From 3a0e77912f9ceee88986d8a2da32996240b3a1f8 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 28 Feb 2022 16:02:03 -0600 Subject: [PATCH 1/2] Update container_merge --- playbooks/custom_functions/container_merge.json | 6 +++--- playbooks/custom_functions/container_merge.py | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/playbooks/custom_functions/container_merge.json b/playbooks/custom_functions/container_merge.json index 9ea4df87bc..c6ac131e42 100644 --- a/playbooks/custom_functions/container_merge.json +++ b/playbooks/custom_functions/container_merge.json @@ -1,6 +1,6 @@ { - "create_time": "2021-10-18T12:31:32.500833+00:00", - "custom_function_id": "83776ecf4dd52c71d8497cb500dd332780eb9c72", + "create_time": "2022-02-25T14:52:47.172543+00:00", + "custom_function_id": "1f8ae8e7978b750272fbbaba5efe4e6127a9a6a7", "description": "An alternative to the add-to-case API call. This function will copy all artifacts, automation, notes and comments over from every container within the container_list into the target_container. The target_container will be upgraded to a case.\n\nThe notes will be copied over with references to the child containers from where they came. A note will be left in the child containers with a link to the target container. The child containers will be marked as evidence within the target container. \n\nAny notes left as a consequence of the merge process will be skipped in subsequent merges.", "draft_mode": false, "inputs": [ @@ -36,6 +36,6 @@ } ], "outputs": [], - "platform_version": "5.0.1.66250", + "platform_version": "5.2.1.78411", "python_version": "3" } \ No newline at end of file diff --git a/playbooks/custom_functions/container_merge.py b/playbooks/custom_functions/container_merge.py index c301bbb310..49cbcce3bf 100644 --- a/playbooks/custom_functions/container_merge.py +++ b/playbooks/custom_functions/container_merge.py @@ -162,7 +162,7 @@ def container_merge(target_container=None, container_list=None, workbook=None, c # Fetch any previous merge note params = {'_filter_container': '"{}"'.format(container['id']), '_filter_title': '"[Auto-Generated] Child Containers"'} note_url = phantom.build_phantom_rest_url('note') - response_data = phantom.requests.get(note_url, verify=False).json() + response_data = phantom.requests.get(note_url, params=params, verify=False).json() # If an old note was found, proceed to overwrite it if response_data['count'] > 0: note_item = response_data['data'][0] From 0d0076a686c022349f495b462d6589a65c2b2ac5 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 28 Feb 2022 16:02:33 -0600 Subject: [PATCH 2/2] Update find_related_containers --- .../custom_functions/find_related_containers.json | 6 +++--- .../custom_functions/find_related_containers.py | 12 +++--------- 2 files changed, 6 insertions(+), 12 deletions(-) diff --git a/playbooks/custom_functions/find_related_containers.json b/playbooks/custom_functions/find_related_containers.json index 1ae234becf..30aeb111f7 100644 --- a/playbooks/custom_functions/find_related_containers.json +++ b/playbooks/custom_functions/find_related_containers.json @@ -1,6 +1,6 @@ { - "create_time": "2021-10-07T15:52:23.940165+00:00", - "custom_function_id": "24c4ef5ecd259674a07cd3c747f4223f09b5dd8f", + "create_time": "2022-02-10T18:24:50.244936+00:00", + "custom_function_id": "5781e3d5a4773b2c48afd429768fd81b5e733e54", "description": "Takes a provided list of indicator values to search for and finds all related containers. It will produce a list of the related container details.", "draft_mode": false, "inputs": [ @@ -113,6 +113,6 @@ "description": "Link to container" } ], - "platform_version": "5.0.1.66250", + "platform_version": "5.2.1.78411", "python_version": "3" } \ No newline at end of file diff --git a/playbooks/custom_functions/find_related_containers.py b/playbooks/custom_functions/find_related_containers.py index 749842d4dd..4fd6bea923 100644 --- a/playbooks/custom_functions/find_related_containers.py +++ b/playbooks/custom_functions/find_related_containers.py @@ -96,7 +96,7 @@ def find_related_containers(value_list=None, minimum_match_count=None, container filter_in_case = True # If value list is equal to * then proceed to grab all indicator records for the current container - if isinstance(value_list, list) and value_list[0] == "*": + if value_list and (isinstance(value_list, list) and "*" in value_list) or (isinstance(value_list, str) and value_list == "*"): new_value_list = [] url = phantom.build_phantom_rest_url('container', current_container, 'artifacts') + '?page_size=0' response_data = phantom.requests.get(uri=url, verify=False).json().get('data') @@ -127,15 +127,10 @@ def find_related_containers(value_list=None, minimum_match_count=None, container for indicator_id in list(set(indicator_id_list)): params = {'indicator_ids': indicator_id} response_data = phantom.requests.get(indicator_common_container_url, params=params, verify=False).json() + # Populate an indicator dictionary where the original ids are the dictionary keys and the # associated continers are the values if response_data: - # Quit early if no related containers were found - if len(response_data) == 1 and response_data[0].get('container_id') == current_container: - phantom.debug(f"No related containers found for provided values: '{value_list}'") - assert json.dumps(outputs) # Will raise an exception if the :outputs: object is not JSON-serializable - return outputs - indicator_id_dictionary[str(indicator_id)] = [] for item in response_data: # Append all related containers except for current container @@ -167,8 +162,7 @@ def find_related_containers(value_list=None, minimum_match_count=None, container # Gather container data params = {'page_size': 0} - if offset_time: - params['_filter__create_time__gt'] = f'"{format_offset_time(time_in_seconds)}"' + params['_filter__create_time__gt'] = f'"{format_offset_time(time_in_seconds)}"' containers_response = phantom.requests.get(uri=container_url, params=params, verify=False).json() all_container_dictionary = {} if containers_response['count'] > 0: