s]+)"),0), +ses = arrayindex(regextract(_raw_log ,"\sses\=(\S+)\s"),0), +res = arrayindex(regextract(_raw_log ,"\sres\=([a-zA-Z0-9\-\_]+)"),0), +success = arrayindex(regextract(_raw_log ,"\ssuccess\=(\S+)\s"),0), +key = arrayindex(regextract(_raw_log ,"\skey\=\"([^\"]+)\""),0), +op = arrayindex(regextract(_raw_log ,"\sop\=PAM\:(\S+)\s"),0), +acct = arrayindex(regextract(_raw_log ,"\sacct\=\"*([^\"]+)\"*\s"),0), +uid = arrayindex(regextract(_raw_log ,"\suid\=(\S+)\s"),0), +addr = arrayindex(regextract(_raw_log ,"\saddr\=(\d+\.\d+\.\d+\.\d+)\s"),0), +pid = arrayindex(regextract(_raw_log ,"\spid\=(\S+)\s"),0), +comm = arrayindex(regextract(_raw_log ,"\scomm\=\"*([^\"]+)\"*\s"),0), +exe = arrayindex(regextract(_raw_log ,"\sexe\=\"*([^\"]+)\"*\s"),0) +| alter + xdm.event.id = eventid, + xdm.event.type = type, + xdm.session_context_id = ses, + xdm.event.outcome = coalesce(res,success), + xdm.event.operation = coalesce(op,key), + xdm.source.user.username = acct, + xdm.source.user.identifier = uid, + xdm.source.ipv4 = addr, + xdm.source.process.pid = to_number(pid), + xdm.source.host.hostname = hostname, + xdm.source.process.command_line = comm, + xdm.source.process.executable.path = exe; \ No newline at end of file diff --git a/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3.yml b/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3.yml new file mode 100644 index 000000000000..4652b51dcdd6 --- /dev/null +++ b/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3.yml @@ -0,0 +1,6 @@ +fromversion: 6.10.0 +id: unix_auditd_modeling_rule +name: Unix Auditd Modeling Rule +rules: '' +schema: '' +tags: Unix Auditd \ No newline at end of file diff --git a/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3_schema.json b/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3_schema.json new file mode 100644 index 000000000000..0afd33228d0d --- /dev/null +++ b/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3_schema.json @@ -0,0 +1,8 @@ +{ + "unix_auditd_raw": { + "_raw_log": { + "type": "string", + "is_array": false + } + } + } \ No newline at end of file diff --git a/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3_testdata.json b/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3_testdata.json new file mode 100644 index 000000000000..e69570033f7d --- /dev/null +++ b/Packs/Auditd/ModelingRules/Auditd_1_3/Auditd_1_3_testdata.json @@ -0,0 +1,25 @@ +{ + "data": [ + { + "test_data_event_id": "5fc5c4eb-037a-4bd6-a9c2-c51577c96cbc", + "vendor": "unix", + "product": "auditd", + "dataset": "unix_auditd_raw", + "event_data": {"_raw_log": "<13>Nov 24 12:20:01 somehost123 audispd: node=czstlls086.prg-dc.dhl.com type=LOGIN msg=audit(1669288801.814:57688940): pid=26435 uid=0 old auid=7632 new auid=0 old ses=337905 new ses=357883"}, + "expected_values": { + "xdm.source.user.identifier": "0", + "xdm.event.outcome": null, + "xdm.event.operation": null, + "xdm.session_context_id": "337905", + "xdm.source.host.hostname": "somehost123", + "xdm.source.process.executable.path": null, + "xdm.source.user.username": null, + "xdm.source.ipv4": null, + "xdm.event.id": "57688940", + "xdm.source.process.pid": "26435", + "xdm.event.type": "LOGIN", + "xdm.source.process.command_line": null + } + } + ] +} \ No newline at end of file diff --git a/Packs/Auditd/ParsingRules/Auditd/Auditd.xif b/Packs/Auditd/ParsingRules/Auditd/Auditd.xif new file mode 100644 index 000000000000..e137bce4ebbd --- /dev/null +++ b/Packs/Auditd/ParsingRules/Auditd/Auditd.xif @@ -0,0 +1,6 @@ +[INGEST:vendor="unix", product="auditd", target_dataset="unix_auditd_raw" , no_hit = keep] +alter tmp_event_time = arrayindex(regextract(_raw_log ,"\<\d+\>([A-Za-z]+\s\d+\s\d+\:\d+\:\d+)\s"),0), + tmp_year = to_string(format_timestamp("%Y",_insert_time )) +| alter tmp_full_event_time = concat(tmp_event_time , " ", tmp_year ) +| alter _time = parse_timestamp("%b %d %H:%M:%S %Y" , tmp_full_event_time) +| fields - tmp_event_time , tmp_year , tmp_full_event_time; \ No newline at end of file diff --git a/Packs/Auditd/ParsingRules/Auditd/Auditd.yml b/Packs/Auditd/ParsingRules/Auditd/Auditd.yml new file mode 100644 index 000000000000..75e3ce3031a1 --- /dev/null +++ b/Packs/Auditd/ParsingRules/Auditd/Auditd.yml @@ -0,0 +1,6 @@ +name: UnixAuditd Parsing Rule +id: UnixAuditd Parsing Rule +fromversion: 6.10.0 +tags: [] +rules: '' +samples: '' \ No newline at end of file diff --git a/Packs/Auditd/README.md b/Packs/Auditd/README.md new file mode 100644 index 000000000000..ae55efe2ef29 --- /dev/null +++ b/Packs/Auditd/README.md @@ -0,0 +1,32 @@ +## Collect Events from Vendor + +In order to use the collector, you can use one of the following options to collect events from the vendor: + - [Broker VM](#broker-vm) + +In either option, you will need to configure the vendor and product for this specific collector. +### Broker VM +You will need to use the information described [here](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/broker-vm/set-up-broker-vm/configure-your-broker-vm).\ +You can configure the specific vendor and product for this instance. +1. Navigate to **Settings** -> **Configuration** -> **Data Broker** -> **Broker VMs**. +2. Right-click, and select **Syslog Collector** -> **Configure**. +3. When configuring the Syslog Collector, set: + - vendor as vendor<- Unix + - product as product<- Auditd + +### Install Auditd on Ubuntu Linux +Install Bash if not present, on your Ubuntu system. +``` +sudo apt update +sudo apt install bash-completion +``` +After these initial steps, now Install Auditd. The following command will install Auditd's latest version on your ubuntu system. +sudo apt-get install auditd +You can start and enable your auditd service so it will run up after system restart or reboot. + +``` +service status auditd + +auditd start + +auditd restart +``` \ No newline at end of file diff --git a/Packs/Auditd/pack_metadata.json b/Packs/Auditd/pack_metadata.json new file mode 100644 index 000000000000..fa207c04f1d2 --- /dev/null +++ b/Packs/Auditd/pack_metadata.json @@ -0,0 +1,18 @@ +{ + "name": "Auditd", + "description": "Auditd Modeling Rules and Parsing Rules Pack.", + "support": "xsoar", + "currentVersion": "1.0.0", + "author": "Cortex XSOAR", + "url": "https://www.paloaltonetworks.com/cortex", + "email": "", + "categories": [ + "Analytics & SIEM" + ], + "tags": [], + "useCases": [], + "keywords": [], + "marketplaces": [ + "marketplacev2" + ] +} \ No newline at end of file diff --git a/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.yml b/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.yml index d05951d53733..cbab62be1d70 100644 --- a/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.yml +++ b/Packs/AutoFocus/Integrations/AutofocusV2/AutofocusV2.yml @@ -1385,7 +1385,7 @@ script: - contextPath: Domain.Name description: The domain name. type: String - dockerimage: demisto/python3:3.10.8.37233 + dockerimage: demisto/python3:3.10.9.40422 isfetch: false longRunning: false longRunningPort: false diff --git a/Packs/AutoFocus/Integrations/FeedAutofocus/FeedAutofocus.yml b/Packs/AutoFocus/Integrations/FeedAutofocus/FeedAutofocus.yml index 5a34fbee053d..5e70caa18a8f 100644 --- a/Packs/AutoFocus/Integrations/FeedAutofocus/FeedAutofocus.yml +++ b/Packs/AutoFocus/Integrations/FeedAutofocus/FeedAutofocus.yml @@ -139,7 +139,7 @@ script: description: Gets the indicators from AutoFocus. execution: false name: autofocus-get-indicators - dockerimage: demisto/python3:3.10.8.39276 + dockerimage: demisto/python3:3.10.9.40422 feed: true isfetch: false longRunning: false diff --git a/Packs/AutoFocus/Integrations/FeedAutofocus/FeedAutofocus_commands b/Packs/AutoFocus/Integrations/FeedAutofocus/command_examples.txt similarity index 100% rename from Packs/AutoFocus/Integrations/FeedAutofocus/FeedAutofocus_commands rename to Packs/AutoFocus/Integrations/FeedAutofocus/command_examples.txt diff --git a/Packs/AutoFocus/ReleaseNotes/2_0_33.md b/Packs/AutoFocus/ReleaseNotes/2_0_33.md new file mode 100644 index 000000000000..691fe0d9e628 --- /dev/null +++ b/Packs/AutoFocus/ReleaseNotes/2_0_33.md @@ -0,0 +1,5 @@ +#### Integrations +##### Palo Alto Networks AutoFocus v2 +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. +##### AutoFocus Feed +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AutoFocus/pack_metadata.json b/Packs/AutoFocus/pack_metadata.json index f92fb4f94f48..bad040d85a93 100644 --- a/Packs/AutoFocus/pack_metadata.json +++ b/Packs/AutoFocus/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AutoFocus by Palo Alto Networks", "description": "Use the Palo Alto Networks AutoFocus integration to distinguish the most\n important threats from everyday commodity attacks.", "support": "xsoar", - "currentVersion": "2.0.32", + "currentVersion": "2.0.33", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Automox/Integrations/Automox/Automox.py b/Packs/Automox/Integrations/Automox/Automox.py index 5bab7728bbb5..cf046696dd5e 100644 --- a/Packs/Automox/Integrations/Automox/Automox.py +++ b/Packs/Automox/Integrations/Automox/Automox.py @@ -13,12 +13,12 @@ from typing import Any, Dict, List import demistomock as demisto -import requests +import urllib3 from CommonServerPython import * # noqa # pylint: disable=unused-wildcard-import from CommonServerUserPython import * # noqa # Disable insecure warnings -requests.packages.urllib3.disable_warnings() # pylint: disable=no-member +urllib3.disable_warnings() # pylint: disable=no-member ''' CONSTANTS ''' VERSION = "1.0.0" diff --git a/Packs/Automox/Integrations/Automox/Automox.yml b/Packs/Automox/Integrations/Automox/Automox.yml index f0f1cc3d3e4d..6d0cf2711389 100644 --- a/Packs/Automox/Integrations/Automox/Automox.yml +++ b/Packs/Automox/Integrations/Automox/Automox.yml @@ -1104,7 +1104,7 @@ script: script: '-' type: python subtype: python3 - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 fromversion: 6.0.0 tests: - No tests diff --git a/Packs/Automox/ReleaseNotes/1_0_3.md b/Packs/Automox/ReleaseNotes/1_0_3.md new file mode 100644 index 000000000000..d3285b6e6cbe --- /dev/null +++ b/Packs/Automox/ReleaseNotes/1_0_3.md @@ -0,0 +1,3 @@ +#### Integrations +##### Automox +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/Automox/pack_metadata.json b/Packs/Automox/pack_metadata.json index aa3123c4e6ac..75bc9f6dfbb3 100644 --- a/Packs/Automox/pack_metadata.json +++ b/Packs/Automox/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Automox", "description": "This pack empowers you with comprehensive solutions to manage your Automox device fleet with ease!", "support": "partner", - "currentVersion": "1.0.2", + "currentVersion": "1.0.3", "author": "Automox Inc.", "url": "https://www.automox.com/", "email": "support@automox.com", diff --git a/Packs/AwakeSecurity/Integrations/AwakeSecurity/AwakeSecurity.yml b/Packs/AwakeSecurity/Integrations/AwakeSecurity/AwakeSecurity.yml index 08a349a890ac..8806e7bd325b 100644 --- a/Packs/AwakeSecurity/Integrations/AwakeSecurity/AwakeSecurity.yml +++ b/Packs/AwakeSecurity/Integrations/AwakeSecurity/AwakeSecurity.yml @@ -109,7 +109,7 @@ script: script: '' type: python subtype: python3 - dockerimage: demisto/python3:3.10.8.39276 + dockerimage: demisto/python3:3.10.9.40422 commands: - name: awake-query-devices arguments: diff --git a/Packs/AwakeSecurity/ReleaseNotes/1_0_17.md b/Packs/AwakeSecurity/ReleaseNotes/1_0_17.md new file mode 100644 index 000000000000..f9f2b6ea46ec --- /dev/null +++ b/Packs/AwakeSecurity/ReleaseNotes/1_0_17.md @@ -0,0 +1,3 @@ +#### Integrations +##### Awake Security +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AwakeSecurity/pack_metadata.json b/Packs/AwakeSecurity/pack_metadata.json index 911040d6976e..ace1abad6ba1 100644 --- a/Packs/AwakeSecurity/pack_metadata.json +++ b/Packs/AwakeSecurity/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Awake Security", "description": "Network Traffic Analysis", "support": "xsoar", - "currentVersion": "1.0.16", + "currentVersion": "1.0.17", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", @@ -10,9 +10,7 @@ "categories": [ "Network Security" ], - "tags": [ - "marketplacev2:Data Source" - ], + "tags": [], "useCases": [], "keywords": [], "marketplaces": [ diff --git a/Packs/Aws-SecretsManager/ReleaseNotes/1_0_5.md b/Packs/Aws-SecretsManager/ReleaseNotes/1_0_5.md new file mode 100644 index 000000000000..3e98c11b9db3 --- /dev/null +++ b/Packs/Aws-SecretsManager/ReleaseNotes/1_0_5.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Aws Secrets Manager +- Fixed an issue where the **region** argument was not being taken into account in some commands. diff --git a/Packs/Aws-SecretsManager/ReleaseNotes/1_0_6.md b/Packs/Aws-SecretsManager/ReleaseNotes/1_0_6.md new file mode 100644 index 000000000000..f2f717013c03 --- /dev/null +++ b/Packs/Aws-SecretsManager/ReleaseNotes/1_0_6.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Aws Secrets Manager +- Fixed a typo in **AWSApiModule**. diff --git a/Packs/Aws-SecretsManager/pack_metadata.json b/Packs/Aws-SecretsManager/pack_metadata.json index 187d42bffe8f..14ec52235aee 100644 --- a/Packs/Aws-SecretsManager/pack_metadata.json +++ b/Packs/Aws-SecretsManager/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AWS Secrets Manager", "description": "AWS Secrets Manager helps you to securely encrypt, store, and retrieve credentials for your databases and other services.", "support": "xsoar", - "currentVersion": "1.0.4", + "currentVersion": "1.0.6", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Axonius/Integrations/Axonius/Axonius.py b/Packs/Axonius/Integrations/Axonius/Axonius.py index 9235c8cdd354..8952e90145ff 100644 --- a/Packs/Axonius/Integrations/Axonius/Axonius.py +++ b/Packs/Axonius/Integrations/Axonius/Axonius.py @@ -275,8 +275,8 @@ def main(): command: str = demisto.command() url: str = params["ax_url"] - key: str = params["ax_key"] - secret: str = params["ax_secret"] + key: str = params.get('credentials', {}).get('identifier') + secret: str = params.get('credentials', {}).get('password') certverify: bool = not params.get("insecure", False) handle_proxy() # noqa: F821, F405 diff --git a/Packs/Axonius/Integrations/Axonius/Axonius.yml b/Packs/Axonius/Integrations/Axonius/Axonius.yml index 36b4410620d2..92eee7df0362 100644 --- a/Packs/Axonius/Integrations/Axonius/Axonius.yml +++ b/Packs/Axonius/Integrations/Axonius/Axonius.yml @@ -7,14 +7,11 @@ configuration: name: ax_url required: true type: 0 -- display: Axonius API Key - name: ax_key +- display: API Key + displaypassword: API Secret + name: credentials + type: 9 required: true - type: 0 -- display: Axonius API Secret - name: ax_secret - required: true - type: 4 - display: Trust any certificate (not secure) name: insecure required: false @@ -737,7 +734,7 @@ script: - contextPath: Axonius.tags description: Axonius Tags type: Unknown - dockerimage: demisto/axonius:1.0.0.30481 + dockerimage: demisto/axonius:1.0.0.40908 feed: false isfetch: false longRunning: false diff --git a/Packs/Axonius/ReleaseNotes/1_1_0.json b/Packs/Axonius/ReleaseNotes/1_1_0.json new file mode 100644 index 000000000000..2cd8b03d8295 --- /dev/null +++ b/Packs/Axonius/ReleaseNotes/1_1_0.json @@ -0,0 +1 @@ +{"breakingChanges": true, "breakingChangesNotes": "To support the use of credentials we are modifying the integration configuration params to use API Key and API Secret instead of ax_key and ax_secret. This is a breaking change. All users will have to re-enter their API credentials."} \ No newline at end of file diff --git a/Packs/Axonius/ReleaseNotes/1_1_0.md b/Packs/Axonius/ReleaseNotes/1_1_0.md new file mode 100644 index 000000000000..572f8a014b5c --- /dev/null +++ b/Packs/Axonius/ReleaseNotes/1_1_0.md @@ -0,0 +1,8 @@ + +#### Integrations +##### Axonius +- Updated the Docker image to: *demisto/axonius:1.0.0.40908*. +- To support the use of credentials we are modifying the integration configuration params to use *API Key* and *API Secret* instead of *ax_key* and *ax_secret*. + - *NOTE:* This is a breaking change. All users will have to re-enter their API credentials. + + diff --git a/Packs/Axonius/pack_metadata.json b/Packs/Axonius/pack_metadata.json index 9af8b2eddec0..3ea93a2f00f3 100644 --- a/Packs/Axonius/pack_metadata.json +++ b/Packs/Axonius/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Axonius", "description": "Enrichment for devices and users in your environment.", "support": "partner", - "currentVersion": "1.0.6", + "currentVersion": "1.1.0", "author": "Axonius", "url": "https://docs.axonius.com", "email": "support@axonius.com", diff --git a/Packs/AzureActiveDirectory/Integrations/AzureADIdentityProtection/example_commands b/Packs/AzureActiveDirectory/Integrations/AzureADIdentityProtection/command_examples.txt similarity index 100% rename from Packs/AzureActiveDirectory/Integrations/AzureADIdentityProtection/example_commands rename to Packs/AzureActiveDirectory/Integrations/AzureADIdentityProtection/command_examples.txt diff --git a/Packs/AzureActiveDirectory/ReleaseNotes/1_3_4.md b/Packs/AzureActiveDirectory/ReleaseNotes/1_3_4.md new file mode 100644 index 000000000000..1b38865066af --- /dev/null +++ b/Packs/AzureActiveDirectory/ReleaseNotes/1_3_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure Active Directory Identity Protection (Deprecated) +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureActiveDirectory/pack_metadata.json b/Packs/AzureActiveDirectory/pack_metadata.json index 56ac231ad424..1c0a82cc99af 100644 --- a/Packs/AzureActiveDirectory/pack_metadata.json +++ b/Packs/AzureActiveDirectory/pack_metadata.json @@ -3,7 +3,7 @@ "description": "Deprecated. Use Microsoft Graph Identity and Access instead.", "support": "xsoar", "hidden": true, - "currentVersion": "1.3.3", + "currentVersion": "1.3.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureCompute/ReleaseNotes/1_1_4.md b/Packs/AzureCompute/ReleaseNotes/1_1_4.md new file mode 100644 index 000000000000..1dec250fbdc1 --- /dev/null +++ b/Packs/AzureCompute/ReleaseNotes/1_1_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure Compute v2 +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureCompute/pack_metadata.json b/Packs/AzureCompute/pack_metadata.json index 3ee30220b575..6c5ed7323901 100644 --- a/Packs/AzureCompute/pack_metadata.json +++ b/Packs/AzureCompute/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Compute", "description": "Create and Manage Azure Virtual Machines", "support": "xsoar", - "currentVersion": "1.1.3", + "currentVersion": "1.1.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureDataExplorer/ReleaseNotes/1_2_5.md b/Packs/AzureDataExplorer/ReleaseNotes/1_2_5.md new file mode 100644 index 000000000000..818a810c5b8b --- /dev/null +++ b/Packs/AzureDataExplorer/ReleaseNotes/1_2_5.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure Data Explorer +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureDataExplorer/pack_metadata.json b/Packs/AzureDataExplorer/pack_metadata.json index 33809e5ba25b..f37450fe27fe 100644 --- a/Packs/AzureDataExplorer/pack_metadata.json +++ b/Packs/AzureDataExplorer/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Data Explorer", "description": "Use Azure Data Explorer integration to collect and analyze data inside clusters of Azure Data Explorer and manage search queries.", "support": "xsoar", - "currentVersion": "1.2.4", + "currentVersion": "1.2.5", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureDevOps/ReleaseNotes/1_2_4.md b/Packs/AzureDevOps/ReleaseNotes/1_2_4.md new file mode 100644 index 000000000000..1770df6312e5 --- /dev/null +++ b/Packs/AzureDevOps/ReleaseNotes/1_2_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### AzureDevOps +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureDevOps/pack_metadata.json b/Packs/AzureDevOps/pack_metadata.json index e0698235b83c..bcfa618ccef3 100644 --- a/Packs/AzureDevOps/pack_metadata.json +++ b/Packs/AzureDevOps/pack_metadata.json @@ -2,7 +2,7 @@ "name": "AzureDevOps", "description": "Create and manage Git repositories in Azure DevOps Services.", "support": "xsoar", - "currentVersion": "1.2.3", + "currentVersion": "1.2.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureFirewall/ReleaseNotes/1_1_4.md b/Packs/AzureFirewall/ReleaseNotes/1_1_4.md new file mode 100644 index 000000000000..63c57d57335a --- /dev/null +++ b/Packs/AzureFirewall/ReleaseNotes/1_1_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure Firewall +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureFirewall/pack_metadata.json b/Packs/AzureFirewall/pack_metadata.json index 0cc93ef68621..3896e959e260 100644 --- a/Packs/AzureFirewall/pack_metadata.json +++ b/Packs/AzureFirewall/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Firewall", "description": "Azure Firewall is a cloud-native and intelligent network firewall security service that provides breed threat protection for cloud workloads running in Azure.It's a fully stateful, firewall as a service with built-in high availability and unrestricted cloud scalability.", "support": "xsoar", - "currentVersion": "1.1.3", + "currentVersion": "1.1.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureKeyVault/ReleaseNotes/1_1_4.md b/Packs/AzureKeyVault/ReleaseNotes/1_1_4.md new file mode 100644 index 000000000000..3f94332f01cb --- /dev/null +++ b/Packs/AzureKeyVault/ReleaseNotes/1_1_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure Key Vault +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureKeyVault/pack_metadata.json b/Packs/AzureKeyVault/pack_metadata.json index 156941471766..ccc3fdc6cab2 100644 --- a/Packs/AzureKeyVault/pack_metadata.json +++ b/Packs/AzureKeyVault/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Key Vault", "description": "Use Key Vault to safeguard and manage cryptographic keys and secrets used by cloud applications and services.", "support": "xsoar", - "currentVersion": "1.1.3", + "currentVersion": "1.1.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureKubernetesServices/ReleaseNotes/1_1_4.md b/Packs/AzureKubernetesServices/ReleaseNotes/1_1_4.md new file mode 100644 index 000000000000..d2a0a0211184 --- /dev/null +++ b/Packs/AzureKubernetesServices/ReleaseNotes/1_1_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure Kubernetes Services +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureKubernetesServices/pack_metadata.json b/Packs/AzureKubernetesServices/pack_metadata.json index daf0184253d3..8b55592854c0 100644 --- a/Packs/AzureKubernetesServices/pack_metadata.json +++ b/Packs/AzureKubernetesServices/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Kubernetes Services", "description": "Deploy and manage containerized applications with a fully managed Kubernetes service.", "support": "xsoar", - "currentVersion": "1.1.3", + "currentVersion": "1.1.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureLogAnalytics/ReleaseNotes/1_1_4.md b/Packs/AzureLogAnalytics/ReleaseNotes/1_1_4.md new file mode 100644 index 000000000000..1572912dec37 --- /dev/null +++ b/Packs/AzureLogAnalytics/ReleaseNotes/1_1_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure Log Analytics +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureLogAnalytics/pack_metadata.json b/Packs/AzureLogAnalytics/pack_metadata.json index e9add298a73e..b18d9af529ad 100644 --- a/Packs/AzureLogAnalytics/pack_metadata.json +++ b/Packs/AzureLogAnalytics/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Log Analytics", "description": "Log Analytics is a service that helps you collect and analyze data generated by resources in your cloud and on-premises environments.", "support": "xsoar", - "currentVersion": "1.1.3", + "currentVersion": "1.1.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureNetworkSecurityGroups/ReleaseNotes/1_2_4.md b/Packs/AzureNetworkSecurityGroups/ReleaseNotes/1_2_4.md new file mode 100644 index 000000000000..66d4301baf47 --- /dev/null +++ b/Packs/AzureNetworkSecurityGroups/ReleaseNotes/1_2_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure Network Security Groups +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureNetworkSecurityGroups/pack_metadata.json b/Packs/AzureNetworkSecurityGroups/pack_metadata.json index 8901a3f40a1b..7d487952032e 100644 --- a/Packs/AzureNetworkSecurityGroups/pack_metadata.json +++ b/Packs/AzureNetworkSecurityGroups/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Network Security Groups", "description": "Azure Network Security Groups are used to filter network traffic to and from Azure resources in an Azure virtual network", "support": "xsoar", - "currentVersion": "1.2.3", + "currentVersion": "1.2.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureRiskyUsers/ReleaseNotes/1_1_4.md b/Packs/AzureRiskyUsers/ReleaseNotes/1_1_4.md new file mode 100644 index 000000000000..8784d1b36948 --- /dev/null +++ b/Packs/AzureRiskyUsers/ReleaseNotes/1_1_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure Risky Users +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureRiskyUsers/pack_metadata.json b/Packs/AzureRiskyUsers/pack_metadata.json index 90e15da6e36c..7cd2f5f02557 100644 --- a/Packs/AzureRiskyUsers/pack_metadata.json +++ b/Packs/AzureRiskyUsers/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Risky Users", "description": "Azure Risky Users provides access to all at-risk users and risk detections in Azure AD environment.", "support": "xsoar", - "currentVersion": "1.1.3", + "currentVersion": "1.1.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureSQLManagement/ReleaseNotes/1_1_4.md b/Packs/AzureSQLManagement/ReleaseNotes/1_1_4.md new file mode 100644 index 000000000000..18dc4dc158c9 --- /dev/null +++ b/Packs/AzureSQLManagement/ReleaseNotes/1_1_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure SQL Management (Beta) +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureSQLManagement/pack_metadata.json b/Packs/AzureSQLManagement/pack_metadata.json index ce69ced1bed5..7bc9702b9c71 100644 --- a/Packs/AzureSQLManagement/pack_metadata.json +++ b/Packs/AzureSQLManagement/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure SQL Management (Beta)", "description": "Microsoft Azure SQL Database is a managed cloud database provided as part of Microsoft Azure", "support": "xsoar", - "currentVersion": "1.1.3", + "currentVersion": "1.1.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureSecurityCenter/ReleaseNotes/1_3_5.md b/Packs/AzureSecurityCenter/ReleaseNotes/1_3_5.md new file mode 100644 index 000000000000..2ad0db248909 --- /dev/null +++ b/Packs/AzureSecurityCenter/ReleaseNotes/1_3_5.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Microsoft Defender for Cloud +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureSecurityCenter/pack_metadata.json b/Packs/AzureSecurityCenter/pack_metadata.json index cc869042e30f..1c2d88c36d32 100644 --- a/Packs/AzureSecurityCenter/pack_metadata.json +++ b/Packs/AzureSecurityCenter/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Microsoft Defender for Cloud", "description": "Unified security management and advanced threat protection across hybrid cloud workloads.", "support": "xsoar", - "currentVersion": "1.3.4", + "currentVersion": "1.3.5", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureSentinel/ReleaseNotes/1_4_5.md b/Packs/AzureSentinel/ReleaseNotes/1_4_5.md new file mode 100644 index 000000000000..27b28779c394 --- /dev/null +++ b/Packs/AzureSentinel/ReleaseNotes/1_4_5.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Microsoft Sentinel +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureSentinel/pack_metadata.json b/Packs/AzureSentinel/pack_metadata.json index b967872bd8cb..5fca9abe1ecd 100644 --- a/Packs/AzureSentinel/pack_metadata.json +++ b/Packs/AzureSentinel/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Microsoft Sentinel", "description": "Azure Sentinel is a cloud-native security information and event manager (SIEM) platform that uses built-in AI to help analyze large volumes of data across an enterprise.", "support": "xsoar", - "currentVersion": "1.4.4", + "currentVersion": "1.4.5", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureStorage/ReleaseNotes/1_2_4.md b/Packs/AzureStorage/ReleaseNotes/1_2_4.md new file mode 100644 index 000000000000..756a48b5b369 --- /dev/null +++ b/Packs/AzureStorage/ReleaseNotes/1_2_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure Storage Management +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureStorage/pack_metadata.json b/Packs/AzureStorage/pack_metadata.json index 8a97d8e0ad7e..39925d00ccf8 100644 --- a/Packs/AzureStorage/pack_metadata.json +++ b/Packs/AzureStorage/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Storage Management", "description": "Deploy and manage storage accounts and blob service properties.", "support": "xsoar", - "currentVersion": "1.2.3", + "currentVersion": "1.2.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureStorageContainer/Integrations/AzureStorageContainer/AzureStorageContainer.py b/Packs/AzureStorageContainer/Integrations/AzureStorageContainer/AzureStorageContainer.py index 4bf1165a69ca..3d3269b5bf3f 100644 --- a/Packs/AzureStorageContainer/Integrations/AzureStorageContainer/AzureStorageContainer.py +++ b/Packs/AzureStorageContainer/Integrations/AzureStorageContainer/AzureStorageContainer.py @@ -1,4 +1,5 @@ import shutil +import urllib3 from typing import Callable from requests import Response @@ -893,7 +894,7 @@ def main() -> None: demisto.debug(f'Command being called is {command}') try: - requests.packages.urllib3.disable_warnings() + urllib3.disable_warnings() client: Client = Client(base_url, verify_certificate, proxy, account_sas_token, storage_account_name, api_version) diff --git a/Packs/AzureStorageContainer/Integrations/AzureStorageContainer/AzureStorageContainer.yml b/Packs/AzureStorageContainer/Integrations/AzureStorageContainer/AzureStorageContainer.yml index 66a09d296286..9772d611a586 100644 --- a/Packs/AzureStorageContainer/Integrations/AzureStorageContainer/AzureStorageContainer.yml +++ b/Packs/AzureStorageContainer/Integrations/AzureStorageContainer/AzureStorageContainer.yml @@ -439,7 +439,7 @@ script: description: Set Blob properties. execution: false name: azure-storage-container-blob-property-set - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/AzureStorageContainer/ReleaseNotes/1_0_3.md b/Packs/AzureStorageContainer/ReleaseNotes/1_0_3.md new file mode 100644 index 000000000000..f0d3c3aa4ec3 --- /dev/null +++ b/Packs/AzureStorageContainer/ReleaseNotes/1_0_3.md @@ -0,0 +1,3 @@ +#### Integrations +##### Azure Storage Container +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AzureStorageContainer/pack_metadata.json b/Packs/AzureStorageContainer/pack_metadata.json index 0a2cc9553451..216ef52fd80b 100644 --- a/Packs/AzureStorageContainer/pack_metadata.json +++ b/Packs/AzureStorageContainer/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Storage Container", "description": "Create and Manage Azure Storage Container services.", "support": "xsoar", - "currentVersion": "1.0.2", + "currentVersion": "1.0.3", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureStorageFileShare/Integrations/AzureStorageFileShare/AzureStorageFileShare.py b/Packs/AzureStorageFileShare/Integrations/AzureStorageFileShare/AzureStorageFileShare.py index 0ba9f6690ecb..c52b0d88d974 100644 --- a/Packs/AzureStorageFileShare/Integrations/AzureStorageFileShare/AzureStorageFileShare.py +++ b/Packs/AzureStorageFileShare/Integrations/AzureStorageFileShare/AzureStorageFileShare.py @@ -1,5 +1,6 @@ import copy import shutil +import urllib3 from typing import Callable from requests import Response @@ -763,7 +764,7 @@ def main() -> None: demisto.debug(f'Command being called is {command}') try: - requests.packages.urllib3.disable_warnings() + urllib3.disable_warnings() client: Client = Client(base_url, verify_certificate, proxy, account_sas_token, storage_account_name, api_version) diff --git a/Packs/AzureStorageFileShare/Integrations/AzureStorageFileShare/AzureStorageFileShare.yml b/Packs/AzureStorageFileShare/Integrations/AzureStorageFileShare/AzureStorageFileShare.yml index 20dcdb6e003a..c46f5960ea3a 100644 --- a/Packs/AzureStorageFileShare/Integrations/AzureStorageFileShare/AzureStorageFileShare.yml +++ b/Packs/AzureStorageFileShare/Integrations/AzureStorageFileShare/AzureStorageFileShare.yml @@ -344,7 +344,7 @@ script: description: Delete file from Share. execution: true name: azure-storage-fileshare-file-delete - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/AzureStorageFileShare/ReleaseNotes/1_0_3.md b/Packs/AzureStorageFileShare/ReleaseNotes/1_0_3.md new file mode 100644 index 000000000000..707373025378 --- /dev/null +++ b/Packs/AzureStorageFileShare/ReleaseNotes/1_0_3.md @@ -0,0 +1,3 @@ +#### Integrations +##### Azure Storage FileShare +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AzureStorageFileShare/pack_metadata.json b/Packs/AzureStorageFileShare/pack_metadata.json index 732b745148a4..4a62dcfe465e 100644 --- a/Packs/AzureStorageFileShare/pack_metadata.json +++ b/Packs/AzureStorageFileShare/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Storage FileShare", "description": "Create and Manage Azure FileShare Files and Directories.", "support": "xsoar", - "currentVersion": "1.0.2", + "currentVersion": "1.0.3", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureStorageTable/Integrations/AzureStorageTable/AzureStorageTable.py b/Packs/AzureStorageTable/Integrations/AzureStorageTable/AzureStorageTable.py index 890040b5d1c2..8d8317d1e077 100644 --- a/Packs/AzureStorageTable/Integrations/AzureStorageTable/AzureStorageTable.py +++ b/Packs/AzureStorageTable/Integrations/AzureStorageTable/AzureStorageTable.py @@ -2,6 +2,7 @@ from CommonServerPython import * # noqa: F401 import copy +import urllib3 from requests import Response DATE_FORMAT = '%Y-%m-%dT%H:%M:%S.%fZ' @@ -605,7 +606,7 @@ def main() -> None: demisto.debug(f'Command being called is {command}') try: - requests.packages.urllib3.disable_warnings() + urllib3.disable_warnings() client: Client = Client(base_url, verify_certificate, proxy, account_sas_token, storage_account_name, api_version) diff --git a/Packs/AzureStorageTable/Integrations/AzureStorageTable/AzureStorageTable.yml b/Packs/AzureStorageTable/Integrations/AzureStorageTable/AzureStorageTable.yml index 156cc75804da..cff5f9610433 100644 --- a/Packs/AzureStorageTable/Integrations/AzureStorageTable/AzureStorageTable.yml +++ b/Packs/AzureStorageTable/Integrations/AzureStorageTable/AzureStorageTable.yml @@ -265,7 +265,7 @@ script: description: Delete an existing entity in a table. execution: true name: azure-storage-table-entity-delete - dockerimage: demisto/python3:3.10.5.31928 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/AzureStorageTable/ReleaseNotes/1_0_3.md b/Packs/AzureStorageTable/ReleaseNotes/1_0_3.md new file mode 100644 index 000000000000..f30ec3199a07 --- /dev/null +++ b/Packs/AzureStorageTable/ReleaseNotes/1_0_3.md @@ -0,0 +1,3 @@ +#### Integrations +##### Azure Storage Table +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. diff --git a/Packs/AzureStorageTable/pack_metadata.json b/Packs/AzureStorageTable/pack_metadata.json index 4899537ad58b..712a7050e737 100644 --- a/Packs/AzureStorageTable/pack_metadata.json +++ b/Packs/AzureStorageTable/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure Storage Table", "description": "Create and Manage Azure Storage Tables and Entities.", "support": "xsoar", - "currentVersion": "1.0.2", + "currentVersion": "1.0.3", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/AzureWAF/ReleaseNotes/1_1_4.md b/Packs/AzureWAF/ReleaseNotes/1_1_4.md new file mode 100644 index 000000000000..066fafbc3fdd --- /dev/null +++ b/Packs/AzureWAF/ReleaseNotes/1_1_4.md @@ -0,0 +1,4 @@ + +#### Integrations +##### Azure Web Application Firewall +- Fixed an issue where in some rare cases, commands would fail with a `'NoneType' object is not subscriptable` message. diff --git a/Packs/AzureWAF/pack_metadata.json b/Packs/AzureWAF/pack_metadata.json index 6d944a7977ca..e8f89922a419 100644 --- a/Packs/AzureWAF/pack_metadata.json +++ b/Packs/AzureWAF/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Azure WAF", "description": "Azure Web Application Firewall is used to detect web related attacks targeting your web servers hosted in azure and allow quick respond to threats", "support": "xsoar", - "currentVersion": "1.1.3", + "currentVersion": "1.1.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/BPA/Integrations/BPA/BPA.py b/Packs/BPA/Integrations/BPA/BPA.py index 1460c86bc2fc..1419a40b6f8a 100644 --- a/Packs/BPA/Integrations/BPA/BPA.py +++ b/Packs/BPA/Integrations/BPA/BPA.py @@ -234,15 +234,16 @@ def get_results_command(client: Client, args: Dict): 'Checks': job_checks, 'Status': status }} - human_readable = tableToMarkdown('BPA Results', job_checks) + headers = ['check_id', 'check_category', 'check_feature', 'check_message', 'check_name', 'check_passed', + 'check_type', 'check_severity'] + human_readable = tableToMarkdown('BPA Results', job_checks, headers=headers, headerTransform=string_to_table_header) return human_readable, context, results def download_report_handler(client: Client, task_id): downloaded_report = client.get_download_results_request(task_id) - demisto.results( - fileResult(task_id + DOWNLOADED_REPORT_NAME_SUFFIX, downloaded_report, entryTypes['entryInfoFile'])) + demisto.results(fileResult(task_id + DOWNLOADED_REPORT_NAME_SUFFIX, downloaded_report, entryTypes['entryInfoFile'])) def test_module(client, panorama): diff --git a/Packs/BPA/Integrations/BPA/BPA.yml b/Packs/BPA/Integrations/BPA/BPA.yml index f3424e676fd6..9e1dd7120669 100644 --- a/Packs/BPA/Integrations/BPA/BPA.yml +++ b/Packs/BPA/Integrations/BPA/BPA.yml @@ -180,7 +180,7 @@ script: - contextPath: InfoFile.Extension description: File extension. type: string - dockerimage: demisto/python3:3.10.8.37233 + dockerimage: demisto/python3:3.10.9.40422 feed: false isfetch: false longRunning: false diff --git a/Packs/BPA/ReleaseNotes/1_2_15.md b/Packs/BPA/ReleaseNotes/1_2_15.md index 9d4b96500e40..ae62be06f184 100644 --- a/Packs/BPA/ReleaseNotes/1_2_15.md +++ b/Packs/BPA/ReleaseNotes/1_2_15.md @@ -1,4 +1,4 @@ #### Integrations ##### Palo Alto Networks BPA -Documentation and metadata improvements. \ No newline at end of file +Documentation and metadata improvements. diff --git a/Packs/BPA/ReleaseNotes/1_2_16.md b/Packs/BPA/ReleaseNotes/1_2_16.md new file mode 100644 index 000000000000..61f4d128472d --- /dev/null +++ b/Packs/BPA/ReleaseNotes/1_2_16.md @@ -0,0 +1,5 @@ + +#### Integrations +##### Palo Alto Networks BPA +- Updated the Docker image to: *demisto/python3:3.10.9.40422*. +- Updated the human-readable section in the ***pan-os-bpa-get-job-results*** command. diff --git a/Packs/BPA/pack_metadata.json b/Packs/BPA/pack_metadata.json index 40d367e7649c..e9aa57cb9dda 100644 --- a/Packs/BPA/pack_metadata.json +++ b/Packs/BPA/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Best Practice Assessment (BPA) by Palo Alto Networks", "description": "Palo Alto Networks Best Practice Assessment (BPA) analyzes NGFW and Panorama configurations and compares them to the best practices.", "support": "xsoar", - "currentVersion": "1.2.15", + "currentVersion": "1.2.16", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/Base/.secrets-ignore b/Packs/Base/.secrets-ignore index fbe1d2d52424..06c31ece87f8 100644 --- a/Packs/Base/.secrets-ignore +++ b/Packs/Base/.secrets-ignore @@ -147,3 +147,5 @@ mei_qiang_82@sohu.com b4:1a:bf:40:27:21:76:28 0e:97:88:1c:6c:a1:37:96 42:03:bc:45:42:24:75:6c +http://test.t +http://.www.test.test diff --git a/Packs/Base/ReleaseNotes/1_31_46.md b/Packs/Base/ReleaseNotes/1_31_46.md new file mode 100644 index 000000000000..3b64f2921f56 --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_31_46.md @@ -0,0 +1,4 @@ + +#### Scripts +##### CommonServerPython +- Added to SSLAdapter class support for HTTPAdapter initialization arguments. diff --git a/Packs/Base/ReleaseNotes/1_31_47.md b/Packs/Base/ReleaseNotes/1_31_47.md new file mode 100644 index 000000000000..328c04fd1bba --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_31_47.md @@ -0,0 +1,4 @@ + +#### Scripts +##### CommonServerPython +- Updated the URL regular expression. diff --git a/Packs/Base/ReleaseNotes/1_31_48.md b/Packs/Base/ReleaseNotes/1_31_48.md new file mode 100644 index 000000000000..9d561dce337f --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_31_48.md @@ -0,0 +1,3 @@ +#### Scripts +##### CommonServerPython +- Fixed an issue in *look-back* functionality where incident ids were removed from the *last-run* before finished fetching all incidents in the same time. \ No newline at end of file diff --git a/Packs/Base/ReleaseNotes/1_31_50.md b/Packs/Base/ReleaseNotes/1_31_50.md new file mode 100644 index 000000000000..4485f6f51976 --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_31_50.md @@ -0,0 +1,3 @@ +#### Scripts +##### CommonServerPython +Added the optional **Publications** field to the **CVE** indicator. \ No newline at end of file diff --git a/Packs/Base/ReleaseNotes/1_31_51.md b/Packs/Base/ReleaseNotes/1_31_51.md new file mode 100644 index 000000000000..50231ade0974 --- /dev/null +++ b/Packs/Base/ReleaseNotes/1_31_51.md @@ -0,0 +1,3 @@ +#### Scripts +##### CommonServerPython +Improved the error shown when failing to parse a request response. \ No newline at end of file diff --git a/Packs/Base/Scripts/CommonServerPython/CommonServerPython.py b/Packs/Base/Scripts/CommonServerPython/CommonServerPython.py index b16984cd733e..11e5b1ad6d32 100644 --- a/Packs/Base/Scripts/CommonServerPython/CommonServerPython.py +++ b/Packs/Base/Scripts/CommonServerPython/CommonServerPython.py @@ -138,9 +138,6 @@ def fix_traceback_line_numbers(trace_str): return trace_str -from DemistoClassApiModule import * # type:ignore [no-redef] # noqa:E402 - - OS_LINUX = False OS_MAC = False OS_WINDOWS = False @@ -3917,6 +3914,9 @@ class CVE(Indicator): :type traffic_light_protocol: ``str`` :param traffic_light_protocol: The CVE tlp color. + :type publications: ``str`` + :param publications: Unique system-assigned ID of the vulnerability evaluation logic + :type dbot_score: ``DBotScore`` :param dbot_score: If file has a score then create and set a DBotScore object @@ -3927,7 +3927,7 @@ class CVE(Indicator): def __init__(self, id, cvss, published, modified, description, relationships=None, stix_id=None, cvss_version=None, cvss_score=None, cvss_vector=None, cvss_table=None, community_notes=None, - tags=None, traffic_light_protocol=None, dbot_score=None): + tags=None, traffic_light_protocol=None, dbot_score=None, publications=None): # type (str, str, str, str, str) -> None # Main indicator value @@ -3946,6 +3946,7 @@ def __init__(self, id, cvss, published, modified, description, relationships=Non self.stix_id = stix_id self.tags = tags self.traffic_light_protocol = traffic_light_protocol + self.publications = publications # XSOAR Fields self.relationships = relationships @@ -4001,6 +4002,9 @@ def to_context(self): if self.traffic_light_protocol: cve_context['TrafficLightProtocol'] = self.traffic_light_protocol + if self.publications: + cve_context['Publications'] = self.create_context_table(self.publications) + ret_value = { Common.CVE.CONTEXT_PATH: cve_context } @@ -5213,6 +5217,7 @@ class SubjectAlternativeName(object): :return: None :rtype: ``None`` """ + def __init__( self, gn=None, # type: Optional[Common.GeneralName] @@ -5252,6 +5257,7 @@ class AuthorityKeyIdentifier(object): :return: None :rtype: ``None`` """ + def __init__( self, issuer=None, # type: Optional[List[Common.GeneralName]] @@ -5295,6 +5301,7 @@ class DistributionPoint(object): :return: None :rtype: ``None`` """ + def __init__( self, full_name=None, # type: Optional[List[Common.GeneralName]] @@ -5334,6 +5341,7 @@ class CertificatePolicy(object): :return: None :rtype: ``None`` """ + def __init__( self, policy_identifier, # type: str @@ -5366,6 +5374,7 @@ class AuthorityInformationAccess(object): :return: None :rtype: ``None`` """ + def __init__( self, access_method, # type: str @@ -5394,6 +5403,7 @@ class BasicConstraints(object): :return: None :rtype: ``None`` """ + def __init__( self, ca, # type: bool @@ -6101,6 +6111,7 @@ class IndicatorsTimeline: :return: None :rtype: ``None`` """ + def __init__(self, indicators=None, category=None, message=None): # type: (list, str, str) -> None if indicators is None: @@ -6133,7 +6144,6 @@ def __init__(self, indicators=None, category=None, message=None): def arg_to_number(arg, arg_name=None, required=False): # type: (Any, Optional[str], bool) -> Optional[int] - """Converts an XSOAR argument to a Python int This function is used to quickly validate an argument provided to XSOAR @@ -6191,7 +6201,6 @@ def arg_to_number(arg, arg_name=None, required=False): def arg_to_datetime(arg, arg_name=None, is_utc=True, required=False, settings=None): # type: (Any, Optional[str], bool, bool, dict) -> Optional[datetime] - """Converts an XSOAR argument to a datetime This function is used to quickly validate an argument provided to XSOAR @@ -7053,6 +7062,7 @@ class ExecutionMetrics(object): :return: None :rtype: ``None`` """ + def __init__(self, success=0, quota_error=0, general_error=0, auth_error=0, service_error=0, connection_error=0, proxy_error=0, ssl_error=0, timeout_error=0): self._metrics = [] @@ -7237,6 +7247,7 @@ class Command: :return: None :rtype: ``None`` """ + def __init__(self, commands, args_lst, brand=None, instance=None): """ @@ -7286,6 +7297,7 @@ class Result: :return: None :rtype: ``None`` """ + def __init__(self, command, args, brand, instance, result): """ :param command: command that was run. @@ -7557,7 +7569,7 @@ def replace_str(src_str): ipv6cidrRegex = r'^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))$' # noqa: E501 emailRegex = r'''(?:[a-z0-9!#$%&'*+/=?^_\x60{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_\x60{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])''' # noqa: E501 hashRegex = r'\b[0-9a-fA-F]+\b' -urlRegex = r"(?i)^[\[({\"']*(?P