Skip to content

Commit 6cab8c8

Browse files
igorski-r7igorski-r7
authored
Release Azure Sentinel v2.2.0
1 parent c2fb340 commit 6cab8c8

File tree

99 files changed

+3816
-9728
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

99 files changed

+3816
-9728
lines changed

‎plugins/azure_sentinel/.CHECKSUM‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,119 +1,119 @@
11
{
2-
"spec": "61796eba0eef46715c75209cf3c59cbf",
3-
"manifest": "a2e22e50bfa844984d49930df2de33e9",
4-
"setup": "34a5efae9b9fd921e3fc8aff1bc4d3bf",
2+
"spec": "dc5247aac271abe6eecfbd86465997b4",
3+
"manifest": "5b79854be3da439bc608ec426d283425",
4+
"setup": "f8ae8fc360f2dc3a836170ac95a16d07",
55
"schemas": [
66
{
77
"identifier": "append_tags/schema.py",
8-
"hash": "970578dff23d82b552ce67b6dc2e15c0"
8+
"hash": "efd164be3c768ac9e84ab2b84f2e56a6"
99
},
1010
{
1111
"identifier": "create_indicator/schema.py",
12-
"hash": "5d7c50b4689e4207e097a477d131c501"
12+
"hash": "4e8662a883709703041293c729475075"
1313
},
1414
{
1515
"identifier": "create_update_comment/schema.py",
16-
"hash": "1a701623c6c0d2260f88ff2d08ad8169"
16+
"hash": "2e4e0c2a696fc3e38fbafe93cb3d52a7"
1717
},
1818
{
1919
"identifier": "create_update_incident/schema.py",
20-
"hash": "5acab9650a8ab5e803a762d524e528e7"
20+
"hash": "35f7d5c31f469061630a39619c6f009d"
2121
},
2222
{
2323
"identifier": "create_update_watchlist/schema.py",
24-
"hash": "ca112a8375a83a85e00b072ccee9c67f"
24+
"hash": "6c95b82712e1d497173e7570cf323211"
2525
},
2626
{
2727
"identifier": "create_update_watchlist_items/schema.py",
28-
"hash": "d67d3e75ae1eef09ae872a789c523f44"
28+
"hash": "57377c97afe10622f8f782a633c0e790"
2929
},
3030
{
3131
"identifier": "delete_comment/schema.py",
32-
"hash": "88792508d72442af971d56020124c814"
32+
"hash": "17cbaac23cd3103376e533d094d1e0ac"
3333
},
3434
{
3535
"identifier": "delete_incident/schema.py",
36-
"hash": "4263c94749a3cd045cdbaf8b9547eda3"
36+
"hash": "f473510d55fcd24d4f4f8fb7eca0dc57"
3737
},
3838
{
3939
"identifier": "delete_indicator/schema.py",
40-
"hash": "04d174f293c3ca26a6a016a96c9c24cc"
40+
"hash": "b3d8ed6c698f51b3c24d28c2801b8307"
4141
},
4242
{
4343
"identifier": "delete_watchlist/schema.py",
44-
"hash": "46a56ffb221502147f1bf8eed845b625"
44+
"hash": "3a3b1e729f68c051f95194c6957c072c"
4545
},
4646
{
4747
"identifier": "delete_watchlist_item/schema.py",
48-
"hash": "3e2b8434adf15e6aa0941bf6f8389355"
48+
"hash": "094faf48901618bb2642e95ab79d5689"
4949
},
5050
{
5151
"identifier": "get_comment/schema.py",
52-
"hash": "39a4ecabb8caca7e0549661a91a05da5"
52+
"hash": "c07729ed21355a7a164aa38080fdeca7"
5353
},
5454
{
5555
"identifier": "get_incident/schema.py",
56-
"hash": "909331a25929336afeca47df9144d33f"
56+
"hash": "a5236ae187595f9e35e7610bcb501ff6"
5757
},
5858
{
5959
"identifier": "get_indicator/schema.py",
60-
"hash": "dd5d981b29fe62a6a69126a333696d68"
60+
"hash": "bcba352ccdc7cab32d6ad6c8e2ad0c4d"
6161
},
6262
{
6363
"identifier": "get_watchlist/schema.py",
64-
"hash": "4ddf655742f1b1be1d49b28785dbda5f"
64+
"hash": "1dc9a60e4a279815adaef80f8d77daa8"
6565
},
6666
{
6767
"identifier": "get_watchlist_item/schema.py",
68-
"hash": "0e2688ae61f9d286357ef084fe847396"
68+
"hash": "b0a528163894c231eae31d8e98dcc856"
6969
},
7070
{
7171
"identifier": "list_alerts/schema.py",
72-
"hash": "fee3475d8322137671135108c5a64600"
72+
"hash": "bd5e7ebaad62b74be4e0cc152cdd12a5"
7373
},
7474
{
7575
"identifier": "list_bookmarks/schema.py",
76-
"hash": "a6221781ab44ec6a17dbf32be832a024"
76+
"hash": "164166e862cf50794109f11b3853e910"
7777
},
7878
{
7979
"identifier": "list_comments/schema.py",
80-
"hash": "bbf2b1877d145a2ad9bfcb242e2c91b5"
80+
"hash": "a8365805f3eaa4ea7a018443bf8c2a91"
8181
},
8282
{
8383
"identifier": "list_entities/schema.py",
84-
"hash": "a276bdf76aee319c04a31525895152e8"
84+
"hash": "2af2a68a6bb31c2713d46870c6370811"
8585
},
8686
{
8787
"identifier": "list_incidents/schema.py",
88-
"hash": "cb10867e59672f46073dabe4e22c8c4c"
88+
"hash": "c98e8c322da214bef25b72644432ae85"
8989
},
9090
{
9191
"identifier": "list_watchlist_items/schema.py",
92-
"hash": "70e11c60286f1c199cc499b8a475b21b"
92+
"hash": "0e2badd3cf3d5c28b1d7c1f06fc1a4c6"
9393
},
9494
{
9595
"identifier": "list_watchlists/schema.py",
96-
"hash": "5befd89a6fcb3fe7f15158c02eb38426"
96+
"hash": "3c931cb46a7ab31848dcaf3761328e72"
9797
},
9898
{
9999
"identifier": "query_indicator/schema.py",
100-
"hash": "94dc763a0f8e337bfa6013d10bf388e1"
100+
"hash": "36e1ee3df41d9dfafcb94284c5b112ba"
101101
},
102102
{
103103
"identifier": "replace_tags/schema.py",
104-
"hash": "d71ab962502cc5876da3a39aab97141e"
104+
"hash": "87e632f675a6547b8a889eefd64de0da"
105105
},
106106
{
107107
"identifier": "update_indicator/schema.py",
108-
"hash": "7a8595b6f4c3c9c16610e6baea6e3d0e"
108+
"hash": "72cfdd2add2431a60dd9b64add846268"
109109
},
110110
{
111111
"identifier": "connection/schema.py",
112-
"hash": "03dee8861337c1d34a0339a6d04d9a96"
112+
"hash": "e35e373e67e10939cde33b6ea1dc7baa"
113113
},
114114
{
115115
"identifier": "get_new_incidents/schema.py",
116-
"hash": "d0af28fdaf4f85e9b12074c9e3f57b90"
116+
"hash": "3495168fcfb530e08d5b65174c2193ed"
117117
}
118118
]
119119
}

‎plugins/azure_sentinel/Dockerfile‎

Lines changed: 21 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,34 @@
1-
FROM rapid7/insightconnect-python-3-38-plugin:4
2-
# Refer to the following documentation for available SDK parent images: https://komand.github.io/python/sdk.html#version
1+
FROM --platform=linux/amd64 rapid7/insightconnect-python-3-slim-plugin:6.4.3 AS builder
2+
3+
WORKDIR /python/src
4+
5+
ADD ./plugin.spec.yaml /plugin.spec.yaml
6+
ADD ./requirements.txt /python/src/requirements.txt
7+
ADD . /python/src
8+
9+
10+
11+
RUN pip install .
12+
RUN pip uninstall -y setuptools
13+
14+
FROM --platform=linux/amd64 rapid7/insightconnect-python-3-slim-plugin:6.4.3
315

416
LABEL organization=rapid7
517
LABEL sdk=python
618

7-
# Add any custom package dependencies here
8-
# NOTE: Add pip packages to requirements.txt
19+
WORKDIR /python/src
920

10-
# End package dependencies
21+
COPY --from=builder /python/src /python/src
22+
COPY --from=builder /plugin.spec.yaml /plugin.spec.yaml
1123

12-
# Add source code
13-
WORKDIR /python/src
14-
ADD ./plugin.spec.yaml /plugin.spec.yaml
15-
ADD . /python/src
1624

17-
# Install pip dependencies
1825
RUN if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
1926

20-
# Install plugin
21-
RUN python setup.py build && python setup.py install
27+
ENV PYTHONPATH="/python/src:${PYTHONPATH}"
28+
29+
RUN rm -rf /root/.cache;
2230

2331
# User to run plugin code. The two supported users are: root, nobody
2432
USER nobody
2533

26-
ENTRYPOINT ["/usr/local/bin/icon_azure_sentinel"]
34+
ENTRYPOINT ["python", "/python/src/bin/icon_azure_sentinel"]

‎plugins/azure_sentinel/bin/icon_azure_sentinel‎

Lines changed: 48 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
#!/usr/bin/env python
2-
# GENERATED BY KOMAND SDK - DO NOT EDIT
2+
# GENERATED BY INSIGHT-PLUGIN - DO NOT EDIT
33
import os
44
import json
55
from sys import argv
66

77
Name = "Azure Sentinel Plugin"
88
Vendor = "rapid7"
9-
Version = "2.1.0"
9+
Version = "2.2.0"
1010
Description = "Microsoft Azure Sentinel is a cloud-native SIEM that provides intelligent security analytics for your entire enterprise, powered by AI"
1111

1212

@@ -23,7 +23,7 @@ def main():
2323
monkey.patch_all()
2424

2525
import insightconnect_plugin_runtime
26-
from icon_azure_sentinel import connection, actions, triggers
26+
from icon_azure_sentinel import connection, actions, triggers, tasks
2727

2828
class ICONAzureSentinel(insightconnect_plugin_runtime.Plugin):
2929
def __init__(self):
@@ -35,59 +35,59 @@ def main():
3535
connection=connection.Connection()
3636
)
3737
self.add_trigger(triggers.GetNewIncidents())
38-
39-
self.add_action(actions.AppendTags())
40-
41-
self.add_action(actions.CreateIndicator())
42-
38+
39+
self.add_action(actions.GetComment())
40+
41+
self.add_action(actions.ListComments())
42+
4343
self.add_action(actions.CreateUpdateComment())
44-
45-
self.add_action(actions.CreateUpdateIncident())
46-
47-
self.add_action(actions.CreateUpdateWatchlist())
48-
49-
self.add_action(actions.CreateUpdateWatchlistItems())
50-
44+
5145
self.add_action(actions.DeleteComment())
52-
53-
self.add_action(actions.DeleteIncident())
54-
55-
self.add_action(actions.DeleteIndicator())
56-
57-
self.add_action(actions.DeleteWatchlist())
58-
59-
self.add_action(actions.DeleteWatchlistItem())
60-
61-
self.add_action(actions.GetComment())
62-
46+
47+
self.add_action(actions.CreateUpdateIncident())
48+
49+
self.add_action(actions.ListIncidents())
50+
6351
self.add_action(actions.GetIncident())
64-
65-
self.add_action(actions.GetIndicator())
66-
67-
self.add_action(actions.GetWatchlist())
68-
69-
self.add_action(actions.GetWatchlistItem())
70-
52+
53+
self.add_action(actions.DeleteIncident())
54+
7155
self.add_action(actions.ListAlerts())
72-
56+
7357
self.add_action(actions.ListBookmarks())
74-
75-
self.add_action(actions.ListComments())
76-
58+
7759
self.add_action(actions.ListEntities())
78-
79-
self.add_action(actions.ListIncidents())
80-
81-
self.add_action(actions.ListWatchlistItems())
82-
83-
self.add_action(actions.ListWatchlists())
84-
60+
61+
self.add_action(actions.CreateIndicator())
62+
63+
self.add_action(actions.GetIndicator())
64+
65+
self.add_action(actions.UpdateIndicator())
66+
67+
self.add_action(actions.DeleteIndicator())
68+
8569
self.add_action(actions.QueryIndicator())
86-
70+
71+
self.add_action(actions.AppendTags())
72+
8773
self.add_action(actions.ReplaceTags())
88-
89-
self.add_action(actions.UpdateIndicator())
90-
74+
75+
self.add_action(actions.CreateUpdateWatchlist())
76+
77+
self.add_action(actions.GetWatchlist())
78+
79+
self.add_action(actions.DeleteWatchlist())
80+
81+
self.add_action(actions.ListWatchlists())
82+
83+
self.add_action(actions.CreateUpdateWatchlistItems())
84+
85+
self.add_action(actions.GetWatchlistItem())
86+
87+
self.add_action(actions.DeleteWatchlistItem())
88+
89+
self.add_action(actions.ListWatchlistItems())
90+
9191

9292
"""Run plugin"""
9393
cli = insightconnect_plugin_runtime.CLI(ICONAzureSentinel())

0 commit comments

Comments
 (0)