SOCFWPackManager

Downloads a SOC Framework content pack from a ZIP URL and installs it on the tenant as system content. Used internally by the SOCFWPackManager script — end users invoke the script, not this integration directly.

Utilities · SOC Framework Pack Manager

Details

ID	`SOCFWPackManager`
Provider	SOC Framework
Category	Utilities
From Version	8.0.0
Docker Image	`demisto/demisto-sdk:1.38.14.6091684`
Supported Modules	Agentix XSIAM

README

SOC Framework Pack Manager — internal HTTP layer used by the SOCFWPackManager
script to install SOC Framework content packs as system content. End users do
not invoke this integration directly.

Architecture

This integration is paired with the SOCFWPackManager script in the same
pack. The script reads the SOC Framework pack catalog, sequences pack
installs, configures integration instances and jobs, and synchronizes the
value_tags lookup. Because Cortex XSIAM scripts can call
demisto.executeCommand, all orchestration lives there.

This integration stores the tenant URL, credentials, TLS verification setting,
and the pack catalog location. It exposes two commands: socfw-install-pack,
which downloads a pack ZIP and uploads it as system content, and
socfw-catalog-url-get, which returns the configured catalog location so the
script can read it. Cortex XSIAM integrations cannot call
demisto.executeCommand, so the integration deliberately performs only the
work that needs raw HTTP.

End users run !SOCFWPackManager action=apply pack_id=... from the XSIAM
Playground. The script invokes socfw-install-pack on this integration
internally.

Configure SOC Framework Pack Manager on Cortex XSIAM

Navigate to Settings > Configurations > API Keys and create a
Standard API key.
Copy the Key, the Key ID, and click Copy URL to capture the
tenant Server URL.
Navigate to Settings > Configurations > Integrations.
Search for SOC Framework Pack Manager.
Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Server URL	The tenant API URL or tenant URL. The integration adds the api- prefix when it is missing.	True
API Key ID	The numeric ID of the Standard API key, shown in the API Keys table.	True
API Key	The secret value of the Standard API key.	True
Trust any certificate (not secure)	Whether to disable TLS certificate validation. Off by default.	False
Use system proxy settings	Whether to route HTTP traffic through the system proxy. Off by default.	False
Pack catalog URL	The location of the SOC Framework pack_catalog.json. Override to point at a fork or branch. Leave empty to use the SOC Framework repository default.	False

Click Test to validate the URL and credentials, then Done.

Commands

You can execute these commands from the Cortex XSIAM CLI as part of an
automation or in a playbook. After you successfully execute a command, a
DBot message appears in the War Room with the command details.

socfw-install-pack

Downloads a SOC Framework pack ZIP from the supplied URL and installs it on
the tenant as system content. Called by the SOCFWPackManager script — do not
invoke directly.

Base Command

socfw-install-pack

Input

Argument Name	Description	Required
url	URL of the pack ZIP to install (typically a GitHub release asset).	Required
filename	Asset filename, including the `.zip` extension. Derived from the URL when omitted.	Optional

Context Output

Path	Type	Description
SOCFramework.PackInstall.filename	String	Installed pack filename.
SOCFramework.PackInstall.url	String	Source URL the pack was downloaded from.
SOCFramework.PackInstall.status	String	Install status (success on completion).
SOCFramework.PackInstall.response	Unknown	Raw response from the demisto-sdk upload step.

Command example

!socfw-install-pack url=https://github.com/Palo-Cortex/secops-framework/releases/download/soc-optimization-unified-v3.6.3/soc-optimization-unified-v3.6.3.zip

Context Example

{
    "SOCFramework": {
        "PackInstall": {
            "filename": "soc-optimization-unified-v3.6.3.zip",
            "url": "https://github.com/Palo-Cortex/secops-framework/releases/download/soc-optimization-unified-v3.6.3/soc-optimization-unified-v3.6.3.zip",
            "status": "success",
            "response": {
                "success": true,
                "message": "Uploaded /home/demisto/Packs/soc-optimization-unified-v3.6.3"
            }
        }
    }
}

Human Readable Output

Pack soc-optimization-unified-v3.6.3.zip installed successfully.

socfw-catalog-url-get

Returns the SOC Framework pack catalog URL configured on this instance. Called by the SOCFWPackManager script so the catalog location is set once on the instance instead of passed as an argument on every run.

Base Command

socfw-catalog-url-get

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
SOCFramework.PackManager.CatalogURL	String	The pack catalog URL configured on this instance, or the SOC Framework default when the field is empty.

Configuration parameters

url — Server URL (required)
credentials — API Key ID (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
catalog_url — Pack catalog URL

Commands (2)

socfw-catalog-url-get
Returns the SOC Framework pack catalog URL configured on this instance. Called by the SOCFWPackManager script so the catalog location is set once on the instance instead of passed as an argument on every run.
socfw-install-pack
Download and install a SOC Framework pack ZIP as system content. Called by the SOCFWPackManager script — do not invoke directly.

Source

SOCFWPackManager.py SOCFWPackManager_test.py SOCFWPackManager.yml SOCFWPackManager_description.md command_examples.txt

Download History Raw

display: SOC Framework Pack Manager
name: SOCFWPackManager
description: Downloads a SOC Framework content pack from a ZIP URL and installs it on the tenant as system content. Used internally by the SOCFWPackManager script — end users invoke the script, not this integration directly.
category: Utilities
fromversion: 8.0.0
system: true
sectionorder:
- Connect
configuration:
- section: Connect
  display: Server URL
  additionalinfo: The tenant API URL or tenant URL. The integration adds the api- prefix when it is missing.
  name: url
  defaultvalue: ''
  type: 0
  required: true
- section: Connect
  display: API Key ID
  additionalinfo: The numeric ID of the Standard API key, shown in the API Keys table, with the key secret itself as the password.
  displaypassword: API Key
  name: credentials
  type: 9
  required: true
- section: Connect
  advanced: true
  display: Trust any certificate (not secure)
  additionalinfo: Whether to disable TLS certificate validation. Off by default.
  name: insecure
  type: 8
  required: false
- section: Connect
  advanced: true
  display: Use system proxy settings
  additionalinfo: Whether to route HTTP traffic through the system proxy. Off by default.
  name: proxy
  type: 8
  required: false
- section: Connect
  advanced: true
  display: Pack catalog URL
  name: catalog_url
  defaultvalue: https://raw.githubusercontent.com/Palo-Cortex/secops-framework/refs/heads/main/pack_catalog.json
  type: 0
  required: false
  additionalinfo: The location of the SOC Framework pack_catalog.json. Override to point at a fork or branch. Leave empty to use the SOC Framework repository default.
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/demisto-sdk:1.38.14.6091684
  runonce: false
  commands:
  - name: socfw-install-pack
    description: Download and install a SOC Framework pack ZIP as system content. Called by the SOCFWPackManager script — do not invoke directly.
    arguments:
    - name: url
      required: true
      description: URL of the pack ZIP to install (typically a GitHub release asset).
    - name: filename
      required: false
      description: Asset filename, including the .zip extension. Derived from the URL when omitted.
    compliantpolicies:
      - Domain Blockage
    outputs:
    - contextPath: SOCFramework.PackInstall.filename
      description: Installed pack filename.
      type: String
    - contextPath: SOCFramework.PackInstall.url
      description: Source URL the pack was downloaded from.
      type: String
    - contextPath: SOCFramework.PackInstall.status
      description: Install status (success on completion).
      type: String
    - contextPath: SOCFramework.PackInstall.response
      description: Raw response from demisto-sdk upload_content_entity.
      type: Unknown
  - name: socfw-catalog-url-get
    description: Returns the SOC Framework pack catalog URL configured on this instance. Called by the SOCFWPackManager script so the catalog location is set once on the instance instead of passed as an argument on every run.
    arguments: []
    outputs:
    - contextPath: SOCFramework.PackManager.CatalogURL
      description: The pack catalog URL configured on this instance, or the SOC Framework default when the field is empty.
      type: String
commonfields:
  id: SOCFWPackManager
  version: -1
provider: SOC Framework
tests:
- No tests (auto formatted)