Skip to content

Commit fcba5d0

Browse files
evisochekeepstainyasta5dansterenson
authored and
xsoar-bot
committed
Fix proofpoint schema (demisto#29037)
* update schema * update rn * add emails * ad bracet * update rn * Update ProofpointThreatResponseModelingRules_1_3_schema.json * Update ProofpointThreatResponseModelingRules_1_3_schema.json * Update 2_0_13.md * update rn * Modified the parsing rule header to match the modeling rule. Modified the modeling rule to refer to event and not events. * Modified the id and name of the parsing rule and the modeling rule. * Modified the release note. * Modified the modeling rule and the schema file --------- Co-authored-by: eepstain <[email protected]> Co-authored-by: Yehonatan Asta <[email protected]> Co-authored-by: Dan Sterenson <[email protected]>
1 parent 3cc07b3 commit fcba5d0

File tree

7 files changed

+54
-34
lines changed

7 files changed

+54
-34
lines changed

Diff for: ‎Packs/ProofpointThreatResponse/ModelingRules/ProofpointThreatResponseModelingRules_1_3/ProofpointThreatResponseModelingRules_1_3.xif

+31-27
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,32 @@
11
[MODEL: dataset = proofpoint_threat_response_raw]
2-
//| alter XDM.Email.event_timestamp = updated_at
3-
alter xdm.event.id = to_string(id),
4-
xdm.alert.category = json_extract_scalar(events, "$.category"),
5-
xdm.alert.severity = json_extract_scalar(events, "$.severity"),
6-
emails = arrayindex(json_extract_array(events, "$.emails"), 0),
7-
attacker_ip_1 = json_extract_scalar(hosts, "$.attacker.0"),
8-
attacker_ip_2 = json_extract_scalar(hosts, "$.attacker.1"),
9-
attacker_ip_3 = json_extract_scalar(hosts, "$.attacker.2")
10-
| alter xdm.email.sender = json_extract_scalar(emails, "$.sender.email"),
11-
xdm.email.message_id = json_extract_scalar(emails, "$.messageId"),
12-
xdm.email.subject = json_extract_scalar(emails, "$.subject"),
13-
xdm.email.recipients = arraycreate(coalesce(json_extract_scalar(emails, "$.recipient.email"), "")),
14-
incident_field_values = incident_field_values -> [],
15-
src_ipv4 = arraycreate(attacker_ip_1, attacker_ip_2, attacker_ip_3)
16-
| alter xdm.alert.name = json_extract_scalar(arrayindex(incident_field_values, 1), "$.value"),
17-
xdm.alert.description = json_extract_scalar(events, "$.description"),
18-
xdm.email.attachment.path = json_extract_scalar(events, "$.fileName"),
19-
xdm.alert.original_alert_id = json_extract_scalar(events, "$.id"),
20-
xdm.source.ipv4 =
21-
to_string(
22-
if(arrayindex(src_ipv4, 0) ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", arrayindex(src_ipv4, 0),
23-
if(arrayindex(src_ipv4, 1) ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", arrayindex(src_ipv4, 1),
24-
if(arrayindex(src_ipv4, 2) ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", arrayindex(src_ipv4, 2), null
25-
)
26-
)
27-
)
28-
);
2+
// Parsing fields
3+
alter
4+
emails = arrayindex(json_extract_array(event, "$.emails"), 0),
5+
attacker_ip_1 = json_extract_scalar(hosts, "$.attacker.0"),
6+
attacker_ip_2 = json_extract_scalar(hosts, "$.attacker.1"),
7+
attacker_ip_3 = json_extract_scalar(hosts, "$.attacker.2"),
8+
incident_field_values = incident_field_values -> []
9+
| alter
10+
src_ipv4 = arraycreate(attacker_ip_1, attacker_ip_2, attacker_ip_3)
11+
// Mapping fields
12+
| alter
13+
xdm.event.id = to_string(id),
14+
xdm.alert.category = json_extract_scalar(event, "$.category"),
15+
xdm.alert.severity = json_extract_scalar(event, "$.severity"),
16+
xdm.email.sender = json_extract_scalar(emails, "$.sender.email"),
17+
xdm.email.message_id = json_extract_scalar(emails, "$.messageId"),
18+
xdm.email.subject = json_extract_scalar(emails, "$.subject"),
19+
xdm.email.recipients = arraycreate(coalesce(json_extract_scalar(emails, "$.recipient.email"), "")),
20+
xdm.alert.name = json_extract_scalar(arrayindex(incident_field_values, 1), "$.value"),
21+
xdm.alert.description = json_extract_scalar(event, "$.description"),
22+
xdm.email.attachment.path = json_extract_scalar(event, "$.fileName"),
23+
xdm.alert.original_alert_id = to_string(json_extract_scalar(event, "$.id")),
24+
xdm.source.ipv4 =
25+
to_string(
26+
if(arrayindex(src_ipv4, 0) ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", arrayindex(src_ipv4, 0),
27+
if(arrayindex(src_ipv4, 1) ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", arrayindex(src_ipv4, 1),
28+
if(arrayindex(src_ipv4, 2) ~= "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", arrayindex(src_ipv4, 2), null
29+
)
30+
)
31+
)
32+
);

Diff for: ‎Packs/ProofpointThreatResponse/ModelingRules/ProofpointThreatResponseModelingRules_1_3/ProofpointThreatResponseModelingRules_1_3.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
fromversion: 6.10.0
2-
id: proofpoint_threat_response_collection
2+
id: proofpoint_threat_response_ModelingRule
33
name: Proofpoint Threat Response Modeling Rule
44
rules: ''
55
schema: ''

Diff for: ‎Packs/ProofpointThreatResponse/ModelingRules/ProofpointThreatResponseModelingRules_1_3/ProofpointThreatResponseModelingRules_1_3_schema.json

+10-2
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
{
22
"proofpoint_threat_response_raw": {
33
"id": {
4+
"type": "int",
5+
"is_array": false
6+
},
7+
"event": {
8+
"type": "string",
9+
"is_array": false
10+
},
11+
"hosts": {
412
"type": "string",
513
"is_array": false
614
},
7-
"events": {
15+
"incident_field_values": {
816
"type": "string",
917
"is_array": false
1018
}
1119
}
12-
}
20+
}

Diff for: ‎Packs/ProofpointThreatResponse/ParsingRules/ProofpointThreatResponse/ProofpointThreatResponse.xif

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
[INGEST:vendor="proofpoint", product="trap", target_dataset="proofpoint_trap_raw", no_hit=keep]
1+
[INGEST:vendor = "proofpoint", product = "threat_response", target_dataset = "proofpoint_threat_response_raw", no_hit = keep]
22
filter to_string(updated_at) ~= ".*\d{2}:\d{2}:\d{2}.*"
33
| alter _time = updated_at;

Diff for: ‎Packs/ProofpointThreatResponse/ParsingRules/ProofpointThreatResponse/ProofpointThreatResponse.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
id: proofpoint_threat_response
2-
name: Proofpoint Threat Response
1+
id: proofpoint_threat_response_ParsingRule
2+
name: Proofpoint Threat Response Parsing Rule
33
fromversion: 6.10.0
44
tags: []
55
rules: ''

Diff for: ‎Packs/ProofpointThreatResponse/ReleaseNotes/2_0_13.md

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#### Modeling Rules
2+
##### Proofpoint Threat Response Modeling Rule
3+
- Updated the schema with the missing fields "hosts", "emails" and "incident_field_values".
4+
5+
#### Parsing Rules
6+
##### Proofpoint Threat Response Parsing Rule
7+
- Updated the dataset name.
8+

Diff for: ‎Packs/ProofpointThreatResponse/pack_metadata.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Proofpoint Threat Response",
33
"description": "Use the Proofpoint Threat Response integration to orchestrate and automate incident response.",
44
"support": "xsoar",
5-
"currentVersion": "2.0.12",
5+
"currentVersion": "2.0.13",
66
"author": "Cortex XSOAR",
77
"url": "https://www.paloaltonetworks.com/cortex",
88
"email": "",

0 commit comments

Comments
 (0)