Update Integration: CTM360 #38199

edx-sayed-salem · 2025-01-16T13:10:36Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Description

An update to the integration to make use of changes to endpoint to pull incidents from different modules:

New playbook based on the old one with slight modification to work for multi-instance setup.
New incident field used in dashboard widget.
Instance configuration option to select API module.
Updated Dashboard: Moved widgets around.
Updated incoming mapper for new added field.
Updated pack README.

Must have

Tests
Documentation

content-bot · 2025-01-16T13:12:17Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @talzich will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

content-bot · 2025-01-16T13:12:19Z

Hi @edx-sayed-salem, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

edx-sayed-salem · 2025-01-16T13:35:36Z

I think pre-commit failed due to docker image error. But locally I passed all.

ilaredo · 2025-01-24T17:25:07Z

Packs/CTM360-CyberBlindspot/Integrations/CyberBlindspot/CyberBlindspot.py

        response = self._http_request(
            method='GET',
            retries=MAX_RETRIES,
            backoff_factor=10,
            status_list_to_retry=[400, 429, 500],
-            url_suffix=f'{CBS_API_ENDPOINT}/xsoar',
+            url_suffix=CBS_API_ENDPOINT + API['FETCH'],


Suggested change

url_suffix=CBS_API_ENDPOINT + API['FETCH'],

url_suffix=CBS_API_ENDPOINT + API.get('FETCH'),

Made required change

ilaredo · 2025-01-24T17:27:52Z

Packs/CTM360-CyberBlindspot/Integrations/CyberBlindspot/CyberBlindspot.py

    :type last_run_incident_identifiers: List[str]

-    :return: Returns updated list of event hashes and unique incidents that should be created.
+    :return: Returns updated list of event ids and unique incidents that should be created.
    :rtype: ``tuple[list,list]``
    """
    log(DEBUG, "at Dedup function")


Please avoid using log(), you can use demisto.debug(), demisto.info(), demisto.error(), etc.

log() is a helper function that eventually calls demisto.debug(), demisto.error(), demisto.info() but adds something to the log message before doing so, is it necessary to remove it?

After double-checking with @edik24, it was made clear to me that it is okay to use the log function in this integration.

ilaredo · 2025-01-24T17:28:53Z

Packs/CTM360-CyberBlindspot/Integrations/CyberBlindspot/CyberBlindspot.py

        except Exception as e:
-            log(ERROR, f'Skipping insertion of current incident. Error while calculating hash for {incident=}. Error: {str(e)}')
+            log(ERROR, f'Skipping insertion of current incident. Error while fetching ID from {incident=}. Error: {str(e)}')


Please avoid using log(), you can use demisto.debug(), demisto.info(), demisto.error(), etc.

karinafishman · 2025-01-28T11:50:37Z

Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_Incident_Management_V2.yml

+    conditions:
+    - label: "yes"
+      condition:
+      - - operator: in


Why do you use "in" operator? If the status is just "closed" you can use equals + Ignore case flag.

I believe this is an artifact, the task may have started with a list comparison. Will make the adjustment.

Corrected operator

karinafishman · 2025-01-28T12:19:27Z

Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_Incident_Management_V2.yml

+      - "3"
+    scriptarguments:
+      id:
+        simple: ${incident.dbotMirrorId}


Is it returns only 1 id or is it possible to receive multiple?
In both cases, we will prefer to use input as "complex" and not simple.

It's 1 id only.

~~For the "complex" input, is it set by adding transformations? Because there is no "simple/complex" option to choose from.~~ It was set when using the transformation menu.

You need to click on the {} sign and then to put the value in the "get", like this:

No need to add transformers. sometimes we are adding "unique" transformer to avoid duplicate content. (but it is not mandatory)

Complex version will look like this:

Adjusted to complex

ShirleyDenkberg · 2025-02-09T09:44:45Z

Packs/CTM360-CyberBlindspot/Integrations/CyberBlindspot/CyberBlindspot.yml

+  section: Collect
+- defaultvalue: Incidents
+  display: Module To Use
+  additionalinfo: "Choose the module you want to use: Incidents, or Leaks."


The additional information you listed only 2 modules, but it looks like there are several modules according to the options.

Packs/CTM360-CyberBlindspot/Integrations/CyberBlindspot/CyberBlindspot.yml

ShirleyDenkberg · 2025-02-09T09:48:12Z

Packs/CTM360-CyberBlindspot/Integrations/CyberBlindspot/README.md

 | **Parameter** | **Description** | **Required** |
 | --- | --- | --- |
 | Incident Mirroring Direction | Choose the direction to mirror the incident: Incoming \(from CyberBlindspot to Cortex XSOAR\), Outgoing \(from Cortex XSOAR to CyberBlindspot\), or Incoming and Outgoing \(from/to Cortex XSOAR and CyberBlindspot\). | False |
+| Module To Use | Choose the module you want to use: Incidents, or Leaks. | False |


According to line 30-35 in the yml file, there are several modules, not just Incidents or Leaks

Also Updated

Packs/CTM360-CyberBlindspot/Integrations/CyberBlindspot/README.md

Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_Incident_Management_V2.yml

Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_Incident_Management_V2_README.md

Packs/CTM360-CyberBlindspot/README.md

Packs/CTM360-CyberBlindspot/ReleaseNotes/2_1_0.md

ShirleyDenkberg · 2025-02-09T10:23:23Z

@ilaredo @karinafishman Doc review completed.

…lindspot.yml Co-authored-by: ShirleyDenkberg <[email protected]>

Co-authored-by: ShirleyDenkberg <[email protected]>

…Incident_Management_V2_README.md Co-authored-by: ShirleyDenkberg <[email protected]>

…Incident_Management_V2.yml Co-authored-by: ShirleyDenkberg <[email protected]>

ilaredo · 2025-02-09T11:43:02Z

@edx-sayed-salem can you commit an empty commit to trigger the build process again? It looks like there is an issue with GitHub

ilaredo · 2025-02-09T12:45:20Z

@edx-sayed-salem Just one last check before merging it, I would like you to create a short video demo showcasing the changes you made and confirming that they work correctly. Please also demonstrate that the test module passes successfully.
Again, thank you for your work, and I look forward to hearing from you.

edx-sayed-salem · 2025-02-10T06:45:15Z

Hope this covers it GDrive

github-actions · 2025-02-10T08:16:55Z

Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.

* Update CyberBlindspot integration * Empty-Commit to trigger CI * Fix pre-commit error * Ran format command to correct file(s) * Revert version and add configuration sections * use `.get()` for safe dictionary access. * Add contributors * Extend dashboard to cover whole page * Remove comments * Add default value for key * Use `equals` instead of `in` operator * Use complex field value * Add `IsIntegrationAvailable()` check * ran `demisto-sdk format` * Ran `demisto-sdk format` * Update Packs/CTM360-CyberBlindspot/Integrations/CyberBlindspot/CyberBlindspot.yml * Update Packs/CTM360-CyberBlindspot/Integrations/CyberBlindspot/README.md * Update Packs/CTM360-CyberBlindspot/ReleaseNotes/2_1_0.md * Update Packs/CTM360-CyberBlindspot/ReleaseNotes/2_1_0.md * Update Packs/CTM360-CyberBlindspot/README.md * Update Packs/CTM360-CyberBlindspot/README.md * Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_Incident_Management_V2_README.md * Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_Incident_Management_V2.yml * Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_Incident_Management_V2.yml * Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_Incident_Management_V2.yml * Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_Incident_Management_V2.yml * Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_Incident_Management_V2.yml * Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_Incident_Management_V2.yml * Update `Module To Use` additional info * Empty-Commit --------- Co-authored-by: S. AlQasim D. <[email protected]> Co-authored-by: ShirleyDenkberg <[email protected]>

Update CyberBlindspot integration

d7a0657

content-bot added Contribution Thank you! Contributions are always welcome! External PR Partner Support Level Indicates that the contribution is for Partner supported pack labels Jan 16, 2025

content-bot changed the base branch from master to contrib/CTM360-Integrations_ctm360-cbs-1 January 16, 2025 13:11

content-bot assigned talzich and karinafishman Jan 16, 2025

content-bot added the Security Review label Jan 16, 2025

content-bot requested review from karinafishman and talzich January 16, 2025 13:12

content-bot assigned edik24 Jan 16, 2025

content-bot added Partner-Approved Contribution Form Filled Whether contribution form filled or not. Partner labels Jan 16, 2025

JudahSchwartz requested review from ilaredo and removed request for talzich January 21, 2025 08:27

JudahSchwartz assigned ilaredo and unassigned talzich Jan 21, 2025

edx-sayed-salem added 4 commits January 22, 2025 09:11

Empty-Commit to trigger CI

2737f43

Fix pre-commit error

dc99fa0

Ran format command to correct file(s)

dcea20f

Revert version and add configuration sections

ec18fa5

ilaredo reviewed Jan 24, 2025

View reviewed changes

use .get() for safe dictionary access.

638f372

karinafishman requested changes Jan 28, 2025

View reviewed changes

richardbluestone removed their assignment Feb 9, 2025

ShirleyDenkberg reviewed Feb 9, 2025

View reviewed changes

ShirleyDenkberg added the docs-approved label Feb 9, 2025

edx-sayed-salem and others added 14 commits February 9, 2025 13:46

Update Packs/CTM360-CyberBlindspot/Integrations/CyberBlindspot/CyberB…

12850dc

…lindspot.yml Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/Integrations/CyberBlindspot/README.md

dd88ec1

Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/ReleaseNotes/2_1_0.md

9014dfc

Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/ReleaseNotes/2_1_0.md

01f8569

Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/README.md

a746888

Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/README.md

206aebe

Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_…

a7613c1

…Incident_Management_V2_README.md Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_…

6bad89b

…Incident_Management_V2.yml Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_…

af1d6e0

…Incident_Management_V2.yml Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_…

304f57a

…Incident_Management_V2.yml Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_…

003d870

…Incident_Management_V2.yml Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_…

5756933

…Incident_Management_V2.yml Co-authored-by: ShirleyDenkberg <[email protected]>

Update Packs/CTM360-CyberBlindspot/Playbooks/playbook-CyberBlindspot_…

1610795

…Incident_Management_V2.yml Co-authored-by: ShirleyDenkberg <[email protected]>

Update Module To Use additional info

e0f5050

ilaredo approved these changes Feb 9, 2025

View reviewed changes

Empty-Commit

44fddee

ilaredo unassigned ShirleyDenkberg Feb 9, 2025

karinafishman approved these changes Feb 9, 2025

View reviewed changes

ilaredo added the pending-demo Demo pending label Feb 9, 2025

ilaredo merged commit 3b32cbd into demisto:contrib/CTM360-Integrations_ctm360-cbs-1 Feb 10, 2025
17 checks passed

content-bot mentioned this pull request Feb 10, 2025

Update Integration: CTM360 #38558

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update Integration: CTM360 #38199

Update Integration: CTM360 #38199

edx-sayed-salem commented Jan 16, 2025

content-bot commented Jan 16, 2025

content-bot commented Jan 16, 2025

edx-sayed-salem commented Jan 16, 2025 •

edited

Loading

ilaredo Jan 24, 2025

edx-sayed-salem Jan 27, 2025

ilaredo Jan 24, 2025

edx-sayed-salem Jan 27, 2025

ilaredo Jan 27, 2025

ilaredo Jan 24, 2025

karinafishman Jan 28, 2025

edx-sayed-salem Jan 28, 2025

edx-sayed-salem Jan 29, 2025

karinafishman Jan 28, 2025

edx-sayed-salem Jan 28, 2025 •

edited

Loading

karinafishman Jan 28, 2025

karinafishman Jan 28, 2025

edx-sayed-salem Jan 29, 2025

ShirleyDenkberg Feb 9, 2025

edx-sayed-salem Feb 9, 2025

ShirleyDenkberg Feb 9, 2025

edx-sayed-salem Feb 9, 2025

ShirleyDenkberg commented Feb 9, 2025

ilaredo commented Feb 9, 2025

ilaredo commented Feb 9, 2025

edx-sayed-salem commented Feb 10, 2025

github-actions bot commented Feb 10, 2025

	url_suffix=CBS_API_ENDPOINT + API['FETCH'],
	url_suffix=CBS_API_ENDPOINT + API.get('FETCH'),

Update Integration: CTM360 #38199

Update Integration: CTM360 #38199

Conversation

edx-sayed-salem commented Jan 16, 2025

Contributing to Cortex XSOAR Content

Status

Description

Must have

content-bot commented Jan 16, 2025

content-bot commented Jan 16, 2025

edx-sayed-salem commented Jan 16, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

edx-sayed-salem Jan 28, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ShirleyDenkberg commented Feb 9, 2025

ilaredo commented Feb 9, 2025

ilaredo commented Feb 9, 2025

edx-sayed-salem commented Feb 10, 2025

github-actions bot commented Feb 10, 2025

edx-sayed-salem commented Jan 16, 2025 •

edited

Loading

edx-sayed-salem Jan 28, 2025 •

edited

Loading