[VirusTotal] Add custom fields to indicators #35349

pabloperezj · 2024-07-10T10:13:40Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

fixes: link to the issue

Description

A few sentences describing the overall goals of the pull request's commits.

Must have

Tests
Documentation

…into virustotal-custom-indicator-fields

ssokolovich

Looks good from my end - just changed the unsearchable to true on all the new fields.

Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Detection_Names.json

Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Detections.json

Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Vendors.json

…ction_Names.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com>

…ctions.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com>

…ors.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com>

pabloperezj · 2024-07-12T08:27:22Z

Looks good, @thefrieddan1 please invite me to the demo

I have just uploaded a demo video to the virustotal channel on Slack :)

thefrieddan1 · 2024-07-14T08:26:42Z

Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.py

+        if self.vt_detection_names is not None:
+            file_context['VTVendors']['EngineDetectionNames'] = self.vt_detection_names
+
+        if not file_context['VTVendors']:


Consider using the same convention as in other if statements
if not file_context['VTVendors']:
or
if file_context['VTVendors'] is not None:

thefrieddan1 · 2024-07-14T08:30:27Z

Looks good, @thefrieddan1 please invite me to the demo

I have just uploaded a demo video to the virustotal channel on Slack :)

@pabloperezj
Thank you for your contribution it looks fine by me as well.
As for the demo recording in what channel is that? is it on DFIR?
Please add me to the channel.
Also please upload it to this PR for future references as well

pabloperezj · 2024-07-15T08:10:58Z

Looks good, @thefrieddan1 please invite me to the demo

I have just uploaded a demo video to the virustotal channel on Slack :)

@pabloperezj Thank you for your contribution it looks fine by me as well. As for the demo recording in what channel is that? is it on DFIR? Please add me to the channel. Also please upload it to this PR for future references as well

Hi @thefrieddan1,

virustotal-partner channel on Demisto DFIR Community.

Here is the video! :)

vt-custom-fields.mp4

Packs/VirusTotal/Integrations/VirusTotalV3/README.md

Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml

Packs/VirusTotal/ReleaseNotes/2_6_21.md

Packs/VirusTotal/ReleaseNotes/2_6_22.md

ShirleyDenkberg · 2024-07-16T07:57:28Z

@ssokolovich @thefrieddan1 @MLainer1 Doc review completed.

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

github-actions · 2024-07-16T09:53:03Z

Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.

* [VirusTotal] Add custom fields to indicators (#35349) * Add custom fields * nit * Lint * Update docker image * Update readme and release notes * Update fields * Update release note * Update all indicators * Update version * Restore unused fields * Update Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Detection_Names.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com> * Update Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Detections.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com> * Update Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Vendors.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/ReleaseNotes/2_6_21.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/ReleaseNotes/2_6_22.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> --------- Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * RN and known words. --------- Co-authored-by: Pablo Pérez <122302023+pabloperezj@users.noreply.github.com> Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> Co-authored-by: Danny_Fried <dfried@paloaltonetworks.com>

* [VirusTotal] Add custom fields to indicators (demisto#35349) * Add custom fields * nit * Lint * Update docker image * Update readme and release notes * Update fields * Update release note * Update all indicators * Update version * Restore unused fields * Update Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Detection_Names.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com> * Update Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Detections.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com> * Update Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Vendors.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/ReleaseNotes/2_6_21.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/ReleaseNotes/2_6_22.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> --------- Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> * RN and known words. --------- Co-authored-by: Pablo Pérez <122302023+pabloperezj@users.noreply.github.com> Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com> Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com> Co-authored-by: Danny_Fried <dfried@paloaltonetworks.com>

pabloperezj added 8 commits July 8, 2024 17:47

Add custom fields

41c899f

nit

aa77f13

Lint

f1179e8

Update docker image

7a3460d

Update readme and release notes

f2a6b9d

Update fields

8f84572

Update release note

c8ded92

Update all indicators

ea9107d

content-bot assigned barryyosi-panw and ssokolovich Jul 10, 2024

pabloperezj and others added 2 commits July 10, 2024 12:16

Merge branch 'contrib/VirusTotal_virustotal-custom-indicator-fields' …

adf9beb

…into virustotal-custom-indicator-fields

Update version

c74a109

barryyosi-panw requested review from thefrieddan1 and removed request for barryyosi-panw July 10, 2024 10:22

edik24 self-assigned this Jul 10, 2024

pabloperezj and others added 2 commits July 10, 2024 17:36

Restore unused fields

7ba4727

Merge branch 'contrib/VirusTotal_virustotal-custom-indicator-fields' …

e2749e6

…into virustotal-custom-indicator-fields

ssokolovich reviewed Jul 11, 2024

View reviewed changes

pabloperezj and others added 3 commits July 11, 2024 10:06

Update Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Dete…

ffab14d

…ction_Names.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com>

Update Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Dete…

979d161

…ctions.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com>

Update Packs/VirusTotal/IndicatorFields/indicatorfield-VT_Engine_Vend…

9a7a698

…ors.json Co-authored-by: Sasha Sokolovich <88268646+ssokolovich@users.noreply.github.com>

thefrieddan1 assigned thefrieddan1 and unassigned barryyosi-panw Jul 11, 2024

thefrieddan1 reviewed Jul 14, 2024

View reviewed changes

thefrieddan1 assigned ShirleyDenkberg Jul 16, 2024

ShirleyDenkberg reviewed Jul 16, 2024

View reviewed changes

ShirleyDenkberg added the docs-approved label Jul 16, 2024

pabloperezj and others added 15 commits July 16, 2024 10:50

Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md

d037fb7

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md

d0b0560

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md

d15e69d

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md

1efede5

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md

3c09ce6

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml

3f7d57f

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml

f959d01

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml

bce5367

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/ReleaseNotes/2_6_21.md

478e8e7

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/ReleaseNotes/2_6_22.md

7b162d0

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md

94a6004

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md

820da2c

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md

960203e

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/README.md

156559f

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

Update Packs/VirusTotal/Integrations/VirusTotalV3/VirusTotalV3.yml

03e7d79

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

thefrieddan1 added the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Jul 16, 2024

edik24 added the Partner-Approved label Jul 16, 2024

thefrieddan1 self-requested a review July 16, 2024 09:51

thefrieddan1 approved these changes Jul 16, 2024

View reviewed changes

thefrieddan1 merged commit 91a4d31 into demisto:contrib/VirusTotal_virustotal-custom-indicator-fields Jul 16, 2024
16 of 20 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[VirusTotal] Add custom fields to indicators #35349

[VirusTotal] Add custom fields to indicators #35349

pabloperezj commented Jul 10, 2024

ssokolovich left a comment

pabloperezj commented Jul 12, 2024

thefrieddan1 Jul 14, 2024

thefrieddan1 commented Jul 14, 2024 •

edited

Loading

pabloperezj commented Jul 15, 2024 •

edited

Loading

ShirleyDenkberg commented Jul 16, 2024

github-actions bot commented Jul 16, 2024

[VirusTotal] Add custom fields to indicators #35349

[VirusTotal] Add custom fields to indicators #35349

Conversation

pabloperezj commented Jul 10, 2024

Contributing to Cortex XSOAR Content

Status

Related Issues

Description

Must have

ssokolovich left a comment

Choose a reason for hiding this comment

pabloperezj commented Jul 12, 2024

thefrieddan1 Jul 14, 2024

Choose a reason for hiding this comment

thefrieddan1 commented Jul 14, 2024 • edited Loading

pabloperezj commented Jul 15, 2024 • edited Loading

ShirleyDenkberg commented Jul 16, 2024

github-actions bot commented Jul 16, 2024

thefrieddan1 commented Jul 14, 2024 •

edited

Loading

pabloperezj commented Jul 15, 2024 •

edited

Loading