Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cs falcon fetch limit issue #29411

Merged
merged 21 commits into from
Sep 7, 2023
Merged

Cs falcon fetch limit issue #29411

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
e631658
fixed the parameter that send as a limit
Sep 3, 2023
4fae562
update rn
Sep 3, 2023
cf7e2e2
Merge branch 'master' into cs-falcon-fetch-limit-issue
daryakoval Sep 4, 2023
2432be5
Merge branch 'master' into cs-falcon-fetch-limit-issue
daryakoval Sep 4, 2023
4897753
update test playbook
Sep 4, 2023
43208c9
Merge branch 'master' into cs-falcon-fetch-limit-issue
Sep 4, 2023
02df704
Merge remote-tracking branch 'origin/cs-falcon-fetch-limit-issue' int…
Sep 4, 2023
7382032
Update Packs/CrowdStrikeFalcon/ReleaseNotes/1_11_7.md
daryakoval Sep 4, 2023
ffc9e96
fixing test playbook
Sep 5, 2023
b99f433
adding sort incidents by the ids order; fix time field issue
Sep 5, 2023
9d5fa2d
rename rn
Sep 5, 2023
fc7e163
Merge branch 'master' into cs-falcon-fetch-limit-issue
Sep 5, 2023
a437dd4
bump version
Sep 5, 2023
cee456a
added unitest
Sep 5, 2023
f44087a
Merge branch 'master' into cs-falcon-fetch-limit-issue
Sep 5, 2023
d19c1b1
fix rn
Sep 5, 2023
20e62dc
save unitest fix
Sep 5, 2023
0757d96
save format
Sep 5, 2023
baf0f4e
save unitest fix
Sep 5, 2023
2b0c358
update docker
Sep 5, 2023
80fddab
Merge branch 'master' into cs-falcon-fetch-limit-issue
Sep 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2547,7 +2547,7 @@ def fetch_incidents():

detections = filter_incidents_by_duplicates_and_limit(incidents_res=detections,
last_run=current_fetch_info_detections,
fetch_limit=fetch_limit, id_field='name')
fetch_limit=INCIDENTS_PER_FETCH, id_field='name')

for detection in detections:
occurred = dateparser.parse(detection["occurred"])
Expand Down Expand Up @@ -2589,7 +2589,7 @@ def fetch_incidents():
incidents.append(incident_to_context)

incidents = filter_incidents_by_duplicates_and_limit(incidents_res=incidents, last_run=current_fetch_info_incidents,
fetch_limit=fetch_limit, id_field='name')
fetch_limit=INCIDENTS_PER_FETCH, id_field='name')
for incident in incidents:
occurred = dateparser.parse(incident["occurred"])
if occurred:
Expand Down Expand Up @@ -2624,7 +2624,7 @@ def fetch_incidents():

idp_detections = filter_incidents_by_duplicates_and_limit(incidents_res=idp_detections,
last_run=current_fetch_info_idp_detections,
fetch_limit=fetch_limit, id_field='name')
fetch_limit=INCIDENTS_PER_FETCH, id_field='name')
updated_last_run = update_last_run_object(last_run=current_fetch_info_idp_detections, incidents=idp_detections,
fetch_limit=fetch_limit,
start_fetch_time=start_fetch_time, end_fetch_time=end_fetch_time,
Expand Down
2 changes: 1 addition & 1 deletion Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/CrowdStrikeFalcon.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4375,7 +4375,7 @@ script:
- contextPath: CrowdStrike.IDPEntity.EmailAddresses
description: The identity entity email address.
type: String
dockerimage: demisto/py3-tools:1.0.0.72003
dockerimage: demisto/py3-tools:1.0.0.72621
isfetch: true
ismappable: true
isremotesyncin: true
Expand Down
8 changes: 8 additions & 0 deletions Packs/CrowdStrikeFalcon/ReleaseNotes/1_11_7.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@

#### Integrations

##### CrowdStrike Falcon

- Fixed an issue where the **Max incidents per fetch** parameter did not work properly.
- Updated the Docker image to: *demisto/py3-tools:1.0.0.72621*.

20 changes: 10 additions & 10 deletions Packs/CrowdStrikeFalcon/TestPlaybooks/playbook-CrowdStrikeFalcon-Test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -319,12 +319,11 @@ tasks:
nexttasks:
'#none#':
- "1"
- "2"
- "63"
- "68"
- "91"
- "96"
- "127"
- "96"
- "72"
scriptarguments:
all:
simple: "yes"
Expand All @@ -334,7 +333,7 @@ tasks:
{
"position": {
"x": 1575,
"y": 195
"y": 190
}
}
note: false
Expand Down Expand Up @@ -614,7 +613,7 @@ tasks:
brand: ""
nexttasks:
'#none#':
- "72"
- "73"
scriptarguments:
key:
simple: CrowdStrike.IOC
Expand Down Expand Up @@ -2804,12 +2803,13 @@ tasks:
brand: ""
nexttasks:
'#none#':
- "73"
- "2"
- "91"
scriptarguments:
Digits:
simple: "False"
Length:
simple: "5"
simple: "9"
Lowercase:
simple: "True"
Punctuation:
Expand All @@ -2821,8 +2821,8 @@ tasks:
view: |-
{
"position": {
"x": 480,
"y": 2470
"x": 960,
"y": 370
}
}
note: false
Expand Down Expand Up @@ -2966,7 +2966,7 @@ tasks:
groups:
simple: 7471ba0636b34cbb8c65fae7979a6a9b
value:
simple: test
simple: ${RandomString}-test
separatecontext: false
continueonerrortype: ""
view: |-
Expand Down
2 changes: 1 addition & 1 deletion Packs/CrowdStrikeFalcon/pack_metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "CrowdStrike Falcon",
"description": "The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.",
"support": "xsoar",
"currentVersion": "1.11.6",
"currentVersion": "1.11.7",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down