File tree 6 files changed +56
-21
lines changed
Integrations/CortexXpanse
6 files changed +56
-21
lines changed Original file line number Diff line number Diff line change 99 "Xpanse Alert ID" : {
1010 "complex" : {
1111 "filters" : [],
12- "root" : " external_id "
12+ "root" : " alert_id "
1313 "transformers" : []
1414 }
1515 },
7878 "Xpanse IP" : {
7979 "complex" : {
8080 "filters" : [],
81- "root" : " action_remote_ip "
81+ "root" : " ipv4_addresses "
8282 "transformers" : [
8383 {
84- "args" : {
85- "applyIfEmpty" : {},
86- "defaultValue" : {
87- "isContext" : true ,
88- "value" : {
89- "simple" : " ipv4_addresses[0]"
90- }
91- }
92- },
93- "operator" : " SetIfEmpty"
84+ "operator" : " FirstArrayElement"
9485 }
9586 ]
9687 }
175166 "dbot_classification_incident_type_all" : {
176167 "dontMapEventToLabels" : false ,
177168 "internalMapping" : {
178- "Tags" : {
179- "complex" : {
169+ "Description" : {
170+ "simple" : " description"
171+ },
172+ "Destination IP" : {
173+ "complex" : {
174+ "filters" : [],
175+ "root" : " ipv4_addresses"
176+ "transformers" : [
177+ {
178+ "operator" : " FirstArrayElement"
179+ }
180+ ]
181+ }
182+ },
183+ "Protocol" : {
184+ "complex" : {
185+ "filters" : [],
186+ "root" : " port_protocol"
187+ "transformers" : []
188+ }
189+ },
190+ "Tags" : {
191+ "complex" : {
180192 "filters" : [],
181193 "root" : " tags"
182194 "transformers" : []
183195 }
184- }
185- }
196+ }
197+ }
186198 }
187199 },
188200 "name" : " Xpanse - Incoming Mapper"
Original file line number Diff line number Diff line change 2222 "threshold" : 72 ,
2323 "type" : " shortText"
2424 "unmapped" : false ,
25- "unsearchable" : true ,
25+ "unsearchable" : false ,
2626 "useAsKpi" : true ,
2727 "version" : -1 ,
2828 "fromVersion" : " 6.5.0"
Original file line number Diff line number Diff line change 1919 "group" : 0 ,
2020 "hidden" : false ,
2121 "openEnded" : false ,
22- "associatedToAll" : true ,
22+ "associatedToAll" : false ,
23+ "associatedTypes" : [
24+ " Xpanse Alert"
25+ ],
2326 "unmapped" : false ,
24- "unsearchable" : true ,
27+ "unsearchable" : false ,
2528 "caseInsensitive" : true ,
2629 "sla" : 0 ,
2730 "threshold" : 72 ,
Original file line number Diff line number Diff line change @@ -399,7 +399,7 @@ script:
399399 - resolved_contested_asset
400400 - resolved_remediated_automatically
401401 - resolved
402- - description : Comma-separated list of strings of the business units
402+ - description : Comma-separated list of strings of the business units.
403403 name : business_units_list
404404 - description : A date in the format 2019-12-31T23:59:00. Only incidents that were created on or before the specified date/time will be retrieved.
405405 name : lte_creation_time
@@ -686,6 +686,8 @@ script:
686686 script : ' '
687687 subtype : python3
688688 type : python
689+ defaultmapperin : Xpanse - Incoming Mapper
690+ defaultclassifier : Xpanse - Classifier
689691fromversion : 6.5.0
690692tests :
691693- CortexXpanse_Test
Original file line number Diff line number Diff line change 1+
2+ #### Integrations
3+ ##### Cortex Xpanse
4+
5+ - Updated the default classifier and incoming mapper for the integration.
6+
7+ #### Mappers
8+ ##### Xpanse - Incoming Mapper
9+
10+ - Updated the targets for several fields for improved accuracy and formatting.
11+
12+ #### Incident Fields
13+ ##### Xpanse Tags
14+ Updated the field to be searchable.
15+
16+ ##### Xpanse Provider
17+ Updated the field to be searchable and to not be scoped to all incident types.
18+
Original file line number Diff line number Diff line change 22 "name" : " Cortex Xpanse"
33 "description" : " Content for working with Attack Surface Management (ASM)."
44 "support" : " xsoar"
5- "currentVersion" : " 1.0.9 "
5+ "currentVersion" : " 1.0.10 "
66 "author" : " Cortex XSOAR"
77 "url" : " https://www.paloaltonetworks.com/cortex"
88 "email" : " "
You can’t perform that action at this time.
0 commit comments