Skip to content

Commit be01bdc

Browse files
content-botDNRRomerolderequesensSMosheEichler
authored
[Zerofox] Key Incidents Integration (demisto#39834)
* [Zerofox] Key Incidents Integration (demisto#39506) * Add new base application (#142) * Format applications (#144) * add key incident client (#145) * add key incident attachment method (#146) * Add simple key mapper (#147) * add incident type, incident type field and layout to ZeroFox Key Incident Pack (#149) * Add Fetch Incidents (#148) * add key incident attachment command (#150) * fix classifier, layout and incident type formats (#152) * update release notes * move key incidents package to zerofox pack (#153) * Move key incidents integration to zerofox pack * correct pack readme to include zerofox ki integration * improve unit tests in ki integration (#154) * rename integration to ZeroFoxKeyIncidents * update release notes * correct incident field names * format ZeroFox pack files --------- Co-authored-by: Leonardo de Requeséns <134218114+lderequesensS@users.noreply.github.com> * post demo fixes * fix incident name * ignore * fix incident name --------- Co-authored-by: Diego Ramirez R <dramirez@zerofox.com> Co-authored-by: Leonardo de Requeséns <134218114+lderequesensS@users.noreply.github.com> Co-authored-by: meichler <meichler@paloaltonetworks.com>
1 parent e25d1cf commit be01bdc

24 files changed

+2654
-5
lines changed

‎Packs/ZeroFox/.secrets-ignore‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,4 +80,6 @@ https://www.youtube.com
8080
https://api.zerofox.com
8181
https://api.securitycenter.windows.com
8282
kkk@gmail.com
83-
me@zerofox.com
83+
me@zerofox.com
84+
nvISo
85+
Enbridge

‎Packs/ZeroFox/Classifiers/classifier-ZeroFox_Key_Incident_Incoming_Mapper.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"defaultIncidentType": "",
3+
"definitionId": "",
4+
"description": "Maps ZeroFox Key Incidents Fields to XSOAR",
5+
"feed": false,
6+
"id": "ZeroFox Key Incidents (incoming)",
7+
"fromVersion": "6.0.0",
8+
"mapping": {
9+
"ZeroFox Key Incident": {
10+
"dontMapEventToLabels": false,
11+
"internalMapping": {
12+
"ZeroFox Key Incident Analysis": {
13+
"complex": {
14+
"filters": [],
15+
"root": "analysis",
16+
"transformers": []
17+
}
18+
},
19+
"ZeroFox Key Incident Headline": {
20+
"complex": {
21+
"filters": [],
22+
"root": "headline",
23+
"transformers": []
24+
}
25+
},
26+
"Tags": {
27+
"complex": {
28+
"accessor": "[0]",
29+
"filters": [],
30+
"root": "tags",
31+
"transformers": []
32+
}
33+
},
34+
"occurred": {
35+
"simple": "created_at"
36+
}
37+
}
38+
},
39+
"dbot_classification_incident_type_all": {
40+
"dontMapEventToLabels": true,
41+
"internalMapping": {}
42+
}
43+
},
44+
"name": "ZeroFox Key Incidents (incoming)",
45+
"type": "mapping-incoming",
46+
"version": -1
47+
}

‎Packs/ZeroFox/IncidentFields/ZeroFoxKeyIncidents_Analysis.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "incident_zerofoxkeyincidentanalysis",
3+
"version": -1,
4+
"modified": "2025-04-01T14:37:02.293030483Z",
5+
"fromVersion": "6.10.0",
6+
"name": "ZeroFox Key Incident Analysis",
7+
"ownerOnly": true,
8+
"cliName": "zerofoxkeyincidentanalysis",
9+
"type": "longText",
10+
"closeForm": false,
11+
"editForm": true,
12+
"required": false,
13+
"neverSetAsRequired": false,
14+
"isReadOnly": false,
15+
"useAsKpi": false,
16+
"locked": false,
17+
"system": false,
18+
"content": true,
19+
"group": 0,
20+
"hidden": false,
21+
"openEnded": false,
22+
"associatedTypes": [
23+
"ZeroFox Key Incident"
24+
],
25+
"associatedToAll": false,
26+
"unmapped": false,
27+
"unsearchable": true,
28+
"caseInsensitive": true,
29+
"sla": 0,
30+
"threshold": 72
31+
}

‎Packs/ZeroFox/IncidentFields/ZeroFoxKeyIncidents_Headline.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"id": "incident_zerofoxkeyincidentheadline",
3+
"version": -1,
4+
"fromVersion": "6.10.0",
5+
"modified": "2025-04-01T14:36:27.595586447Z",
6+
"content": true,
7+
"name": "ZeroFox Key Incident Headline",
8+
"ownerOnly": true,
9+
"cliName": "zerofoxkeyincidentheadline",
10+
"type": "shortText",
11+
"closeForm": false,
12+
"editForm": true,
13+
"required": false,
14+
"neverSetAsRequired": false,
15+
"isReadOnly": false,
16+
"useAsKpi": false,
17+
"locked": false,
18+
"system": false,
19+
"group": 0,
20+
"hidden": false,
21+
"openEnded": false,
22+
"associatedTypes": [
23+
"ZeroFox Key Incident"
24+
],
25+
"associatedToAll": false,
26+
"unmapped": false,
27+
"unsearchable": true,
28+
"caseInsensitive": true,
29+
"sla": 0,
30+
"threshold": 72
31+
}

‎Packs/ZeroFox/IncidentTypes/ZeroFox_Key_Incident.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"id": "ZeroFox Key Incident",
3+
"name": "ZeroFox Key Incident",
4+
"version": -1,
5+
"fromVersion": "6.10.0",
6+
"color": "#e7282b",
7+
"hours": 0,
8+
"days": 0,
9+
"weeks": 0,
10+
"hoursR": 0,
11+
"daysR": 0,
12+
"weeksR": 0,
13+
"system": false,
14+
"readonly": false,
15+
"default": false,
16+
"autorun": false,
17+
"disabled": false,
18+
"layout": "ZeroFox Key Incidents Layout",
19+
"marketplaces": [
20+
"xsoar"
21+
]
22+
}

‎Packs/ZeroFox/Integrations/ZeroFox/ZeroFox.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1532,7 +1532,7 @@ script:
15321532
- contextPath: File.Extension
15331533
description: The file extension.
15341534
type: String
1535-
dockerimage: demisto/python3:3.12.8.1983910
1535+
dockerimage: demisto/python3:3.12.8.3296088
15361536
longRunning: false
15371537
longRunningPort: false
15381538
runonce: false

‎Packs/ZeroFox/Integrations/ZeroFox/ZeroFox_test.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1321,7 +1321,7 @@ def test_send_alert_attachment_command(requests_mock, mocker):
13211321
requests_mock.get(f"/1.0/alerts/{alert_id}/", json=alert_response)
13221322
client = build_zf_client()
13231323
spy_send_attachment = mocker.spy(client, "send_alert_attachment")
1324-
mocker.patch("builtins.open", mocker.mock_open(read_data=b"data"))
1324+
mocker.patch("builtins.open", mocker.mock_open(read_data="data"))
13251325
mocker.patch.object(
13261326
demisto,
13271327
"getFilePath",
@@ -1337,7 +1337,6 @@ def test_send_alert_attachment_command(requests_mock, mocker):
13371337
"entry_id": entry_id,
13381338
"attachment_type": attachment_type,
13391339
}
1340-
13411340
results = send_alert_attachment_command(client, args)
13421341

13431342
spy_send_attachment.assert_called_once()

‎Packs/ZeroFox/Integrations/ZeroFoxKeyIncidents/README.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
Cloud-based SaaS to detect risks found on social media and digital channels.
2+
This integration was integrated and tested with version 1.4.0 of ZeroFoxKey.
3+
4+
## Configure ZeroFox Key Incidents in Cortex
5+
6+
7+
| **Parameter** | **Required** |
8+
| --- | --- |
9+
| URL (e.g., https://api.zerofox.com/) | True |
10+
| Fetch incidents | False |
11+
| Username | True |
12+
| Password | True |
13+
| First fetch timestamp (&lt;number&gt; &lt;time unit&gt;, e.g., 12 hours, 7 days) | False |
14+
| Incident type | False |
15+
16+
## Commands
17+
18+
You can execute these commands from the CLI, as part of an automation, or in a playbook.
19+
After you successfully execute a command, a DBot message appears in the War Room with the command details.
20+
21+
### zerofox-get-key-incident-attachment
22+
23+
***
24+
Fetches a Key Incident Attachment by ID and uploads it to the current investigation War Room.
25+
26+
#### Base Command
27+
28+
`zerofox-get-key-incident-attachment`
29+
30+
#### Input
31+
32+
| **Argument Name** | **Description** | **Required** |
33+
| --- | --- | --- |
34+
| attachment_id | The ID of the Key Incident Attachment. | Required |
35+
36+
#### Context Output
37+
38+
| **Path** | **Type** | **Description** |
39+
| --- | --- | --- |
40+
| File.Size | Number | The size of the file. |
41+
| File.SHA1 | String | The SHA1 hash of the file. |
42+
| File.SHA256 | String | The SHA256 hash of the file. |
43+
| File.SHA512 | String | The SHA512 hash of the file. |
44+
| File.Name | String | The name of the file. |
45+
| File.SSDeep | String | The SSDeep hash of the file. |
46+
| File.EntryID | String | The entry ID of the file. |
47+
| File.Info | String | File information. |
48+
| File.Type | String | The file type. |
49+
| File.MD5 | String | The MD5 hash of the file. |
50+
| File.Extension | String | The file extension. |
51+
52+
## Incident Mirroring
53+
54+
You can enable incident mirroring between Cortex XSOAR incidents and ZeroFox Key Incidents corresponding events (available from Cortex XSOAR version 6.0.0).
55+
To set up the mirroring:
56+
1. Enable *Fetching incidents* in your instance configuration.
57+
58+
Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
59+
**Important Note:** To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and ZeroFox Key Incidents.

0 commit comments

Comments
 (0)