From 836117a8d2f889903dcba9ae70a8c360e582db46 Mon Sep 17 00:00:00 2001 From: darkushin <61732335+darkushin@users.noreply.github.com> Date: Mon, 7 Aug 2023 10:00:12 +0300 Subject: [PATCH] Private upload mode docs #3 (#28648) * Updated Docs * Added RNs * updated known words * updated known words * Bump pack from version ThreatConnect to 3.0.8. * Bump pack from version CrowdStrikeFalconX to 1.2.33. --------- Co-authored-by: Content Bot --- .../CrowdStrikeFalconX/CrowdStrikeFalconX_description.md | 2 ++ .../Integrations/CrowdStrikeFalconX/README.md | 2 ++ Packs/CrowdStrikeFalconX/ReleaseNotes/1_2_33.md | 6 ++++++ Packs/CrowdStrikeFalconX/pack_metadata.json | 2 +- .../CuckooSandbox/CuckooSandbox_description.md | 4 +++- Packs/CuckooSandbox/Integrations/CuckooSandbox/README.md | 1 + Packs/CuckooSandbox/ReleaseNotes/1_1_4.md | 6 ++++++ Packs/CuckooSandbox/pack_metadata.json | 2 +- Packs/FortiSandbox/.pack-ignore | 6 +++++- .../Integrations/FortiSandbox/FortiSandbox_description.md | 7 ++++++- Packs/FortiSandbox/Integrations/FortiSandbox/README.md | 4 ++++ Packs/FortiSandbox/ReleaseNotes/1_0_5.md | 6 ++++++ Packs/FortiSandbox/pack_metadata.json | 2 +- Packs/Synapse/Integrations/Synapse/README.md | 4 ++++ Packs/Synapse/Integrations/Synapse/Synapse_description.md | 7 ++++++- Packs/Synapse/ReleaseNotes/1_0_5.md | 6 ++++++ Packs/Synapse/pack_metadata.json | 2 +- Packs/ThreatConnect/Integrations/ThreatConnectV3/README.md | 4 ++++ .../ThreatConnectV3/ThreatConnectV3_description.md | 4 ++++ Packs/ThreatConnect/ReleaseNotes/3_0_8.md | 6 ++++++ Packs/ThreatConnect/pack_metadata.json | 2 +- 21 files changed, 76 insertions(+), 9 deletions(-) create mode 100644 Packs/CrowdStrikeFalconX/ReleaseNotes/1_2_33.md create mode 100644 Packs/CuckooSandbox/ReleaseNotes/1_1_4.md create mode 100644 Packs/FortiSandbox/ReleaseNotes/1_0_5.md create mode 100644 Packs/Synapse/ReleaseNotes/1_0_5.md create mode 100644 Packs/ThreatConnect/ReleaseNotes/3_0_8.md diff --git a/Packs/CrowdStrikeFalconX/Integrations/CrowdStrikeFalconX/CrowdStrikeFalconX_description.md b/Packs/CrowdStrikeFalconX/Integrations/CrowdStrikeFalconX/CrowdStrikeFalconX_description.md index 254b35689ad7..fbf84df37c9a 100644 --- a/Packs/CrowdStrikeFalconX/Integrations/CrowdStrikeFalconX/CrowdStrikeFalconX_description.md +++ b/Packs/CrowdStrikeFalconX/Integrations/CrowdStrikeFalconX/CrowdStrikeFalconX_description.md @@ -8,3 +8,5 @@ First we upload the file and retrieve its SHA256 hash. Then, we use that ID to u If you want to upload a file to the sandbox in a single command, use the cs-fx-upload-file and supply the following argument and value: submit_file=yes. For more information on CrowdStrike Falcon Intelligence Sandbox, see the [CrowdStrike Falcon Intelligence Sandbox FAQ](https://www.crowdstrike.com/endpoint-security-products/falcon-x-threat-intelligence/crowdstrike-falcon-x-faq/). + +Notice: Submitting indicators using the **cs-fx-submit-url** command of this integration might make the indicator data publicly available. See the vendor’s documentation for more details diff --git a/Packs/CrowdStrikeFalconX/Integrations/CrowdStrikeFalconX/README.md b/Packs/CrowdStrikeFalconX/Integrations/CrowdStrikeFalconX/README.md index b2cb22b0a803..aac53766a43b 100644 --- a/Packs/CrowdStrikeFalconX/Integrations/CrowdStrikeFalconX/README.md +++ b/Packs/CrowdStrikeFalconX/Integrations/CrowdStrikeFalconX/README.md @@ -1887,6 +1887,8 @@ Gets reputation info for one or more files, by their sha256 hash. *** Submits a URL or FTP for sandbox analysis. +Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details. + #### Base Command diff --git a/Packs/CrowdStrikeFalconX/ReleaseNotes/1_2_33.md b/Packs/CrowdStrikeFalconX/ReleaseNotes/1_2_33.md new file mode 100644 index 000000000000..94e98b0f4311 --- /dev/null +++ b/Packs/CrowdStrikeFalconX/ReleaseNotes/1_2_33.md @@ -0,0 +1,6 @@ + +#### Integrations + +##### CrowdStrike Falcon Intelligence Sandbox + +Documentation and metadata improvements. diff --git a/Packs/CrowdStrikeFalconX/pack_metadata.json b/Packs/CrowdStrikeFalconX/pack_metadata.json index 58d6ce2586b4..7faebedd5a1e 100644 --- a/Packs/CrowdStrikeFalconX/pack_metadata.json +++ b/Packs/CrowdStrikeFalconX/pack_metadata.json @@ -3,7 +3,7 @@ "description": "Fully automated malware analysis", "support": "xsoar", "serverMinVersion": "5.0.0", - "currentVersion": "1.2.32", + "currentVersion": "1.2.33", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/CuckooSandbox/Integrations/CuckooSandbox/CuckooSandbox_description.md b/Packs/CuckooSandbox/Integrations/CuckooSandbox/CuckooSandbox_description.md index c71b6b9821be..ff0f4871ba69 100644 --- a/Packs/CuckooSandbox/Integrations/CuckooSandbox/CuckooSandbox_description.md +++ b/Packs/CuckooSandbox/Integrations/CuckooSandbox/CuckooSandbox_description.md @@ -1,2 +1,4 @@ #### Authenticate with an API token -In new Cuckoo installations, a random API token is automatically generated for you, and located in the cuckoo.conf file. In order to authenticate with an API token, insert '__token' in the "Username" textbox, and the token itself in the "Password" textbox. \ No newline at end of file +In new Cuckoo installations, a random API token is automatically generated for you, and located in the cuckoo.conf file. In order to authenticate with an API token, insert '__token' in the "Username" textbox, and the token itself in the "Password" textbox. + +Notice: Submitting indicators using the **cuckoo-create-task-from-url** command of this integration might make the indicator data publicly available. See the vendor’s documentation for more details \ No newline at end of file diff --git a/Packs/CuckooSandbox/Integrations/CuckooSandbox/README.md b/Packs/CuckooSandbox/Integrations/CuckooSandbox/README.md index 19c8cb541680..ad97642b81bd 100644 --- a/Packs/CuckooSandbox/Integrations/CuckooSandbox/README.md +++ b/Packs/CuckooSandbox/Integrations/CuckooSandbox/README.md @@ -416,6 +416,7 @@

4. Submit a URL for analysis

Submits a URL to Cuckoo Sandbox for analysis.

+

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command
cuckoo-create-task-from-url
Input
diff --git a/Packs/CuckooSandbox/ReleaseNotes/1_1_4.md b/Packs/CuckooSandbox/ReleaseNotes/1_1_4.md new file mode 100644 index 000000000000..e060a16711c6 --- /dev/null +++ b/Packs/CuckooSandbox/ReleaseNotes/1_1_4.md @@ -0,0 +1,6 @@ + +#### Integrations + +##### Cuckoo Sandbox + +Documentation and metadata improvements. diff --git a/Packs/CuckooSandbox/pack_metadata.json b/Packs/CuckooSandbox/pack_metadata.json index 6d84afbeaf6a..ffe88b8bdaf7 100644 --- a/Packs/CuckooSandbox/pack_metadata.json +++ b/Packs/CuckooSandbox/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Cuckoo Sandbox", "description": "Malware dynamic analysis sandboxing", "support": "xsoar", - "currentVersion": "1.1.3", + "currentVersion": "1.1.4", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "", diff --git a/Packs/FortiSandbox/.pack-ignore b/Packs/FortiSandbox/.pack-ignore index fa7af37be7ac..5ba2194ca731 100644 --- a/Packs/FortiSandbox/.pack-ignore +++ b/Packs/FortiSandbox/.pack-ignore @@ -2,4 +2,8 @@ ignore=RM104 [file:FortiSandbox_image.png] -ignore=IM111 \ No newline at end of file +ignore=IM111 + +[known_words] +FortiSandbox +Forti \ No newline at end of file diff --git a/Packs/FortiSandbox/Integrations/FortiSandbox/FortiSandbox_description.md b/Packs/FortiSandbox/Integrations/FortiSandbox/FortiSandbox_description.md index 13b629b08857..b861db2b539c 100644 --- a/Packs/FortiSandbox/Integrations/FortiSandbox/FortiSandbox_description.md +++ b/Packs/FortiSandbox/Integrations/FortiSandbox/FortiSandbox_description.md @@ -1,4 +1,9 @@ If no hostname use IP address in URL in the http://IP/ format. Please make sure XSOAR server can connect to FortiSandbox server. Recommended playbook to use to upload file for analysis and get report: -Detonate File - FortiSandbox \ No newline at end of file +Detonate File - FortiSandbox + +Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available. +- ***fortisandbox-url-rating*** +- ***fortisandbox-upload-urls*** +See the vendor’s documentation for more details. \ No newline at end of file diff --git a/Packs/FortiSandbox/Integrations/FortiSandbox/README.md b/Packs/FortiSandbox/Integrations/FortiSandbox/README.md index cb715c431685..5dfb1b860ec1 100644 --- a/Packs/FortiSandbox/Integrations/FortiSandbox/README.md +++ b/Packs/FortiSandbox/Integrations/FortiSandbox/README.md @@ -73,6 +73,8 @@ There is no context output for this command. *** Get URL Rating from FortiSandbox +Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details. + #### Base Command @@ -246,6 +248,8 @@ There is no context output for this command. *** Upload CSV URLs +Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details. + #### Base Command diff --git a/Packs/FortiSandbox/ReleaseNotes/1_0_5.md b/Packs/FortiSandbox/ReleaseNotes/1_0_5.md new file mode 100644 index 000000000000..341085256f1e --- /dev/null +++ b/Packs/FortiSandbox/ReleaseNotes/1_0_5.md @@ -0,0 +1,6 @@ + +#### Integrations + +##### FortiSandbox + +Documentation and metadata improvements. diff --git a/Packs/FortiSandbox/pack_metadata.json b/Packs/FortiSandbox/pack_metadata.json index d771227d62a5..8be3dff227de 100644 --- a/Packs/FortiSandbox/pack_metadata.json +++ b/Packs/FortiSandbox/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Forti Sandbox", "description": "Pack contains integration with playbooks to upload file for malware analysis, retrieve the results and get file rating for previously scanned files from FortiSandbox", "support": "community", - "currentVersion": "1.0.4", + "currentVersion": "1.0.5", "author": "vibhuabharadwaj", "url": "", "email": "", diff --git a/Packs/Synapse/Integrations/Synapse/README.md b/Packs/Synapse/Integrations/Synapse/README.md index 6d7c6cabe7e1..c0cbdaf9cb0c 100644 --- a/Packs/Synapse/Integrations/Synapse/README.md +++ b/Packs/Synapse/Integrations/Synapse/README.md @@ -95,6 +95,8 @@ Returns IP information and reputation. *** Returns URL information and reputation. +Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details. + #### Base Command @@ -157,6 +159,8 @@ Returns URL information and reputation. *** Returns Domain information and reputation. +Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details. + #### Base Command diff --git a/Packs/Synapse/Integrations/Synapse/Synapse_description.md b/Packs/Synapse/Integrations/Synapse/Synapse_description.md index 88807da9f176..84ce22a2c10c 100644 --- a/Packs/Synapse/Integrations/Synapse/Synapse_description.md +++ b/Packs/Synapse/Integrations/Synapse/Synapse_description.md @@ -3,4 +3,9 @@ 2. Configure the **Server URL** to match that of your remote cortex instance. 3. Configure the **port** that was used for the REST API (default is `:4443`). 4. Use your **username** and **password** for remote authentication. -5. Set **use_optic** if your instance is running Synapse Optic. \ No newline at end of file +5. Set **use_optic** if your instance is running Synapse Optic. + +Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available. +- ***url*** +- ***domain*** +See the vendor’s documentation for more details. \ No newline at end of file diff --git a/Packs/Synapse/ReleaseNotes/1_0_5.md b/Packs/Synapse/ReleaseNotes/1_0_5.md new file mode 100644 index 000000000000..b7b858f2f2ad --- /dev/null +++ b/Packs/Synapse/ReleaseNotes/1_0_5.md @@ -0,0 +1,6 @@ + +#### Integrations + +##### Synapse + +Documentation and metadata improvements. diff --git a/Packs/Synapse/pack_metadata.json b/Packs/Synapse/pack_metadata.json index 3c6d65d1745a..1306050e93ce 100644 --- a/Packs/Synapse/pack_metadata.json +++ b/Packs/Synapse/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Synapse", "description": "Vertex Synapse intelligence analysis framework.", "support": "community", - "currentVersion": "1.0.4", + "currentVersion": "1.0.5", "author": "Jordan Berry", "url": "", "email": "", diff --git a/Packs/ThreatConnect/Integrations/ThreatConnectV3/README.md b/Packs/ThreatConnect/Integrations/ThreatConnectV3/README.md index 33758674df47..63cbc7c5b18a 100644 --- a/Packs/ThreatConnect/Integrations/ThreatConnectV3/README.md +++ b/Packs/ThreatConnect/Integrations/ThreatConnectV3/README.md @@ -93,6 +93,8 @@ Searches for an indicator of type IP address. *** Searches for an indicator of type URL. +Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details. + #### Base Command `url` @@ -550,6 +552,8 @@ Associates an indicator with an existing incident. The indicator must exist befo *** Searches for an indicator of type domain. +Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details. + #### Base Command `domain` diff --git a/Packs/ThreatConnect/Integrations/ThreatConnectV3/ThreatConnectV3_description.md b/Packs/ThreatConnect/Integrations/ThreatConnectV3/ThreatConnectV3_description.md index 257837012900..ae331fe616ef 100644 --- a/Packs/ThreatConnect/Integrations/ThreatConnectV3/ThreatConnectV3_description.md +++ b/Packs/ThreatConnect/Integrations/ThreatConnectV3/ThreatConnectV3_description.md @@ -3,6 +3,10 @@ 2. Go to **Membership** and click **Create API User** to add a new API user. 3. Finish the configuration as shown [here](https://training.threatconnect.com/learn/article/creating-user-accounts-kb-article#2). +Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available. +- ***url*** +- ***domain*** +See the vendor’s documentation for more details. --- [View API Documentation](https://docs.threatconnect.com/en/latest/rest_api/rest_api.html#v3-api) diff --git a/Packs/ThreatConnect/ReleaseNotes/3_0_8.md b/Packs/ThreatConnect/ReleaseNotes/3_0_8.md new file mode 100644 index 000000000000..852eb4961792 --- /dev/null +++ b/Packs/ThreatConnect/ReleaseNotes/3_0_8.md @@ -0,0 +1,6 @@ + +#### Integrations + +##### ThreatConnect v3 + +Documentation and metadata improvements. diff --git a/Packs/ThreatConnect/pack_metadata.json b/Packs/ThreatConnect/pack_metadata.json index a331a926b09c..5c62401bed9a 100644 --- a/Packs/ThreatConnect/pack_metadata.json +++ b/Packs/ThreatConnect/pack_metadata.json @@ -2,7 +2,7 @@ "name": "ThreatConnect", "description": "Threat intelligence platform.", "support": "xsoar", - "currentVersion": "3.0.7", + "currentVersion": "3.0.8", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "",