XSOAR EDL Checker

Details

ID	`XSOAR EDL Checker`
Provider	Palo Alto Networks
Category	Utilities
From Version	6.5.0
Docker Image	`demisto/python3:3.12.8.3296088`

README

Checks an XSOAR hosted EDL to make sure it’s returning a valid response. Supports PAN-OS (text), CSV, or JSON EDLs.

This integration was integrated and tested with version 6.12 and 8.4 of Cortex XSOAR, and version 3.2.12 of the Generic Export Indicator Service.

Configure XSOAR EDL Checker in Cortex

Parameter	Description	Required
EDL Name	The name of the edl from the generic indicator export service	True
Username		False
Password		False
Trust any certificate (not secure)		False
XSOAR Version	The version of XSOAR you are using 6.x or 8.x	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

xsoaredlchecker-get-edl

Checks the EDL and returns the response.

Base Command

xsoaredlchecker-get-edl

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
EDLChecker.Name	unknown	The Name of the EDL from the Generic Indicators Export Service instance
EDLChecker.Status	unknown	The HTTP Status Code returned by the EDL
EDLChecker.Response	unknown	The Response or Error from the check.
EDLChecker.ItemsOnList	unknown	The number of indicators on the list, assuming a successful response!

Command example


#### Context Example

```json
{
    "EDLChecker": [
        {
            "ItemsOnList": 2,
            "Name": "domains",
            "Response": "domains returned a 200 response, all should be well",
            "Status": 200
        },
        {
            "ItemsOnList": 0,
            "Name": "ips",
            "Response": "Instance 'ips' is disabled (922)",
            "Status": 400
        }
    ]
}

Human Readable Output

EDL Response for domains

Name Status Response ItemsOnList

domains 200 domains returned a 200 response, all should be well 2

Name	Status	Response	ItemsOnList
domains	200	domains returned a 200 response, all should be well	2

Configuration parameters

edl_name — EDL Name (required)
credentials — Username
insecure — Trust any certificate (not secure)
xsoarversion — XSOAR Version

Commands (1)

xsoaredlchecker-get-edl
Checks the EDL and returns the response.

Source

XSOAREDLChecker.py XSOAREDLChecker.yml XSOAREDLChecker_description.md command_examples.txt

Download History Raw

category: Utilities
provider: Palo Alto Networks
commonfields:
  id: XSOAR EDL Checker
  version: -1
configuration:
- additionalinfo: The name of the edl from the generic indicator export service
  display: EDL Name
  name: edl_name
  required: true
  type: 0
- display: Username
  displaypassword: Password
  name: credentials
  type: 9
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: XSOAR Version
  name: xsoarversion
  defaultvalue: 6.x
  type: 15
  required: false
  options:
  - 6.x
  - 8.x
  additionalinfo: 'The version of XSOAR you are using 6.x or 8.x '
description: Checks an XSOAR hosted EDL to make sure it's returning a valid response.   Supports PAN-OS (text), CSV, or JSON EDLs.
display: XSOAR EDL Checker
name: XSOAR EDL Checker
script:
  commands:
  - arguments: []
    description: 'Checks the EDL and returns the response. '
    name: xsoaredlchecker-get-edl
    outputs:
    - contextPath: EDLChecker.Name
      description: The Name of the EDL from the Generic Indicators Export Service instance.
    - contextPath: EDLChecker.Status
      description: The HTTP Status Code returned by the EDL.
    - contextPath: EDLChecker.Response
      description: The Response or Error from the check.
    - contextPath: EDLChecker.ItemsOnList
      description: The number of indicators on the list, assuming a successful response!
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.5.0
tests:
- TestXSOAREDLCheckerPlaybook