Skip to content

Commit b765f9d

Browse files
ishaishorishaiisraelpoliShirleyDenkbergdorschw
authored
Is 1447 exabeam fetch incidents (demisto#22664)
* New feature: exabeam fetch incidents * New feature: exabeam fetch incidents * New feature: exabeam fetch incidents * Improvement: rsa * Improvement: exabeam * Improvement: exabeam * Improvement: exabeam * Improvement: exabeam * Improvement: exabeam * Improvement: exabeam * Improvement: exabeam * Improvement: exabeam * Improvement: exabeam * Improvement: exabeam * Improvement: exabeam * first commit for fetch * commit * commit * first commit for fetch * commit * Added fetch incident command and list incidents command * mypy and pylint * commit * Corrections UT and classifier * fixed fthe Readme * Add UT for fetch-incidents * commit * Fixed UT * fix UT * commit * commit * corrections * commit * corrections * Update 3_3_40.md Done. * Update Exabeam.yml Done. * Update Exabeam.yml Done. * Update README.md Done. * Update 2_2_0.md Done. * commit * corrections * Update docker * fix * commit * correction to RN Co-authored-by: ishai <[email protected]> Co-authored-by: israelpolishook <[email protected]> Co-authored-by: ShirleyDenkberg <[email protected]> Co-authored-by: dorschw <[email protected]>
1 parent 612278f commit b765f9d

21 files changed

+1354
-65
lines changed

‎Packs/CommonTypes/.pack-ignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -327,6 +327,7 @@ emailRep
327327
accountRep
328328
cveRep
329329
VerifyCIDR
330+
Exabeam
330331

331332
[file:classifier-Mail-listener.json]
332333
ignore=BA101

‎Packs/CommonTypes/IncidentFields/incidentfield-Close_Time.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@
77
"SysAid Request",
88
"Qradar Generic",
99
"Guardicore Incident",
10-
"Saas Security Incident"
10+
"Saas Security Incident",
11+
"Exabeam Incident"
1112
],
1213
"breachScript": "",
1314
"caseInsensitive": true,

‎Packs/CommonTypes/IncidentFields/incidentfield-Item_Owner.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@
2323
"Symantec DLP Discover Incident",
2424
"Symantec DLP Endpoint Incident",
2525
"Symantec DLP Network Incident",
26-
"ThreatConnect"
26+
"ThreatConnect",
27+
"Exabeam Incident"
2728
],
2829
"unmapped": false,
2930
"unsearchable": false,

‎Packs/CommonTypes/IncidentFields/incidentfield-Source_Updated_By.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"id": "incident_sourceupdatedby",
3+
"version": -1,
4+
"modified": "2022-12-05T14:55:55.838824+02:00",
5+
"name": "Source Updated by",
6+
"ownerOnly": false,
7+
"cliName": "sourceupdatedby",
8+
"type": "shortText",
9+
"closeForm": false,
10+
"editForm": true,
11+
"required": false,
12+
"neverSetAsRequired": false,
13+
"isReadOnly": false,
14+
"useAsKpi": false,
15+
"locked": false,
16+
"system": false,
17+
"content": true,
18+
"group": 0,
19+
"hidden": false,
20+
"openEnded": false,
21+
"associatedToAll": true,
22+
"unmapped": false,
23+
"unsearchable": true,
24+
"caseInsensitive": true,
25+
"sla": 0,
26+
"threshold": 72,
27+
"fromVersion": "6.5.0"
28+
}

‎Packs/CommonTypes/IncidentFields/incidentfield-Start_Time.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@
88
"CrowdStrike Falcon Incident",
99
"Microsoft Defender For Endpoint",
1010
"Skyhigh Security Alert",
11-
"Skyhigh Security Threat"
11+
"Skyhigh Security Threat",
12+
"Exabeam Incident"
1213
],
1314
"breachScript": "",
1415
"caseInsensitive": true,

‎Packs/CommonTypes/IncidentFields/incidentfield-Title.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@
3737
"AWS Guard Duty IAM Finding",
3838
"AWS Guard Duty Kubernetes Finding",
3939
"AWS Guard Duty Malware Protection Finding",
40-
"AWS Guard Duty S3 Finding"
40+
"AWS Guard Duty S3 Finding",
41+
"Exabeam Incident"
4142
],
4243
"associatedToAll": false,
4344
"unmapped": false,

‎Packs/CommonTypes/ReleaseNotes/3_3_40.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
2+
#### Incident Fields
3+
Added the **Exabeam Incident** incident type to the following incident fields:
4+
- **Close Time**
5+
- **Item Owner**
6+
- **Start Time**
7+
- **Title**
8+
- **Source Updated by**
9+
10+
Added the **Source Updated By** incident field.

‎Packs/CommonTypes/pack_metadata.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Common Types",
33
"description": "This Content Pack will get you up and running in no-time and provide you with the most commonly used incident & indicator fields and types.",
44
"support": "xsoar",
5-
"currentVersion": "3.3.39",
5+
"currentVersion": "3.3.40",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",

‎Packs/Exabeam/Classifiers/classifier-exabeam_mapping.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"description": "",
3+
"feed": false,
4+
"id": "Exabeam mapping",
5+
"mapping": {
6+
"Exabeam Incident": {
7+
"dontMapEventToLabels": true,
8+
"internalMapping": {
9+
"Close Time": {
10+
"simple": "baseFields.closedDate"
11+
},
12+
"Description": {
13+
"simple": "baseFields.description"
14+
},
15+
"Exabeam Id": {
16+
"simple": "incidentId"
17+
},
18+
"Exabeam Queue": {
19+
"simple": "baseFields.queue"
20+
},
21+
"Item Owner": {
22+
"simple": "baseFields.owner"
23+
},
24+
"Last Update Time": {
25+
"simple": "baseFields.updatedAt"
26+
},
27+
"Source Category": {
28+
"simple": "baseFields.incidentType"
29+
},
30+
"Source Create time": {
31+
"simple": "baseFields.createdAt"
32+
},
33+
"Source Created By": {
34+
"simple": "baseFields.createdBy"
35+
},
36+
"Source Priority": {
37+
"simple": "baseFields.priority"
38+
},
39+
"Source Status": {
40+
"simple": "baseFields.status"
41+
},
42+
"Source Updated by": {
43+
"simple": "baseFields.updatedBy"
44+
},
45+
"Start Time": {
46+
"simple": "baseFields.startedDate"
47+
},
48+
"Title": {
49+
"simple": "name"
50+
}
51+
}
52+
}
53+
},
54+
"name": "Exabeam mapping",
55+
"type": "mapping-incoming",
56+
"version": -1,
57+
"fromVersion": "6.5.0"
58+
}

‎Packs/Exabeam/IncidentFields/incidentfields-exabeamid.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "incident_exabeamid",
3+
"version": -1,
4+
"modified": "2022-11-30T14:33:28.322016+02:00",
5+
"name": "Exabeam Id",
6+
"ownerOnly": false,
7+
"cliName": "exabeamid",
8+
"type": "shortText",
9+
"closeForm": false,
10+
"editForm": true,
11+
"required": false,
12+
"neverSetAsRequired": false,
13+
"isReadOnly": false,
14+
"useAsKpi": false,
15+
"locked": false,
16+
"system": false,
17+
"content": true,
18+
"group": 0,
19+
"hidden": false,
20+
"openEnded": false,
21+
"associatedTypes": [
22+
"Exabeam Incident"
23+
],
24+
"associatedToAll": false,
25+
"unmapped": false,
26+
"unsearchable": true,
27+
"caseInsensitive": true,
28+
"sla": 0,
29+
"threshold": 72,
30+
"fromVersion": "6.5.0"
31+
}

0 commit comments

Comments
 (0)