Skip to content

Commit 7dba8e8

Browse files
content-botRadargogerkamalq97
authored
Related Findings Update Content Addition in SOCRadarIncidentsV4 (demisto#43459)
* Related Findings Update Content Addition in SOCRadarIncidentsV4 (demisto#43235) * Change risk score scale from 1000 to 100 It is very important to new joiner * Related Findings Update Content Addition * Increase alarm text limit from 1024 to 2048 characters * Increase alarm_text length limit to 2048 characters * Update SOCRADAR API endpoint to production URL * fixed buil test warnings * pre-commit issues * fix: replace cached_alarms with last_alarm_ids in both integrations * testcase updated * fix: remove emoji assertions from V4 test_fetch tests * fix: add capfd.disabled() to stdout-producing tests in V4 * fix: README newlines, ruff auto-fixes, and coverage tests * fix: README newlines, ruff auto-fixes, and coverage tests * fix: fix test assertions and apply ruff auto-fixes * fix: apply ruff auto-fixes inline * style: apply ruff format fixes * fix: correct test assertions and ruff blank lines * style: fix remaining ruff blank line issues in MultiTenant * Add update_related_finding_status and email parameters Added parameters to specify update behavior and owner email. * Add update_related_finding_status and email parameters Added parameters for updating related finding status and email. * Change 'Show Content' default value to False * Update README.md * Increase last_alarm_ids limit from 1000 to 10000 * Rename function argToBoolean to argToBool * Change API Key type from 4 to 9 in YAML config * Change default value of show_content to true * Fix indentation for predefined options in YAML * Rename function argToBoolean to argToBool * Fix indentation in update_related_finding_status options * Change default value of show_content to true * Change API Key type from 4 to 9 * Change argToBool to argToBoolean for consistency * Change function name from argToBool to argToBoolean * Add 'SOCRadar' tag to pack metadata * Update tags and keywords in pack_metadata.json Removed the 'SOCRadar' tag and added it to keywords. * Change API Key type from 9 to 4 * Change API Key type from 9 to 4 * Update 2_2_2.md * Update 2_2_2.md --------- Co-authored-by: Radargoger <burak.goger@socradar.io> Co-authored-by: Kamal Qarain <45042524+kamalq97@users.noreply.github.com>
1 parent d4a18ab commit 7dba8e8

10 files changed

Lines changed: 1829 additions & 729 deletions

File tree

Packs/SOCRadar/Integrations/SOCRadarIncidentsV4/README.md

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ To obtain your API credentials:
100100
| **Max incidents per fetch** | No | 10000 | Maximum incidents per fetch cycle |
101101
| **First fetch time** | No | 3 days | Initial time range for first fetch |
102102
| **Fetch Interval (Minutes)** | No | 1 | Time window for subsequent fetches |
103+
| **Show Content** | No | False | Show Alarm Content Field |
103104

104105
### Filtering Options
105106

@@ -210,11 +211,16 @@ Change the status of one or more alarms.
210211
- `DUPLICATE`, `PROCESSED_INTERNALLY`, `MITIGATED`, `NOT_APPLICABLE`
211212
- `comments` (Optional): Status change comments
212213
- `company_id` (Optional): Override default company ID
214+
- `update_related_finding_status` (Optional, boolean): If set to true, also update related finding status.
215+
- `email` (Conditionally Required): Email of action owner. **Required if `update_related_finding_status` is true.**
216+
217+
**Relational Logic:**
218+
If you select `update_related_finding_status`, you must provide the `email` field.
213219

214220
**Example:**
215221

216222
```
217-
!socradar-change-alarm-status alarm_ids="81171696" status_reason="INVESTIGATING" comments="Under review"
223+
!socradar-change-alarm-status alarm_ids="81171696" status_reason="INVESTIGATING" comments="Under review" update_related_finding_status=true email="analyst@company.com"
218224
```
219225

220226
**From Incident Context:**
@@ -638,7 +644,3 @@ SOCRadar is a leading Extended Threat Intelligence (XTI) platform that helps org
638644
- Ensure supply chain security
639645

640646
Learn more: [www.socradar.io](https://www.socradar.io)
641-
642-
---
643-
644-
**Made with ❤️ by the SOCRadar Integration Team and XSOAR teams**

0 commit comments

Comments
 (0)