-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Xdr isolation and un-isolation warning on disconnected endpoint #14751
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
please consider renaming the arg to the suggested. I did not review the code.
description: Whether return an error when trying to isolate a disconnected endpoint. | ||
When sets to false, a warnning will be returned. | ||
isArray: false | ||
name: disconnected_endpoint_should_return_error |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
name: disconnected_endpoint_should_return_error | |
name: suppress_disconnected_endpoint_error |
- auto: PREDEFINED | ||
default: false | ||
defaultValue: 'True' | ||
description: Whether return an error when trying to isolate a disconnected endpoint. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
description: Whether return an error when trying to isolate a disconnected endpoint. | |
description: Whether to return an error when trying to isolate a disconnected endpoint. |
description: Whether return an error when trying to unisolate a disconnected | ||
endpoint. When sets to false, a warnning will be returned. | ||
isArray: false | ||
name: disconnected_endpoint_should_return_error |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
name: disconnected_endpoint_should_return_error | |
name: suppress_disconnected_endpoint_error |
- auto: PREDEFINED | ||
default: false | ||
defaultValue: 'True' | ||
description: Whether return an error when trying to unisolate a disconnected |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
description: Whether return an error when trying to unisolate a disconnected | |
description: Whether to return an error when trying to unisolate a disconnected |
|
||
#### Integrations | ||
##### Palo Alto Networks Cortex XDR - Investigation and Response | ||
- Added an argument for the **xdr-isolate-endpoint** and **xdr-unisolate-endpoint** commands whether or not to return an error when the endpoint is disconnected. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
- Added an argument for the **xdr-isolate-endpoint** and **xdr-unisolate-endpoint** commands whether or not to return an error when the endpoint is disconnected. | |
- Added the *suppress_disconnected_endpoint_error* argument for the ***xdr-isolate-endpoint*** and the ***xdr-unisolate-endpoint*** commands which dictates whether to return an error when the endpoint is disconnected. |
@yuvalbenshalom can you review this, please? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
see my comments
@@ -789,6 +789,18 @@ script: | |||
name: endpoint_id | |||
required: true | |||
secret: false | |||
- auto: PREDEFINED | |||
default: false | |||
defaultValue: 'True' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
defaultValue: 'True' | |
defaultValue: 'true' |
@@ -805,6 +817,18 @@ script: | |||
name: endpoint_id | |||
required: true | |||
secret: false | |||
- auto: PREDEFINED | |||
default: false | |||
defaultValue: 'True' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
defaultValue: 'True' | |
defaultValue: 'true' |
@@ -1881,7 +1881,7 @@ def insert_cef_alerts_command(client, args): | |||
|
|||
def isolate_endpoint_command(client, args): | |||
endpoint_id = args.get('endpoint_id') | |||
|
|||
disconnected_should_return_error = argToBoolean(args.get('suppress_disconnected_endpoint_error', True)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
disconnected_should_return_error = argToBoolean(args.get('suppress_disconnected_endpoint_error', True)) | |
disconnected_should_return_error = not argToBoolean(args.get('suppress_disconnected_endpoint_error', False)) |
while it is correct that if suppress_disconnected_endpoint_error
does not exist, then disconnected_should_return_error
should be true,
if uppress_disconnected_endpoint_error
exists, disconnected_should_return_error
should get the opposite value of it.
@@ -1922,7 +1928,7 @@ def isolate_endpoint_command(client, args): | |||
|
|||
def unisolate_endpoint_command(client, args): | |||
endpoint_id = args.get('endpoint_id') | |||
|
|||
disconnected_should_return_error = argToBoolean(args.get('suppress_disconnected_endpoint_error', True)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
disconnected_should_return_error = argToBoolean(args.get('suppress_disconnected_endpoint_error', True)) | |
disconnected_should_return_error = not argToBoolean(args.get('suppress_disconnected_endpoint_error', False)) |
# Conflicts: # Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR.py # Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR.yml # Packs/CortexXDR/Integrations/CortexXDRIR/README.md
Status
Related Issues
related: https://github.com/demisto/etc/issues/23083
related: #14505
Description
Added a new argument for both isolation and un-isolation actions in order to know if the user wants to get back an error if the endpoint is disconnected. The default is an error. Otherwise, a warning will be returned.
Screenshots
Does it break backward compatibility?
Must have