Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Large upload alert bug fix calculate verdict #36535

Open
wants to merge 17 commits into
base: master
Choose a base branch
from
Open

Large upload alert bug fix calculate verdict #36535

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
b3c60a3
removed unnecessary spaces in the playbook YML file
TalNos Sep 15, 2024
8b81455
Merge branch 'master' of github.com:demisto/content
TalNos Sep 15, 2024
6e2f454
Merge remote-tracking branch 'origin/master'
TalNos Sep 16, 2024
7dd733c
Merge branch 'master' of github.com:demisto/content
TalNos Sep 17, 2024
a1aa810
Merge branch 'master' of github.com:demisto/content
TalNos Sep 22, 2024
fdc1c17
Merge branch 'master' of github.com:demisto/content
TalNos Sep 24, 2024
b2a53b1
Merge remote-tracking branch 'origin/master'
TalNos Sep 26, 2024
f9e8a6b
The context path of one of the benign conditions within task 35 has b…
TalNos Sep 26, 2024
9172969
reverted the change in task number 2
TalNos Sep 26, 2024
b18e7bd
changed the conditions in task number 35
TalNos Sep 26, 2024
e7d6081
changed the conditions in task number 35
TalNos Sep 26, 2024
7a5282c
reverted the change in task number 2
TalNos Sep 26, 2024
ead3a41
RN
TalNos Sep 26, 2024
f13715f
changed the conditions in task number 35
TalNos Sep 26, 2024
1e2e324
reverted the change in task number 2
TalNos Sep 26, 2024
329daf0
Merged master into current branch.
Oct 1, 2024
5dc1eac
Bump pack from version Core to 3.0.70.
Oct 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 16 additions & 54 deletions Packs/Core/Playbooks/Playbook-Large_Upload_Alert.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2069,10 +2069,10 @@ tasks:
isautoswitchedtoquietmode: false
"35":
id: "35"
taskid: 2d42a79a-15bd-4851-8ce1-16e874ea4567
taskid: 4e31d21d-f0e5-40d2-8333-750fd0973c3c
type: condition
task:
id: 2d42a79a-15bd-4851-8ce1-16e874ea4567
id: 4e31d21d-f0e5-40d2-8333-750fd0973c3c
version: -1
name: Calculate Verdict
description: Estimate the verdict for the large upload Cortex XDR alerts.
Expand Down Expand Up @@ -2468,100 +2468,62 @@ tasks:
value:
simple: inputs.InternalIPRanges
iscontext: true
- operator: isEqualString
- operator: inList
left:
value:
complex:
root: Core.Incident.alerts
root: Core.OriginalAlert
filters:
- - operator: inList
- - operator: isNotEmpty
left:
value:
simple: Core.Incident.alerts.host_name
iscontext: true
right:
value:
simple: Analysis.FTP_Server
simple: Core.OriginalAlert._all_events.agent_hostname
iscontext: true
ignorecase: true
- - operator: isEqualString
left:
value:
simple: Core.Incident.alerts.name
simple: Core.OriginalAlert.alert_name
iscontext: true
right:
value:
simple: Large Upload (FTP)
ignorecase: true
accessor: host_name
accessor: _all_events.agent_hostname
transformers:
- operator: uniq
iscontext: true
right:
value:
complex:
root: Core.Endpoint
filters:
- - operator: isEqualString
left:
value:
simple: Core.Endpoint.endpoint_type
iscontext: true
right:
value:
simple: AGENT_TYPE_SERVER
ignorecase: true
accessor: endpoint_name
transformers:
- operator: uniq
simple: Analysis.FTP_Server
iscontext: true
ignorecase: true
- operator: isEqualString
- operator: inList
left:
value:
complex:
root: Core.Incident.alerts
root: Core.OriginalAlert
filters:
- - operator: inList
- - operator: isNotEmpty
left:
value:
simple: Core.Incident.alerts.host_name
iscontext: true
right:
value:
simple: Analysis.SMTP_Server
simple: Core.OriginalAlert._all_events.agent_hostname
iscontext: true
ignorecase: true
- - operator: isEqualString
left:
value:
simple: Core.Incident.alerts.name
simple: Core.OriginalAlert.alert_name
iscontext: true
right:
value:
simple: Large Upload (SMTP)
ignorecase: true
accessor: host_name
accessor: _all_events.agent_hostname
transformers:
- operator: uniq
iscontext: true
right:
value:
complex:
root: Core.Endpoint
filters:
- - operator: isEqualString
left:
value:
simple: Core.Endpoint.endpoint_type
iscontext: true
right:
value:
simple: AGENT_TYPE_SERVER
ignorecase: true
accessor: endpoint_name
transformers:
- operator: uniq
simple: Analysis.SMTP_Server
iscontext: true
ignorecase: true
- - operator: lessThanOrEqual
Expand Down
6 changes: 6 additions & 0 deletions Packs/Core/ReleaseNotes/3_0_70.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Playbooks

##### Large Upload Alert

- Fixed an issue which caused the *‘Calculate Verdict’* task to fail due to incorrect context keys used in *benign* conditions of the ‘Calculate Verdict’ playbook task.
2 changes: 1 addition & 1 deletion Packs/Core/pack_metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Core - Investigation and Response",
"description": "Automates incident response",
"support": "xsoar",
"currentVersion": "3.0.69",
"currentVersion": "3.0.70",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
Loading