8000 [Marketplace Contribution] ThreatGrid by xsoar-bot · Pull Request #21611 · demisto/content · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

[Marketplace Contribution] ThreatGrid #21611

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 36 commits into from
Jan 3, 2023
Merged

[Marketplace Contribution] ThreatGrid #21611

merged 36 commits into from
Jan 3, 2023

Conversation

xsoar-bot
Copy link
Contributor

Status

  • In Progress
  • Ready
  • In Hold - (Reason for hold)

Contributor

@amkoppad

Notes

Added the two commands to the integration.

  1. !threat-grid-advanced-search
  2. !threat-grid-submit-urls
    Adding these two commands to the integration make the implementation with XSOAR more efficient.
    Without the !threat-grid-submit-urls command urls first have to be converted to files and then uploaded to ThreatGrid as samples.
    !threat-grid-advanced-search command enables XSOAR to run the ThreatGrid query search.

Video Link

Short demo video of the Pack usage. Speeds up the review. Optional but recommended. Use a video sharing service such as Google Drive or YouTube.

@content-bot content-bot added the Contribution Thank you! Contributions are always welcome! label Oct 4, 2022
@content-bot content-bot changed the base branch from master to contrib/xsoar-contrib_amkoppad-contrib-ThreatGrid October 4, 2022 18:33
@content-bot
Copy link
Collaborator

Thank you for your contribution. Your generosity and caring are unrivaled! Rest assured - our content wizard @rshunim will very shortly look over your proposed changes.

@content-bot content-bot requested a review from rshunim October 4, 2022 18:33
@amkoppad
Copy link
Contributor

Usage example:

!threat-grid-advanced-search query="{
\"query\": \"query get_sample($q_json:
String) {sample(, q_json: $q_json,limit: 20) {submitted_at id submitted_file_type status threat_score state login url}}\",\"variables\": {\"q_json\": \"{\\\"op\\\": \\\"and\\\",\\\"clauses\\\": [{\\\"op\\\": \\\"attr\\\",\\\"attr\\\": \\\"submitted_at\\\",\\\"comp_op\\\": \\\"gte\\\",\\\"value\\\": \\\"2022-09-30T21:09:02Z\\\"}]}\"}}"

!threat-grid-submit-urls url="www.xyz.com"

@rshunim rshunim requested a review from JasBeilin November 15, 2022 08:09
@JasBeilin
Copy link
Contributor

Hi, @amkoppad, thank you for contributing!
I have one question before I start the review- I see that you added a new pack with Dev in the name, and very few changes in the code itself from the production current version.
I believe it is a mistake, If I am wrong please let me know so I will start to review. otherwise please re-submit this PR with the relevant changes in the actual production pack and I will review it.

@JasBeilin JasBeilin added the pending-contributor The PR is pending the response of its creator label Nov 15, 2022
@JasBeilin JasBeilin removed the request for review from rshunim November 20, 2022 11:53
@JasBeilin
Copy link
Contributor

Hi @amkoppad , any updates here?

@amkoppad
Copy link
Contributor

@JasBeilin I have added 2 commands as mentioned. You can find the functions in the code. def submit_urls() and def advanced_search() are the definitions you can check for in the integration. I just saw that the integration had some updates. I made the changes to the updated integration and have uploaded the .yml file again. Please let me know if you have any other questions. I am happy to answer or give you a demo of what exactly has been added.

@JasBeilin
Copy link
Contributor

Hi @amkoppad, I have changed the code in the original integration. Please go through it and make sure I have added all the changes so I can actually review.
Also, please note that the yml file you provided python file instead of yml file. Please restore the file to be a valid yml.

@amkoppad
Copy link
Contributor
amkoppad commented Dec 1, 2022

Hi @JasBeilin, I have checked your changes. You have added all the things. I don't see anything being missed. I have also made changes to the .yml file as you suggested. Please let me know what you might need next. Thank you.

JasBeilin
JasBeilin requested changes Dec 5, 2022
View reviewed changes
Copy link
Contributor
@JasBeilin JasBeilin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good.
I added some comment that I would appreciate if you can address.
In addition, please add unit tests (you can check https://xsoar.pan.dev/docs/integrations/unit-testing for instructions) feel free to let me know if you need any assistance with it.

Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py Outdated
Comment on lines 945 to 950
return_results({
'Type': entryTypes['note'],
'EntryContext': {'ThreatGrid.URLs': res},
'HumanReadable': tableToMarkdown('ThreatGrid - URL Submission', res),
'ContentsFormat': formats['json'],
'Contents': res
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please change to ComandResult Object instead of the json.

JasBeilin and others added 3 commits December 5, 2022 10:19
@JasBeilin
Merge branch 'contrib/xsoar-contrib_amkoppad-contrib-ThreatGrid' into…
995ca8a 
… amkoppad-contrib-ThreatGrid
@amkoppad @JasBeilin
Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py
451aac8 
Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>
@amkoppad @JasBeilin
Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py
8f3400d 
Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>
@dorschw dorschw changed the title [Marketplace Contribution] Cisco Secure Malware Analytics - Content Pack Update [Marketplace Contribution] ThreatGrid Dec 7, 2022
JasBeilin
JasBeilin reviewed Dec 8, 2022
View reviewed changes
@JasBeilin
Copy link
Contributor

Hi, Please notice this comment you have not addressed yet- https://github.com/demisto/content/pull/21611/files#r1039259785
Also, I added a suggestion that should fix the validation check.
Another error I see is this:
Missing the field "description" in Path: 'script'-> 'commands'-> 'threat-grid-advanced-search'-> 'outputs'-> 'Threatgrid.SearchResult'
Please add the field "description" to the path: 'script'-> 'commands'-> 'threat-grid-advanced-search'-> 'outputs'-> 'Threatgrid.SearchResult' in the yml.

If you need my help in any of these fixes, let me know.

amkoppad and others added 20 commits December 19, 2022 08:15
JasBeilin
JasBeilin approved these changes Jan 3, 2023
View reviewed changes
Copy link
Contributor
@JasBeilin JasBeilin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work!

@JasBeilin
Copy link
Contributor

Commenting here for documentation-
We are merging this PR in order to have a fix for customer, the design of this addition is taken into consideration in a V2 version that should be available soon.

@JasBeilin JasBeilin merged commit 32667ff into demisto:contrib/xsoar-contrib_amkoppad-contrib-ThreatGrid Jan 3, 2023
@content-bot content-bot mentioned this pull request Jan 3, 2023
Merged
3 tasks
JasBeilin added a commit that referenced this pull request Jan 3, 2023
@content-bot @xsoar-bot
@amkoppad @JasBeilin
[Marketplace Contribution] ThreatGrid (#21611) (#23525)
f5c4f1d 
* "contribution update to pack "Cisco Secure Malware Analytics""

* Update ThreatGridDev.yml

* added commands in original integration

* Update ThreatGridDev.yml

* fixed RN

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Made the suggested changes to the advanced_search function and added the desciption for outputs in .yml file

* Added a test function and addressed the previous build errors

* Modified the test function

* Modified the test function

* Modified the test function v3

* Fixed the type errors

* Fixed the submit_urls test function

* Adding the test function for advanced search function

* Fixed mocking the requests object

* Fixed test_data path

* Test function fix 2

* Test function fix 3

* Test function fix 4

* Test function fix 5

* Modified the yml file to exclude image tag

* Modified python function for test function

* Modified the mock_response object

* Fixed the request typeerror

* Modified the mock_data

* TypeError fix 2

* Changed the mocker object

* This should fix all the test functions

* Fixed the image version issue

* Fixed Readme

* Fixed the lint errors

* Update README.md

Fixed the README issues.

Co-authored-by: amkoppad <82898085+amkoppad@users.noreply.github.com>
Co-authored-by: Jas Beilin <jgranot@paloaltonetworks.com>
Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>
Co-authored-by: amkoppad <amit.koppad@paloaltonetworks.com>

Co-authored-by: xsoar-bot <67315154+xsoar-bot@users.noreply.github.com>
Co-authored-by: amkoppad <82898085+amkoppad@users.noreply.github.com>
Co-authored-by: Jas Beilin <jgranot@paloaltonetworks.com>
Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>
Co-authored-by: amkoppad <amit.koppad@paloaltonetworks.com>
efelmandar pushed a commit that referenced this pull request Jan 4, 2023
@content-bot @xsoar-bot
@amkoppad @JasBeilin @efelmandar
[Marketplace Contribution] ThreatGrid (#21611) (#23525)
1488f0c 
* "contribution update to pack "Cisco Secure Malware Analytics""

* Update ThreatGridDev.yml

* added commands in original integration

* Update ThreatGridDev.yml

* fixed RN

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Made the suggested changes to the advanced_search function and added the desciption for outputs in .yml file

* Added a test function and addressed the previous build errors

* Modified the test function

* Modified the test function

* Modified the test function v3

* Fixed the type errors

* Fixed the submit_urls test function

* Adding the test function for advanced search function

* Fixed mocking the requests object

* Fixed test_data path

* Test function fix 2

* Test function fix 3

* Test function fix 4

* Test function fix 5

* Modified the yml file to exclude image tag

* Modified python function for test function

* Modified the mock_response object

* Fixed the request typeerror

* Modified the mock_data

* TypeError fix 2

* Changed the mocker object

* This should fix all the test functions

* Fixed the image version issue

* Fixed Readme

* Fixed the lint errors

* Update README.md

Fixed the README issues.

Co-authored-by: amkoppad <82898085+amkoppad@users.noreply.github.com>
Co-authored-by: Jas Beilin <jgranot@paloaltonetworks.com>
Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>
Co-authored-by: amkoppad <amit.koppad@paloaltonetworks.com>

Co-authored-by: xsoar-bot <67315154+xsoar-bot@users.noreply.github.com>
Co-authored-by: amkoppad <82898085+amkoppad@users.noreply.github.com>
Co-authored-by: Jas Beilin <jgranot@paloaltonetworks.com>
Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>
Co-authored-by: amkoppad <amit.koppad@paloaltonetworks.com>
ckaadic pushed a commit to ckaadic/content that referenced this pull request Jan 10, 2023
@content-bot @xsoar-bot
@amkoppad @JasBeilin @ckaadic
[Marketplace Contribution] ThreatGrid (demisto#21611) (demisto#23525)
8f7768a 
* "contribution update to pack "Cisco Secure Malware Analytics""

* Update ThreatGridDev.yml

* added commands in original integration

* Update ThreatGridDev.yml

* fixed RN

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Made the suggested changes to the advanced_search function and added the desciption for outputs in .yml file

* Added a test function and addressed the previous build errors

* Modified the test function

* Modified the test function

* Modified the test function v3

* Fixed the type errors

* Fixed the submit_urls test function

* Adding the test function for advanced search function

* Fixed mocking the requests object

* Fixed test_data path

* Test function fix 2

* Test function fix 3

* Test function fix 4

* Test function fix 5

* Modified the yml file to exclude image tag

* Modified python function for test function

* Modified the mock_response object

* Fixed the request typeerror

* Modified the mock_data

* TypeError fix 2

* Changed the mocker object

* This should fix all the test functions

* Fixed the image version issue

* Fixed Readme

* Fixed the lint errors

* Update README.md

Fixed the README issues.

Co-authored-by: amkoppad <82898085+amkoppad@users.noreply.github.com>
Co-authored-by: Jas Beilin <jgranot@paloaltonetworks.com>
Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>
Co-authored-by: amkoppad <amit.koppad@paloaltonetworks.com>

Co-authored-by: xsoar-bot <67315154+xsoar-bot@users.noreply.github.com>
Co-authored-by: amkoppad <82898085+amkoppad@users.noreply.github.com>
Co-authored-by: Jas Beilin <jgranot@paloaltonetworks.com>
Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>
Co-authored-by: amkoppad <amit.koppad@paloaltonetworks.com>
xsoar-bot added a commit to xsoar-contrib/content that referenced this pull request Jan 11, 2023
@content-bot @xsoar-bot
@amkoppad @JasBeilin
[Marketplace Contribution] ThreatGrid (demisto#21611) (demisto#23525)
14015f8 
* "contribution update to pack "Cisco Secure Malware Analytics""

* Update ThreatGridDev.yml

* added commands in original integration

* Update ThreatGridDev.yml

* fixed RN

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Update Packs/ThreatGrid/Integrations/ThreatGrid/ThreatGrid.py

Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>

* Made the suggested changes to the advanced_search function and added the desciption for outputs in .yml file

* Added a test function and addressed the previous build errors

* Modified the test function

* Modified the test function

* Modified the test function v3

* Fixed the type errors

* Fixed the submit_urls test function

* Adding the test function for advanced search function

* Fixed mocking the requests object

* Fixed test_data path

* Test function fix 2

* Test function fix 3

* Test function fix 4

* Test function fix 5

* Modified the yml file to exclude image tag

* Modified python function for test function

* Modified the mock_response object

* Fixed the request typeerror

* Modified the mock_data

* TypeError fix 2

* Changed the mocker object

* This should fix all the test functions

* Fixed the image version issue

* Fixed Readme

* Fixed the lint errors

* Update README.md

Fixed the README issues.

Co-authored-by: amkoppad <82898085+amkoppad@users.noreply.github.com>
Co-authored-by: Jas Beilin <jgranot@paloaltonetworks.com>
Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>
Co-authored-by: amkoppad <amit.koppad@paloaltonetworks.com>

Co-authored-by: xsoar-bot <67315154+xsoar-bot@users.noreply.github.com>
Co-authored-by: amkoppad <82898085+amkoppad@users.noreply.github.com>
Co-authored-by: Jas Beilin <jgranot@paloaltonetworks.com>
Co-authored-by: Jasmine Beilin <71636766+JasBeilin@users.noreply.github.com>
Co-authored-by: amkoppad <amit.koppad@paloaltonetworks.com>
@xsoar-bot xsoar-bot deleted the amkoppad-contrib-ThreatGrid branch November 23, 2023 15:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@amkoppad amkoppad amkoppad left review comments

@JasBeilin JasBeilin JasBeilin approved these changes

Assignees

@JasBeilin JasBeilin

Labels
Contribution Thank you! Contributions are always welcome! docs-approved pending-contributor The PR is pending the response of its creator
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@xsoar-bot @content-bot @amkoppad @JasBeilin @CLAassistant @rshunim
0