This repository was archived by the owner on Dec 14, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 49
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(app/addon): Add Cortex XDR incident support to App and Add-on
PR: #166 BREAKING CHANGE: Replaces dashboards including Adversary Scoreboard and Incident Feed with new XDR Incidents dashboard.
- Loading branch information
1 parent
9114de9
commit 8be8edb
Showing
19 changed files
with
1,200 additions
and
231 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
98 changes: 98 additions & 0 deletions
98
Splunk_TA_paloalto/bin/Splunk_TA_paloalto_rh_cortex_xdr.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
|
|
||
| import splunk_ta_paloalto_declare | ||
|
|
||
| from splunktaucclib.rest_handler.endpoint import ( | ||
| field, | ||
| validator, | ||
| RestModel, | ||
| DataInputModel, | ||
| ) | ||
| from splunktaucclib.rest_handler import admin_external, util | ||
| from splunk_aoblib.rest_migration import ConfigMigrationHandler | ||
|
|
||
| util.remove_http_proxy_env_vars() | ||
|
|
||
|
|
||
| fields = [ | ||
| field.RestField( | ||
| 'interval', | ||
| required=True, | ||
| encrypted=False, | ||
| default=None, | ||
| validator=validator.Pattern( | ||
| regex=r"""^\-[1-9]\d*$|^\d*$""", | ||
| ) | ||
| ), | ||
| field.RestField( | ||
| 'index', | ||
| required=True, | ||
| encrypted=False, | ||
| default='default', | ||
| validator=validator.String( | ||
| min_len=1, | ||
| max_len=80, | ||
| ) | ||
| ), | ||
| field.RestField( | ||
| 'xdr_tenant', | ||
| required=True, | ||
| encrypted=False, | ||
| default=None, | ||
| validator=validator.String( | ||
| min_len=0, | ||
| max_len=8192, | ||
| ) | ||
| ), | ||
| field.RestField( | ||
| 'xdr_region', | ||
| required=True, | ||
| encrypted=False, | ||
| default='us', | ||
| validator=validator.String( | ||
| min_len=0, | ||
| max_len=8192, | ||
| ) | ||
| ), | ||
| field.RestField( | ||
| 'xdr_key_id', | ||
| required=True, | ||
| encrypted=True, | ||
| default=None, | ||
| validator=validator.String( | ||
| min_len=0, | ||
| max_len=8192, | ||
| ) | ||
| ), | ||
| field.RestField( | ||
| 'xdr_key', | ||
| required=True, | ||
| encrypted=True, | ||
| default=None, | ||
| validator=validator.String( | ||
| min_len=0, | ||
| max_len=8192, | ||
| ) | ||
| ), | ||
|
|
||
| field.RestField( | ||
| 'disabled', | ||
| required=False, | ||
| validator=None | ||
| ) | ||
|
|
||
| ] | ||
| model = RestModel(fields, name=None) | ||
|
|
||
|
|
||
|
|
||
| endpoint = DataInputModel( | ||
| 'cortex_xdr', | ||
| model, | ||
| ) | ||
|
|
||
|
|
||
| if __name__ == '__main__': | ||
| admin_external.handle( | ||
| endpoint, | ||
| handler=ConfigMigrationHandler, | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| import splunk_ta_paloalto_declare | ||
|
|
||
| import os | ||
| import sys | ||
| import time | ||
| import datetime | ||
| import json | ||
|
|
||
| import modinput_wrapper.base_modinput | ||
| from solnlib.packages.splunklib import modularinput as smi | ||
|
|
||
|
|
||
|
|
||
| import input_module_cortex_xdr as input_module | ||
|
|
||
| bin_dir = os.path.basename(__file__) | ||
|
|
||
| ''' | ||
| Do not edit this file!!! | ||
| This file is generated by Add-on builder automatically. | ||
| Add your modular input logic to file input_module_cortex_xdr.py | ||
| ''' | ||
| class ModInputcortex_xdr(modinput_wrapper.base_modinput.BaseModInput): | ||
|
|
||
| def __init__(self): | ||
| if 'use_single_instance_mode' in dir(input_module): | ||
| use_single_instance = input_module.use_single_instance_mode() | ||
| else: | ||
| use_single_instance = False | ||
| super(ModInputcortex_xdr, self).__init__("splunk_ta_paloalto", "cortex_xdr", use_single_instance) | ||
| self.global_checkbox_fields = None | ||
|
|
||
| def get_scheme(self): | ||
| """overloaded splunklib modularinput method""" | ||
| scheme = super(ModInputcortex_xdr, self).get_scheme() | ||
| scheme.title = ("Cortex XDR") | ||
| scheme.description = ("Go to the add-on\'s configuration UI and configure modular inputs under the Inputs menu.") | ||
| scheme.use_external_validation = True | ||
| scheme.streaming_mode_xml = True | ||
|
|
||
| scheme.add_argument(smi.Argument("name", title="Name", | ||
| description="", | ||
| required_on_create=True)) | ||
|
|
||
| """ | ||
| For customized inputs, hard code the arguments here to hide argument detail from users. | ||
| For other input types, arguments should be get from input_module. Defining new input types could be easier. | ||
| """ | ||
| scheme.add_argument(smi.Argument("xdr_tenant", title="Tenant Name", | ||
| description="Value can be found in Cortex XDR URL: https://<tenantname>.xdr.<tenantregion>.paloaltonetworks.com/", | ||
| required_on_create=True, | ||
| required_on_edit=False)) | ||
| scheme.add_argument(smi.Argument("xdr_region", title="Tenant Region", | ||
| description="Value can be found in Cortex XDR URL: https://<tenantname>.xdr.<tenantregion>.paloaltonetworks.com/", | ||
| required_on_create=True, | ||
| required_on_edit=False)) | ||
| scheme.add_argument(smi.Argument("xdr_key_id", title="API Key ID", | ||
| description="API key should have \"Advanced\" security level with a role of \"Viewer\"", | ||
| required_on_create=True, | ||
| required_on_edit=False)) | ||
| scheme.add_argument(smi.Argument("xdr_key", title="API Key", | ||
| description="API key should have \"Advanced\" security level with a role of \"Viewer\"", | ||
| required_on_create=True, | ||
| required_on_edit=False)) | ||
| return scheme | ||
|
|
||
| def get_app_name(self): | ||
| return "Splunk_TA_paloalto" | ||
|
|
||
| def validate_input(self, definition): | ||
| """validate the input stanza""" | ||
| input_module.validate_input(self, definition) | ||
|
|
||
| def collect_events(self, ew): | ||
| """write out the events""" | ||
| input_module.collect_events(self, ew) | ||
|
|
||
| def get_account_fields(self): | ||
| account_fields = [] | ||
| return account_fields | ||
|
|
||
| def get_checkbox_fields(self): | ||
| checkbox_fields = [] | ||
| return checkbox_fields | ||
|
|
||
| def get_global_checkbox_fields(self): | ||
| if self.global_checkbox_fields is None: | ||
| checkbox_name_file = os.path.join(bin_dir, 'global_checkbox_param.json') | ||
| try: | ||
| if os.path.isfile(checkbox_name_file): | ||
| with open(checkbox_name_file, 'r') as fp: | ||
| self.global_checkbox_fields = json.load(fp) | ||
| else: | ||
| self.global_checkbox_fields = [] | ||
| except Exception as e: | ||
| self.log_error('Get exception when loading global checkbox parameter names. ' + str(e)) | ||
| self.global_checkbox_fields = [] | ||
| return self.global_checkbox_fields | ||
|
|
||
| if __name__ == "__main__": | ||
| exitcode = ModInputcortex_xdr().run(sys.argv) | ||
| sys.exit(exitcode) |
Oops, something went wrong.