Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SOAR-18536] palo alto cortex xdr #3027

Merged
merged 9 commits into from
Jan 6, 2025
Merged

[SOAR-18536] palo alto cortex xdr #3027

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
8953966
Update pagination decision in task
ablakley-r7 Jan 6, 2025
311aff2
Update unit test pagination
ablakley-r7 Jan 6, 2025
96ba37d
testing unit test
ablakley-r7 Jan 6, 2025
fdd1de0
testing unit test
ablakley-r7 Jan 6, 2025
9d2dfd0
testing unit test
ablakley-r7 Jan 6, 2025
2b513b3
testing unit test
ablakley-r7 Jan 6, 2025
c430c81
testing unit test
ablakley-r7 Jan 6, 2025
944a2e9
testing unit test
ablakley-r7 Jan 6, 2025
1716d2b
Update logging
ablakley-r7 Jan 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions plugins/palo_alto_cortex_xdr/.CHECKSUM
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"spec": "1a737630103c5a3fb2d61444c2fefbb9",
"manifest": "58618c879c00000568c7d1e4da6bc0a1",
"setup": "cb9fd1212032e1f3d1d0246bf663c090",
"spec": "8125e2ef1c00b4a1402f087180e53f38",
"manifest": "65bd596c7372174f46013b4d0ce10b04",
"setup": "b2d24cbc8912756962fb0415a975bb53",
"schemas": [
{
"identifier": "allow_file/schema.py",
Expand Down Expand Up @@ -48,4 +48,4 @@
"hash": "64c151d95839f2c46a85d401b0d98e5f"
}
]
}
}
2 changes: 1 addition & 1 deletion plugins/palo_alto_cortex_xdr/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM --platform=linux/amd64 rapid7/insightconnect-python-3-slim-plugin:6.2.0
FROM --platform=linux/amd64 rapid7/insightconnect-python-3-slim-plugin:6.2.2

LABEL organization=rapid7
LABEL sdk=python
Expand Down
2 changes: 1 addition & 1 deletion plugins/palo_alto_cortex_xdr/bin/icon_palo_alto_cortex_xdr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ from sys import argv

Name = "Palo Alto Cortex XDR"
Vendor = "rapid7"
Version = "4.0.4"
Version = "4.0.5"
Description = "Stop modern attacks with the industry's first extended detection and response platform that spans your endpoints, network and cloud data"


Expand Down
1 change: 1 addition & 0 deletions plugins/palo_alto_cortex_xdr/help.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -927,6 +927,7 @@ Isolate Endpoint fails with 500 error - This will happen if an isolation action

# Version History

* 4.0.5 - Update `MonitorAlerts` task pagination decision handling | update SDK to 6.2.2
* 4.0.4 - Raise authentication errors if provided invalid credentials
* 4.0.3 - `Monitor Incidents` - Add custom config exception handling
* 4.0.2 - SDK bump to 6.1.4
Expand Down
5 changes: 3 additions & 2 deletions plugins/palo_alto_cortex_xdr/icon_palo_alto_cortex_xdr/tasks/monitor_alerts/task.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,15 +117,15 @@ def get_alerts_palo_alto(self, state: dict, start_time: Optional[int], now: int,
state[CURRENT_COUNT] = state.get(CURRENT_COUNT, 0) + results_count

new_alerts, new_alert_hashes, last_alert_time = self._dedupe_and_get_highest_time(results, state)

is_paginating = state.get(CURRENT_COUNT) < total_count
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the issue here just an off by 1 error or something?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we probbaly never get < on the finishing statement because on the last page it would equal the total_count. think the comparison was wrong but the new one should still work

is_paginating = results_count >= alert_limit
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

makes sense to me! can we just log the 'results_count' in the pagination log so we can follow this? I'm guessing our results_count will equal the alert_limit each time? Although reading the logic around alert_limit it doesn't lok like we ever pass this to the API call against Palo Alto so we may need a follow on ticket, I'm guessing at the minute the default API limit from them is 100.


if is_paginating:
self.logger.info(f"Found total alerts={total_count}, limit={alert_limit}, is_paginating={is_paginating}")
self.logger.info(
f"Paginating alerts: Saving state with existing filters: "
f"search_from = {search_from} "
f"search_to = {search_to} "
f"results returned this page = {results_count} "
f"current_count = {state.get(CURRENT_COUNT)} "
f"total_count = {total_count}"
)
Expand All @@ -138,6 +138,7 @@ def get_alerts_palo_alto(self, state: dict, start_time: Optional[int], now: int,
f"Paginating final page of alerts: "
f"search_from = {search_from} "
f"search_to = {search_to} "
f"results returned this page = {results_count} "
f"current_count = {state.get(CURRENT_COUNT)} "
f"total_count = {total_count} "
)
Expand Down
5 changes: 3 additions & 2 deletions plugins/palo_alto_cortex_xdr/plugin.spec.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,12 @@ products: [insightconnect]
name: palo_alto_cortex_xdr
title: Palo Alto Cortex XDR
description: Stop modern attacks with the industry's first extended detection and response platform that spans your endpoints, network and cloud data
version: 4.0.4
version: 4.0.5
connection_version: 2
cloud_ready: true
sdk:
type: slim
version: 6.2.0
version: 6.2.2
user: nobody
supported_versions: ["2024-07-15 Palo Alto Cortex XDR API"]
vendor: rapid7
Expand Down Expand Up @@ -38,6 +38,7 @@ key_features:
- "Add files to the block or allow lists"
troubleshooting: "Isolate Endpoint fails with 500 error - This will happen if an isolation action (Isolate or Unisolate) is in progress on the selected endpoint. Wait a few minutes and try again."
version_history:
- "4.0.5 - Update `MonitorAlerts` task pagination decision handling | update SDK to 6.2.2"
- "4.0.4 - Raise authentication errors if provided invalid credentials"
- "4.0.3 - `Monitor Incidents` - Add custom config exception handling"
- "4.0.2 - SDK bump to 6.1.4"
Expand Down
2 changes: 1 addition & 1 deletion plugins/palo_alto_cortex_xdr/setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@


setup(name="palo_alto_cortex_xdr-rapid7-plugin",
version="4.0.4",
version="4.0.5",
description="Stop modern attacks with the industry's first extended detection and response platform that spans your endpoints, network and cloud data",
author="rapid7",
author_email="",
Expand Down
17 changes: 11 additions & 6 deletions plugins/palo_alto_cortex_xdr/unit_test/test_monitor_alerts.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,11 @@
"last_alert_hash": ["f4ef7617f46fef7b78410498f563e01df2a5f030"],
}

STUB_STATE_NO_PAGES = {
"last_alert_time": 1706540499609,
"last_alert_hash": ["a502a9c50798186882ad8dc91ac2b38eb185c404"],
}

STUB_STATE_MORE_PAGES = {
"current_count": 1,
"last_search_to": 100,
Expand Down Expand Up @@ -78,18 +83,18 @@ def setUp(self) -> None:
"starting",
{},
TaskUtil.load_expected("monitor_alerts"),
True,
False,
"monitor_alerts",
STUB_STATE_MORE_PAGES,
STUB_STATE_NO_PAGES,
200,
],
[
"next_page",
STUB_STATE_MORE_PAGES.copy(),
TaskUtil.load_expected("monitor_alert_two"),
True,
False,
"monitor_alerts_two",
STUB_STATE_EXPECTED_SECOND_PAGE,
STUB_STATE_EXPECTED_NO_PAGE,
200,
],
[
Expand Down Expand Up @@ -250,7 +255,7 @@ def test_monitor_alerts_dedupe(

self.assertEqual(status_code, expected_status_code)
self.assertEqual(input_state, state)
self.assertEqual(has_more_pages, True)
self.assertEqual(has_more_pages, False)
self.assertEqual(output, [])

@parameterized.expand(
Expand Down Expand Up @@ -353,4 +358,4 @@ def test_monitor_alerts_custom_config(
self.assertEqual(output, expected_output)
self.assertEqual(status_code, expected_status_code)
self.assertEqual(input_state, state)
self.assertEqual(has_more_pages, True)
self.assertEqual(has_more_pages, False)
Loading