Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add events_from_decider_list to coreIR #36022

Merged
merged 11 commits into from
Aug 28, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
added rn
  • Loading branch information
YuvHayun committed Aug 26, 2024
commit 25a3b7a4ded3016312a066e1cf747902cc7f7ce7
Original file line number Diff line number Diff line change
Expand Up @@ -3561,7 +3561,6 @@ def filter_general_fields(alert: dict, filter_fields: bool = True) -> dict:
result = {k: v for k, v in alert.items() if k in ALERT_GENERAL_FIELDS}
else:
result = alert

if events_from_decider := alert.get("stateful_raw_data", {}).get("events_from_decider", {}):
alert["stateful_raw_data"]["events_from_decider_list"] = list(events_from_decider.values())

Expand Down
10 changes: 10 additions & 0 deletions Packs/Core/ReleaseNotes/3_0_55.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@

#### Integrations

##### Indicators detection

- Added the **events_from_decider_list** context path to **core-get-cloud-original-alerts** command to show the events_from_decider as a list.

##### Investigation & Response

- Added the **events_from_decider_list** context path to **core-get-cloud-original-alerts** command to show the events_from_decider as a list.
2 changes: 1 addition & 1 deletion Packs/Core/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Core - Investigation and Response",
"description": "Automates incident response",
"support": "xsoar",
"currentVersion": "3.0.54",
"currentVersion": "3.0.55",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
6 changes: 6 additions & 0 deletions Packs/CortexXDR/ReleaseNotes/6_1_66.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Integrations

##### Palo Alto Networks Cortex XDR - Investigation and Response

- Added the **events_from_decider_list** context path to **xdr-get-cloud-original-alerts** command to show the events_from_decider as a list.
2 changes: 1 addition & 1 deletion Packs/CortexXDR/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Cortex XDR by Palo Alto Networks",
"description": "Automates Cortex XDR incident response, and includes custom Cortex XDR incident views and layouts to aid analyst investigations.",
"support": "xsoar",
"currentVersion": "6.1.65",
"currentVersion": "6.1.66",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
6 changes: 6 additions & 0 deletions Packs/ctf01/ReleaseNotes/1_0_27.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Integrations

##### Cortex XDR - IR CTF

- Added the **events_from_decider_list** context path to **xdr-get-cloud-original-alerts** command to show the events_from_decider as a list.
2 changes: 1 addition & 1 deletion Packs/ctf01/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Capture The Flag - 01",
"description": "XSOAR's Capture the flag (CTF)",
"support": "xsoar",
"currentVersion": "1.0.26",
"currentVersion": "1.0.27",
"serverMinVersion": "8.2.0",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
Expand Down
Loading