DlpAskFeedback

Sends a message via Slack or MS Teams to the user whose activity violated DLP policies and triggered the incident.

python · Enterprise DLP by Palo Alto Networks

Details

ID	`DlpAskFeedback`
Language	python
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

Sends a message via Slack to the user whose file upload violated DLP policies and triggered the incident.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	5.5.0

Dependencies

This script uses the following commands and scripts.

send-notification

Used In

This script is used in the following playbooks and scripts.

DLP Incident Feedback Loop

Inputs

Argument Name	Description
messenger	The messenger to use for sending notification,
file_name	The name of the file that triggered the incident.
data_profile_name	The name of the DLP data profile that detected the violation.
app_name	The application that performed the upload.
task	A manual task that this task can close.
user_display_name	The user name displayed in the Slack message.
user_id	The user ID to identify the recipient in Slack.
snippets	The snippets of the violation.
include_violation_detail	Whether to include violation details in the message.
question_type	Whether to ask the user about the file content or about exemption.

Outputs

There are no outputs for this script.

Source

DlpAskFeedback.py DlpAskFeedback_test.py DlpAskFeedback.yml

Download History Raw

import datetime

import dateparser
import demistomock as demisto
import DlpAskFeedback
from CommonServerPython import entryTypes

BLOCKS = [
    {"type": "section", "text": {"type": "mrkdwn", "text": "Are you sure"}},
    {
        "type": "actions",
        "elements": [
            {
                "type": "button",
                "text": {"type": "plain_text", "emoji": True, "text": "Yes"},
                "value": '{"entitlement": "4404dae8-2d45-46bd-85fa-64779c12abe8@22", "reply": "Thank you for your response."}',
                "style": "primary",
            },
            {
                "type": "button",
                "text": {"type": "plain_text", "emoji": True, "text": "No"},
                "value": '{"entitlement": "4404dae8-2d45-46bd-85fa-64779c12abe8@22", "reply": "Thank you for your response."}',
                "style": "primary",
            },
        ],
    },
]

BLOCKS_ADDITIONAL = [
    {"type": "section", "text": {"type": "mrkdwn", "text": "wat up"}},
    {
        "type": "actions",
        "elements": [
            {
                "type": "button",
                "text": {"type": "plain_text", "emoji": True, "text": "yes"},
                "value": '{"entitlement": "4404dae8-2d45-46bd-85fa-64779c12abe8@22", "reply": "Thank you brother."}',
                "style": "danger",
            },
            {
                "type": "button",
                "text": {"type": "plain_text", "emoji": True, "text": "no"},
                "value": '{"entitlement": "4404dae8-2d45-46bd-85fa-64779c12abe8@22", "reply": "Thank you brother."}',
                "style": "danger",
            },
            {
                "type": "button",
                "text": {"type": "plain_text", "emoji": True, "text": "maybe"},
                "value": '{"entitlement": "4404dae8-2d45-46bd-85fa-64779c12abe8@22", "reply": "Thank you brother."}',
            },
        ],
    },
]


def execute_command(command, args):
    if command == "addEntitlement":
        return [{"Type": entryTypes["note"], "Contents": "4404dae8-2d45-46bd-85fa-64779c12abe8"}]
    elif command == "pan-dlp-slack-message":
        return [{"Contents": {"message": "Are you sure"}, "Type": 1}]

    return []


def test_slack_ask_user(mocker):
    # Set
    mocker.patch.object(demisto, "executeCommand", side_effect=execute_command)
    mocker.patch.object(demisto, "investigation", return_value={"id": "22"})
    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "messenger": "Slack",
            "user_id": "alexios",
            "message": "wat up",
            "option1": "yes#red",
            "option2": "no#red",
            "reply": "Thank you brother.",
            "lifetime": "24 hours",
            "defaultResponse": "NoResponse",
            "using-brand": "SlackV3",
        },
    )
    mocker.patch.object(demisto, "results")
    mocker.patch.object(dateparser, "parse", return_value=datetime.datetime(2019, 9, 26, 18, 38, 25))

    # Arrange
    DlpAskFeedback.main()
    call_args = demisto.executeCommand.call_args[0]

    # Assert
    assert call_args[1]["using-brand"] == "SlackV3"
    assert call_args[1]["to"] == "alexios"


def test_teams_ask_user(mocker):
    # Set
    mocker.patch.object(demisto, "executeCommand", side_effect=execute_command)
    mocker.patch.object(demisto, "investigation", return_value={"id": "22"})
    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "messenger": "Microsoft Teams",
            "user_id": "alexios",
            "message": "wat up",
            "option1": "yes#red",
            "option2": "no#red",
            "reply": "Thank you brother.",
            "lifetime": "24 hours",
            "defaultResponse": "NoResponse",
            "using-brand": "SlackV3",
        },
    )
    mocker.patch.object(demisto, "results")
    mocker.patch.object(dateparser, "parse", return_value=datetime.datetime(2019, 9, 26, 18, 38, 25))

    # Arrange
    DlpAskFeedback.main()
    call_args = demisto.executeCommand.call_args[0]

    # Assert
    assert call_args[1]["using-brand"] == "Microsoft Teams"
    assert call_args[1]["team_member"] == "alexios"