Skip to content

Commit b97041c

Browse files
content-botContent Botmayyagoldman
authored
Apply markdownlint (36) (#39486)
* Tessian: Apply markdownlint * FeedFastly: Apply markdownlint * CVE_2022_3786_and_CVE_2022_3602_-_OpenSSL_X.509_Buffer_Overflows: Apply markdownlint * WhisperGateCVE-2021-32648: Apply markdownlint * Envoy: Apply markdownlint * OracleCloudInfrastructure: Apply markdownlint * JamfProtect: Apply markdownlint * BitDam: Apply markdownlint * Office365: Apply markdownlint * ShiftLeft: Apply markdownlint * RSANetWitnessEndpoint: Apply markdownlint * Cyberwatch: Apply markdownlint * ManageEngine-ADAudit: Apply markdownlint * GoogleChrome: Apply markdownlint * FeedBlocklist_de: Apply markdownlint * MicrosoftGraphFiles: Apply markdownlint * MinervaLabsAntiEvasionPlatform: Apply markdownlint * RsaNetWitnessPacketsAndLogs: Apply markdownlint * AzureDataExplorer: Apply markdownlint * APIVoid: Apply markdownlint * IP-API: Apply markdownlint * Snowflake: Apply markdownlint * McAfeeDatabaseSecurity: Apply markdownlint * IvantiConnectSecure: Apply markdownlint * XSOARSummaryDashboard: Apply markdownlint --------- Co-authored-by: Content Bot <bot@demisto.com> Co-authored-by: mayagoldman <mgoldman@paloaltonetworks.com>
1 parent 4bd84be commit b97041c

File tree

29 files changed

+1333
-1248
lines changed

29 files changed

+1333
-1248
lines changed

‎Packs/APIVoid/Integrations/APIVoid/README.md

+524-523
Large diffs are not rendered by default.

‎Packs/AzureDataExplorer/Integrations/AzureDataExplorer/README.md

+152-138
Large diffs are not rendered by default.

‎Packs/AzureDataExplorer/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
# Azure Data Explorer Pack
2+
23
Use the Azure Data Explorer pack to collect and analyze data inside Azure Data Explorer clusters, and to manage search queries.<br>
34

45
## What does this pack do?
6+
57
- Execute a Kusto Query Language (KQL) query against the given database inside a cluster.
68
- List search queries that have reached a final state in the given database.
79
- List currently executing search queries in the given database.
810
- Start a best-effort attempt to cancel a specific running search query in the specified database.
911
- Start, complete, or rerun the authorization process.
1012
- Rest the connectivity to Azure Data Explorer.
1113

12-
1314
This pack contains an integration, which was integrated and tested with version V1 of AzureDataExplorer.<br>

‎Packs/BitDam/Integrations/BitDam/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -182,4 +182,4 @@
182182
<h5>Context Example</h5>
183183
<p>root:{} 4 items<br>BitDam:{} 2 items<br>Analysis:{} 3 items<br>ID:68f009dc92a405d1015026e8e30e6d1598047124<br>Status:DONE<br>Verdict:CLEAN<br>FileScan:{} 1 item<br>SHA1:68f009dc92a405d1015026e8e30e6d1598047124<br>DBotScore:{} 4 items<br>Indicator:68f009dc92a405d1015026e8e30e6d1598047124<br>Score:1<br>Type:File<br>Vendor:BitDam</p>
184184
<h5>Human Readable Output</h5>
185-
<p><a href="../../doc_files/47355146-4473a400-d6c9-11e8-8ded-a3f99e31ddb7.png" target="_blank" rel="noopener noreferrer"><img src="../../doc_files/47355146-4473a400-d6c9-11e8-8ded-a3f99e31ddb7.png" alt="image" width="752" height="258"></a></p>
185+
<p><a href="../../doc_files/47355146-4473a400-d6c9-11e8-8ded-a3f99e31ddb7.png" target="_blank" rel="noopener noreferrer"><img src="../../doc_files/47355146-4473a400-d6c9-11e8-8ded-a3f99e31ddb7.png" alt="image" width="752" height="258"></a></p>

‎Packs/CVE_2022_3786_and_CVE_2022_3602_-_OpenSSL_X.509_Buffer_Overflows/README.md

+10-8
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,24 @@ On November 1, OpenSSL released a [security advisory](https://www.openssl.org/ne
44

55
The vulnerability described in CVE-2022-3602 allows an attacker to obtain a 4-byte overflow on the stack by crafting a malicious email address within the attacker-controlled certificate. The overflow will result in a crash (most likely scenario) or potentially remote code execution (much less likely). In CVE-2022-3786, an attacker can achieve a stack overflow of arbitrary length by crafting a malicious email address within the attacker-controlled certificate.
66

7-
Both vulnerabilities are “triggered through X.509 certificate verification, specifically, name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.”
7+
Both vulnerabilities are “triggered through X.509 certificate verification, specifically, name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.”
88

99
**The playbook includes the following tasks:**
10+
1011
* Hunting for active processes running OpenSSL vulnerable versions using:
11-
* Cortex XDR
12-
* Splunk
13-
* Azure Sentinel
14-
* Cortex Xpanse
15-
* Prisma
16-
* PANOS
12+
* Cortex XDR
13+
* Splunk
14+
* Azure Sentinel
15+
* Cortex Xpanse
16+
* Prisma
17+
* PANOS
1718

1819
**Mitigations:**
20+
1921
* OpenSSL official patch
2022

2123
More information:
2224

2325
[Unit42 Threat Brief: CVE-2022-3786 and CVE-2022-3602: OpenSSL X.509 Buffer Overflows](https://unit42.paloaltonetworks.com/openssl-vulnerabilities/)
2426

25-
[NCSC-NL - OpenSSL overview Scanning software](https://github.com/NCSC-NL/OpenSSL-2022/tree/main/scanning)
27+
[NCSC-NL - OpenSSL overview Scanning software](https://github.com/NCSC-NL/OpenSSL-2022/tree/main/scanning)

‎Packs/Cyberwatch/Integrations/Cyberwatch/README.md

+154-99
Large diffs are not rendered by default.

‎Packs/Envoy/Integrations/EnvoyIAM/README.md

+60-68
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ This integration was integrated and tested with version v2 of Envoy SCIM API.
33

44
## Configure Envoy IAM in Cortex
55

6-
76
| **Parameter** | **Description** | **Required** |
87
| --- | --- | --- |
98
| Base URL | | True |
@@ -19,159 +18,152 @@ This integration was integrated and tested with version v2 of Envoy SCIM API.
1918
| Outgoing Mapper | | True |
2019

2120
## Commands
21+
2222
You can execute these commands from the CLI, as part of an automation, or in a playbook.
2323
After you successfully execute a command, a DBot message appears in the War Room with the command details.
24+
2425
### iam-create-user
26+
2527
***
2628
Creates a user.
2729

28-
2930
#### Base Command
3031

3132
`iam-create-user`
33+
3234
#### Input
3335

3436
| **Argument Name** | **Description** | **Required** |
3537
| --- | --- | --- |
36-
| user-profile | User Profile indicator details. | Required |
37-
| allow-enable | When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true. | Optional |
38-
38+
| user-profile | User Profile indicator details. | Required |
39+
| allow-enable | When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true. | Optional |
3940

4041
#### Context Output
4142

4243
| **Path** | **Type** | **Description** |
4344
| --- | --- | --- |
44-
| IAM.Vendor.active | Boolean | When true, indicates that the employee's status is active in the 3rd-party integration. |
45-
| IAM.Vendor.brand | String | Name of the integration. |
46-
| IAM.Vendor.details | string | Provides the raw data from the 3rd-party integration. |
47-
| IAM.Vendor.email | String | The employee's email address. |
48-
| IAM.Vendor.errorCode | Number | HTTP error response code. |
49-
| IAM.Vendor.errorMessage | String | Reason why the API failed. |
50-
| IAM.Vendor.id | String | The employee's user ID in the app. |
51-
| IAM.Vendor.instanceName | string | Name of the integration instance. |
52-
| IAM.Vendor.success | Boolean | When true, indicates that the command was executed successfully. |
53-
| IAM.Vendor.username | String | The employee's username in the app. |
54-
45+
| IAM.Vendor.active | Boolean | When true, indicates that the employee's status is active in the 3rd-party integration. |
46+
| IAM.Vendor.brand | String | Name of the integration. |
47+
| IAM.Vendor.details | string | Provides the raw data from the 3rd-party integration. |
48+
| IAM.Vendor.email | String | The employee's email address. |
49+
| IAM.Vendor.errorCode | Number | HTTP error response code. |
50+
| IAM.Vendor.errorMessage | String | Reason why the API failed. |
51+
| IAM.Vendor.id | String | The employee's user ID in the app. |
52+
| IAM.Vendor.instanceName | string | Name of the integration instance. |
53+
| IAM.Vendor.success | Boolean | When true, indicates that the command was executed successfully. |
54+
| IAM.Vendor.username | String | The employee's username in the app. |
5555

5656
#### Command Example
57+
5758
``` !iam-create-user user-profile=`{"email": "john.doe@example.com", "givenname": "test", "surname": "test"}` ```
5859

5960
#### Human Readable Output
6061

61-
62-
6362
### iam-update-user
63+
6464
***
6565
Updates an existing user with the data passed in the user-profile argument.
6666

67-
6867
#### Base Command
6968

7069
`iam-update-user`
70+
7171
#### Input
7272

7373
| **Argument Name** | **Description** | **Required** |
7474
| --- | --- | --- |
75-
| user-profile | A User Profile indicator. | Required |
76-
| allow-enable | When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true. | Optional |
77-
75+
| user-profile | A User Profile indicator. | Required |
76+
| allow-enable | When set to true, after the command execution the status of the user in the 3rd-party integration will be active. Possible values are: true, false. Default is true. | Optional |
7877

7978
#### Context Output
8079

8180
| **Path** | **Type** | **Description** |
8281
| --- | --- | --- |
83-
| IAM.Vendor.active | Boolean | When true, indicates that the employee's status is active in the 3rd-party integration. |
84-
| IAM.Vendor.brand | String | Name of the integration. |
85-
| IAM.Vendor.details | string | Provides the raw data from the 3rd-party integration. |
86-
| IAM.Vendor.email | String | The employee's email address. |
87-
| IAM.Vendor.errorCode | Number | HTTP error response code. |
88-
| IAM.Vendor.errorMessage | String | Reason why the API failed. |
89-
| IAM.Vendor.id | String | The employee's user ID in the app. |
90-
| IAM.Vendor.instanceName | string | Name of the integration instance. |
91-
| IAM.Vendor.success | Boolean | When true, indicates that the command was executed successfully. |
92-
| IAM.Vendor.username | String | The employee's username in the app. |
93-
82+
| IAM.Vendor.active | Boolean | When true, indicates that the employee's status is active in the 3rd-party integration. |
83+
| IAM.Vendor.brand | String | Name of the integration. |
84+
| IAM.Vendor.details | string | Provides the raw data from the 3rd-party integration. |
85+
| IAM.Vendor.email | String | The employee's email address. |
86+
| IAM.Vendor.errorCode | Number | HTTP error response code. |
87+
| IAM.Vendor.errorMessage | String | Reason why the API failed. |
88+
| IAM.Vendor.id | String | The employee's user ID in the app. |
89+
| IAM.Vendor.instanceName | string | Name of the integration instance. |
90+
| IAM.Vendor.success | Boolean | When true, indicates that the command was executed successfully. |
91+
| IAM.Vendor.username | String | The employee's username in the app. |
9492

9593
#### Command Example
94+
9695
``` !iam-update-user user-profile=`{"email": "john.doe@example.com", "givenname": "John"}` ```
9796

9897
#### Human Readable Output
9998

100-
101-
10299
### iam-get-user
100+
103101
***
104102
Retrieves a single user resource.
105103

106-
107104
#### Base Command
108105

109106
`iam-get-user`
107+
110108
#### Input
111109

112110
| **Argument Name** | **Description** | **Required** |
113111
| --- | --- | --- |
114-
| user-profile | A User Profile indicator. | Required |
115-
112+
| user-profile | A User Profile indicator. | Required |
116113

117114
#### Context Output
118115

119116
| **Path** | **Type** | **Description** |
120117
| --- | --- | --- |
121-
| IAM.Vendor.active | Boolean | When true, indicates that the employee's status is active in the 3rd-party integration. |
122-
| IAM.Vendor.brand | String | Name of the integration. |
123-
| IAM.Vendor.details | string | Provides the raw data from the 3rd-party integration. |
124-
| IAM.Vendor.email | String | The employee's email address. |
125-
| IAM.Vendor.errorCode | Number | HTTP error response code. |
126-
| IAM.Vendor.errorMessage | String | Reason why the API failed. |
127-
| IAM.Vendor.id | String | The employee's user ID in the app. |
128-
| IAM.Vendor.instanceName | string | Name of the integration instance. |
129-
| IAM.Vendor.success | Boolean | When true, indicates that the command was executed successfully. |
130-
| IAM.Vendor.username | String | The employee's username in the app. |
131-
118+
| IAM.Vendor.active | Boolean | When true, indicates that the employee's status is active in the 3rd-party integration. |
119+
| IAM.Vendor.brand | String | Name of the integration. |
120+
| IAM.Vendor.details | string | Provides the raw data from the 3rd-party integration. |
121+
| IAM.Vendor.email | String | The employee's email address. |
122+
| IAM.Vendor.errorCode | Number | HTTP error response code. |
123+
| IAM.Vendor.errorMessage | String | Reason why the API failed. |
124+
| IAM.Vendor.id | String | The employee's user ID in the app. |
125+
| IAM.Vendor.instanceName | string | Name of the integration instance. |
126+
| IAM.Vendor.success | Boolean | When true, indicates that the command was executed successfully. |
127+
| IAM.Vendor.username | String | The employee's username in the app. |
132128

133129
#### Command Example
130+
134131
``` !iam-get-user user-profile=`{"email": "john.doe@example.com"}` ```
135132

136133
#### Human Readable Output
137134

138-
139-
140135
### iam-disable-user
136+
141137
***
142138
Disable an active user.
143139

144-
145140
#### Base Command
146141

147142
`iam-disable-user`
143+
148144
#### Input
149145

150146
| **Argument Name** | **Description** | **Required** |
151147
| --- | --- | --- |
152-
| user-profile | A User Profile indicator. | Required |
153-
148+
| user-profile | A User Profile indicator. | Required |
154149

155150
#### Context Output
156151

157152
| **Path** | **Type** | **Description** |
158153
| --- | --- | --- |
159-
| IAM.Vendor.active | Boolean | When true, indicates that the employee's status is active in the 3rd-party integration. |
160-
| IAM.Vendor.brand | String | Name of the integration. |
161-
| IAM.Vendor.details | string | Provides the raw data from the 3rd-party integration. |
162-
| IAM.Vendor.email | String | The employee's email address. |
163-
| IAM.Vendor.errorCode | Number | HTTP error response code. |
164-
| IAM.Vendor.errorMessage | String | Reason why the API failed. |
165-
| IAM.Vendor.id | String | The employee's user ID in the app. |
166-
| IAM.Vendor.instanceName | string | Name of the integration instance. |
167-
| IAM.Vendor.success | Boolean | When true, indicates that the command was executed successfully. |
168-
| IAM.Vendor.username | String | The employee's username in the app. |
169-
154+
| IAM.Vendor.active | Boolean | When true, indicates that the employee's status is active in the 3rd-party integration. |
155+
| IAM.Vendor.brand | String | Name of the integration. |
156+
| IAM.Vendor.details | string | Provides the raw data from the 3rd-party integration. |
157+
| IAM.Vendor.email | String | The employee's email address. |
158+
| IAM.Vendor.errorCode | Number | HTTP error response code. |
159+
| IAM.Vendor.errorMessage | String | Reason why the API failed. |
160+
| IAM.Vendor.id | String | The employee's user ID in the app. |
161+
| IAM.Vendor.instanceName | string | Name of the integration instance. |
162+
| IAM.Vendor.success | Boolean | When true, indicates that the command was executed successfully. |
163+
| IAM.Vendor.username | String | The employee's username in the app. |
170164

171165
#### Command Example
166+
172167
``` !iam-disable-user user-profile=`{"email": "john.doe@example.com", "givenname": "John"}` ```
173168

174169
#### Human Readable Output
175-
176-
177-

‎Packs/FeedBlocklist_de/Integrations/FeedBlocklist_de/README.md

+7-7
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ Use the Blocklist.de feed integration to fetch indicators from the feed.
22

33
## Configure Blocklist.de Feed in Cortex
44

5-
65
| **Parameter** | **Description** | **Required** |
76
| --- | --- | --- |
87
| Fetch indicators | | False |
@@ -20,29 +19,30 @@ Use the Blocklist.de feed integration to fetch indicators from the feed.
2019
| Tags | Supports CSV values. | False |
2120

2221
## Commands
22+
2323
You can execute these commands from the CLI, as part of an automation, or in a playbook.
2424
After you successfully execute a command, a DBot message appears in the War Room with the command details.
25+
2526
### blocklist_de-get-indicators
27+
2628
***
2729
Gets the feed indicators.
2830

29-
3031
#### Base Command
3132

3233
`blocklist_de-get-indicators`
34+
3335
#### Input
3436

3537
| **Argument Name** | **Description** | **Required** |
3638
| --- | --- | --- |
37-
| limit | The maximum number of results to return. The default value is 50. Default is 50. | Optional |
38-
| indicator_type | The indicator type. | Optional |
39-
39+
| limit | The maximum number of results to return. The default value is 50. Default is 50. | Optional |
40+
| indicator_type | The indicator type. | Optional |
4041

4142
#### Context Output
4243

4344
There is no context output for this command.
4445

45-
4646
#### Human Readable Output
4747

4848
### Indicators
@@ -51,4 +51,4 @@ There is no context output for this command.
5151
>|---|---|---|
5252
>| 1.1.1.1 | IP | value: 1.1.1.1<br>type: IP<br>tags: null |
5353
>| 2.2.2.2 | IP | value: 2.2.2.2<br>type: IP<br>tags: null |
54-
>| 3.3.3.3 | IP | value: 3.3.3.3<br>type: IP<br>tags: null |
54+
>| 3.3.3.3 | IP | value: 3.3.3.3<br>type: IP<br>tags: null |

‎Packs/FeedBlocklist_de/README.md

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
1-
Use the Blocklist.de feed integration to fetch indicators from the daily Threat Feed and Custom feeds.
1+
Use the Blocklist.de feed integration to fetch indicators from the daily Threat Feed and Custom feeds.
22
When you configure your servers, you can use this information to reject a connection because of the indicators received from the Blocklist.de feed.
33

4-
54
## Custom Feeds
65

76
You can connect to a custom Blocklist.de feed by specifying the services from which to process indicators.

‎Packs/FeedFastly/Integrations/FeedFastly/README.md

+6-5
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ Use Fastly Feed to get assigned CIDRs and add them to your firewall's allow-list
22

33
## Configure Fastly Feed in Cortex
44

5-
65
| **Parameter** | **Description** | **Required** |
76
| --- | --- | --- |
87
| Fetch indicators | | False |
@@ -19,23 +18,25 @@ Use Fastly Feed to get assigned CIDRs and add them to your firewall's allow-list
1918
| Use system proxy settings | | False |
2019

2120
## Commands
21+
2222
You can execute these commands from the CLI, as part of an automation, or in a playbook.
2323
After you successfully execute a command, a DBot message appears in the War Room with the command details.
24+
2425
### fastly-get-indicators
26+
2527
***
2628
Fetches indicators from the feed.
2729

28-
2930
#### Base Command
3031

3132
`fastly-get-indicators`
33+
3234
#### Input
3335

3436
| **Argument Name** | **Description** | **Required** |
3537
| --- | --- | --- |
36-
| limit | limits the number of context indicators to output. Default is 50. | Optional |
37-
38+
| limit | limits the number of context indicators to output. Default is 50. | Optional |
3839

3940
#### Context Output
4041

41-
There is no context output for this command.
42+
There is no context output for this command.

0 commit comments

Comments
 (0)