xsoar-cli 1.0.1__py3-none-any.whl → 1.0.3__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of xsoar-cli might be problematic. Click here for more details.
- xsoar_cli/__about__.py +1 -1
- xsoar_cli/case/commands.py +1 -0
- xsoar_cli/manifest/README.md +260 -14
- xsoar_cli/utilities.py +3 -3
- xsoar_cli-1.0.3.dist-info/METADATA +256 -0
- {xsoar_cli-1.0.1.dist-info → xsoar_cli-1.0.3.dist-info}/RECORD +9 -9
- xsoar_cli-1.0.1.dist-info/METADATA +0 -128
- {xsoar_cli-1.0.1.dist-info → xsoar_cli-1.0.3.dist-info}/WHEEL +0 -0
- {xsoar_cli-1.0.1.dist-info → xsoar_cli-1.0.3.dist-info}/entry_points.txt +0 -0
- {xsoar_cli-1.0.1.dist-info → xsoar_cli-1.0.3.dist-info}/licenses/LICENSE.txt +0 -0
xsoar_cli/__about__.py
CHANGED
xsoar_cli/case/commands.py
CHANGED
|
@@ -66,6 +66,7 @@ def clone(ctx: click.Context, casenumber: int, source: str, dest: str) -> None:
|
|
|
66
66
|
@click.option("--casetype", default="", show_default=True, help="Create case of specified type. Default type set in config file.")
|
|
67
67
|
@click.argument("details", type=str, default="Placeholder case details")
|
|
68
68
|
@click.argument("name", type=str, default="Test case created from xsoar-cli")
|
|
69
|
+
@click.command()
|
|
69
70
|
@click.pass_context
|
|
70
71
|
@load_config
|
|
71
72
|
def create(ctx: click.Context, environment: str, casetype: str, name: str, details: str) -> None:
|
xsoar_cli/manifest/README.md
CHANGED
|
@@ -1,23 +1,269 @@
|
|
|
1
|
-
# Manifest
|
|
1
|
+
# Manifest Commands
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
3
|
+
The manifest commands help you manage XSOAR content pack deployments using a declarative configuration file (`xsoar_config.json`). This file defines which content packs should be installed on your XSOAR server and their specific versions.
|
|
4
|
+
|
|
5
|
+
## Prerequisites
|
|
6
|
+
|
|
7
|
+
- Valid XSOAR CLI configuration file (`~/.config/xsoar-cli/config.json`)
|
|
8
|
+
- Access to XSOAR server API
|
|
9
|
+
- For custom packs: AWS S3 credentials configured (AWS S3 is currently the only supported artifacts repository provider)
|
|
10
|
+
- Content repository with proper directory structure
|
|
11
|
+
|
|
12
|
+
## Manifest File Structure
|
|
13
|
+
|
|
14
|
+
The `xsoar_config.json` file contains two main sections:
|
|
15
|
+
|
|
16
|
+
```json
|
|
17
|
+
{
|
|
18
|
+
"custom_packs": [
|
|
19
|
+
{
|
|
20
|
+
"id": "MyCustomPack",
|
|
21
|
+
"version": "1.0.0",
|
|
22
|
+
"_comment": "Optional comment for documentation"
|
|
23
|
+
}
|
|
24
|
+
],
|
|
25
|
+
"marketplace_packs": [
|
|
26
|
+
{
|
|
27
|
+
"id": "CommonScripts",
|
|
28
|
+
"version": "1.20.0"
|
|
29
|
+
}
|
|
30
|
+
]
|
|
31
|
+
}
|
|
32
|
+
```
|
|
33
|
+
|
|
34
|
+
- **custom_packs**: Content packs developed by your organization, stored in AWS S3 (currently the only supported artifacts repository provider; pull requests for new providers are welcome!)
|
|
35
|
+
- **marketplace_packs**: Official Palo Alto Networks content packs from the marketplace
|
|
36
|
+
- **_comment**: Optional field for documentation/notes about specific pack versions
|
|
37
|
+
|
|
38
|
+
## Commands
|
|
39
|
+
|
|
40
|
+
### validate
|
|
41
|
+
Validates the manifest file and verifies all specified content packs are available.
|
|
42
|
+
|
|
43
|
+
**Usage:**
|
|
44
|
+
```bash
|
|
45
|
+
xsoar-cli manifest validate [OPTIONS] MANIFEST_PATH
|
|
46
|
+
```
|
|
47
|
+
|
|
48
|
+
**Options:**
|
|
49
|
+
- `--environment TEXT`: Environment name from config file (default: dev)
|
|
50
|
+
|
|
51
|
+
**Examples:**
|
|
52
|
+
```bash
|
|
53
|
+
# Validate manifest in current directory
|
|
54
|
+
xsoar-cli manifest validate ./xsoar_config.json
|
|
55
|
+
|
|
56
|
+
# Validate with specific environment
|
|
57
|
+
xsoar-cli manifest validate --environment prod ./xsoar_config.json
|
|
58
|
+
```
|
|
59
|
+
|
|
60
|
+
**What it checks:**
|
|
61
|
+
- JSON syntax validity
|
|
62
|
+
- Custom pack availability in S3 artifact repository
|
|
63
|
+
- Marketplace pack availability via HTTP connectivity
|
|
64
|
+
- Local pack metadata consistency for new packs in development
|
|
65
|
+
|
|
66
|
+
**Sample output:**
|
|
6
67
|
```
|
|
7
|
-
|
|
8
|
-
|
|
68
|
+
Manifest is valid JSON
|
|
69
|
+
Checking custom_packs availability ........................done.
|
|
70
|
+
Checking marketplace_packs availability ........................done.
|
|
71
|
+
Manifest is valid JSON and all packs are reachable.
|
|
9
72
|
```
|
|
10
73
|
|
|
11
|
-
|
|
12
|
-
|
|
74
|
+
### update
|
|
75
|
+
Compares installed packs against available versions and updates the manifest with latest versions.
|
|
76
|
+
|
|
77
|
+
**Usage:**
|
|
78
|
+
```bash
|
|
79
|
+
xsoar-cli manifest update [OPTIONS] MANIFEST_PATH
|
|
13
80
|
```
|
|
14
|
-
|
|
15
|
-
|
|
81
|
+
|
|
82
|
+
**Options:**
|
|
83
|
+
- `--environment TEXT`: Environment name from config file (default: dev)
|
|
84
|
+
|
|
85
|
+
**Examples:**
|
|
86
|
+
```bash
|
|
87
|
+
# Update manifest with latest versions
|
|
88
|
+
xsoar-cli manifest update ./xsoar_config.json
|
|
89
|
+
|
|
90
|
+
# Interactive prompts for each pack upgrade
|
|
91
|
+
xsoar-cli manifest update --environment staging ./xsoar_config.json
|
|
16
92
|
```
|
|
17
93
|
|
|
18
|
-
|
|
19
|
-
Queries
|
|
94
|
+
**Behavior:**
|
|
95
|
+
- Queries XSOAR server for outdated packs
|
|
96
|
+
- Displays upgrade candidates in tabular format
|
|
97
|
+
- Prompts for confirmation on each upgrade
|
|
98
|
+
- Preserves `_comment` fields but shows warnings
|
|
99
|
+
- Updates manifest file on disk
|
|
100
|
+
|
|
101
|
+
**Sample output:**
|
|
20
102
|
```
|
|
21
|
-
|
|
22
|
-
|
|
103
|
+
Fetching outdated packs from XSOAR server. This may take a minute...done.
|
|
104
|
+
Pack ID Installed version Latest available version
|
|
105
|
+
CommonScripts 1.19.0 1.20.0
|
|
106
|
+
Base 1.40.14 1.41.14
|
|
107
|
+
Total number of outdated content packs: 2
|
|
108
|
+
Upgrade CommonScripts from 1.19.0 to 1.20.0? [Y/n]: y
|
|
109
|
+
Upgrade Base from 1.40.14 to 1.41.14? [Y/n]: y
|
|
110
|
+
Written updated manifest to './xsoar_config.json'
|
|
23
111
|
```
|
|
112
|
+
|
|
113
|
+
### diff
|
|
114
|
+
Compares the manifest definition against what's actually installed on the XSOAR server.
|
|
115
|
+
|
|
116
|
+
**Usage:**
|
|
117
|
+
```bash
|
|
118
|
+
xsoar-cli manifest diff [OPTIONS] MANIFEST_PATH
|
|
119
|
+
```
|
|
120
|
+
|
|
121
|
+
**Options:**
|
|
122
|
+
- `--environment TEXT`: Environment name from config file (default: dev)
|
|
123
|
+
|
|
124
|
+
**Examples:**
|
|
125
|
+
```bash
|
|
126
|
+
# Show differences between manifest and server
|
|
127
|
+
xsoar-cli manifest diff ./xsoar_config.json
|
|
128
|
+
|
|
129
|
+
# Check production environment
|
|
130
|
+
xsoar-cli manifest diff --environment prod ./xsoar_config.json
|
|
131
|
+
```
|
|
132
|
+
|
|
133
|
+
**Output shows:**
|
|
134
|
+
- Packs defined in manifest but not installed
|
|
135
|
+
- Version mismatches between manifest and installed packs
|
|
136
|
+
- Summary message when everything is up to date
|
|
137
|
+
|
|
138
|
+
**Sample output:**
|
|
139
|
+
```
|
|
140
|
+
Pack MyCustomPack is not installed
|
|
141
|
+
Manifest states CommonScripts version 1.20.0 but version 1.19.0 is installed
|
|
142
|
+
```
|
|
143
|
+
|
|
144
|
+
### deploy
|
|
145
|
+
Installs or updates content packs on the XSOAR server according to the manifest.
|
|
146
|
+
|
|
147
|
+
**Usage:**
|
|
148
|
+
```bash
|
|
149
|
+
xsoar-cli manifest deploy [OPTIONS] MANIFEST_PATH
|
|
150
|
+
```
|
|
151
|
+
|
|
152
|
+
**Options:**
|
|
153
|
+
- `--environment TEXT`: Environment name from config file (default: dev)
|
|
154
|
+
- `--verbose`: Show detailed information about skipped packs
|
|
155
|
+
- `--yes`: Skip confirmation prompt
|
|
156
|
+
|
|
157
|
+
**Examples:**
|
|
158
|
+
```bash
|
|
159
|
+
# Deploy with confirmation prompt
|
|
160
|
+
xsoar-cli manifest deploy ./xsoar_config.json
|
|
161
|
+
|
|
162
|
+
# Deploy to production without prompts
|
|
163
|
+
xsoar-cli manifest deploy --environment prod --yes ./xsoar_config.json
|
|
164
|
+
|
|
165
|
+
# Deploy with verbose output
|
|
166
|
+
xsoar-cli manifest deploy --verbose ./xsoar_config.json
|
|
167
|
+
```
|
|
168
|
+
|
|
169
|
+
**Behavior:**
|
|
170
|
+
- Prompts for confirmation before deployment (unless --yes used)
|
|
171
|
+
- Only installs/updates packs that differ from current installation
|
|
172
|
+
- Shows progress for each pack installation
|
|
173
|
+
- Skips packs already at correct version
|
|
174
|
+
|
|
175
|
+
**Sample output:**
|
|
176
|
+
```
|
|
177
|
+
WARNING: this operation will attempt to deploy all packs defined in the manifest to XSOAR dev environment. Continue? [y/N]: y
|
|
178
|
+
Fetching installed packs...done.
|
|
179
|
+
Installing MyCustomPack version 1.0.0...OK.
|
|
180
|
+
Installing CommonScripts version 1.20.0...OK.
|
|
181
|
+
Not installing Base version 1.41.14. Already installed.
|
|
182
|
+
```
|
|
183
|
+
|
|
184
|
+
## Common Workflows
|
|
185
|
+
|
|
186
|
+
### Initial Setup
|
|
187
|
+
1. Create manifest: `xsoar-cli manifest validate ./xsoar_config.json` (validates structure)
|
|
188
|
+
2. Deploy: `xsoar-cli manifest deploy ./xsoar_config.json`
|
|
189
|
+
|
|
190
|
+
### Regular Updates
|
|
191
|
+
1. Check for updates: `xsoar-cli manifest update ./xsoar_config.json`
|
|
192
|
+
2. Review changes in manifest file
|
|
193
|
+
3. Deploy updates: `xsoar-cli manifest deploy ./xsoar_config.json`
|
|
194
|
+
|
|
195
|
+
### Environment Consistency
|
|
196
|
+
1. Check differences: `xsoar-cli manifest diff --environment prod ./xsoar_config.json`
|
|
197
|
+
2. Deploy if needed: `xsoar-cli manifest deploy --environment prod ./xsoar_config.json`
|
|
198
|
+
|
|
199
|
+
### CI/CD Pipeline Integration
|
|
200
|
+
```bash
|
|
201
|
+
# Typical CI/CD workflow
|
|
202
|
+
xsoar-cli manifest validate ./xsoar_config.json # Fail fast on invalid manifest
|
|
203
|
+
xsoar-cli manifest diff --environment dev ./xsoar_config.json # Show what will change
|
|
204
|
+
xsoar-cli manifest deploy --yes --environment dev ./xsoar_config.json # Deploy changes
|
|
205
|
+
```
|
|
206
|
+
|
|
207
|
+
## Troubleshooting
|
|
208
|
+
|
|
209
|
+
### Common Issues
|
|
210
|
+
|
|
211
|
+
**"Failed to decode JSON in {filepath}"**
|
|
212
|
+
- Check JSON syntax in manifest file
|
|
213
|
+
- Ensure no trailing commas or missing quotes
|
|
214
|
+
- Use a JSON validator to identify syntax errors
|
|
215
|
+
|
|
216
|
+
**"Failed to reach pack {pack_id} version {version}"**
|
|
217
|
+
- **For custom packs**: Check AWS S3 credentials and bucket access
|
|
218
|
+
- **For marketplace packs**: Verify internet connectivity to Palo Alto Networks CDN
|
|
219
|
+
- Ensure pack version exists in the artifact repository
|
|
220
|
+
- Check if pack is in development locally (may not be uploaded yet)
|
|
221
|
+
|
|
222
|
+
**"Pack {pack_id} not found in manifest"**
|
|
223
|
+
- Verify pack ID matches exactly (case-sensitive)
|
|
224
|
+
- Check that pack is in correct section (`custom_packs` vs `marketplace_packs`)
|
|
225
|
+
- Ensure pack ID in manifest matches the ID in pack metadata
|
|
226
|
+
|
|
227
|
+
**"Environment not found"**
|
|
228
|
+
- Check config file exists: `~/.config/xsoar-cli/config.json`
|
|
229
|
+
- Verify environment name matches configuration exactly
|
|
230
|
+
- Run `xsoar-cli config create` if configuration is missing
|
|
231
|
+
- Check server connectivity and API credentials
|
|
232
|
+
|
|
233
|
+
**"WARNING: comment found in manifest for {pack_id}: {comment}"**
|
|
234
|
+
- This is informational only - comments are preserved during updates
|
|
235
|
+
- Review the comment to understand why the version was pinned
|
|
236
|
+
- Decide whether to accept or decline the upgrade based on the comment
|
|
237
|
+
|
|
238
|
+
### Performance Considerations
|
|
239
|
+
|
|
240
|
+
- **Large manifests**: Commands may take several minutes with 100+ packs
|
|
241
|
+
- **Network timeouts**: Custom pack validation requires S3 connectivity
|
|
242
|
+
- **Rate limiting**: XSOAR API calls are rate-limited; large deployments may be slower
|
|
243
|
+
|
|
244
|
+
### Best Practices
|
|
245
|
+
|
|
246
|
+
1. **Version Control**: Keep `xsoar_config.json` in version control
|
|
247
|
+
2. **Comments**: Use `_comment` field to document version pin reasons
|
|
248
|
+
3. **Testing**: Always validate before deploying to production
|
|
249
|
+
4. **Environment Separation**: Consider different manifests for dev/staging/prod
|
|
250
|
+
5. **Backup**: Run `diff` before `deploy` to understand changes
|
|
251
|
+
6. **Incremental Updates**: Update and deploy frequently rather than large batch updates
|
|
252
|
+
7. **Monitoring**: Check deployment results and verify pack functionality after updates
|
|
253
|
+
|
|
254
|
+
### Development Workflow
|
|
255
|
+
|
|
256
|
+
When developing new custom packs:
|
|
257
|
+
|
|
258
|
+
1. Add pack to manifest with new version
|
|
259
|
+
2. Run `xsoar-cli manifest validate` - may show pack not available (expected)
|
|
260
|
+
3. The validation will pass if local pack metadata matches manifest version
|
|
261
|
+
4. Deploy pack artifacts to S3 repository
|
|
262
|
+
5. Run `xsoar-cli manifest deploy` to install on XSOAR server
|
|
263
|
+
|
|
264
|
+
### Security Notes
|
|
265
|
+
|
|
266
|
+
- AWS credentials should be configured securely (IAM roles, not hardcoded keys)
|
|
267
|
+
- XSOAR API keys should be stored in the configuration file with appropriate permissions
|
|
268
|
+
- Consider using different credentials for different environments
|
|
269
|
+
- Review pack sources and content before deploying to production systems
|
xsoar_cli/utilities.py
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import json
|
|
2
|
+
from collections.abc import Callable
|
|
2
3
|
from functools import update_wrapper
|
|
3
4
|
from pathlib import Path
|
|
4
|
-
from typing import Callable
|
|
5
5
|
|
|
6
6
|
import click
|
|
7
7
|
from xsoar_client.xsoar_client import Client
|
|
@@ -90,6 +90,6 @@ def parse_config(config: dict, ctx: click.Context) -> None:
|
|
|
90
90
|
custom_pack_authors=config["custom_pack_authors"],
|
|
91
91
|
xsiam_auth_id=config["server_config"][key].get("xsiam_auth_id", ""),
|
|
92
92
|
server_version=config["server_config"][key]["server_version"],
|
|
93
|
-
artifacts_location=config["server_config"][key]
|
|
94
|
-
s3_bucket_name=config["server_config"][key]
|
|
93
|
+
artifacts_location=config["server_config"][key].get("artifacts_location", None),
|
|
94
|
+
s3_bucket_name=config["server_config"][key].get("s3_bucket_name", None),
|
|
95
95
|
)
|
|
@@ -0,0 +1,256 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: xsoar-cli
|
|
3
|
+
Version: 1.0.3
|
|
4
|
+
Project-URL: Documentation, https://github.com/tlium/xsoar-cli#readme
|
|
5
|
+
Project-URL: Issues, https://github.com/tlium/xsoar-cli/issues
|
|
6
|
+
Project-URL: Source, https://github.com/tlium/xsoar-cli
|
|
7
|
+
Author-email: Torbjørn Lium <torben@lium.org>
|
|
8
|
+
License-Expression: MIT
|
|
9
|
+
License-File: LICENSE.txt
|
|
10
|
+
Classifier: Development Status :: 4 - Beta
|
|
11
|
+
Classifier: Programming Language :: Python
|
|
12
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
13
|
+
Classifier: Programming Language :: Python :: Implementation :: CPython
|
|
14
|
+
Classifier: Programming Language :: Python :: Implementation :: PyPy
|
|
15
|
+
Requires-Python: >=3.12
|
|
16
|
+
Requires-Dist: click==8.1.8
|
|
17
|
+
Requires-Dist: pyyaml>=6.0.2
|
|
18
|
+
Requires-Dist: xsoar-client>=1.0.0
|
|
19
|
+
Requires-Dist: xsoar-dependency-graph>=0.0.3
|
|
20
|
+
Description-Content-Type: text/markdown
|
|
21
|
+
|
|
22
|
+
# xsoar-cli
|
|
23
|
+
|
|
24
|
+
[](https://badge.fury.io/py/xsoar-cli) [](https://pypi.org/project/xsoar-cli/) [](https://github.com/psf/black) [](https://opensource.org/licenses/MIT)
|
|
25
|
+
|
|
26
|
+
A command-line interface for managing Palo Alto Networks XSOAR (Cortex XSOAR) that streamlines content development and deployment workflows.
|
|
27
|
+
|
|
28
|
+
**Key Features:**
|
|
29
|
+
- **Content Management**: Validate and deploy content packs with declarative manifests
|
|
30
|
+
- **Case Operations**: Retrieve case details and clone cases between environments
|
|
31
|
+
- **Playbook Development**: Download playbooks for local editing and testing
|
|
32
|
+
- **Dependency Analysis**: Generate visual graphs of content pack dependencies
|
|
33
|
+
- **Plugin System**: Extend functionality with custom commands
|
|
34
|
+
|
|
35
|
+
Perfect for DevOps teams using CI/CD pipelines to manage XSOAR content stored in [content repositories](https://github.com/demisto/content-ci-cd-template).
|
|
36
|
+
|
|
37
|
+
Pull Requests are very welcome and appreciated! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
|
|
38
|
+
|
|
39
|
+
## Quick Start
|
|
40
|
+
|
|
41
|
+
```bash
|
|
42
|
+
# Install
|
|
43
|
+
pip install xsoar-cli
|
|
44
|
+
|
|
45
|
+
# Create configuration file
|
|
46
|
+
xsoar-cli config create
|
|
47
|
+
|
|
48
|
+
# Validate and deploy your content
|
|
49
|
+
xsoar-cli manifest validate ./xsoar_config.json
|
|
50
|
+
xsoar-cli manifest deploy ./xsoar_config.json
|
|
51
|
+
|
|
52
|
+
# Get help on available commands
|
|
53
|
+
xsoar-cli --help
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
## Important Notes
|
|
57
|
+
|
|
58
|
+
This CLI tool is made to be run from the root of a content repository. Some commands depend on files located in your content repository or expects a certain directory structure to be available from your currently working directory.
|
|
59
|
+
|
|
60
|
+
## Requirements
|
|
61
|
+
|
|
62
|
+
### Core Requirements
|
|
63
|
+
- XSOAR servers version 6 or 8
|
|
64
|
+
- Python 3.9+ (only tested with Python 3.12, earlier versions may work but are not guaranteed)
|
|
65
|
+
|
|
66
|
+
### Additional Requirements (depending on usage)
|
|
67
|
+
- **AWS SDK for Python (Boto3)** - Only required when working with custom content packs stored in S3. You can use marketplace packs and other functionality without AWS setup.
|
|
68
|
+
|
|
69
|
+
**Note:** AWS S3 is currently the only available artifacts repository provider for custom packs. Pull requests for new providers are welcome!
|
|
70
|
+
|
|
71
|
+
## Installation
|
|
72
|
+
|
|
73
|
+
```bash
|
|
74
|
+
pip install xsoar-cli
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
## Upgrading
|
|
78
|
+
|
|
79
|
+
```bash
|
|
80
|
+
pip install --upgrade xsoar-cli
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
## Uninstalling
|
|
84
|
+
|
|
85
|
+
```bash
|
|
86
|
+
pip uninstall xsoar-cli
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
## Configuration
|
|
90
|
+
|
|
91
|
+
The xsoar-cli config file is located in `~/.config/xsoar-cli/config.json`. To create a configuration file from template, please run:
|
|
92
|
+
|
|
93
|
+
```bash
|
|
94
|
+
xsoar-cli config create
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
### Configuration File Structure
|
|
98
|
+
|
|
99
|
+
After creating the config file, edit it with your XSOAR server details:
|
|
100
|
+
|
|
101
|
+
```json
|
|
102
|
+
{
|
|
103
|
+
"default_environment": "xsoar6",
|
|
104
|
+
"default_new_case_type": "",
|
|
105
|
+
"custom_pack_authors": ["SOMEONE"],
|
|
106
|
+
"server_config": {
|
|
107
|
+
"xsoar6": {
|
|
108
|
+
"base_url": "https://xsoar-v6.example.com",
|
|
109
|
+
"api_token": "YOUR API TOKEN HERE",
|
|
110
|
+
"artifacts_location": "S3",
|
|
111
|
+
"s3_bucket_name": "xsoar-cicd",
|
|
112
|
+
"verify_ssl": "/path/to/your/CA_bundle.pem",
|
|
113
|
+
"server_version": 6
|
|
114
|
+
},
|
|
115
|
+
"xsoar8": {
|
|
116
|
+
"base_url": "https://xsoar-v8.example.com",
|
|
117
|
+
"api_token": "YOUR API TOKEN HERE",
|
|
118
|
+
"artifacts_location": "S3",
|
|
119
|
+
"s3_bucket_name": "xsoar-cicd-prod",
|
|
120
|
+
"verify_ssl": false,
|
|
121
|
+
"server_version": 8,
|
|
122
|
+
"xsiam_auth_id": 123
|
|
123
|
+
}
|
|
124
|
+
}
|
|
125
|
+
}
|
|
126
|
+
```
|
|
127
|
+
|
|
128
|
+
### Configuration Options
|
|
129
|
+
|
|
130
|
+
- **default_environment**: Which environment to use by default (e.g., "xsoar6")
|
|
131
|
+
- **default_new_case_type**: Default case type when creating new cases
|
|
132
|
+
- **custom_pack_authors**: List of author names used in your custom content packs. This helps xsoar-cli distinguish between your custom packs and marketplace packs. Use the same values you have in `pack_metadata.json` files.
|
|
133
|
+
|
|
134
|
+
- **server_config**: Define multiple XSOAR environments (xsoar6, xsoar8, etc.)
|
|
135
|
+
- **base_url**: Your XSOAR server URL
|
|
136
|
+
- **api_token**: API token for authentication (see XSOAR documentation for creating API keys)
|
|
137
|
+
- **artifacts_location**: Where artifacts are stored (currently only "S3" is supported)
|
|
138
|
+
- **s3_bucket_name**: S3 bucket where your custom content packs are stored
|
|
139
|
+
- **verify_ssl**: SSL certificate verification - use `false` for self-signed certificates, or path to CA bundle
|
|
140
|
+
- **server_version**: XSOAR server version (6 or 8)
|
|
141
|
+
- **xsiam_auth_id**: Required for XSOAR 8 (XSIAM) - the authentication ID for API access
|
|
142
|
+
|
|
143
|
+
### Validation
|
|
144
|
+
|
|
145
|
+
Test your configuration with:
|
|
146
|
+
|
|
147
|
+
```bash
|
|
148
|
+
xsoar-cli config validate
|
|
149
|
+
```
|
|
150
|
+
|
|
151
|
+
This will verify connectivity to all configured XSOAR environments.
|
|
152
|
+
|
|
153
|
+
## Usage
|
|
154
|
+
|
|
155
|
+
```bash
|
|
156
|
+
xsoar-cli <command> <sub-command> <args>
|
|
157
|
+
```
|
|
158
|
+
|
|
159
|
+
For information about available commands, run `xsoar-cli` without arguments.
|
|
160
|
+
|
|
161
|
+
For more information on a specific command execute `xsoar-cli <command> --help`.
|
|
162
|
+
|
|
163
|
+
### Commands
|
|
164
|
+
|
|
165
|
+
- **[case](src/xsoar_cli/case/README.md)** - Retrieve case details and clone cases between environments
|
|
166
|
+
- **[config](src/xsoar_cli/config/README.md)** - Create, validate, and manage CLI configuration files
|
|
167
|
+
- **[graph](src/xsoar_cli/graph/README.md)** - Generate visual dependency graphs for content packs
|
|
168
|
+
- **[manifest](src/xsoar_cli/manifest/README.md)** - Validate and deploy content using declarative manifests
|
|
169
|
+
- **[pack](src/xsoar_cli/pack/README.md)** - Manage content pack operations and information
|
|
170
|
+
- **[playbook](src/xsoar_cli/playbook/README.md)** - Download playbooks for local editing and development
|
|
171
|
+
- **[plugins](src/xsoar_cli/plugins/README.md)** - Extend CLI functionality with custom commands
|
|
172
|
+
|
|
173
|
+
## Plugin System
|
|
174
|
+
|
|
175
|
+
xsoar-cli supports a plugin system that allows you to extend the CLI with custom commands. Plugins are Python files that you place in `~/.local/xsoar-cli/plugins/` and they're automatically discovered and loaded.
|
|
176
|
+
|
|
177
|
+
### Quick Start with Plugins
|
|
178
|
+
|
|
179
|
+
1. **Create an example plugin**:
|
|
180
|
+
```bash
|
|
181
|
+
xsoar-cli plugins create-example
|
|
182
|
+
```
|
|
183
|
+
|
|
184
|
+
2. **List available plugins**:
|
|
185
|
+
```bash
|
|
186
|
+
xsoar-cli plugins list
|
|
187
|
+
```
|
|
188
|
+
|
|
189
|
+
3. **Test the example plugin**:
|
|
190
|
+
```bash
|
|
191
|
+
xsoar-cli example hello --name "World"
|
|
192
|
+
```
|
|
193
|
+
|
|
194
|
+
### Plugin Management Commands
|
|
195
|
+
|
|
196
|
+
- `xsoar-cli plugins list` - List all plugins
|
|
197
|
+
- `xsoar-cli plugins info <plugin>` - Show plugin information
|
|
198
|
+
- `xsoar-cli plugins validate` - Validate all plugins
|
|
199
|
+
- `xsoar-cli plugins reload <plugin>` - Reload a specific plugin
|
|
200
|
+
- `xsoar-cli plugins create-example` - Create an example plugin
|
|
201
|
+
- `xsoar-cli plugins open` - Open the plugins directory
|
|
202
|
+
|
|
203
|
+
### Creating Your Own Plugins
|
|
204
|
+
|
|
205
|
+
Create a Python file in `~/.local/xsoar-cli/plugins/` that inherits from `XSOARPlugin`:
|
|
206
|
+
|
|
207
|
+
```python
|
|
208
|
+
import click
|
|
209
|
+
from xsoar_cli.plugins import XSOARPlugin
|
|
210
|
+
|
|
211
|
+
class MyPlugin(XSOARPlugin):
|
|
212
|
+
@property
|
|
213
|
+
def name(self) -> str:
|
|
214
|
+
return "myplugin"
|
|
215
|
+
|
|
216
|
+
@property
|
|
217
|
+
def version(self) -> str:
|
|
218
|
+
return "1.0.0"
|
|
219
|
+
|
|
220
|
+
def get_command(self) -> click.Command:
|
|
221
|
+
@click.command(help="My custom command")
|
|
222
|
+
def mycommand():
|
|
223
|
+
click.echo("Hello from my plugin!")
|
|
224
|
+
return mycommand
|
|
225
|
+
```
|
|
226
|
+
|
|
227
|
+
For detailed documentation, see [Plugin System Documentation](src/xsoar_cli/plugins/README.md).
|
|
228
|
+
|
|
229
|
+
## Troubleshooting
|
|
230
|
+
|
|
231
|
+
### Common Issues
|
|
232
|
+
|
|
233
|
+
**"Config file not found"**
|
|
234
|
+
- Run `xsoar-cli config create` to generate a template configuration file
|
|
235
|
+
- Ensure the file exists at `~/.config/xsoar-cli/config.json`
|
|
236
|
+
|
|
237
|
+
**"Failed to reach pack" or connection errors**
|
|
238
|
+
- Verify your XSOAR server URL and API token in the config file
|
|
239
|
+
- Check network connectivity to your XSOAR server
|
|
240
|
+
- For custom packs: Ensure AWS credentials are configured and S3 bucket is accessible
|
|
241
|
+
|
|
242
|
+
**"Invalid environment"**
|
|
243
|
+
- Check that the environment name matches exactly what's defined in your config file
|
|
244
|
+
- Use `xsoar-cli config validate` to verify your configuration
|
|
245
|
+
|
|
246
|
+
**Python compatibility issues**
|
|
247
|
+
- Ensure you're using Python 3.9 or later
|
|
248
|
+
- Consider using Python 3.12 for best compatibility
|
|
249
|
+
|
|
250
|
+
## Contributing
|
|
251
|
+
|
|
252
|
+
We welcome all contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines on how to contribute to this project.
|
|
253
|
+
|
|
254
|
+
## License
|
|
255
|
+
|
|
256
|
+
`xsoar-cli` is distributed under the terms of the [MIT](https://spdx.org/licenses/MIT.html) license.
|
|
@@ -1,17 +1,17 @@
|
|
|
1
|
-
xsoar_cli/__about__.py,sha256=
|
|
1
|
+
xsoar_cli/__about__.py,sha256=Oc-4-rjAIQ778vlOrSIYWZiG60XDtE3d7y9Zg7hzGB8,127
|
|
2
2
|
xsoar_cli/__init__.py,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
|
|
3
3
|
xsoar_cli/cli.py,sha256=iAlSeZe2iR6ciTVrJYLt-CDZk7b5I-hzHFXbYoXhupA,1342
|
|
4
|
-
xsoar_cli/utilities.py,sha256=
|
|
4
|
+
xsoar_cli/utilities.py,sha256=1cIydI1WlKHKEXsKOcQGc8-SMedCBddOegwc8U6EaSc,3960
|
|
5
5
|
xsoar_cli/case/README.md,sha256=MTfgVeW3qJXRPNFo8CkZvulm2vwbN8sgiW86V-qXRFw,1342
|
|
6
6
|
xsoar_cli/case/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
7
|
-
xsoar_cli/case/commands.py,sha256=
|
|
7
|
+
xsoar_cli/case/commands.py,sha256=EWFld2BfLPgBhPJs5QqWsddlzrUvNIWmlKG4HwnpukU,3511
|
|
8
8
|
xsoar_cli/config/README.md,sha256=pcO858PDL9c0qtwj3_a6B8q2CGvcka3dwclVnwi2vlA,516
|
|
9
9
|
xsoar_cli/config/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
10
10
|
xsoar_cli/config/commands.py,sha256=SJqIBUBq4tHmnXusycXuIOkmHhyc-vKvQwFMjIHh3Cc,3884
|
|
11
11
|
xsoar_cli/graph/README.md,sha256=kyWIGs2Sd-OdqAaCWJjyvGpAhXhFcuqQwVqFBgzgWzk,861
|
|
12
12
|
xsoar_cli/graph/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
13
13
|
xsoar_cli/graph/commands.py,sha256=LKOpUu8r6KThJ5HdyjZlhpwLKRgMcEu7btBOQXwDkMs,1069
|
|
14
|
-
xsoar_cli/manifest/README.md,sha256=
|
|
14
|
+
xsoar_cli/manifest/README.md,sha256=0oiA6rZEAUQMOYM7VmtUBtW3PRo7-exfkjw5JLt_whU,9282
|
|
15
15
|
xsoar_cli/manifest/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
16
16
|
xsoar_cli/manifest/commands.py,sha256=jShmi0s7GOSXJt9DQbEoFSu4ZsC0Givv1vJj7qfwI2g,8697
|
|
17
17
|
xsoar_cli/pack/README.md,sha256=CA7jAEphHxK0gh58rLRKL-u3wx29QgNAXojd_tGBXnY,46
|
|
@@ -24,8 +24,8 @@ xsoar_cli/plugins/README.md,sha256=qQ_shzxcJcJKHuWfuN_cTVhtaew4BEGBEjn9wxaZG5c,1
|
|
|
24
24
|
xsoar_cli/plugins/__init__.py,sha256=81IZsMbZsqrLdB6TjA9t6s3yS8FkuihliBFX4xZUpTo,1753
|
|
25
25
|
xsoar_cli/plugins/commands.py,sha256=HC0sWu149uQG9Ztag4t2CNPKXTM4WJbEdLSvFMEjw80,10660
|
|
26
26
|
xsoar_cli/plugins/manager.py,sha256=7RPk3lAYDifGMLOU-hFOqyPxTVk8ibBVzBqH7R8wy4g,13012
|
|
27
|
-
xsoar_cli-1.0.
|
|
28
|
-
xsoar_cli-1.0.
|
|
29
|
-
xsoar_cli-1.0.
|
|
30
|
-
xsoar_cli-1.0.
|
|
31
|
-
xsoar_cli-1.0.
|
|
27
|
+
xsoar_cli-1.0.3.dist-info/METADATA,sha256=7tIWtehSw_xJenZ9PhazuKbQ3KzZAXV1cXGK0FMTRSY,9110
|
|
28
|
+
xsoar_cli-1.0.3.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
|
|
29
|
+
xsoar_cli-1.0.3.dist-info/entry_points.txt,sha256=s6Klu4QRekXsmZaBxMyFlE4Q-4_jIA9uijk4qIYUPvE,48
|
|
30
|
+
xsoar_cli-1.0.3.dist-info/licenses/LICENSE.txt,sha256=l6xnqWKshqwwTXt6ayO6MX8Uvygq0YnkUuFTNnR3ba4,1097
|
|
31
|
+
xsoar_cli-1.0.3.dist-info/RECORD,,
|
|
@@ -1,128 +0,0 @@
|
|
|
1
|
-
Metadata-Version: 2.4
|
|
2
|
-
Name: xsoar-cli
|
|
3
|
-
Version: 1.0.1
|
|
4
|
-
Project-URL: Documentation, https://github.com/tlium/xsoar-cli#readme
|
|
5
|
-
Project-URL: Issues, https://github.com/tliumb/xsoar-cli/issues
|
|
6
|
-
Project-URL: Source, https://github.com/tlium/xsoar-cli
|
|
7
|
-
Author-email: Torbjørn Lium <torben@lium.org>
|
|
8
|
-
License-Expression: MIT
|
|
9
|
-
License-File: LICENSE.txt
|
|
10
|
-
Classifier: Development Status :: 4 - Beta
|
|
11
|
-
Classifier: Programming Language :: Python
|
|
12
|
-
Classifier: Programming Language :: Python :: 3.8
|
|
13
|
-
Classifier: Programming Language :: Python :: 3.9
|
|
14
|
-
Classifier: Programming Language :: Python :: 3.10
|
|
15
|
-
Classifier: Programming Language :: Python :: 3.11
|
|
16
|
-
Classifier: Programming Language :: Python :: 3.12
|
|
17
|
-
Classifier: Programming Language :: Python :: Implementation :: CPython
|
|
18
|
-
Classifier: Programming Language :: Python :: Implementation :: PyPy
|
|
19
|
-
Requires-Python: >=3.8
|
|
20
|
-
Requires-Dist: click==8.1.8
|
|
21
|
-
Requires-Dist: pyyaml>=6.0.2
|
|
22
|
-
Requires-Dist: xsoar-client>=1.0.0
|
|
23
|
-
Requires-Dist: xsoar-dependency-graph>=0.0.3
|
|
24
|
-
Description-Content-Type: text/markdown
|
|
25
|
-
|
|
26
|
-
# xsoar-cli
|
|
27
|
-
-----
|
|
28
|
-
This tool is made to help provide a smoother workflow for developers, but also for power users to get useful information out of XSOAR from
|
|
29
|
-
the terminal. Merge requests are very welcome and appreciated!
|
|
30
|
-
|
|
31
|
-
*IMPORTANT NOTE* This CLI tools is made to be run from the root of a content repository. Some commands depends on files located in your
|
|
32
|
-
content repository or expects a certain directory structure to be available from your currently working directory.
|
|
33
|
-
|
|
34
|
-
## Installation
|
|
35
|
-
```
|
|
36
|
-
pip install xsoar-cli
|
|
37
|
-
```
|
|
38
|
-
## Upgrading
|
|
39
|
-
```
|
|
40
|
-
pip install --upgrade xsoar-cli
|
|
41
|
-
```
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
## Configuration
|
|
45
|
-
The xsoar-cli config file is located in `~/.config/xsoar-cli/config.json`. To create a configuration file from template, please run
|
|
46
|
-
```
|
|
47
|
-
xsoar-cli config create
|
|
48
|
-
```
|
|
49
|
-
Open up the newly created configuration file and add values that correspond with your environment.
|
|
50
|
-
*IMPORTANT NOTE*: the configuration key `"custom_pack_authors": ["SOMEONE"]` is needed in order for `xsoar-cli` to be able to
|
|
51
|
-
determine which content packs are your own custom content packs and which are supplied from Palo Alto upstream. Use whateve values you may have set in
|
|
52
|
-
pack_metadata.json in the content packs in your content repository.
|
|
53
|
-
|
|
54
|
-
## Usage
|
|
55
|
-
```
|
|
56
|
-
xsoar-cli <command> <sub-command> <args>
|
|
57
|
-
```
|
|
58
|
-
For information about available commands, run `xsoar-cli` without arguments.
|
|
59
|
-
|
|
60
|
-
For more information on a specific command execute `xsoar-cli <command> --help.`
|
|
61
|
-
|
|
62
|
-
### Commands
|
|
63
|
-
1. [case](src/xsoar_cli/case/README.md)
|
|
64
|
-
2. [config](src/xsoar_cli/config/README.md)
|
|
65
|
-
3. [manifest](src/xsoar_cli/manifest/README.md)
|
|
66
|
-
4. [pack](src/xsoar_cli/pack/README.md)
|
|
67
|
-
5. [playbook](src/xsoar_cli/playbook/README.md)
|
|
68
|
-
6. [plugins](src/xsoar_cli/plugins/README.md)
|
|
69
|
-
|
|
70
|
-
## Plugin System
|
|
71
|
-
|
|
72
|
-
xsoar-cli supports a plugin system that allows you to extend the CLI with custom commands. Plugins are Python files that you place in `~/.local/xsoar-cli/plugins/` and they're automatically discovered and loaded.
|
|
73
|
-
|
|
74
|
-
### Quick Start with Plugins
|
|
75
|
-
|
|
76
|
-
1. **Create an example plugin**:
|
|
77
|
-
```bash
|
|
78
|
-
xsoar-cli plugins create-example
|
|
79
|
-
```
|
|
80
|
-
|
|
81
|
-
2. **List available plugins**:
|
|
82
|
-
```bash
|
|
83
|
-
xsoar-cli plugins list
|
|
84
|
-
```
|
|
85
|
-
|
|
86
|
-
3. **Test the example plugin**:
|
|
87
|
-
```bash
|
|
88
|
-
xsoar-cli example hello --name "World"
|
|
89
|
-
```
|
|
90
|
-
|
|
91
|
-
### Plugin Management Commands
|
|
92
|
-
|
|
93
|
-
- `xsoar-cli plugins list` - List all plugins
|
|
94
|
-
- `xsoar-cli plugins info <plugin>` - Show plugin information
|
|
95
|
-
- `xsoar-cli plugins validate` - Validate all plugins
|
|
96
|
-
- `xsoar-cli plugins reload <plugin>` - Reload a specific plugin
|
|
97
|
-
- `xsoar-cli plugins create-example` - Create an example plugin
|
|
98
|
-
- `xsoar-cli plugins open` - Open the plugins directory
|
|
99
|
-
|
|
100
|
-
### Creating Your Own Plugins
|
|
101
|
-
|
|
102
|
-
Create a Python file in `~/.local/xsoar-cli/plugins/` that inherits from `XSOARPlugin`:
|
|
103
|
-
|
|
104
|
-
```python
|
|
105
|
-
import click
|
|
106
|
-
from xsoar_cli.plugins import XSOARPlugin
|
|
107
|
-
|
|
108
|
-
class MyPlugin(XSOARPlugin):
|
|
109
|
-
@property
|
|
110
|
-
def name(self) -> str:
|
|
111
|
-
return "myplugin"
|
|
112
|
-
|
|
113
|
-
@property
|
|
114
|
-
def version(self) -> str:
|
|
115
|
-
return "1.0.0"
|
|
116
|
-
|
|
117
|
-
def get_command(self) -> click.Command:
|
|
118
|
-
@click.command(help="My custom command")
|
|
119
|
-
def mycommand():
|
|
120
|
-
click.echo("Hello from my plugin!")
|
|
121
|
-
return mycommand
|
|
122
|
-
```
|
|
123
|
-
|
|
124
|
-
For detailed documentation, see [Plugin System Documentation](src/xsoar_cli/plugins/README.md).
|
|
125
|
-
|
|
126
|
-
## License
|
|
127
|
-
|
|
128
|
-
`xsoar-cli` is distributed under the terms of the [MIT](https://spdx.org/licenses/MIT.html) license.
|
|
File without changes
|
|
File without changes
|
|
File without changes
|