Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update ZeroFox Integration #27969

Merged
merged 16 commits into from
Aug 13, 2023
Merged

Update ZeroFox Integration #27969

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
cdf62b7
Add command to modify notes in a specific alert (#2)
figarrido Jun 2, 2023
aae2c2e
Sort imports and add zerofox-submit-threat command
DNRRomero Jun 2, 2023
a88bd59
Add offending content url to alert responses
figarrido Jun 5, 2023
6ace4c0
Add CTI feed lookup commands
DNRRomero Jun 7, 2023
967ce5c
Add commands to sync alerts from zf to xsoar
figarrido Jun 7, 2023
f3fb8f7
Add release notes and update integration version
figarrido Jun 20, 2023
587148c
Improve code presentation according to XSOARs guidelines
DNRRomero Jun 12, 2023
8243c21
Add release notes and update integration version
figarrido Jun 20, 2023
6d0ed29
Refactor to follow XSOAR Guidelines
figarrido Jul 3, 2023
511e647
Fix types in the integration file
figarrido Jul 7, 2023
658d5f7
Change data test's folder name
figarrido Jul 7, 2023
d32bbd7
Update testing email data
figarrido Jul 10, 2023
7b888de
Update docker tag, python type hints and docstrings
figarrido Jul 24, 2023
d9a5bc2
Add description in main Readme file
figarrido Aug 2, 2023
c0a335c
Fix zf api call
figarrido Aug 10, 2023
d8319cb
Merge branch 'contrib/riskive_master-1' into master
figarrido Aug 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions Packs/ZeroFox/.pack-ignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,10 @@
[file:ZeroFox.yml]
ignore=IN126

[file:TestData/alert.json]
ignore=BA115

[known_words]
zerofox
CTI
hashes
Binary file added Packs/ZeroFox/Author_image.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
172 changes: 172 additions & 0 deletions Packs/ZeroFox/Classifiers/classifier-ZeroFox_Mapping.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,172 @@
{
"description": "",
"feed": false,
"id": "ZeroFox Mapping",
"mapping": {
"dbot_classification_incident_type_all": {
"dontMapEventToLabels": true,
"internalMapping": {
"Additional Data": {
"simple": "metadata"
},
"Alert Category": {
"simple": "alert_type"
},
"Alert ID": {
"simple": "id"
},
"Alert Source": {
"simple": "network"
},
"Event Type": {
"simple": "alert_type"
},
"External Status": {
"simple": "status"
},
"Rule Name": {
"complex": {
"filters": [],
"root": "rule_name",
"transformers": []
}
},
"Tags": {
"complex": {
"filters": [],
"root": "tags",
"transformers": [
{
"args": {
"separator": {
"value": {
"simple": ","
}
}
},
"operator": "join"
}
]
}
},
"Threat Name": {
"simple": "rule_name"
},
"URLs": {
"simple": "offending_content_url"
},
"dbotMirrorDirection": {
"simple": "mirror_direction"
},
"dbotMirrorId": {
"simple": "id"
},
"dbotMirrorInstance": {
"simple": "mirror_instance"
},
"details": {
"simple": "notes"
},
"occurred": {
"complex": {
"filters": [],
"root": "timestamp",
"transformers": []
}
},
"severity": {
"complex": {
"filters": [],
"root": "severity",
"transformers": [
{
"args": {
"limit": {},
"replaceWith": {
"value": {
"simple": "informational"
}
},
"toReplace": {
"value": {
"simple": "1"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {},
"replaceWith": {
"value": {
"simple": "low"
}
},
"toReplace": {
"value": {
"simple": "2"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {},
"replaceWith": {
"value": {
"simple": "medium"
}
},
"toReplace": {
"value": {
"simple": "3"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {},
"replaceWith": {
"value": {
"simple": "high"
}
},
"toReplace": {
"value": {
"simple": "4"
}
}
},
"operator": "replace"
},
{
"args": {
"limit": {},
"replaceWith": {
"value": {
"simple": "critical"
}
},
"toReplace": {
"value": {
"simple": "5"
}
}
},
"operator": "replace"
}
]
}
}
}
}
},
"name": "ZeroFox Mapping",
"type": "mapping-incoming",
"version": -1,
"fromVersion": "6.8.0"
}
Loading
Loading