TransformIndicatorToMSDefenderIOC

Transform a XSOAR indicator into a Microsoft Defender for Endpoint IOC. The output (at TransformIndicatorToMSDefenderIOC.JsonOutput) is a json representation of the indicators in MSDE format. This json can be the input for the *microsoft-atp-indicator-batch-update* command.

python · Microsoft Defender for Endpoint

Details

IDTransformIndicatorToMSDefenderIOC
Languagepython
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10404775

README

Transform a XSOAR indicator into a Microsoft Defender for Endpoint IOC. The output (at TransformIndicatorToMSDefenderIOC.JsonOutput) is a json representation of the indicators in MSDE format. This json can be the input for the microsoft-atp-indicator-batch-update command.

Script Data

Name Description
Script Type python3
Tags  
Cortex XSOAR Version 6.0.0

Inputs

Argument Name Description Required
query The indicators query. Required
action The action that will be taken if the indicator will be discovered in the organization. Required
limit The maximum number of indicators to fetch. Optional
offset The results offset page. Only change when the number of the results exceed the limit. Optional

Outputs

Path Description Type
TransformIndicatorToMSDefenderIOC.JsonOutput Json output of the indicators. Should be the input for the *microsoft-atp-indicator-batch-update*. String
TransformIndicatorToMSDefenderIOC.Indicators.indicatorValue The value of the Indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.indicatorType Type of the indicator. Possible values are: FileSha1, FileSha256, FileMd5, CertificateThumbprint, IpAddress, DomainName, Url String
TransformIndicatorToMSDefenderIOC.Indicators.lastUpdateTime The last time the indicator was updated. String
TransformIndicatorToMSDefenderIOC.Indicators.lastUpdatedBy Identity of the user/application that last updated the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.action The action that will be taken if the indicator will be discovered in the organization. Possible values are: “Warn”, “Block”, “Audit”, “Alert”, “AlertAndBlock”, “BlockAndRemediate” and “Allowed”. String
TransformIndicatorToMSDefenderIOC.Indicators.title Indicator title. String
TransformIndicatorToMSDefenderIOC.Indicators.expirationTime The expiration time of the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.description Description of the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.creationTimeDateTimeUtc The date and time when the indicator was created. String
TransformIndicatorToMSDefenderIOC.Indicators.Severity The severity of the indicator. possible values are: Informational, Low, Medium and High. String
TransformIndicatorToMSDefenderIOC.Indicators.application The application associated with the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.externalID Id the customer can submit in the request for custom correlation. String
TransformIndicatorToMSDefenderIOC.Indicators.sourceType User in case the Indicator created by a user. “AadApp” in case it submitted using automated application via the API. String
TransformIndicatorToMSDefenderIOC.Indicators.createdBySource The name of the user or application that submitted the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.createdBy Unique identity of the user or application that submitted the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.recommendedActions Recommended actions for the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.rbacGroupNames RBAC device group names where the indicator is exposed and active. Empty list in case it exposed to all devices. Unknown
TransformIndicatorToMSDefenderIOC.Indicators.rbacGroupIds RBAC device group ID’s where the indicator is exposed and active. Empty list in case it exposed to all devices. Unknown
TransformIndicatorToMSDefenderIOC.Indicators.generateAlert True if alert generation is required, False if this indicator should not generate an alert. String

More info

  1. Please read about MSDE Indicator resource type here.
  2. Please read about limitations for creating and updating batch of indicators here.
  3. Please read about the required permissions for creating and updating batch of indicators here.

Source

TransformIndicatorToMSDefenderIOC.py TransformIndicatorToMSDefenderIOC_test.py TransformIndicatorToMSDefenderIOC.yml
Download History Raw 
import pytest
from TransformIndicatorToMSDefenderIOC import *

MSDE_IOC_BY_VALUE = [
    {
        "expirationTime": "2022-02-10T17:02:59.193836+02:00",
        "creationTimeDateTimeUtc": "2022-01-22T12:55:20.20775+02:00",
        "indicatorType": "IpAddress",
        "lastUpdateTime": "2022-02-03T17:02:59.232834+02:00",
        "Severity": "High",
        "indicatorValue": "1.2.3.4",
        "action": "Alert",
        "title": "XSOAR Indicator title",
        "description": "XSOAR Indicator description",
    }
]

XSOAR_INDICATOR_BY_VALUE = [
    {
        "expiration": "2022-02-10T17:02:59.193836+02:00",
        "firstSeen": "2022-01-22T12:55:20.20775+02:00",
        "indicator_type": "IP",
        "lastSeen": "2022-02-03T17:02:59.232834+02:00",
        "score": 3,
        "value": "1.2.3.4",
    }
]

XSOAR_INDICATOR_FILE = [
    {
        "expiration": "2022-02-10T17:02:59.193836+02:00",
        "firstSeen": "2022-01-22T12:55:20.20775+02:00",
        "indicator_type": "File",
        "lastSeen": "2022-02-03T17:02:59.232834+02:00",
        "score": 1,
        "value": "098f6bcd4621d373cade4e832627b4f6",
    }
]

MSDE_IOC_FILE = [
    {
        "expirationTime": "2022-02-10T17:02:59.193836+02:00",
        "creationTimeDateTimeUtc": "2022-01-22T12:55:20.20775+02:00",
        "indicatorType": "FileMd5",
        "lastUpdateTime": "2022-02-03T17:02:59.232834+02:00",
        "Severity": "Informational",
        "indicatorValue": "098f6bcd4621d373cade4e832627b4f6",
        "action": "Alert",
        "title": "XSOAR Indicator title",
        "description": "XSOAR Indicator description",
    }
]

XSOAR_INDICATOR_URL = [
    {
        "expiration": "2022-02-10T17:02:59.193836+02:00",
        "firstSeen": "2022-01-22T12:55:20.20775+02:00",
        "indicator_type": "URL",
        "lastSeen": "2022-02-03T17:02:59.232834+02:00",
        "score": 2,
        "value": "www.example.com",
    }
]

MSDE_IOC_URL = [
    {
        "expirationTime": "2022-02-10T17:02:59.193836+02:00",
        "creationTimeDateTimeUtc": "2022-01-22T12:55:20.20775+02:00",
        "indicatorType": "Url",
        "lastUpdateTime": "2022-02-03T17:02:59.232834+02:00",
        "Severity": "Medium",
        "indicatorValue": "www.example.com",
        "action": "Alert",
        "title": "XSOAR Indicator title",
        "description": "XSOAR Indicator description",
    }
]


@pytest.mark.parametrize(
    "args, xsoar_indicator, msde_ioc",
    [
        ({"query": "value=1.2.3.4", "action": "Alert"}, XSOAR_INDICATOR_BY_VALUE, MSDE_IOC_BY_VALUE),
        ({"query": "indicator_type=FILE", "action": "Alert"}, XSOAR_INDICATOR_FILE, MSDE_IOC_FILE),
        (
            {"query": "value=www.example.com and indicator_type=URL and score=2", "action": "Alert"},
            XSOAR_INDICATOR_URL,
            MSDE_IOC_URL,
        ),
    ],
)
def test_get_indicators_by_query(mocker, args, xsoar_indicator, msde_ioc):
    mocker.patch("TransformIndicatorToMSDefenderIOC.execute_command", return_value=xsoar_indicator)
    mocker.patch.object(demisto, "args", return_value=args)
    assert get_indicators_by_query() == msde_ioc


def test_get_indicators_by_query_no_indicators(mocker):
    mocker.patch("TransformIndicatorToMSDefenderIOC.execute_command", return_value=[])
    mocker.patch.object(demisto, "args", return_value={"query": "value=1.2.3.4", "action": "Alert"})
    assert get_indicators_by_query() == []