CrowdStrikeStreamingPreProcessing

Pre processing script for CrowdStrike Streaming, will not duplicate incidents(detection events) that have same Host. Will add entry to duplicate(older) incident notifying a duplicate incident was ignored. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · CrowdStrike Falcon Streaming

Details

IDCrowdStrikeStreamingPreProcessing
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
TagspreProcessing crowdStrike crowdStrikeStreaming

README

Adds an entry to duplicate (older) incidents, notifying that a duplicate incident was ignored. Use this script as the pre-processing script for CrowdStrike Streaming. This will not duplicate incidents (detection events) that have the same host.

Permissions

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name Description
Script Type python
Tags preProcessing, crowdStrike, crowdStrikeStreaming

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

CrowdStrikeStreamingPreProcessing.py CrowdStrikeStreamingPreProcessing_test.py CrowdStrikeStreamingPreProcessing.yml
Download History Raw 
import pytest
from CrowdStrikeStreamingPreProcessing import get_host_from_system_incident

test_data = [
    ({"labels": [{"type": "x", "value": "not found"}, {"type": "y", "value": "not found 1"}]}, ""),
    (
        {
            "labels": [
                {"type": "x", "value": "nothing"},
                {"type": "System", "value": "gotta catch em all"},
                {"type": "System", "value": "you bet ya"},
                {"type": "y", "value": "nanana"},
            ]
        },
        "you bet ya",
    ),
]


@pytest.mark.parametrize("incident,expected_host", test_data)
def test_get_host_from_incident(incident, expected_host):
    """Test get_host_from_incident function conditions"""
    assert get_host_from_system_incident(incident) == expected_host