[CEM] Cortex Exposure Management Pack

[johnnywilkes]

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Related Issues

https://jira-dc.paloaltonetworks.com/browse/UVEM-2497

Description

New Cortex Exposure Management Pack

Must have

• Tests
• Documentation

[YaelShamai]

Hey,
I answered your questions, please take a look.

[Benimanela]

Hi @johnnywilkes, The playbooks look good!

I have just one question:

In the playbook Cortex EM - Exposure Issue, there's a step called Initialize fields that uses the setIssue (Builtin) automation. I don't see this automation available, even after installing all dependencies.
Could you clarify where this automation comes from?

[johnnywilkes]

Hi @johnnywilkes, The playbooks look good!

I have just one question:

In the playbook Cortex EM - Exposure Issue, there's a step called Initialize fields that uses the setIssue (Builtin) automation. I don't see this automation available, even after installing all dependencies. Could you clarify where this automation comes from?

@Benimanela , my understanding is that !setIssue does exactly what !setAlert/setIncident do and is a standard of platform tenants as alerts are being replaced by issues:

[Benimanela]

Hi @johnnywilkes, The playbooks look good!
I have just one question:
In the playbook Cortex EM - Exposure Issue, there's a step called Initialize fields that uses the setIssue (Builtin) automation. I don't see this automation available, even after installing all dependencies. Could you clarify where this automation comes from?

@Benimanela , my understanding is that !setIssue does exactly what !setAlert/setIncident do and is a standard of platform tenants as alerts are being replaced by issues:

Ok, understood. I’m using XSOAR on-prem, and I don’t have the setIssue automation available, so the playbook will throw an error. Maybe we should set the fromversion to 8.x or higher to prevent installing it on older environments that don’t have setIssue?

However, the PR is approved from my review side, and I’d like to see a demo to better understand how the playbooks work in practice.

[johnnywilkes]

Hi @johnnywilkes, The playbooks look good!
I have just one question:
In the playbook Cortex EM - Exposure Issue, there's a step called Initialize fields that uses the setIssue (Builtin) automation. I don't see this automation available, even after installing all dependencies. Could you clarify where this automation comes from?

@Benimanela , my understanding is that !setIssue does exactly what !setAlert/setIncident do and is a standard of platform tenants as alerts are being replaced by issues:

Ok, understood. I’m using XSOAR on-prem, and I don’t have the setIssue automation available, so the playbook will throw an error. Maybe we should set the fromversion to 8.x or higher to prevent installing it on older environments that don’t have setIssue?

However, the PR is approved from my review side, and I’d like to see a demo to better understand how the playbooks work in practice.

This pack is scoped to platform marketplace, so it shouldn't be a concern.

[content-bot]

For the Reviewer: Trigger build request has been accepted for this contribution PR.

[content-bot]

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/4228003

[content-bot]

Validate summary
The following errors were thrown as a part of this pr: RM104, RM108, RN106, RM116, PA128, RM109, GR103.
The following errors can be ignored: RM104, RM108, RM116, GR103.
The following errors cannot be ignored: RN106, PA128, RM109.
If the AG100 validation in the pre-commit GitHub Action fails, the pull request cannot be force-merged.
The following errors don't run as part of the nightly flow and therefore can be force merged: RM108, RN106, RM116, PA128, RM109.

Verdict: PR can be force merged from validate perspective? ❌

[github-actions]

Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.