import json from datetime import datetime from math import floor import dateparser import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 """ CONSTANTS/GLOBALS """ TIME_FORMAT = "%Y-%m-%dT%H:%M:%S" INTEGRATION_CONTEXT_BRAND = "RespondSoftwareAnalyst" BASE_URL = demisto.params().get("base_url") VERIFY_CERT = not demisto.params().get("insecure", False) API_TOKEN = demisto.params().get("token") MIRROR_DIRECTION = {"None": None, "Incoming": "In", "Outgoing": "Out", "Both": "Both"} RESPOND_FEEDBACK_STATUS = { "ConfirmedIncident": "Confirmed Incident", "NonActionable": "Non-Actionable", "Inconclusive": "Inconclusive", } RESPOND_INCIDENT_FIELDS = { "feedback comments": { "description": "the user assigned outcome of a closed incident", "xsoar_field_name": "feedbackcomments", }, "title": {"description": "incident title", "xsoar_field_name": "Title"}, "feedback outcome": {"description": "the outcome of the incident close", "xsoar_field_name": "feedbackoutcome"}, } RESPOND_INCIDENT_TYPE_NAME = "Respond Software Incident" def convert_epoch_to_milli(timestamp): if timestamp is None: return None if 9 < len(str(timestamp)) < 13: timestamp = int(timestamp) * 1000 return int(timestamp) def convert_datetime_to_epoch(the_time=0): if the_time is None: return None try: if isinstance(the_time, datetime): return int(the_time.strftime("%s")) except Exception as err: demisto.error(err) return 0 def convert_datetime_to_epoch_millis(the_time=0): return convert_epoch_to_milli(convert_datetime_to_epoch(the_time=the_time)) def arg_to_timestamp(arg, arg_name: str, required: bool = False): if arg is None: if required is True: raise ValueError(f'Missing "{arg_name}"') return None if isinstance(arg, str) and arg.isdigit(): # timestamp that str - we just convert it to int return int(arg) if isinstance(arg, str): # if the arg is string of date format 2019-10-23T00:00:00 or "3 days", etc date = dateparser.parse(arg, settings={"TIMEZONE": "UTC"}) if date is None: # if d is None it means dateparser failed to parse it raise ValueError(f"Invalid date: {arg_name}") return int(date.timestamp() * 1000) if isinstance(arg, int | float): return arg return None # helper function gets incident ids from Respond into array format def extract_id(incident_id_map): return int(incident_id_map.get("id")) class RestClient(BaseClient): def send_graphql_request(self, tenant_id, data): return self._http_request( method="POST", url_suffix=f"/graphql?tempId={API_TOKEN}&tenantId={tenant_id}", retries=3, json_data=data, ) def get_tenant_mappings(self): # need to send one request to big-monolith service to get the external tenant id res = self._http_request( method="GET", url_suffix=f"/session/tenantIdMapping?tempId={API_TOKEN}", retries=3, resp_type="none" ) """ this is a hacky way of checking for a bad api token if an api token is bad, Respond will redirect to the login page, which is html normally requests using the BaseClient assume resp_type=json and return a parsed json object from the body for this request we specifically use a resp_type that will return the entire response and allow us to attempt to parse the json. if parsing fails, try to parse as text, and then search the text for 'login' if we find that, it is sufficient to say we have a bad token, and can return a more helpful error. this isn't ideal. this is also, at the time of this writing, the first REST request made by all of our commands because we need to get the internal tenant id before doing anything else. that's why we only do this hack on this request. """ try: tenant_mappings = res.json() if len(tenant_mappings) == 0: raise Exception("no tenants found for user") return tenant_mappings except ValueError: if "login" in res.text.lower(): raise Exception(f"invalid API token for {BASE_URL}") def get_current_user(self): return self._http_request(method="GET", url_suffix=f"/session/activeUser?tempId={API_TOKEN}", retries=3) def get_all_users(self): return self._http_request(method="GET", url_suffix=f"/api/v0/users?tempId={API_TOKEN}", retries=3) # sadly the linting process will fail if the format below is not used. Hard to read def construct_and_send_full_incidents_query(self, tenant_id, incident_ids): query = { "query": "query { " "fullIncidents(ids: " + str(incident_ids) + ") {" " id" " dateCreated" " eventCount" " firstEventTime" " lastEventTime" " title" " description" " attackStage" " assetClass" " probabilityBucket" " status" " priority" " internalSystemsCount" " allSystems{" " hostname" " ipAddress" " isInternal" " }" " avAccounts{" " name" " domain" " }" " wpAccounts{" " name" " domain" " }" " authDataAccounts{" " name" " domain" " }" " edrAccounts{" " name" " domain" " }" " avMalwareNames{" " name" " vendor" " type" " }" " nidsSignatures{" " vendor" " name" " category" " }" " wpHosts{" " hostname" " categorizations" " }" " avFileHashes{" " hash" " }" " feedback {" " newStatus" " status" " newSelectedOptions{" " id" " key" " value" " }" " timeGiven" " optionalText" " userId" " closedAt" " closedBy" " }" " userIds" " tags {" " label" " }" "} }" } res = self.send_graphql_request(tenant_id, query) return res.get("data").get("fullIncidents") def construct_and_send_get_incident_ids_query(self, tenant_id, from_time_str): if from_time_str == "": query = {"query": "query { incidents( statusFilters: [ { incidentStatus: Open } ] ){ id dateCreated } }"} else: query = {"query": 'query { incidents( createdAfter:"' + from_time_str + '" ){ id dateCreated } }'} res = self.send_graphql_request(tenant_id, query) return res.get("data").get("incidents") def construct_and_send_close_incident_mutation( self, tenant_id, feedback_status, feedback_selected_options, feedback_optional_text, incident_id, user ): if feedback_selected_options is None: feedback_selected_options = [] # sadly the linting process will fail if the format below is not used. Hard to read query = { "query": "mutation closeIncident( " "$incidentId: ID! " "$user: User! " "$feedbackStatus: FeedbackStatus! " "$newFeedbackSelectedOptions: [FeedbackSelectionInput!] " "$feedbackOptionalText: String ){ " "closeIncident( " "incidentId: $incidentId " "user: $user " "feedbackStatus: $feedbackStatus " "newFeedbackSelectedOptions: $newFeedbackSelectedOptions " "feedbackOptionalText: $feedbackOptionalText " ") { " "id " "status " "feedback { " "userId " "newStatus " "timeGiven " "newSelectedOptions{ " "id " "key " "value " "} " "optionalText " "} " "} " "}", "variables": { "incidentId": incident_id, "user": user, "feedbackStatus": feedback_status, "newFeedbackSelectedOptions": feedback_selected_options, "feedbackOptionalText": feedback_optional_text, }, } res = self.send_graphql_request(tenant_id, query) return res.get("data").get("closeIncident") def construct_and_send_add_user_to_incident_mutation(self, tenant_id, user_id, incident_id): query = { "query": "mutation addUserToIncident($id: ID! $userId: String!) { " "addUserToIncident(incidentId: $id userId: $userId) { " "id " "userIds " "} " "}", "variables": {"id": incident_id, "userId": user_id}, } res = self.send_graphql_request(tenant_id, query) return res.get("data").get("addUserToIncident") def construct_and_send_remove_user_from_incident_mutation(self, tenant_id, user_id, incident_id): query = { "query": "mutation removeUserFromIncident($id: ID! $userId: String!) { " "removeUserFromIncident(incidentId: $id userId: $userId) { " "id " "userIds " "} " "}", "variables": {"id": incident_id, "userId": user_id}, } res = self.send_graphql_request(tenant_id, query) return res.get("data").get("removeUserFromIncident") def construct_and_send_new_escalations_query(self, tenant_id, incident_id): query = { "query": "query {" 'newEscalations(consumer: "XSOAR' + tenant_id + '", patterns: [{type: INCIDENT_ID, value: "' + incident_id + '"}]) { ' " timeGenerated " " sourceType " " incident { " " id " " priority " " probabilityBucket " " } " " ... on NIDSEvent { " " idx " " nidsAction: action { " " action " " } " " actionExt " " trafficFlow " " signature { " " vendor " " category " " idx " " } " " signatureImportance " " signatureName " " categoryExt " " deviceId " " protocol " " sourceHostname " " sourceIpAddress " " sourceZone " " sourceSystem { " " isInternal " " isCritical " " } " " sourceAssetClassification " " sourceSubClassifications " " sourceCriticality " " sourcePort { " " number " " } " " sourceSuspicion " " destinationHostname " " destinationIpAddress " " destinationZone " " destinationSystem { " " isInternal " " isCritical " " } " " destinationAssetClassification " " destinationSubClassifications " " destinationCriticality " " destinationPort { " " number " " } " " destinationSuspicion " " } " " ... on AVEvent {" " system {" " hostname" " ipAddress" " zone " " }" " account {" " domain" " name" " }" " hash {" " hash" " }" " malwareName {" " name" " type" " vendor" " }" " accountType " " isKnownBadHash " " deviceId" " scanTypeExt" " actionExt" " malwareSeverity" " malwareSeverityExt" " malwareTypeExt" " assetClassification" " assetSubClassifications" " assetCriticality" " systemRepeatOffender" " accountRepeatOffender" " malwareSpreading" " avFilepath: filepath" " }" " ... on WPEvent {" " wpAction: action { " " action " " } " " sourceSystem {" " hostname" " ipAddress" " zone " " isInternal " " }" " sourceAssetClassification " " sourceSubClassifications " " sourceCriticality " " destinationAddress {" " hostname" " ipAddress" " zone " " isInternal " " }" " destinationAssetClassification " " destinationSubClassifications " " destinationCriticality " " account {" " domain" " name" " }" " accountType " " categorizationsExternal " " protocol " " method " " status " " userAgent " " contentType " " fileType " " deviceId " " deviceVendor " " fullUrl " " campaign " " } " " ... on EDREvent {" " system {" " hostname" " ipAddress" " zone " " isInternal " " }" " assetClassification" " assetSubClassifications" " assetCriticality" " account {" " domain" " name" " }" " accountType " " deviceId " " deviceVendor " " edrFilepath: filepath " " fileHash " " watchlistName " " processName " " isBinarySigned " " parentProcessName " " parentFileHash " " parentFilepath " " isParentBinarySigned " " binarySuspicion " " accountActivitySuspicion " " diskOperationSuspicion " " networkConnectionSuspicion " " } " "}" "}" } res = self.send_graphql_request(tenant_id, query) return res.get("data").get("newEscalations") def construct_and_send_update_description_mutation(self, tenant_id, incident_id, description): mutation = { "query": "mutation updateIncidentDescription($incidentId: ID!, $input: IncidentDescription!) { " "updateIncidentDescription( " "incidentId: $incidentId " "input: $input " ") { " "id " "description" "} " "}", "variables": {"incidentId": incident_id, "input": {"description": description}}, } res = self.send_graphql_request(tenant_id, mutation) return res.get("data").get("updateIncidentDescription") def construct_and_send_update_title_mutation(self, tenant_id, incident_id, title): mutation = { "query": "mutation updateIncidentTitle($incidentId: ID!, $input: IncidentTitle!) { " "updateIncidentTitle( " "incidentId: $incidentId " "input: $input " ") { " "id " "title" "} " "}", "variables": {"incidentId": incident_id, "input": {"title": title}}, } res = self.send_graphql_request(tenant_id, mutation) return res.get("data").get("updateIncidentTitle") def test_module(client): """ Tests connection to Respond Analyst Server Returns: nothing if test passed """ client.get_tenant_mappings() def get_max_number_of_ids_by_least_recently_created(all_ids, max_fetch): sorted_ids = sorted(all_ids, key=lambda x: x["dateCreated"]) for _i in range(len(all_ids) - max_fetch): sorted_ids.pop() return list(map(extract_id, sorted_ids)) def fetch_incidents_for_tenant(rest_client, internal_tenant_id, external_tenant_id, from_time, max_fetch): # first time fetch is handled in query try: response = rest_client.construct_and_send_get_incident_ids_query(internal_tenant_id, from_time) if len(response) > max_fetch: id_list = get_max_number_of_ids_by_least_recently_created(response, max_fetch) else: id_list = list(map(extract_id, response)) raw_incidents = rest_client.construct_and_send_full_incidents_query(internal_tenant_id, id_list) # print(raw_incidents) except Exception as err: # log error but continue getting incidents for other tenants demisto.error("Exception thrown retrieving incidents for tenant " + external_tenant_id + ": \n " + str(err)) return [] return raw_incidents def format_raw_incident(raw_incident, external_tenant_id, internal_tenant_id): # separate internal and external systems. internal system = asset assets = [] external_systems = [] lc_assets = [] lc_external_systems: list[dict[str, str]] = [] if raw_incident.get("allSystems"): assets = list(filter(lambda system: system["isInternal"] is True, raw_incident["allSystems"])) for asset in assets: lc_assets.append({k.lower(): v for k, v in asset.items()}) external_systems = list(filter(lambda system: system["isInternal"] is False, raw_incident["allSystems"])) for es in external_systems: lc_external_systems.append({k.lower(): v for k, v in es.items()}) # aggregate accounts accounts = [] accounts.extend(raw_incident.get("avAccounts")) accounts.extend(raw_incident.get("wpAccounts")) accounts.extend(raw_incident.get("authDataAccounts")) accounts.extend(raw_incident.get("edrAccounts")) # if there are unknown accounts, only keep one, and make the name 'unknown' unknown = False for account in accounts: if not account.get("name") and not account.get("domain"): accounts.remove(account) unknown = True if unknown: accounts.append({"name": "Unknown", "domain": None}) # dedupe accounts seen = set() deduped_accounts = [] for account in accounts: t = tuple(account.items()) if t not in seen: seen.add(t) deduped_accounts.append(account) accounts = deduped_accounts # collect hashes hashes = [] for hash_map in raw_incident.get("avFileHashes"): hashes.append({"hash": hash_map.get("hash")}) # collect domains domains = [] for domain in raw_incident.get("wpHosts"): domains.append({"name": domain.get("hostname")}) # convert graphql response to standardized JSON output for an incident formatted_incident = { "incidentId": raw_incident.get("id"), "timeGenerated": timestamp_to_datestring(raw_incident.get("dateCreated"), TIME_FORMAT + "Z"), "eventCount": raw_incident.get("eventCount"), "firstEventTime": timestamp_to_datestring(raw_incident.get("firstEventTime"), TIME_FORMAT + "Z"), "lastEventTime": timestamp_to_datestring(raw_incident.get("lastEventTime"), TIME_FORMAT + "Z"), "URL": BASE_URL + "/secure/incidents/" + raw_incident.get("id") + "?tenantId=" + internal_tenant_id, "closeURL": BASE_URL + "/secure/incidents/feedback/" + raw_incident.get("id") + "?tenantId=" + internal_tenant_id, "title": raw_incident.get("title"), "description": raw_incident.get("description"), "status": raw_incident.get("status"), "severity": raw_incident.get("priority"), "probability": raw_incident.get("probabilityBucket"), "attackStage": raw_incident.get("attackStage"), "attackTactic": raw_incident.get("attackTactic"), "assetCriticality": raw_incident.get("assetClass"), "assetCount": raw_incident.get("internalSystemsCount"), "assets": lc_assets, "externalsystems": lc_external_systems, "accounts": accounts, "domains": domains, "hashes": hashes, "malware": raw_incident.get("avMalwareNames"), "signatures": raw_incident.get("nidsSignatures"), "escalationreasons": raw_incident.get("tags"), "assignedUsers": raw_incident.get("userIds"), "tenantIdRespond": internal_tenant_id, "tenantId": external_tenant_id, "respondRemoteId": f'{external_tenant_id}:{raw_incident.get("id")}', "dbotMirrorDirection": MIRROR_DIRECTION.get(demisto.params().get("mirror_direction", "None"), None), "dbotMirrorInstance": demisto.integrationInstance(), } if len(raw_incident.get("userIds")) > 0: formatted_incident["owner"] = demisto.findUser(email=raw_incident.get("userIds")[0]).get("username") if raw_incident.get("feedback") is not None: formatted_incident["feedback"] = { "timeUpdated": raw_incident.get("feedback").get("timeGiven"), "userId": raw_incident.get("feedback").get("userId"), "outcome": RESPOND_FEEDBACK_STATUS.get(raw_incident.get("feedback").get("newStatus")), "comments": raw_incident.get("feedback").get("optionalText"), } return formatted_incident def get_internal_tenant_from_mapping_with_external(tenant_mappings, external_tenant_id): """ finds the respond tenant id that matches the external tenant id provided, if exists and accessible :param tenant_mappings: dictionary where (k,v) -> (internal_tenant_id,external_tenant_id) :param external_tenant_id: :return: """ for curr_internal_tid, curr_external_tid in tenant_mappings.items(): if external_tenant_id == curr_external_tid: return curr_internal_tid raise Exception( "no respond tenant matches external tenant: " + external_tenant_id + " or user does not have " "permission to access tenant" ) def get_tenant_map_if_single_tenant(user_tenant_mappings): """ returns respond tenant id and external tenant id if the user is single tenant, otherwise raises exception :param user_tenant_mappings: list of user mappings. expect length 1 :return: internal_tenant_id, external_tenant_id """ if len(user_tenant_mappings) > 1: demisto.error("multi-tenant users must specify a tenant id in params, but no tenant id was found") raise Exception("multi-tenant users must specify a tenant id in params, but no tenant id was found") if len(user_tenant_mappings) == 0: demisto.error("no tenants found for user") raise Exception("no tenants found for user") return list(user_tenant_mappings.items())[0] def get_user_id_from_email(email, users): """ given an email address and a list of Respond users, find the user id of the user with the provided email, and raise an exception if no user is found :param email: valid email for a user :param users: list of Respond Users :return: user id (string) of the user with email provided """ # find the user id that matches the email provided in user_to_add field for user in users: if user.get("email") == email: return user.get("userId") raise Exception("no user found with email " + email) def get_formatted_incident(rest_client, args): external_tenant_id = args.get("tenant_id") user_tenant_mappings = rest_client.get_tenant_mappings() if external_tenant_id is None: internal_tenant_id, external_tenant_id = get_tenant_map_if_single_tenant(user_tenant_mappings) else: internal_tenant_id = get_internal_tenant_from_mapping_with_external(user_tenant_mappings, external_tenant_id) incident_id = int(args["incident_id"]) raw_incident = rest_client.construct_and_send_full_incidents_query(internal_tenant_id, [incident_id])[0] return format_raw_incident(raw_incident, external_tenant_id, internal_tenant_id) def get_tenant_ids(rest_client, args): external_tenant_id = args.get("tenant_id") user_tenant_mappings = rest_client.get_tenant_mappings() if external_tenant_id is None: internal_tenant_id, external_tenant_id = get_tenant_map_if_single_tenant(user_tenant_mappings) else: internal_tenant_id = get_internal_tenant_from_mapping_with_external(user_tenant_mappings, external_tenant_id) return internal_tenant_id, external_tenant_id def validate_user(rest_client, args): user_to_remove = args["username"] try: users = rest_client.get_all_users() except Exception as err: demisto.error("error adding user to incident: " + str(err)) raise Exception("error adding user to incident: " + str(err)) valid_user = False for user in users: if user.get("email") == user_to_remove: valid_user = True break if valid_user is False: demisto.error("no user found with email " + user_to_remove) raise Exception("no user found with email " + user_to_remove) return user_to_remove def remove_user_command(rest_client, args): incident_id = int(args["incident_id"]) internal_tenant_id, external_tenant_id = get_tenant_ids(rest_client, args) user_to_remove = validate_user(rest_client, args) try: res = rest_client.construct_and_send_remove_user_from_incident_mutation(internal_tenant_id, user_to_remove, incident_id) return ( "user with email: " + user_to_remove + " removed from incident with id " + res["id"] + " on tenant " + str(external_tenant_id) ) except Exception as err: demisto.error("error removing user from incident: " + str(err)) raise Exception("error removing user from incident: " + str(err)) def assign_user_command(rest_client, args): incident_id = int(args["incident_id"]) internal_tenant_id, external_tenant_id = get_tenant_ids(rest_client, args) user_to_add = validate_user(rest_client, args) try: res = rest_client.construct_and_send_add_user_to_incident_mutation(internal_tenant_id, user_to_add, incident_id) return ( "user with email: " + user_to_add + " added to incident with id " + res.get("id") + " on tenant " + str(external_tenant_id) ) except Exception as err: demisto.error("error adding user to incident: " + str(err)) raise Exception("error adding user to incident: " + str(err)) def close_incident_command(rest_client, args): """ :param rest_client: REST client :param args: parameters include: user_to_add:email, user_to_remove:email, feedback_status:string, feedback_selected_options:[{id, key, value}], feedback_optional_text:string :return: ?? """ respond_user = rest_client.get_current_user() incident_id = int(args["incident_id"]) internal_tenant_id, external_tenant_id = get_tenant_ids(rest_client, args) feedback_status = args.get("incident_feedback") feedback_selected_options = args.get("feedback_selected_options") feedback_optional_text = args.get("feedback_optional_text") try: incident = rest_client.construct_and_send_full_incidents_query(internal_tenant_id, [incident_id])[0] if feedback_status is None: if incident.get("status") == "Open": demisto.error("cannot close an incident without providing feedback status") raise Exception("cannot close an incident without providing feedback status") feedback_status = incident.get("feedback").get("newStatus") if incident.get("feedback") is not None: if feedback_selected_options is None: feedback_selected_options = incident.get("feedback").get("newSelectedOptions") if feedback_optional_text is None: feedback_optional_text = incident.get("feedback").get("optionalText") # get user info with rest client and construct user object respond_graphql_formatted_user = { "userId": respond_user["email"], "firstname": respond_user["firstname"], "lastname": respond_user["lastname"], } res = rest_client.construct_and_send_close_incident_mutation( internal_tenant_id, feedback_status, feedback_selected_options, feedback_optional_text, incident_id, respond_graphql_formatted_user, ) return ( "incident closed and/or feedback updated for incident with id " + str(incident_id) + " on tenant " + external_tenant_id + ":\n" + str(res) ) except Exception as err: demisto.error("error closing incident and/or updating feedback: " + str(err)) raise Exception("error closing incident and/or updating feedback: " + str(err)) def get_incident_command(rest_client, args): formatted_incident = get_formatted_incident(rest_client, args) readable_output = tableToMarkdown( f'Mandiant Automated Defense Alert, {formatted_incident["tenantId"]} : {formatted_incident["incidentId"]}', formatted_incident, ) # return readable_output return CommandResults( readable_output=readable_output, outputs_prefix="Mandiant.Incident", outputs_key_field="incidentId", outputs=formatted_incident, ) def get_escalations_command(rest_client, args): start = datetime.now().timestamp() fourMinutes = 240 try: external_tenant_id = args.get("tenant_id") user_tenant_mappings = rest_client.get_tenant_mappings() if external_tenant_id is None: internal_tenant_id, external_tenant_id = get_tenant_map_if_single_tenant(user_tenant_mappings) else: internal_tenant_id = get_internal_tenant_from_mapping_with_external(user_tenant_mappings, external_tenant_id) entries = [] more_data = True while more_data: if datetime.now().timestamp() - start > fourMinutes: demisto.debug(f'exiting safely for incident {args["incident_id"]} on {external_tenant_id} starting at {start}') entries.append( { "Type": EntryType.NOTE, "Contents": "Safely exited before timeout, but more data needs to be collected. Please re-run command.", "ContentsFormat": EntryFormat.TEXT, } ) break all_escalations = rest_client.construct_and_send_new_escalations_query(internal_tenant_id, args["incident_id"]) for escalation in all_escalations: valid_entry = {"Type": EntryType.NOTE, "Contents": escalation, "ContentsFormat": EntryFormat.JSON} entries.append(valid_entry) if len(all_escalations) == 0: more_data = False except Exception as e: demisto.debug( f'Error while getting escalation data in Respond incoming mirror for incident ' f'{args["incident_id"]} Error message: {e!s}' ) raise e if len(entries) == 0: entries.append({"Type": EntryType.NOTE, "Contents": "No new escalations", "ContentsFormat": EntryFormat.TEXT}) demisto.debug(f'returning escalations for incident {args["incident_id"]} on {external_tenant_id}: {entries}') return entries def get_remote_data_command(rest_client, args): full_id = args.get("id") last_index = full_id.rfind(":") args["respond_tenant_id"] = full_id[0:last_index] args["incident_id"] = full_id[last_index + 1 :] entries = [] try: updated_incident = get_formatted_incident(rest_client, args) updated_incident["id"] = args.get("id") demisto.debug( f"Respond incident {args.get('id')}\nupdate time: {arg_to_timestamp(args.get('last_update'), 'last_update')}" ) except Exception as e: demisto.debug( f'Error while getting incident data in Respond incoming mirror for incident {args["id"]} \nError message: {e!s}' ) raise e # updated_incident['feedback'] = get_incident_feedback(updated_incident) demisto.debug(f'incident feedback: {updated_incident.get("feedback")}') if updated_incident.get("feedback") is not None: demisto.debug(f"Closing Respond issue {updated_incident.get('id')}") closing_entry = { "Type": EntryType.NOTE, "Contents": { "dbotIncidentClose": True, "closeReason": updated_incident.get("feedback").get("outcome"), "closeNotes": updated_incident.get("feedback").get("comments"), }, "ContentsFormat": EntryFormat.JSON, } entries.append(closing_entry) demisto.debug(f'entries: {closing_entry} for incident {args["incident_id"]}') demisto.debug(f'update incident: {updated_incident} for incident {args["incident_id"]}') return [updated_incident] + entries def update_remote_system_command(rest_client, args): remote_args = UpdateRemoteSystemArgs(args) try: if remote_args.delta: # get incident id and tenant id from remote_system_id remote_incident_id = remote_args.remote_incident_id last_index = remote_incident_id.rfind(":") tenant_id = remote_incident_id[0:last_index] incident_id = remote_args.remote_incident_id.split(":")[1] user_tenant_mappings = rest_client.get_tenant_mappings() internal_tenant_id = get_internal_tenant_from_mapping_with_external(user_tenant_mappings, tenant_id) demisto.debug( f"Got the following delta keys {list(remote_args.delta.keys())!s} to " f" update Respond incident {remote_args.remote_incident_id}" ) if remote_args.delta.get("title"): demisto.debug(f'changed title for {remote_args.remote_incident_id}: {remote_args.delta["title"]}') rest_client.construct_and_send_update_title_mutation(internal_tenant_id, incident_id, remote_args.delta["title"]) if remote_args.delta.get("description"): demisto.debug(f'changed description for {remote_args.remote_incident_id}: {remote_args.delta["description"]}') rest_client.construct_and_send_update_description_mutation( internal_tenant_id, incident_id, remote_args.delta["description"] ) if remote_args.delta.get("closeReason"): # todo do we want to map xsoar close reasons to respond incident outcomes # for now just set everything to inconclusive feedback_args = { "tenant_id": tenant_id, "incident_id": incident_id, "incident_feedback": "Inconclusive", "feedback_optional_text": remote_args.delta.get("closeNotes"), } close_incident_command(rest_client, feedback_args) if remote_args.delta.get("owner"): # todo support unassign demisto.debug(f'changed owner for {remote_args.remote_incident_id}: {remote_args.delta["owner"]}') user_email = demisto.findUser(username=remote_args.delta["owner"]).get("email") assigned_user_args = {"tenant_id": tenant_id, "incident_id": incident_id, "username": user_email} assign_user_command(rest_client, assigned_user_args) except Exception as e: demisto.debug(f"Error in Respond outgoing mirror for incident {remote_args.remote_incident_id} Error message: {e!s}") return remote_args.remote_incident_id def get_mapping_fields_command(): respond_incident_type_scheme = SchemeTypeMapping(type_name=RESPOND_INCIDENT_TYPE_NAME) for field in RESPOND_INCIDENT_FIELDS: respond_incident_type_scheme.add_field(name=field, description=RESPOND_INCIDENT_FIELDS[field].get("description")) mapping_response = GetMappingFieldsResponse() mapping_response.add_scheme_type(respond_incident_type_scheme) return mapping_response def fetch_incidents(rest_client, last_run): """ This function will execute each interval (default is 1 minute). Args: rest_client (Client): Demisto BaseClient last_run (dict): Information about the last successful execution of fetch incidents If last_run is None then fetch all open incidents Returns: next_run: This will be last_run in the next fetch-incidents incidents: Incidents that will be created in Demisto """ if last_run is None: last_run = {} # get tenant ids tenant_mappings = rest_client.get_tenant_mappings() incidents = [] next_run = last_run max_fetch = int(demisto.params()["max_fetch"]) if len(tenant_mappings) > max_fetch: demisto.error("Max Fetch may not be less than total number of tenants") raise Exception("Max Fetch may not be less than total number of tenants") max_fetch_per_tenant = floor(max_fetch / len(tenant_mappings)) # get incidents for each tenant for internal_tenant_id, external_tenant_id in tenant_mappings.items(): # Get the last fetch time for tenant, if exists, which will be used as the 'search from here onward' time latest_time = None from_time = str(arg_to_datetime(demisto.params()["first_fetch"], "first_fetch", True)) if last_run.get(external_tenant_id) is not None: latest_time = last_run.get(external_tenant_id).get("time") if latest_time is not None: # latest_time+1 (ms) to prevent duplicates from_time = datetime.utcfromtimestamp((int(latest_time) + 1) / 1000).strftime("%Y-%m-%d %H:%M:%S.%f") # arg, arg_name=None, is_utc=True, required=False, settings=None) # convert to utc datetime for incidents filter raw_incidents = fetch_incidents_for_tenant( rest_client, internal_tenant_id, external_tenant_id, from_time, max_fetch_per_tenant ) raw_incidents.sort(key=lambda x: x.get("dateCreated")) for raw_incident in raw_incidents: try: formatted_incident = format_raw_incident(raw_incident, external_tenant_id, internal_tenant_id) new_incident = { "name": external_tenant_id + ": " + raw_incident["id"], "type": "Respond Software Incident", "occurred": formatted_incident.get("timeGenerated"), "rawJSON": json.dumps(formatted_incident), } incidents.append(new_incident) if latest_time is None or raw_incident["dateCreated"] > latest_time: latest_time = raw_incident["dateCreated"] except Exception as err: demisto.error( "Exception thrown collecting specific incident for tenant: " + external_tenant_id + str(err) + "\n incident: " + str(raw_incident) ) raise Exception( "Exception thrown collecting specific incident for tenant: " + external_tenant_id + str(err) + "\n incident: " + str(raw_incident) ) # store if external_tenant_id in next_run: next_run[external_tenant_id]["time"] = latest_time else: next_run[external_tenant_id] = {"time": latest_time} return next_run, incidents def main(): """ Executes an integration command """ demisto.info("Command being called is " + demisto.command()) """ PARSE AND VALIDATE INTEGRATION PARAMS """ rest_client = RestClient( base_url=BASE_URL, verify=VERIFY_CERT, ) try: if demisto.command() == "test-module": test_module(rest_client) demisto.results("ok") elif demisto.command() == "fetch-incidents": # get all tenant ids next_run, incidents = fetch_incidents(rest_client, demisto.getLastRun()) demisto.setLastRun(next_run) demisto.incidents(incidents) elif demisto.command() == "mad-close-incident": return_outputs(close_incident_command(rest_client, demisto.args())) elif demisto.command() == "mad-assign-user": return_outputs(assign_user_command(rest_client, demisto.args())) elif demisto.command() == "mad-remove-user": return_outputs(remove_user_command(rest_client, demisto.args())) elif demisto.command() == "mad-get-incident": return_results(get_incident_command(rest_client, demisto.args())) elif demisto.command() == "update-remote-system": return_results(update_remote_system_command(rest_client, demisto.args())) elif demisto.command() == "get-mapping-fields": return_results(get_mapping_fields_command()) elif demisto.command() == "get-remote-data": return_results(get_remote_data_command(rest_client, demisto.args())) elif demisto.command() == "mad-get-escalations": return_results(get_escalations_command(rest_client, demisto.args())) else: raise NotImplementedError("Command not implemented") except NotImplementedError: raise except Exception as err: demisto.error(traceback.format_exc()) # print the traceback return_error(f"Failed to execute {demisto.command()} command.\nError:\n{err!s}") if __name__ in ("__main__", "__builtin__", "builtins"): main()