Devo_v2 initial version with enhanced functionality - #5233
Conversation
…lude fetching alerts, running multi-table queries, writing back to Devo tables. Please refer to README.md for all features.
|
This pull request introduces 2 alerts when merging 54b778e into 8973733 - view on LGTM.com new alerts:
|
|
Thank you for your contribution. Your generosity and caring are unrivaled! Rest assured - our content wizard @yaakovi will very shortly look over your proposed changes. |
|
The CircleCI check from your latest pushed commit was unsuccessful. @ansfan take a look at the build by clicking this link. Failed Build Steps
Try and address the listed CircleCI build step failures at your earliest convenience. This will greatly expedite the process of getting your proposed changes merged into master. Happy coding and may the force be with you. |
yaakovi
left a comment
yaakovi
left a comment
There was a problem hiding this comment.
can we schedule a short session for demo?
please contact me on Slack in "Demisto DFIR"
| - name: from | ||
| required: true | ||
| description: Start datetime for specified query. Unix timestamp in seconds expected | ||
| (Decimal milliseconds okay) | ||
| - name: to | ||
| description: End datetime for specified query. Unix timestamp in seconds expected | ||
| (Decimal milliseconds okay) |
There was a problem hiding this comment.
should also support time frame: "X days", "X hours", etc...
in many cases the user would like to query the SIEM for event from the last hours/days.
once you add this option, you can use parse_date_range to convert that format to a datetime object/timestamp.
for more information about the function, see the ScriptHelper or CommonServerPython
| - contextPath: Devo.QueryResults | ||
| description: List of dictionary of results | ||
| type: unknown |
There was a problem hiding this comment.
does the returned object has a constant structure? if so, declare the specific keys as outputs
There was a problem hiding this comment.
The structure will be wholly dependent on the query that the user gives and the tables that they are querying.
| - name: tableName | ||
| required: true | ||
| description: Table name to write to | ||
| - name: records |
There was a problem hiding this comment.
No tableName is just a string
|
additional points from the demo:
|
Devo_v2.yml:
- Moved proxy to end of list
- Changed the types of the JSON filters to long test.
Devo_v2.py:
- Renamed check_credentials to check_configuration and supported more config value checks when using test
- Added in get_time_range to support multiple datetime formats.
- Added in functionality to ignore insecure connections if setting is toggled.
- Wraped socket logic in try/finally block
- Return actual contents that are written instead of length of written contents.
Devo_v2_description:
- Additional integration configuration documentation along with expected values. Also links to Devo Docs.
README.md:
- Additional information on newly supported date formats as well as enhanced documentation to Devo.
Devo_v2_test.py:
- Fixed test for check_configuration.
- Added in test for get_time_range.
|
This pull request introduces 2 alerts when merging 302ac28 into 8973733 - view on LGTM.com new alerts:
|
yaakovi
left a comment
yaakovi
left a comment
There was a problem hiding this comment.
nice work on the check_configuration function
| - display: Allow insecure Devo endpoint connection | ||
| name: allow_insecure |
There was a problem hiding this comment.
please use our convention here:
- display: Trust any certificate (not secure)
name: insecure
…o trust any certificate (not secure)
… true -> false and no default value so that insecure logic works correctly
|
This pull request introduces 2 alerts when merging f8edbd5 into 8973733 - view on LGTM.com new alerts:
|
|
hi @kirbles19 , |
|
@yaakovi Done. |
4 participants
Features now include fetching alerts, running multi-table queries, writing back to Devo tables. Please refer to README.md for all features. Refer to previous PR in related issues as
Status
Ready
Related Issues
#4419
Description
A new and updated Devo_v2 integration with enhanced functionality. Uses our new APIs and offers automated incident creation of alerts generated in Devo.
Screenshots
Required version of Demisto
5.0.0+
Does it break backward compatibility?
Must have
Dependencies
Mention the dependencies of the entity you changed as given from the precommit hooks in checkboxes, and tick after tested them.
Additional changes
Completely new integration
Technical writer review
Mention and link to the files that require a technical writer review.