forked from demisto/content
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add release notes and update integration version
It fixes the problem with the mirroring feature. It also adds the mapping file of the integration to map all fields required for the mirroring feature.
- Loading branch information
Showing
6 changed files
with
232 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,7 @@ | ||
| [file:ZeroFox.yml] | ||
| ignore=IN126 | ||
|
|
||
| [known_words] | ||
| zerofox | ||
| CTI | ||
| hashes |
194 changes: 194 additions & 0 deletions
194
Packs/ZeroFox/Classifiers/classifier-ZeroFox_Mapping.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,194 @@ | ||
| { | ||
| "brands": null, | ||
| "cacheVersn": 0, | ||
| "defaultIncidentType": "", | ||
| "definitionId": "", | ||
| "description": "", | ||
| "feed": false, | ||
| "fromServerVersion": "", | ||
| "id": "ea399f75-4639-468f-8641-75cfc7b30593", | ||
| "incidentSamples": null, | ||
| "indicatorSamples": null, | ||
| "instanceIds": null, | ||
| "itemVersion": "", | ||
| "keyTypeMap": {}, | ||
| "locked": false, | ||
| "logicalVersion": 9, | ||
| "mapping": { | ||
| "dbot_classification_incident_type_all": { | ||
| "dontMapEventToLabels": true, | ||
| "internalMapping": { | ||
| "Additional Data": { | ||
| "simple": "metadata" | ||
| }, | ||
| "Alert Category": { | ||
| "simple": "alert_type" | ||
| }, | ||
| "Alert ID": { | ||
| "simple": "id" | ||
| }, | ||
| "Alert Source": { | ||
| "simple": "network" | ||
| }, | ||
| "Event Type": { | ||
| "simple": "alert_type" | ||
| }, | ||
| "External Status": { | ||
| "simple": "status" | ||
| }, | ||
| "Rule Name": { | ||
| "complex": { | ||
| "filters": [], | ||
| "root": "rule_name", | ||
| "transformers": [] | ||
| } | ||
| }, | ||
| "Tags": { | ||
| "complex": { | ||
| "filters": [], | ||
| "root": "tags", | ||
| "transformers": [ | ||
| { | ||
| "args": { | ||
| "separator": { | ||
| "value": { | ||
| "simple": "," | ||
| } | ||
| } | ||
| }, | ||
| "operator": "join" | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "Threat Name": { | ||
| "simple": "rule_name" | ||
| }, | ||
| "URLs": { | ||
| "simple": "offending_content_url" | ||
| }, | ||
| "dbotMirrorDirection": { | ||
| "simple": "mirror_direction" | ||
| }, | ||
| "dbotMirrorId": { | ||
| "simple": "id" | ||
| }, | ||
| "dbotMirrorInstance": { | ||
| "simple": "mirror_instance" | ||
| }, | ||
| "details": { | ||
| "simple": "notes" | ||
| }, | ||
| "occurred": { | ||
| "complex": { | ||
| "filters": [], | ||
| "root": "timestamp", | ||
| "transformers": [] | ||
| } | ||
| }, | ||
| "severity": { | ||
| "complex": { | ||
| "filters": [], | ||
| "root": "severity", | ||
| "transformers": [ | ||
| { | ||
| "args": { | ||
| "limit": {}, | ||
| "replaceWith": { | ||
| "value": { | ||
| "simple": "informational" | ||
| } | ||
| }, | ||
| "toReplace": { | ||
| "value": { | ||
| "simple": "1" | ||
| } | ||
| } | ||
| }, | ||
| "operator": "replace" | ||
| }, | ||
| { | ||
| "args": { | ||
| "limit": {}, | ||
| "replaceWith": { | ||
| "value": { | ||
| "simple": "low" | ||
| } | ||
| }, | ||
| "toReplace": { | ||
| "value": { | ||
| "simple": "2" | ||
| } | ||
| } | ||
| }, | ||
| "operator": "replace" | ||
| }, | ||
| { | ||
| "args": { | ||
| "limit": {}, | ||
| "replaceWith": { | ||
| "value": { | ||
| "simple": "medium" | ||
| } | ||
| }, | ||
| "toReplace": { | ||
| "value": { | ||
| "simple": "3" | ||
| } | ||
| } | ||
| }, | ||
| "operator": "replace" | ||
| }, | ||
| { | ||
| "args": { | ||
| "limit": {}, | ||
| "replaceWith": { | ||
| "value": { | ||
| "simple": "high" | ||
| } | ||
| }, | ||
| "toReplace": { | ||
| "value": { | ||
| "simple": "4" | ||
| } | ||
| } | ||
| }, | ||
| "operator": "replace" | ||
| }, | ||
| { | ||
| "args": { | ||
| "limit": {}, | ||
| "replaceWith": { | ||
| "value": { | ||
| "simple": "critical" | ||
| } | ||
| }, | ||
| "toReplace": { | ||
| "value": { | ||
| "simple": "5" | ||
| } | ||
| } | ||
| }, | ||
| "operator": "replace" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "name": "ZeroFox Mapping", | ||
| "nameRaw": "ZeroFox Mapping", | ||
| "packID": "", | ||
| "packName": "", | ||
| "propagationLabels": [ | ||
| "all" | ||
| ], | ||
| "sourceClassifierId": "", | ||
| "system": false, | ||
| "toServerVersion": "", | ||
| "transformer": {}, | ||
| "type": "mapping-incoming", | ||
| "unclassifiedCases": null, | ||
| "version": -1 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
|
|
||
| #### Integrations | ||
|
|
||
| ##### ZeroFox | ||
|
|
||
| - Updated the docker image to: *demisto/python3:3.10.11.61265*. | ||
| - Added the command to update alert notes in ZeroFox, `zerofox-modify-alert-notes`. | ||
| - Added the command to submit threats in ZeroFox, `zerofox-submit-threat`. | ||
| - Added the alert's offending content to the response of `zerofox-get-alert` and `zerofox-list-alerts`. | ||
| - Added the ability to look up IPs against ZeroFox CTI feeds with the following new command `zerofox-search-malicious-ip`. | ||
| - Added the ability to look up domains against ZeroFox CTI feeds with the following new command `zerofox-search-compromised-domain`. | ||
| - Added the ability to look up emails against ZeroFox CTI feeds with the following new command `zerofox-search-compromised-email`. | ||
| - Added the ability to look up hashes against ZeroFox CTI feeds with the following new command `zerofox-search-malicious-hash`. | ||
| - Added the ability to look up exploits against ZeroFox CTI feeds with the following new command `zerofox-search-exploit`. | ||
| - Added the incoming mirroring feature. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters