Stamus integration v1.0.0 #26286

regit · 2023-05-03T18:10:47Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

Linked issue: https://github.com/demisto/content/issues/26285

Description

This integration provides interaction with Stamus Security Platform. It provides a way to fetch detection from the solution and
also getting information and context from the Stamus Security Platform.

Screenshots

Minimum version of Cortex XSOAR

6.0.0
6.1.0
6.2.0
6.5.0

Does it break backward compatibility?

Yes
- Further details:
No

Must have

Tests
Documentation

CLAassistant · 2023-05-03T18:10:54Z

All committers have signed the CLA.

content-bot · 2023-05-03T18:12:27Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @GuyAfik will know the proposed changes are ready to be reviewed.

GuyAfik · 2023-05-04T08:23:39Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.0 out of 2 committers have signed the CLA.❌ sonicold❌ regitYou have signed the CLA already but the status is still pending? Let us recheck it.

@sonicold @regit can you please sign the CLA so we can move forward with the review?

regit · 2023-05-04T12:14:12Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.0 out of 2 committers have signed the CLA.x sonicoldx regitYou have signed the CLA already but the status is still pending? Let us recheck it.

@sonicold @regit can you please sign the CLA so we can move forward with the review?

Hello, I did do it as a partner and both @sonicold and myself are working for Stamus Networks. Is it enough ?

regit · 2023-05-04T12:16:38Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.0 out of 2 committers have signed the CLA.x sonicoldx regitYou have signed the CLA already but the status is still pending? Let us recheck it.

@sonicold @regit can you please sign the CLA so we can move forward with the review?

Hello, I did do it as a partner and both @sonicold and myself are working for Stamus Networks. Is it enough ?

OK, just saw that there is 2 different things.

GuyAfik · 2023-05-04T12:39:02Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.0 out of 2 committers have signed the CLA.x sonicoldx regitYou have signed the CLA already but the status is still pending? Let us recheck it.

@sonicold @regit can you please sign the CLA so we can move forward with the review?

Hello, I did do it as a partner and both @sonicold and myself are working for Stamus Networks. Is it enough ?

the CLA looks good now, thank you

GuyAfik

@regit incredible work! a few notes:

each command should have a different context output, it seems like you implemented that each command will use the same context output which is not a good convention.
I see you approach to dict keys without the get method of the dict object, make sure to use get method to avoid un-necessary KeyError exceptions.
please see if you are able to fix the build issues, most of them are validations.

please let me know if you need any help with anything, you can always reach me out in slack in DFIR.

Packs/Stamus/Integrations/Stamus/Stamus.py

Packs/Stamus/Integrations/Stamus/Stamus.yml

regit · 2023-05-10T12:51:19Z

OK, push is not a success. I will try to address the issues later today.

efelmandar

Hi @regit Thank you for your contribution. I have reviewed the content in your PR and I appreciate the effort you have put into it. However, I noticed a few areas that require attention. Please see my detailed comments below:

Incident Field Configuration:
I noticed that the incident field Stamus Threat is currently configured to apply to "All Incident types", whereas all the other incident fields are configured specifically for the Stamus Networks incident type. Could you please clarify if this change was intentional? If it was, I kindly request you provide some insights into the reasoning behind this modification in the PR description or a comment. However, if this was unintentional, please update the configuration to be specific to the Stamus Networks incident type.

Missing Playbook Description:
The playbook "Stamus Networks - Get Extra Data" appears to be missing a description. Including a descriptive explanation of the playbook's purpose and functionality is crucial for users to understand and effectively utilize the content. please add a meaningful description to the playbook.
Non-Existing Command Usage:
I noticed that the playbook is utilizing non-existing commands. While I understand that these commands may be implemented in the integration source code, it is important to declare them properly in the YAML file with inputs, outputs, and other relevant details. I kindly request you to either add the missing command declaration, including the required specifications, or alternatively, modify the playbook to utilize existing commands that are already declared.

I appreciate your attention to these matters. Please make the necessary updates to address the mentioned issues.
If you have any questions or need further clarification on any of the points mentioned above, please don't hesitate to reach out here or on Slack.

GuyAfik

@regit nice work! gave some more comments

please let me know if you need anything.

You can also remove the Pipfile and Pipfile.lock as those files are not needed.

Packs/Stamus/Integrations/Stamus/Stamus.py

Packs/Stamus/Integrations/Stamus/Stamus_test.py

Packs/Stamus/Integrations/Stamus/test_data/baseintegration-dummy.json

Packs/Stamus/Integrations/Stamus/Stamus.yml

GuyAfik

@regit nice work! gave some more comments

please let me know if you need anything.

You can also remove the Pipfile and Pipfile.lock as those files are not needed.

GuyAfik · 2023-05-17T14:15:02Z

@regit let me know when i can re-review? for any help feel free to reach me out

GuyAfik · 2023-07-10T17:59:07Z

@regit nice work! can you please refer to the old comments i gave you please?

in addition, can you please merge from demisto master to re-trigger the build? for any help you can speak to me.

regit · 2023-07-25T14:29:55Z

@regit let me know when i can re-review? for any help feel free to reach me out

Updated the MR by addressing comments, adding unittests and rebasing on master.

Most fields are information and we should not extract indicators.

This is the first pass, we need to add the role.

Host insight info can be available after some time if ever the host has not be seen before.

regit · 2023-08-30T16:37:18Z

@GuyAfik I'm struggling with this one, I don't know what I am missing https://app.circleci.com/pipelines/github/demisto/content/298224/workflows/27794974-779e-42a7-ae37-c266f05a0377/jobs/717860?invite=true#step-119-11335_250

GuyAfik · 2023-09-03T12:19:20Z

@GuyAfik I'm struggling with this one, I don't know what I am missing https://app.circleci.com/pipelines/github/demisto/content/298224/workflows/27794974-779e-42a7-ae37-c266f05a0377/jobs/717860?invite=true#step-119-11335_250

@regit thanks for all the massive effort that you did on this PR, Ill merge it and we will handle the issues internally.
Great work!

regit · 2023-09-03T15:22:27Z

@GuyAfik I'm struggling with this one, I don't know what I am missing https://app.circleci.com/pipelines/github/demisto/content/298224/workflows/27794974-779e-42a7-ae37-c266f05a0377/jobs/717860?invite=true#step-119-11335_250

@regit thanks for all the massive effort that you did on this PR, Ill merge it and we will handle the issues internally.
Great work!

Thanks a lot for all the help from the Palo Alto team on this.

* Stamus integration v1.0.0 (#26286) * packs: add stamus pack to xsoar content Implement a new set of commands to interact with Stamus Security Platform. * Stamus: remove dummy test * Stamus: use StamusIntegration prefix * Stamus: fix some descriptions * Stamus: update result to return markdown * Stamus: rename commands * Stamus: update pack metadata * Stamus: homogeneize message * Stamus: really basic README * Stamus: fix some linters warning * Stamus: import playbook and mapper * Stamus: more import Import Stamus' IncidentFields, IncidentFields and Layouts * Stamus: add playbook documentation * Stamus: more documentation * Stamus: add generated docs * Stamus: remove template comment * Stamus: use f-string * Stamus: simply test connection * Stamus: remove commented code * Stamus: docstring on escape function * Stamus: fix to have one context for each command * Stamus: refactoring * Stamus: remove useless code * Stamus: get default value in results if no results * Stamus: run demisto format on yaml files * Stamus: update README * Stamus: fix missing description and format * Stamus: fix following validation * Stamus: add missing playbook image * Stamus: remove marketplacev2 support * Stamus: fix info extraction in get DoC command * Stamus: use getter function Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> * Stamus: command should be lower case * Stamus: avoid double read of event * Stamus: little optimization * Stamus: add docstring * Stamus: remove not needed files * Stamus: add basic integration doc * Stamus: fix JSON format * Stamus: fix some name in playbook * Stamus: rename IOC params * Stamus: fix demisto sdk validation validation: demisto-sdk validate -i Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json validation: fix: demisto-sdk format -i /home/snuser/cortex/Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json * Stamus: fix params name gotten from conf * Stamus: fix stamus extra data playbook following new naming * Stamus: fix playbook ID * Stamus: Add descriptions * Stamus: move constants with other constants * Stamus: use getter function + fix linter * Stamus: use fstring * Stamus: unit tests impl * Stamus: remove template doc Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> * Stamus: add test data to secret-ignore * Stamus: fix event type * Stamus: update demisto docker image * Stamus: fix reference in classifier * Stamus: update README.md Runned demisto-sdk generate-docs -i Packs/Stamus/Integrations/Stamus/Stamus.yml and fixed the version string. * Stamus: fix linter error * Stamus: fix linter warning * Stamus: fix a playbook param * Stamus: fix key value * Stamus: set default value for incident * Stamus: update from version * Stamus: set default incoming mapper * Stamus: improve layout * Stamus: some more layout work * Stamus: use already defined fields * Stamus: don't extract indicators Most fields are information and we should not extract indicators. * Stamus: display threat info in layout * Stamus: don't try to display removed field * Stamus: add host first seen * Stamus: add host insight info in incident layout This is the first pass, we need to add the role. * Stamus: display major host insight information * Stamus: retry policy and fix a field Host insight info can be available after some time if ever the host has not be seen before. * Stamus: update to fix validation * Stamus: add description to mapper * Stamus: add integration as 'start time' user --------- Co-authored-by: Nicolas Frisoni <nfrisoni@stamus-networks.com> Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> Co-authored-by: Peter <pmanev@stamus-networks.com> * bump rn * rn * pre-commit * Bump pack from version CommonTypes to 3.3.85. * update mapper * bump rn * update rn * Empty-Commit * bump rn * ds108 validation fixes * fix validation * ds108 --------- Co-authored-by: Eric Leblond <eric@regit.org> Co-authored-by: Nicolas Frisoni <nfrisoni@stamus-networks.com> Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> Co-authored-by: Peter <pmanev@stamus-networks.com> Co-authored-by: GuyAfik <guyafik11@gmail.com> Co-authored-by: Content Bot <bot@demisto.com>

* Stamus integration v1.0.0 (demisto#26286) * packs: add stamus pack to xsoar content Implement a new set of commands to interact with Stamus Security Platform. * Stamus: remove dummy test * Stamus: use StamusIntegration prefix * Stamus: fix some descriptions * Stamus: update result to return markdown * Stamus: rename commands * Stamus: update pack metadata * Stamus: homogeneize message * Stamus: really basic README * Stamus: fix some linters warning * Stamus: import playbook and mapper * Stamus: more import Import Stamus' IncidentFields, IncidentFields and Layouts * Stamus: add playbook documentation * Stamus: more documentation * Stamus: add generated docs * Stamus: remove template comment * Stamus: use f-string * Stamus: simply test connection * Stamus: remove commented code * Stamus: docstring on escape function * Stamus: fix to have one context for each command * Stamus: refactoring * Stamus: remove useless code * Stamus: get default value in results if no results * Stamus: run demisto format on yaml files * Stamus: update README * Stamus: fix missing description and format * Stamus: fix following validation * Stamus: add missing playbook image * Stamus: remove marketplacev2 support * Stamus: fix info extraction in get DoC command * Stamus: use getter function Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> * Stamus: command should be lower case * Stamus: avoid double read of event * Stamus: little optimization * Stamus: add docstring * Stamus: remove not needed files * Stamus: add basic integration doc * Stamus: fix JSON format * Stamus: fix some name in playbook * Stamus: rename IOC params * Stamus: fix demisto sdk validation validation: demisto-sdk validate -i Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json validation: fix: demisto-sdk format -i /home/snuser/cortex/Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json * Stamus: fix params name gotten from conf * Stamus: fix stamus extra data playbook following new naming * Stamus: fix playbook ID * Stamus: Add descriptions * Stamus: move constants with other constants * Stamus: use getter function + fix linter * Stamus: use fstring * Stamus: unit tests impl * Stamus: remove template doc Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> * Stamus: add test data to secret-ignore * Stamus: fix event type * Stamus: update demisto docker image * Stamus: fix reference in classifier * Stamus: update README.md Runned demisto-sdk generate-docs -i Packs/Stamus/Integrations/Stamus/Stamus.yml and fixed the version string. * Stamus: fix linter error * Stamus: fix linter warning * Stamus: fix a playbook param * Stamus: fix key value * Stamus: set default value for incident * Stamus: update from version * Stamus: set default incoming mapper * Stamus: improve layout * Stamus: some more layout work * Stamus: use already defined fields * Stamus: don't extract indicators Most fields are information and we should not extract indicators. * Stamus: display threat info in layout * Stamus: don't try to display removed field * Stamus: add host first seen * Stamus: add host insight info in incident layout This is the first pass, we need to add the role. * Stamus: display major host insight information * Stamus: retry policy and fix a field Host insight info can be available after some time if ever the host has not be seen before. * Stamus: update to fix validation * Stamus: add description to mapper * Stamus: add integration as 'start time' user --------- Co-authored-by: Nicolas Frisoni <nfrisoni@stamus-networks.com> Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> Co-authored-by: Peter <pmanev@stamus-networks.com> * bump rn * rn * pre-commit * Bump pack from version CommonTypes to 3.3.85. * update mapper * bump rn * update rn * Empty-Commit * bump rn * ds108 validation fixes * fix validation * ds108 --------- Co-authored-by: Eric Leblond <eric@regit.org> Co-authored-by: Nicolas Frisoni <nfrisoni@stamus-networks.com> Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> Co-authored-by: Peter <pmanev@stamus-networks.com> Co-authored-by: GuyAfik <guyafik11@gmail.com> Co-authored-by: Content Bot <bot@demisto.com>

* Stamus integration v1.0.0 (#26286) * packs: add stamus pack to xsoar content Implement a new set of commands to interact with Stamus Security Platform. * Stamus: remove dummy test * Stamus: use StamusIntegration prefix * Stamus: fix some descriptions * Stamus: update result to return markdown * Stamus: rename commands * Stamus: update pack metadata * Stamus: homogeneize message * Stamus: really basic README * Stamus: fix some linters warning * Stamus: import playbook and mapper * Stamus: more import Import Stamus' IncidentFields, IncidentFields and Layouts * Stamus: add playbook documentation * Stamus: more documentation * Stamus: add generated docs * Stamus: remove template comment * Stamus: use f-string * Stamus: simply test connection * Stamus: remove commented code * Stamus: docstring on escape function * Stamus: fix to have one context for each command * Stamus: refactoring * Stamus: remove useless code * Stamus: get default value in results if no results * Stamus: run demisto format on yaml files * Stamus: update README * Stamus: fix missing description and format * Stamus: fix following validation * Stamus: add missing playbook image * Stamus: remove marketplacev2 support * Stamus: fix info extraction in get DoC command * Stamus: use getter function Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> * Stamus: command should be lower case * Stamus: avoid double read of event * Stamus: little optimization * Stamus: add docstring * Stamus: remove not needed files * Stamus: add basic integration doc * Stamus: fix JSON format * Stamus: fix some name in playbook * Stamus: rename IOC params * Stamus: fix demisto sdk validation validation: demisto-sdk validate -i Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json validation: fix: demisto-sdk format -i /home/snuser/cortex/Packs/Stamus/IncidentTypes/incidenttype-Stamus_Networks.json * Stamus: fix params name gotten from conf * Stamus: fix stamus extra data playbook following new naming * Stamus: fix playbook ID * Stamus: Add descriptions * Stamus: move constants with other constants * Stamus: use getter function + fix linter * Stamus: use fstring * Stamus: unit tests impl * Stamus: remove template doc Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> * Stamus: add test data to secret-ignore * Stamus: fix event type * Stamus: update demisto docker image * Stamus: fix reference in classifier * Stamus: update README.md Runned demisto-sdk generate-docs -i Packs/Stamus/Integrations/Stamus/Stamus.yml and fixed the version string. * Stamus: fix linter error * Stamus: fix linter warning * Stamus: fix a playbook param * Stamus: fix key value * Stamus: set default value for incident * Stamus: update from version * Stamus: set default incoming mapper * Stamus: improve layout * Stamus: some more layout work * Stamus: use already defined fields * Stamus: don't extract indicators Most fields are information and we should not extract indicators. * Stamus: display threat info in layout * Stamus: don't try to display removed field * Stamus: add host first seen * Stamus: add host insight info in incident layout This is the first pass, we need to add the role. * Stamus: display major host insight information * Stamus: retry policy and fix a field Host insight info can be available after some time if ever the host has not be seen before. * Stamus: update to fix validation * Stamus: add description to mapper * Stamus: add integration as 'start time' user --------- Co-authored-by: Nicolas Frisoni <nfrisoni@stamus-networks.com> Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> Co-authored-by: Peter <pmanev@stamus-networks.com> * bump rn * rn * pre-commit * Bump pack from version CommonTypes to 3.3.85. * update mapper * bump rn * update rn * Empty-Commit * bump rn * ds108 validation fixes * fix validation * ds108 --------- Co-authored-by: Eric Leblond <eric@regit.org> Co-authored-by: Nicolas Frisoni <nfrisoni@stamus-networks.com> Co-authored-by: Guy Afik <53861351+GuyAfik@users.noreply.github.com> Co-authored-by: Peter <pmanev@stamus-networks.com> Co-authored-by: GuyAfik <guyafik11@gmail.com> Co-authored-by: Content Bot <bot@demisto.com>

content-bot added the Contribution Thank you! Contributions are always welcome! label May 3, 2023

content-bot changed the base branch from master to contrib/StamusNetworks_stamus-integration-v1.0.0 May 3, 2023 18:12

content-bot assigned GuyAfik May 3, 2023

content-bot requested a review from GuyAfik May 3, 2023 18:12

content-bot assigned edik24 May 3, 2023

content-bot added Contribution Form Filled Whether contribution form filled or not. Partner labels May 3, 2023

GuyAfik requested a review from efelmandar May 4, 2023 09:43

GuyAfik requested changes May 4, 2023

View reviewed changes

GuyAfik added the pending-contributor The PR is pending the response of its creator label May 7, 2023

GuyAfik assigned efelmandar May 7, 2023

efelmandar requested changes May 10, 2023

View reviewed changes

GuyAfik requested changes May 11, 2023

View reviewed changes

regit force-pushed the stamus-integration-v1.0.0 branch from 90f673c to 80adc68 Compare July 25, 2023 14:27

regit requested review from dorschw, daryakoval, yucohen, amshamah419 and thefrieddan1 as code owners July 25, 2023 14:27

regit added 9 commits August 30, 2023 16:59

Stamus: some more layout work

93c5e0a

Stamus: use already defined fields

2968027

Stamus: don't extract indicators

fe4c1c2

Most fields are information and we should not extract indicators.

Stamus: display threat info in layout

0393292

Stamus: don't try to display removed field

74d673a

Stamus: add host first seen

e351212

Stamus: add host insight info in incident layout

9ff14f5

This is the first pass, we need to add the role.

Stamus: display major host insight information

293788b

Stamus: retry policy and fix a field

34d88f9

Host insight info can be available after some time if ever the host has not be seen before.

regit force-pushed the stamus-integration-v1.0.0 branch from 23c4acb to 34d88f9 Compare August 30, 2023 14:59

regit added 3 commits August 30, 2023 17:45

Stamus: update to fix validation

3b325c4

Stamus: add description to mapper

1c006a1

Stamus: add integration as 'start time' user

60eb556

regit requested review from michalgold and idovandijk as code owners August 30, 2023 16:32

GuyAfik added the docs-approved label Sep 3, 2023

GuyAfik approved these changes Sep 3, 2023

View reviewed changes

efelmandar approved these changes Sep 4, 2023

View reviewed changes

GuyAfik added the Partner-Approved label Sep 4, 2023

GuyAfik merged commit 3987e11 into demisto:contrib/StamusNetworks_stamus-integration-v1.0.0 Sep 4, 2023

content-bot mentioned this pull request Sep 4, 2023

Stamus integration v1.0.0 #29426

Merged

11 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Stamus integration v1.0.0 #26286

Stamus integration v1.0.0 #26286

regit commented May 3, 2023

CLAassistant commented May 3, 2023 •

edited

Loading

content-bot commented May 3, 2023

GuyAfik commented May 4, 2023

regit commented May 4, 2023

regit commented May 4, 2023

GuyAfik commented May 4, 2023

GuyAfik left a comment •

edited

Loading

regit commented May 10, 2023

efelmandar left a comment

GuyAfik left a comment

GuyAfik left a comment

GuyAfik commented May 17, 2023

GuyAfik commented Jul 10, 2023 •

edited

Loading

regit commented Jul 25, 2023

regit commented Aug 30, 2023

GuyAfik commented Sep 3, 2023

regit commented Sep 3, 2023

Stamus integration v1.0.0 #26286

Stamus integration v1.0.0 #26286

Conversation

regit commented May 3, 2023

Contributing to Cortex XSOAR Content

Status

Related Issues

Description

Screenshots

Minimum version of Cortex XSOAR

Does it break backward compatibility?

Must have

CLAassistant commented May 3, 2023 • edited Loading

content-bot commented May 3, 2023

GuyAfik commented May 4, 2023

regit commented May 4, 2023

regit commented May 4, 2023

GuyAfik commented May 4, 2023

GuyAfik left a comment • edited Loading

Choose a reason for hiding this comment

regit commented May 10, 2023

efelmandar left a comment

Choose a reason for hiding this comment

GuyAfik left a comment

Choose a reason for hiding this comment

GuyAfik left a comment

Choose a reason for hiding this comment

GuyAfik commented May 17, 2023

GuyAfik commented Jul 10, 2023 • edited Loading

regit commented Jul 25, 2023

regit commented Aug 30, 2023

GuyAfik commented Sep 3, 2023

regit commented Sep 3, 2023

CLAassistant commented May 3, 2023 •

edited

Loading

GuyAfik left a comment •

edited

Loading

GuyAfik commented Jul 10, 2023 •

edited

Loading