CreateEDLInstance

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401
import random


edl_instance_name = demisto.args().get("InstanceName")
edl_port_list_name = demisto.args().get("PortListName")
edl_query = demisto.args().get("Query")
port = demisto.args().get("Port", None)

try:
    existing_port_list = demisto.executeCommand("getList", {"listName": edl_port_list_name})[0].get("Contents").split(",")
except Exception as e:
    return_error(e)


def generate_random_port():
    return random.randint(3000, 50000)


if not port:
    # create initial random port
    port = generate_random_port()

    # keep generating a random port until one is found
    # which is not in existing port list
    i = 0
    while str(port) in existing_port_list:
        port = generate_random_port()
        i += 1
        if i > 30:
            return_error("Looks like there are no more free ports!")

if port not in existing_port_list:
    existing_port_list.append(str(port))
else:
    return_error("Error: It looks like that port is already taken!")

# Add new port to existing port list
try:
    new_list = demisto.executeCommand("setList", {"listName": edl_port_list_name, "listData": ",".join(existing_port_list)})
except Exception as e:
    return_error(e)

body = {
    "name": edl_instance_name,
    "id": "",
    "engine": "",
    "engineGroup": "",
    "defaultIgnore": False,
    "configuration": {
        "sortValues": None,
        "display": "Palo Alto Networks PAN-OS EDL Service",
        "canGetSamples": True,
        "itemVersion": "2.1.5",
        "brand": "",
        "modified": "2021-12-06T19:38:01.956979888Z",
        "shouldCommit": False,
        "hidden": False,
        "fromServerVersion": "5.5.0",
        "propagationLabels": [],
        "name": "EDL",
        "vcShouldKeepItemLegacyProdMachine": False,
        "system": True,
        "commitMessage": "",
        "vcShouldIgnore": False,
        "packPropagationLabels": ["all"],
        "packID": "EDL",
        "configuration": [
            {
                "hiddenUsername": False,
                "display": "Indicator Query",
                "hiddenPassword": False,
                "hidden": False,
                "name": "indicators_query",
                "info": "The query to run to update the EDL. To view expected results, you can run the following command"
                " from the Cortex XSOAR CLI `!findIndicators query=<your query>`",
                "defaultValue": "",
                "type": 0,
                "displayPassword": "",
                "options": None,
                "required": False,
                "value": edl_query,
                "hasvalue": True,
            },
            {
                "hiddenUsername": False,
                "display": "EDL Size",
                "hiddenPassword": False,
                "hidden": False,
                "name": "edl_size",
                "info": "Maximum number of items in the EDL",
                "defaultValue": "2500",
                "type": 0,
                "displayPassword": "",
                "options": None,
                "required": True,
                "value": "2500",
                "hasvalue": True,
            },
            {
                "hiddenUsername": False,
                "display": "Update EDL On Demand Only",
                "hiddenPassword": False,
                "hidden": False,
                "name": "on_demand",
                "info": "Enabling this will prevent automatic EDL refresh",
                "defaultValue": "",
                "type": 8,
                "displayPassword": "",
                "options": None,
                "required": False,
            },
            {
                "hiddenUsername": False,
                "display": "Refresh Rate",
                "hiddenPassword": False,
                "hidden": False,
                "name": "cache_refresh_rate",
                "info": "How often to refresh the EDL (e.g., 5 minutes, 12 hours, 7 days, 3 months, 1 year)."
                " For performance reasons, we do not recommend setting this value to less than 1 minute.",
                "defaultValue": "5 minutes",
                "type": 0,
                "displayPassword": "",
                "options": None,
                "required": False,
                "value": "5 minutes",
                "hasvalue": True,
            },
            {
                "hiddenUsername": False,
                "display": "Long Running Instance",
                "hiddenPassword": False,
                "hidden": True,
                "name": "longRunning",
                "info": "",
                "defaultValue": "true",
                "type": 8,
                "displayPassword": "",
                "options": None,
                "required": False,
                "value": "true",
                "hasvalue": True,
            },
            {
                "hiddenUsername": False,
                "display": "Listen Port",
                "hiddenPassword": False,
                "hidden": False,
                "name": "longRunningPort",
                "info": "Will run the EDL service on this port from within Cortex XSOAR. Requires a unique port for"
                " each long-running integration instance. Do not use the same port for multiple instances.",
                "defaultValue": "",
                "type": 0,
                "displayPassword": "",
                "options": None,
                "required": True,
                "value": str(port),
                "hasvalue": True,
            },
            {
                "hiddenUsername": False,
                "display": "Certificate (Required for HTTPS)",
                "hiddenPassword": False,
                "hidden": False,
                "name": "certificate",
                "info": "",
                "defaultValue": "",
                "type": 12,
                "displayPassword": "",
                "options": None,
                "required": False,
            },
            {
                "hiddenUsername": False,
                "display": "Private Key (Required for HTTPS)",
                "hiddenPassword": False,
                "hidden": False,
                "name": "key",
                "info": "",
                "defaultValue": "",
                "type": 14,
                "displayPassword": "",
                "options": None,
                "required": False,
            },
            {
                "hiddenUsername": False,
                "display": "Username",
                "hiddenPassword": False,
                "hidden": False,
                "name": "credentials",
                "info": "Uses basic authentication for accessing the EDL. If empty, no authentication is enforced.",
                "defaultValue": "",
                "type": 9,
                "displayPassword": "",
                "options": None,
                "required": False,
            },
            {
                "hiddenUsername": False,
                "display": "Strip Ports from URLs",
                "hiddenPassword": False,
                "hidden": False,
                "name": "url_port_stripping",
                "info": "If selected, a URL that includes a port number will be reformatted to remove the port."
                " For example, 'www.example.com:9999/path' would become 'www.example.com/path'.",
                "defaultValue": "true",
                "type": 8,
                "displayPassword": "",
                "options": None,
                "required": False,
                "value": "true",
                "hasvalue": True,
            },
            {
                "hiddenUsername": False,
                "display": "PAN-OS URL Drop Invalid Entries",
                "hiddenPassword": False,
                "hidden": False,
                "name": "drop_invalids",
                "info": "If selected, any URL entry that is not compliant with PAN-OS EDL URL format is dropped instead"
                " of being rewritten.",
                "defaultValue": "",
                "type": 8,
                "displayPassword": "",
                "options": None,
                "required": False,
            },
            {
                "hiddenUsername": False,
                "display": "Add Comment To Empty EDL",
                "hiddenPassword": False,
                "hidden": False,
                "name": "add_comment_if_empty",
                "info": 'If selected, add to an empty EDL the comment "# Empty EDL".',
                "defaultValue": "true",
                "type": 8,
                "displayPassword": "",
                "options": None,
                "required": False,
                "value": "true",
                "hasvalue": True,
            },
            {
                "hiddenUsername": False,
                "display": "Should Collapse IPs:",
                "hiddenPassword": False,
                "hidden": False,
                "name": "collapse_ips",
                "info": "",
                "defaultValue": "Don't Collapse",
                "type": 15,
                "displayPassword": "",
                "options": ["Don't Collapse", "To CIDRS", "To Ranges"],
                "required": False,
                "value": "Don't Collapse",
                "hasvalue": True,
            },
            {
                "hiddenUsername": False,
                "display": "XSOAR Indicator Page Size",
                "hiddenPassword": False,
                "hidden": False,
                "name": "page_size",
                "info": "Internal page size used when querying Cortex XSOAR for the EDL."
                " By default, this value shouldn't be changed.",
                "defaultValue": "2000",
                "type": 0,
                "displayPassword": "",
                "options": None,
                "required": False,
                "value": "2000",
                "hasvalue": True,
            },
            {
                "hiddenUsername": False,
                "display": "NGINX Global Directives",
                "hiddenPassword": False,
                "hidden": False,
                "name": "nginx_global_directives",
                "info": "NGINX global directives to be passed on the command line using the -g option."
                " Each directive should end with `;`. For example: `worker_processes 4; timer_resolution 100ms;`"
                ". Advanced configuration to be used only if instructed by Cortex XSOAR Support.",
                "defaultValue": "",
                "type": 0,
                "displayPassword": "",
                "options": None,
                "required": False,
            },
            {
                "hiddenUsername": False,
                "display": "NGINX Server Conf",
                "hiddenPassword": False,
                "hidden": False,
                "name": "nginx_server_conf",
                "info": "NGINX server configuration. To be used instead of the default NGINX_SERVER_CONF used"
                " in the integration code. Advanced configuration to be used only if instructed by Cortex"
                " XSOAR Support.",
                "defaultValue": "",
                "type": 12,
                "displayPassword": "",
                "options": None,
                "required": False,
            },
            {
                "hiddenUsername": False,
                "display": "Advanced: Use Legacy Queries",
                "hiddenPassword": False,
                "hidden": False,
                "name": "use_legacy_query",
                "info": "Legacy Queries: When enabled, the integration will query the Server using full queries."
                " Enable this query mode, if you've been instructed by Support,"
                " or you've encountered in the log errors of the form: msgpack: invalid code.",
                "defaultValue": "",
                "type": 8,
                "displayPassword": "",
                "options": None,
                "required": False,
            },
            {
                "hiddenUsername": False,
                "display": "Incident type",
                "hiddenPassword": False,
                "hidden": False,
                "name": "incidentType",
                "info": "",
                "defaultValue": "",
                "type": 13,
                "displayPassword": "",
                "options": None,
                "required": False,
            },
        ],
        "version": 1,
        "icon": "",
        "toServerVersion": "",
        "id": "EDL",
        "description": "This integration provides External Dynamic List (EDL) as a service for"
        " the system indicators (Outbound feed).",
        "category": "Data Enrichment & Threat Intelligence",
        "prevName": "EDL",
        "integrationScript": {
            "resetContext": False,
            "isRemoteSyncOut": False,
            "longRunning": True,
            "commands": [
                {
                    "timeout": 0,
                    "important": None,
                    "polling": False,
                    "indicatorAction": False,
                    "docsHidden": False,
                    "cartesian": False,
                    "hidden": False,
                    "name": "edl-update",
                    "outputs": None,
                    "deprecated": False,
                    "arguments": [
                        {
                            "default": False,
                            "deprecated": False,
                            "description": "The query used to retrieve indicators from the system.",
                            "name": "query",
                            "required": True,
                            "secret": False,
                        },
                        {
                            "default": False,
                            "deprecated": False,
                            "description": "The maximum number of entries in the EDL. If no value is provided,"
                            ' will use the value specified in the "EDL Size" parameter configured'
                            " in the instance configuration.",
                            "name": "edl_size",
                            "required": False,
                            "secret": False,
                        },
                        {
                            "default": False,
                            "predefined": ["False", "True"],
                            "name": "drop_invalids",
                            "auto": "PREDEFINED",
                            "secret": False,
                            "defaultValue": "false",
                            "deprecated": False,
                            "description": "If True, any URL entry that is not compliant with PAN-OS EDL URL"
                            " format is dropped instead of being rewritten.",
                            "required": False,
                        },
                        {
                            "default": False,
                            "predefined": ["False", "True"],
                            "name": "url_port_stripping",
                            "auto": "PREDEFINED",
                            "secret": False,
                            "defaultValue": "false",
                            "deprecated": False,
                            "description": "If set to True, a URL that includes a port number will be reformatted to"
                            " remove the port. For example, 'www.example.com:9999/path' would become"
                            " 'www.example.com/path'.",
                            "required": False,
                        },
                        {
                            "default": False,
                            "predefined": ["False", "True"],
                            "name": "add_comment_if_empty",
                            "auto": "PREDEFINED",
                            "secret": False,
                            "defaultValue": "false",
                            "deprecated": False,
                            "description": 'If selected, add to an empty EDL the comment "# Empty EDL".',
                            "required": False,
                        },
                        {
                            "default": False,
                            "predefined": ["Don't Collapse", "To CIDRS", "To Ranges"],
                            "name": "collapse_ips",
                            "auto": "PREDEFINED",
                            "secret": False,
                            "defaultValue": "Don't Collapse",
                            "deprecated": False,
                            "description": "Whether to collapse IPs to ranges or CIDRs.",
                            "required": False,
                        },
                        {
                            "default": False,
                            "defaultValue": "0",
                            "deprecated": False,
                            "description": "The starting entry index from which to export the indicators.",
                            "name": "offset",
                            "required": False,
                            "secret": False,
                        },
                    ],
                    "sensitive": False,
                    "permitted": False,
                    "execution": False,
                    "description": "Updates values stored in the EDL (only available On-Demand).",
                }
            ],
            "longRunningPortMapping": True,
            "isFetchCredentials": False,
            "runOnce": False,
            "isRemoteSyncIn": False,
            "isFetch": False,
            "isMappable": False,
            "isFetchSamples": False,
            "subtype": "python3",
            "type": "python",
            "dockerImage": "demisto/flask-nginx:1.0.0.23674",
            "feed": False,
        },
        "instances": [],
    },
    "enabled": "true",
    "propagationLabels": ["all"],
    "data": [
        {
            "name": "indicators_query",
            "value": edl_query,
            "hasvalue": True,
            "type": 0,
            "defaultValue": "",
            "required": False,
            "options": None,
        },
        {"name": "edl_size", "value": "2500", "hasvalue": True, "type": 0, "defaultValue": "", "required": True, "options": None},
        {"name": "on_demand", "type": 8, "defaultValue": "", "required": False, "options": None},
        {
            "name": "cache_refresh_rate",
            "value": "5 minutes",
            "hasvalue": True,
            "type": 0,
            "defaultValue": "",
            "required": False,
            "options": None,
        },
        {
            "name": "longRunning",
            "value": "true",
            "hasvalue": True,
            "type": 8,
            "defaultValue": "",
            "required": False,
            "options": None,
        },
        {
            "name": "longRunningPort",
            "value": str(port),
            "hasvalue": True,
            "type": 0,
            "defaultValue": "",
            "required": True,
            "options": None,
        },
        {"name": "certificate", "type": 12, "defaultValue": "", "required": False, "options": None},
        {"name": "key", "type": 14, "defaultValue": "", "required": False, "options": None},
        {"name": "credentials", "type": 9, "defaultValue": "", "required": False, "options": None},
        {
            "name": "url_port_stripping",
            "value": "true",
            "hasvalue": True,
            "type": 8,
            "defaultValue": "",
            "required": False,
            "options": None,
        },
        {"name": "drop_invalids", "type": 8, "defaultValue": "", "required": False, "options": None},
        {
            "name": "add_comment_if_empty",
            "value": "true",
            "hasvalue": True,
            "type": 8,
            "defaultValue": "",
            "required": False,
            "options": None,
        },
        {
            "name": "collapse_ips",
            "value": "Don't Collapse",
            "hasvalue": True,
            "type": 15,
            "defaultValue": "",
            "required": False,
            "options": ["Don't Collapse", "To CIDRS", "To Ranges"],
        },
        {
            "name": "page_size",
            "value": "2000",
            "hasvalue": True,
            "type": 0,
            "defaultValue": "",
            "required": False,
            "options": None,
        },
        {"name": "nginx_global_directives", "type": 0, "defaultValue": "", "required": False, "options": None},
        {"name": "nginx_server_conf", "type": 12, "defaultValue": "", "required": False, "options": None},
        {"name": "use_legacy_query", "type": 8, "defaultValue": "", "required": False, "options": None},
        {"name": "incidentType", "type": 13, "defaultValue": "", "required": False, "options": None},
    ],
    "brand": "EDL",
    "canSample": True,
    "category": "Data Enrichment & Threat Intelligence",
    "version": 0,
    "isIntegrationScript": True,
    "isLongRunning": True,
    "passwordProtected": False,
    "mappingId": "",
    "incomingMapperId": "",
    "outgoingMapperId": "",
    "resetContext": False,
    "integrationLogLevel": "",
}


def main():
    # Create EDL instance
    parameters = {"uri": "/settings/integration", "body": body}

    try:
        results = demisto.executeCommand("core-api-put", parameters)
    except Exception as e:
        return_error(e)

    output = {"Name": edl_instance_name, "PortListName": edl_port_list_name, "Query": edl_query, "Port": port}

    readable_output = tableToMarkdown("Indicator Feed", output)

    return_results(
        CommandResults(
            outputs_key_field="Name", outputs_prefix="EDL", outputs=output, readable_output=readable_output, raw_response=results
        )
    )


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()

README