xsoar-cli 1.0.5__py3-none-any.whl → 1.0.6__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of xsoar-cli might be problematic. Click here for more details.
- xsoar_cli/__about__.py +1 -1
- xsoar_cli/case/README.md +43 -17
- xsoar_cli/case/commands.py +23 -2
- xsoar_cli/config/README.md +58 -6
- xsoar_cli/manifest/README.md +71 -218
- xsoar_cli/pack/README.md +31 -2
- xsoar_cli/playbook/README.md +38 -14
- xsoar_cli/utilities.py +1 -1
- {xsoar_cli-1.0.5.dist-info → xsoar_cli-1.0.6.dist-info}/METADATA +4 -4
- {xsoar_cli-1.0.5.dist-info → xsoar_cli-1.0.6.dist-info}/RECORD +13 -13
- {xsoar_cli-1.0.5.dist-info → xsoar_cli-1.0.6.dist-info}/WHEEL +0 -0
- {xsoar_cli-1.0.5.dist-info → xsoar_cli-1.0.6.dist-info}/entry_points.txt +0 -0
- {xsoar_cli-1.0.5.dist-info → xsoar_cli-1.0.6.dist-info}/licenses/LICENSE.txt +0 -0
xsoar_cli/__about__.py
CHANGED
xsoar_cli/case/README.md
CHANGED
|
@@ -1,31 +1,57 @@
|
|
|
1
1
|
# Case
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Various case/incident related commands for XSOAR.
|
|
4
4
|
|
|
5
|
-
##
|
|
6
|
-
|
|
7
|
-
|
|
5
|
+
## Get
|
|
6
|
+
|
|
7
|
+
Retrieve basic information about a single case. Returns raw JSON formatted with 4-space indentation.
|
|
8
|
+
|
|
9
|
+
**Syntax:** `xsoar-cli case get [OPTIONS] CASENUMBER`
|
|
10
|
+
|
|
11
|
+
**Options:**
|
|
12
|
+
- `--environment TEXT` - Target environment (default: uses default environment from config)
|
|
8
13
|
|
|
9
|
-
|
|
14
|
+
**Examples:**
|
|
10
15
|
```
|
|
11
|
-
xsoar-cli case
|
|
12
|
-
xsoar-cli case
|
|
16
|
+
xsoar-cli case get 312412
|
|
17
|
+
xsoar-cli case get --environment prod 312412
|
|
13
18
|
```
|
|
14
19
|
|
|
20
|
+
## Clone
|
|
21
|
+
|
|
22
|
+
Clone a case from one environment to another. Useful for copying production cases to development environment for testing.
|
|
15
23
|
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
24
|
+
**Syntax:** `xsoar-cli case clone [OPTIONS] CASENUMBER`
|
|
25
|
+
|
|
26
|
+
**Options:**
|
|
27
|
+
- `--source TEXT` - Source environment (default: prod)
|
|
28
|
+
- `--dest TEXT` - Destination environment (default: dev)
|
|
29
|
+
|
|
30
|
+
**Examples:**
|
|
20
31
|
```
|
|
21
|
-
xsoar-cli case
|
|
22
|
-
xsoar-cli case
|
|
32
|
+
xsoar-cli case clone 312412 # Clone from prod to dev (defaults)
|
|
33
|
+
xsoar-cli case clone --source dev --dest prod 312412 # Clone from dev to prod
|
|
23
34
|
```
|
|
24
35
|
|
|
36
|
+
## Create
|
|
25
37
|
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
38
|
+
Create a new case in XSOAR with optional custom fields and case type.
|
|
39
|
+
|
|
40
|
+
**Syntax:** `xsoar-cli case create [OPTIONS] [NAME] [DETAILS]`
|
|
41
|
+
|
|
42
|
+
**Options:**
|
|
43
|
+
- `--environment TEXT` - Target environment (default: uses default environment from config)
|
|
44
|
+
- `--casetype TEXT` - Case type (default: uses default case type from config)
|
|
45
|
+
- `--custom-fields TEXT` - Additional fields in format "field1=value1,field2=value2" (useful when XSOAR has mandatory custom case fields configured)
|
|
46
|
+
- `--custom-fields-delimiter TEXT` - Delimiter for custom fields (default: ",")
|
|
47
|
+
|
|
48
|
+
**Arguments:**
|
|
49
|
+
- `NAME` - Case title (default: "Test case created from xsoar-cli")
|
|
50
|
+
- `DETAILS` - Case description (default: "Placeholder case details")
|
|
51
|
+
|
|
52
|
+
**Examples:**
|
|
29
53
|
```
|
|
30
|
-
xsoar-cli case
|
|
54
|
+
xsoar-cli case create
|
|
55
|
+
xsoar-cli case create "Security Incident" "Suspicious network activity detected"
|
|
56
|
+
xsoar-cli case create --casetype "Phishing" --custom-fields "severity=High,source=Email" "Phishing Email" "Suspicious email received"
|
|
31
57
|
```
|
xsoar_cli/case/commands.py
CHANGED
|
@@ -33,15 +33,31 @@ def get(ctx: click.Context, casenumber: int, environment: str | None) -> None:
|
|
|
33
33
|
@click.argument("casenumber", type=int)
|
|
34
34
|
@click.option("--source", default="prod", show_default=True, help="Source environment")
|
|
35
35
|
@click.option("--dest", default="dev", show_default=True, help="Destination environment")
|
|
36
|
+
@click.option(
|
|
37
|
+
"--custom-fields",
|
|
38
|
+
default=None,
|
|
39
|
+
help='Additional fields on the form "myfield=my_value,anotherfield=another value". Use machine name for field names, e.g mycustomfieldname.',
|
|
40
|
+
)
|
|
41
|
+
@click.option("--custom-fields-delimiter", default=",", help='Delimiter when specifying additional fields. Default is ","')
|
|
36
42
|
@click.command()
|
|
37
43
|
@click.pass_context
|
|
38
44
|
@load_config
|
|
39
|
-
def clone(
|
|
45
|
+
def clone( # noqa: PLR0913
|
|
46
|
+
ctx: click.Context,
|
|
47
|
+
casenumber: int,
|
|
48
|
+
source: str,
|
|
49
|
+
dest: str,
|
|
50
|
+
custom_fields: str | None,
|
|
51
|
+
custom_fields_delimiter: str,
|
|
52
|
+
) -> None:
|
|
40
53
|
"""Clones a case from source to destination environment."""
|
|
41
54
|
valid_envs = validate_environments(source, dest, ctx=ctx)
|
|
42
55
|
if not valid_envs:
|
|
43
56
|
click.echo(f"Error: cannot find environments {source} and/or {dest} in config")
|
|
44
57
|
ctx.exit(1)
|
|
58
|
+
if custom_fields and "=" not in custom_fields:
|
|
59
|
+
click.echo('Malformed custom fields. Must be on the form "myfield=myvalue"')
|
|
60
|
+
ctx.exit(1)
|
|
45
61
|
xsoar_source_client: Client = ctx.obj["server_envs"][source]["xsoar_client"]
|
|
46
62
|
results = xsoar_source_client.get_case(casenumber)
|
|
47
63
|
data = results["data"][0]
|
|
@@ -58,6 +74,8 @@ def clone(ctx: click.Context, casenumber: int, source: str, dest: str) -> None:
|
|
|
58
74
|
data.pop("modified")
|
|
59
75
|
# Ensure that playbooks run immediately when the case is created
|
|
60
76
|
data["createInvestigation"] = True
|
|
77
|
+
if "CustomFields" in data:
|
|
78
|
+
data["CustomFields"] = data["CustomFields"] | parse_string_to_dict(custom_fields, custom_fields_delimiter)
|
|
61
79
|
|
|
62
80
|
xsoar_dest_client: Client = ctx.obj["server_envs"][dest]["xsoar_client"]
|
|
63
81
|
case_data = xsoar_dest_client.create_case(data=data)
|
|
@@ -83,10 +101,13 @@ def create( # noqa: PLR0913
|
|
|
83
101
|
casetype: str,
|
|
84
102
|
name: str,
|
|
85
103
|
custom_fields: str | None,
|
|
86
|
-
custom_fields_delimiter: str
|
|
104
|
+
custom_fields_delimiter: str,
|
|
87
105
|
details: str,
|
|
88
106
|
) -> None:
|
|
89
107
|
"""Creates a new case in XSOAR. If invalid case type is specified as a command option, XSOAR will default to using Unclassified."""
|
|
108
|
+
if custom_fields and "=" not in custom_fields:
|
|
109
|
+
click.echo('Malformed custom fields. Must be on the form "myfield=myvalue"')
|
|
110
|
+
ctx.exit(1)
|
|
90
111
|
if not environment:
|
|
91
112
|
environment = ctx.obj["default_environment"]
|
|
92
113
|
xsoar_client: Client = ctx.obj["server_envs"][environment]["xsoar_client"]
|
xsoar_cli/config/README.md
CHANGED
|
@@ -1,12 +1,64 @@
|
|
|
1
1
|
# Config
|
|
2
|
-
|
|
2
|
+
|
|
3
|
+
Configuration management commands for XSOAR CLI.
|
|
3
4
|
|
|
4
5
|
## Create
|
|
5
|
-
Creates a new configuration file in `~/.config/xsoar-cli/config.json` based on a template. If the file already exists, then the user is prompted to overwrite
|
|
6
|
-
the existing file.
|
|
7
6
|
|
|
8
|
-
|
|
9
|
-
|
|
7
|
+
Create a new configuration file based on a template. If the configuration file already exists, prompts for confirmation to overwrite.
|
|
8
|
+
|
|
9
|
+
**Syntax:** `xsoar-cli config create`
|
|
10
|
+
|
|
11
|
+
**Examples:**
|
|
12
|
+
```
|
|
13
|
+
xsoar-cli config create
|
|
14
|
+
```
|
|
15
|
+
|
|
16
|
+
## Show
|
|
17
|
+
|
|
18
|
+
Display the current configuration file contents as formatted JSON. API keys are masked by default for security.
|
|
19
|
+
|
|
20
|
+
**Syntax:** `xsoar-cli config show [OPTIONS]`
|
|
21
|
+
|
|
22
|
+
**Options:**
|
|
23
|
+
- `--unmask` - Show unmasked API keys in output
|
|
24
|
+
|
|
25
|
+
**Examples:**
|
|
26
|
+
```
|
|
27
|
+
xsoar-cli config show
|
|
28
|
+
xsoar-cli config show --unmask
|
|
29
|
+
```
|
|
10
30
|
|
|
11
31
|
## Validate
|
|
12
|
-
|
|
32
|
+
|
|
33
|
+
Validate that the configuration file is properly formatted JSON and test connectivity to each XSOAR environment defined in the configuration.
|
|
34
|
+
|
|
35
|
+
**Syntax:** `xsoar-cli config validate [OPTIONS]`
|
|
36
|
+
|
|
37
|
+
**Options:**
|
|
38
|
+
- `--only-test-environment TEXT` - Test connectivity for only the specified environment
|
|
39
|
+
|
|
40
|
+
**Examples:**
|
|
41
|
+
```
|
|
42
|
+
xsoar-cli config validate
|
|
43
|
+
xsoar-cli config validate --only-test-environment prod
|
|
44
|
+
```
|
|
45
|
+
|
|
46
|
+
## Set Credentials
|
|
47
|
+
|
|
48
|
+
Update API credentials for a specific environment in the configuration file. Automatically sets server version based on whether a key ID is provided.
|
|
49
|
+
|
|
50
|
+
**Syntax:** `xsoar-cli config set-credentials [OPTIONS] APITOKEN`
|
|
51
|
+
|
|
52
|
+
**Options:**
|
|
53
|
+
- `--environment TEXT` - Target environment (default: dev)
|
|
54
|
+
- `--key_id INTEGER` - API key ID for XSOAR 8 (sets server_version to 8, omit for XSOAR 6)
|
|
55
|
+
|
|
56
|
+
**Arguments:**
|
|
57
|
+
- `APITOKEN` - The API token to set for the environment
|
|
58
|
+
|
|
59
|
+
**Examples:**
|
|
60
|
+
```
|
|
61
|
+
xsoar-cli config set-credentials your-api-token-here
|
|
62
|
+
xsoar-cli config set-credentials --environment prod your-api-token-here
|
|
63
|
+
xsoar-cli config set-credentials --environment prod --key_id 123 your-api-token-here
|
|
64
|
+
```
|
xsoar_cli/manifest/README.md
CHANGED
|
@@ -1,269 +1,122 @@
|
|
|
1
|
-
# Manifest
|
|
1
|
+
# Manifest
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Content pack deployment management commands using a declarative configuration file (`xsoar_config.json`).
|
|
4
4
|
|
|
5
|
-
##
|
|
5
|
+
## Generate
|
|
6
6
|
|
|
7
|
-
|
|
8
|
-
- Access to XSOAR server API
|
|
9
|
-
- For custom packs: AWS S3 credentials configured (AWS S3 is currently the only supported artifacts repository provider)
|
|
10
|
-
- Content repository with proper directory structure
|
|
7
|
+
Generate a new manifest file from currently installed content packs. Assumes all packs are marketplace packs (no custom packs).
|
|
11
8
|
|
|
12
|
-
|
|
9
|
+
**Syntax:** `xsoar-cli manifest generate [OPTIONS] MANIFEST_PATH`
|
|
13
10
|
|
|
14
|
-
|
|
11
|
+
**Options:**
|
|
12
|
+
- `--environment TEXT` - Target environment (default: uses default environment from config)
|
|
15
13
|
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
"custom_packs": [
|
|
19
|
-
{
|
|
20
|
-
"id": "MyCustomPack",
|
|
21
|
-
"version": "1.0.0",
|
|
22
|
-
"_comment": "Optional comment for documentation"
|
|
23
|
-
}
|
|
24
|
-
],
|
|
25
|
-
"marketplace_packs": [
|
|
26
|
-
{
|
|
27
|
-
"id": "CommonScripts",
|
|
28
|
-
"version": "1.20.0"
|
|
29
|
-
}
|
|
30
|
-
]
|
|
31
|
-
}
|
|
32
|
-
```
|
|
14
|
+
**Arguments:**
|
|
15
|
+
- `MANIFEST_PATH` - Path where the new manifest file will be created
|
|
33
16
|
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
-
|
|
17
|
+
**Examples:**
|
|
18
|
+
```
|
|
19
|
+
xsoar-cli manifest generate ./xsoar_config.json
|
|
20
|
+
xsoar-cli manifest generate --environment prod ./xsoar_config.json
|
|
21
|
+
```
|
|
37
22
|
|
|
38
|
-
##
|
|
23
|
+
## Validate
|
|
39
24
|
|
|
40
|
-
|
|
41
|
-
Validates the manifest file and verifies all specified content packs are available.
|
|
25
|
+
Validate manifest JSON syntax and verify all specified content packs are available. Tests connectivity to pack sources and checks local pack metadata for development packs.
|
|
42
26
|
|
|
43
|
-
**
|
|
44
|
-
```bash
|
|
45
|
-
xsoar-cli manifest validate [OPTIONS] MANIFEST_PATH
|
|
46
|
-
```
|
|
27
|
+
**Syntax:** `xsoar-cli manifest validate [OPTIONS] MANIFEST_PATH`
|
|
47
28
|
|
|
48
29
|
**Options:**
|
|
49
|
-
- `--environment TEXT
|
|
30
|
+
- `--environment TEXT` - Target environment (default: uses default environment from config)
|
|
31
|
+
|
|
32
|
+
**Arguments:**
|
|
33
|
+
- `MANIFEST_PATH` - Path to the manifest file to validate
|
|
50
34
|
|
|
51
35
|
**Examples:**
|
|
52
|
-
```
|
|
53
|
-
# Validate manifest in current directory
|
|
36
|
+
```
|
|
54
37
|
xsoar-cli manifest validate ./xsoar_config.json
|
|
55
|
-
|
|
56
|
-
# Validate with specific environment
|
|
57
|
-
xsoar-cli manifest validate --environment prod ./xsoar_config.json
|
|
38
|
+
xsoar-cli manifest validate --environment staging ./xsoar_config.json
|
|
58
39
|
```
|
|
59
40
|
|
|
60
|
-
|
|
61
|
-
- JSON syntax validity
|
|
62
|
-
- Custom pack availability in S3 artifact repository
|
|
63
|
-
- Marketplace pack availability via HTTP connectivity
|
|
64
|
-
- Local pack metadata consistency for new packs in development
|
|
65
|
-
|
|
66
|
-
**Sample output:**
|
|
67
|
-
```
|
|
68
|
-
Manifest is valid JSON
|
|
69
|
-
Checking custom_packs availability ........................done.
|
|
70
|
-
Checking marketplace_packs availability ........................done.
|
|
71
|
-
Manifest is valid JSON and all packs are reachable.
|
|
72
|
-
```
|
|
41
|
+
## Update
|
|
73
42
|
|
|
74
|
-
|
|
75
|
-
Compares installed packs against available versions and updates the manifest with latest versions.
|
|
43
|
+
Compare installed packs against available versions and update the manifest file with latest versions. Prompts for confirmation on each upgrade.
|
|
76
44
|
|
|
77
|
-
**
|
|
78
|
-
```bash
|
|
79
|
-
xsoar-cli manifest update [OPTIONS] MANIFEST_PATH
|
|
80
|
-
```
|
|
45
|
+
**Syntax:** `xsoar-cli manifest update [OPTIONS] MANIFEST_PATH`
|
|
81
46
|
|
|
82
47
|
**Options:**
|
|
83
|
-
- `--environment TEXT
|
|
48
|
+
- `--environment TEXT` - Target environment (default: uses default environment from config)
|
|
49
|
+
|
|
50
|
+
**Arguments:**
|
|
51
|
+
- `MANIFEST_PATH` - Path to the manifest file to update
|
|
84
52
|
|
|
85
53
|
**Examples:**
|
|
86
|
-
```
|
|
87
|
-
# Update manifest with latest versions
|
|
54
|
+
```
|
|
88
55
|
xsoar-cli manifest update ./xsoar_config.json
|
|
89
|
-
|
|
90
|
-
# Interactive prompts for each pack upgrade
|
|
91
|
-
xsoar-cli manifest update --environment staging ./xsoar_config.json
|
|
56
|
+
xsoar-cli manifest update --environment dev ./xsoar_config.json
|
|
92
57
|
```
|
|
93
58
|
|
|
94
|
-
|
|
95
|
-
- Queries XSOAR server for outdated packs
|
|
96
|
-
- Displays upgrade candidates in tabular format
|
|
97
|
-
- Prompts for confirmation on each upgrade
|
|
98
|
-
- Preserves `_comment` fields but shows warnings
|
|
99
|
-
- Updates manifest file on disk
|
|
59
|
+
## Diff
|
|
100
60
|
|
|
101
|
-
|
|
102
|
-
```
|
|
103
|
-
Fetching outdated packs from XSOAR server. This may take a minute...done.
|
|
104
|
-
Pack ID Installed version Latest available version
|
|
105
|
-
CommonScripts 1.19.0 1.20.0
|
|
106
|
-
Base 1.40.14 1.41.14
|
|
107
|
-
Total number of outdated content packs: 2
|
|
108
|
-
Upgrade CommonScripts from 1.19.0 to 1.20.0? [Y/n]: y
|
|
109
|
-
Upgrade Base from 1.40.14 to 1.41.14? [Y/n]: y
|
|
110
|
-
Written updated manifest to './xsoar_config.json'
|
|
111
|
-
```
|
|
61
|
+
Compare the manifest definition against what is actually installed on the XSOAR server. Shows packs that are missing or have version mismatches.
|
|
112
62
|
|
|
113
|
-
|
|
114
|
-
Compares the manifest definition against what's actually installed on the XSOAR server.
|
|
115
|
-
|
|
116
|
-
**Usage:**
|
|
117
|
-
```bash
|
|
118
|
-
xsoar-cli manifest diff [OPTIONS] MANIFEST_PATH
|
|
119
|
-
```
|
|
63
|
+
**Syntax:** `xsoar-cli manifest diff [OPTIONS] MANIFEST_PATH`
|
|
120
64
|
|
|
121
65
|
**Options:**
|
|
122
|
-
- `--environment TEXT
|
|
66
|
+
- `--environment TEXT` - Target environment (default: uses default environment from config)
|
|
67
|
+
|
|
68
|
+
**Arguments:**
|
|
69
|
+
- `MANIFEST_PATH` - Path to the manifest file to compare
|
|
123
70
|
|
|
124
71
|
**Examples:**
|
|
125
|
-
```
|
|
126
|
-
# Show differences between manifest and server
|
|
72
|
+
```
|
|
127
73
|
xsoar-cli manifest diff ./xsoar_config.json
|
|
128
|
-
|
|
129
|
-
# Check production environment
|
|
130
74
|
xsoar-cli manifest diff --environment prod ./xsoar_config.json
|
|
131
75
|
```
|
|
132
76
|
|
|
133
|
-
|
|
134
|
-
- Packs defined in manifest but not installed
|
|
135
|
-
- Version mismatches between manifest and installed packs
|
|
136
|
-
- Summary message when everything is up to date
|
|
137
|
-
|
|
138
|
-
**Sample output:**
|
|
139
|
-
```
|
|
140
|
-
Pack MyCustomPack is not installed
|
|
141
|
-
Manifest states CommonScripts version 1.20.0 but version 1.19.0 is installed
|
|
142
|
-
```
|
|
77
|
+
## Deploy
|
|
143
78
|
|
|
144
|
-
|
|
145
|
-
Installs or updates content packs on the XSOAR server according to the manifest.
|
|
79
|
+
Install or update content packs on the XSOAR server according to the manifest. Only deploys packs that differ from current installation.
|
|
146
80
|
|
|
147
|
-
**
|
|
148
|
-
```bash
|
|
149
|
-
xsoar-cli manifest deploy [OPTIONS] MANIFEST_PATH
|
|
150
|
-
```
|
|
81
|
+
**Syntax:** `xsoar-cli manifest deploy [OPTIONS] MANIFEST_PATH`
|
|
151
82
|
|
|
152
83
|
**Options:**
|
|
153
|
-
- `--environment TEXT
|
|
154
|
-
- `--verbose
|
|
155
|
-
- `--yes
|
|
84
|
+
- `--environment TEXT` - Target environment (default: uses default environment from config)
|
|
85
|
+
- `--verbose` - Show detailed information about skipped packs
|
|
86
|
+
- `--yes` - Skip confirmation prompt
|
|
87
|
+
|
|
88
|
+
**Arguments:**
|
|
89
|
+
- `MANIFEST_PATH` - Path to the manifest file to deploy
|
|
156
90
|
|
|
157
91
|
**Examples:**
|
|
158
|
-
```
|
|
159
|
-
# Deploy with confirmation prompt
|
|
92
|
+
```
|
|
160
93
|
xsoar-cli manifest deploy ./xsoar_config.json
|
|
161
|
-
|
|
162
|
-
# Deploy to production without prompts
|
|
163
94
|
xsoar-cli manifest deploy --environment prod --yes ./xsoar_config.json
|
|
164
|
-
|
|
165
|
-
# Deploy with verbose output
|
|
166
95
|
xsoar-cli manifest deploy --verbose ./xsoar_config.json
|
|
167
96
|
```
|
|
168
97
|
|
|
169
|
-
|
|
170
|
-
- Prompts for confirmation before deployment (unless --yes used)
|
|
171
|
-
- Only installs/updates packs that differ from current installation
|
|
172
|
-
- Shows progress for each pack installation
|
|
173
|
-
- Skips packs already at correct version
|
|
174
|
-
|
|
175
|
-
**Sample output:**
|
|
176
|
-
```
|
|
177
|
-
WARNING: this operation will attempt to deploy all packs defined in the manifest to XSOAR dev environment. Continue? [y/N]: y
|
|
178
|
-
Fetching installed packs...done.
|
|
179
|
-
Installing MyCustomPack version 1.0.0...OK.
|
|
180
|
-
Installing CommonScripts version 1.20.0...OK.
|
|
181
|
-
Not installing Base version 1.41.14. Already installed.
|
|
182
|
-
```
|
|
183
|
-
|
|
184
|
-
## Common Workflows
|
|
185
|
-
|
|
186
|
-
### Initial Setup
|
|
187
|
-
1. Create manifest: `xsoar-cli manifest validate ./xsoar_config.json` (validates structure)
|
|
188
|
-
2. Deploy: `xsoar-cli manifest deploy ./xsoar_config.json`
|
|
189
|
-
|
|
190
|
-
### Regular Updates
|
|
191
|
-
1. Check for updates: `xsoar-cli manifest update ./xsoar_config.json`
|
|
192
|
-
2. Review changes in manifest file
|
|
193
|
-
3. Deploy updates: `xsoar-cli manifest deploy ./xsoar_config.json`
|
|
98
|
+
## Manifest File Structure
|
|
194
99
|
|
|
195
|
-
|
|
196
|
-
1. Check differences: `xsoar-cli manifest diff --environment prod ./xsoar_config.json`
|
|
197
|
-
2. Deploy if needed: `xsoar-cli manifest deploy --environment prod ./xsoar_config.json`
|
|
100
|
+
The `xsoar_config.json` file defines content packs to be installed:
|
|
198
101
|
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
102
|
+
```json
|
|
103
|
+
{
|
|
104
|
+
"custom_packs": [
|
|
105
|
+
{
|
|
106
|
+
"id": "MyCustomPack",
|
|
107
|
+
"version": "1.0.0",
|
|
108
|
+
"_comment": "Optional documentation comment"
|
|
109
|
+
}
|
|
110
|
+
],
|
|
111
|
+
"marketplace_packs": [
|
|
112
|
+
{
|
|
113
|
+
"id": "CommonScripts",
|
|
114
|
+
"version": "1.20.0"
|
|
115
|
+
}
|
|
116
|
+
]
|
|
117
|
+
}
|
|
205
118
|
```
|
|
206
119
|
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
**"Failed to decode JSON in {filepath}"**
|
|
212
|
-
- Check JSON syntax in manifest file
|
|
213
|
-
- Ensure no trailing commas or missing quotes
|
|
214
|
-
- Use a JSON validator to identify syntax errors
|
|
215
|
-
|
|
216
|
-
**"Failed to reach pack {pack_id} version {version}"**
|
|
217
|
-
- **For custom packs**: Check AWS S3 credentials and bucket access
|
|
218
|
-
- **For marketplace packs**: Verify internet connectivity to Palo Alto Networks CDN
|
|
219
|
-
- Ensure pack version exists in the artifact repository
|
|
220
|
-
- Check if pack is in development locally (may not be uploaded yet)
|
|
221
|
-
|
|
222
|
-
**"Pack {pack_id} not found in manifest"**
|
|
223
|
-
- Verify pack ID matches exactly (case-sensitive)
|
|
224
|
-
- Check that pack is in correct section (`custom_packs` vs `marketplace_packs`)
|
|
225
|
-
- Ensure pack ID in manifest matches the ID in pack metadata
|
|
226
|
-
|
|
227
|
-
**"Environment not found"**
|
|
228
|
-
- Check config file exists: `~/.config/xsoar-cli/config.json`
|
|
229
|
-
- Verify environment name matches configuration exactly
|
|
230
|
-
- Run `xsoar-cli config create` if configuration is missing
|
|
231
|
-
- Check server connectivity and API credentials
|
|
232
|
-
|
|
233
|
-
**"WARNING: comment found in manifest for {pack_id}: {comment}"**
|
|
234
|
-
- This is informational only - comments are preserved during updates
|
|
235
|
-
- Review the comment to understand why the version was pinned
|
|
236
|
-
- Decide whether to accept or decline the upgrade based on the comment
|
|
237
|
-
|
|
238
|
-
### Performance Considerations
|
|
239
|
-
|
|
240
|
-
- **Large manifests**: Commands may take several minutes with 100+ packs
|
|
241
|
-
- **Network timeouts**: Custom pack validation requires S3 connectivity
|
|
242
|
-
- **Rate limiting**: XSOAR API calls are rate-limited; large deployments may be slower
|
|
243
|
-
|
|
244
|
-
### Best Practices
|
|
245
|
-
|
|
246
|
-
1. **Version Control**: Keep `xsoar_config.json` in version control
|
|
247
|
-
2. **Comments**: Use `_comment` field to document version pin reasons
|
|
248
|
-
3. **Testing**: Always validate before deploying to production
|
|
249
|
-
4. **Environment Separation**: Consider different manifests for dev/staging/prod
|
|
250
|
-
5. **Backup**: Run `diff` before `deploy` to understand changes
|
|
251
|
-
6. **Incremental Updates**: Update and deploy frequently rather than large batch updates
|
|
252
|
-
7. **Monitoring**: Check deployment results and verify pack functionality after updates
|
|
253
|
-
|
|
254
|
-
### Development Workflow
|
|
255
|
-
|
|
256
|
-
When developing new custom packs:
|
|
257
|
-
|
|
258
|
-
1. Add pack to manifest with new version
|
|
259
|
-
2. Run `xsoar-cli manifest validate` - may show pack not available (expected)
|
|
260
|
-
3. The validation will pass if local pack metadata matches manifest version
|
|
261
|
-
4. Deploy pack artifacts to S3 repository
|
|
262
|
-
5. Run `xsoar-cli manifest deploy` to install on XSOAR server
|
|
263
|
-
|
|
264
|
-
### Security Notes
|
|
265
|
-
|
|
266
|
-
- AWS credentials should be configured securely (IAM roles, not hardcoded keys)
|
|
267
|
-
- XSOAR API keys should be stored in the configuration file with appropriate permissions
|
|
268
|
-
- Consider using different credentials for different environments
|
|
269
|
-
- Review pack sources and content before deploying to production systems
|
|
120
|
+
- **custom_packs**: Organization-developed packs stored in artifact repositories
|
|
121
|
+
- **marketplace_packs**: Official Palo Alto Networks content packs
|
|
122
|
+
- **_comment**: Optional field for documentation (preserved during updates)
|
xsoar_cli/pack/README.md
CHANGED
|
@@ -1,7 +1,36 @@
|
|
|
1
1
|
# Pack
|
|
2
2
|
|
|
3
|
+
Content pack management commands for XSOAR.
|
|
4
|
+
|
|
3
5
|
## Delete
|
|
4
6
|
|
|
5
|
-
|
|
7
|
+
Delete a content pack from the XSOAR server. Verifies the pack is installed before attempting deletion.
|
|
8
|
+
|
|
9
|
+
**Syntax:** `xsoar-cli pack delete [OPTIONS] PACK_ID`
|
|
10
|
+
|
|
11
|
+
**Options:**
|
|
12
|
+
- `--environment TEXT` - Target environment (default: uses default environment from config)
|
|
13
|
+
|
|
14
|
+
**Arguments:**
|
|
15
|
+
- `PACK_ID` - The ID of the content pack to delete
|
|
16
|
+
|
|
17
|
+
**Examples:**
|
|
18
|
+
```
|
|
19
|
+
xsoar-cli pack delete MyCustomPack
|
|
20
|
+
xsoar-cli pack delete --environment prod CommonScripts
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
## Get Outdated
|
|
24
|
+
|
|
25
|
+
Display a list of outdated content packs showing current and latest available versions in table format.
|
|
26
|
+
|
|
27
|
+
**Syntax:** `xsoar-cli pack get-outdated [OPTIONS]`
|
|
28
|
+
|
|
29
|
+
**Options:**
|
|
30
|
+
- `--environment TEXT` - Target environment (default: uses default environment from config)
|
|
6
31
|
|
|
7
|
-
|
|
32
|
+
**Examples:**
|
|
33
|
+
```
|
|
34
|
+
xsoar-cli pack get-outdated
|
|
35
|
+
xsoar-cli pack get-outdated --environment staging
|
|
36
|
+
```
|
xsoar_cli/playbook/README.md
CHANGED
|
@@ -1,19 +1,43 @@
|
|
|
1
1
|
# Playbook
|
|
2
2
|
|
|
3
|
+
Playbook management commands for XSOAR development workflows.
|
|
4
|
+
|
|
3
5
|
## Download
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
#### Example invocation:
|
|
6
|
+
|
|
7
|
+
Download a playbook from XSOAR, format it with demisto-sdk, and re-attach it to the server. Designed for content repository development workflows.
|
|
8
|
+
|
|
9
|
+
**Syntax:** `xsoar-cli playbook download [OPTIONS] NAME`
|
|
10
|
+
|
|
11
|
+
**Options:**
|
|
12
|
+
- `--environment TEXT` - Target environment (default: uses default environment from config)
|
|
13
|
+
|
|
14
|
+
**Arguments:**
|
|
15
|
+
- `NAME` - The name of the playbook to download
|
|
16
|
+
|
|
17
|
+
**Examples:**
|
|
17
18
|
```
|
|
18
|
-
xsoar-cli playbook download "
|
|
19
|
+
xsoar-cli playbook download "My Awesome Playbook"
|
|
20
|
+
xsoar-cli playbook download --environment dev "Security Investigation"
|
|
19
21
|
```
|
|
22
|
+
|
|
23
|
+
## Requirements
|
|
24
|
+
|
|
25
|
+
- Must be run from the root of a content repository with proper directory structure
|
|
26
|
+
- Target directory `Packs/<PackID>/Playbooks/` must exist
|
|
27
|
+
- `demisto-sdk` must be installed and available in PATH
|
|
28
|
+
|
|
29
|
+
## Behavior
|
|
30
|
+
|
|
31
|
+
1. Downloads the specified playbook from XSOAR
|
|
32
|
+
2. Detects the content pack ID from playbook metadata
|
|
33
|
+
3. Saves to `$(cwd)/Packs/<PackID>/Playbooks/<playbook_name>.yml`
|
|
34
|
+
4. Runs `demisto-sdk format --assume-yes --no-validate --no-graph` on the file
|
|
35
|
+
5. Re-attaches the formatted playbook to XSOAR
|
|
36
|
+
6. Replaces whitespace characters in filenames with underscores
|
|
37
|
+
|
|
38
|
+
## Limitations
|
|
39
|
+
|
|
40
|
+
- Only supports playbooks that are already part of a content pack
|
|
41
|
+
- Requires existing content repository directory structure
|
|
42
|
+
- Attempting to download non-existing playbooks results in server errors
|
|
43
|
+
- Does not support completely new playbooks (not yet implemented)
|
xsoar_cli/utilities.py
CHANGED
|
@@ -14,7 +14,7 @@ def parse_string_to_dict(input_string: str | None, delimiter: str) -> dict:
|
|
|
14
14
|
# Parse a string into a python dictionary
|
|
15
15
|
pairs = [pair.split("=", 1) for pair in input_string.split(delimiter)]
|
|
16
16
|
# Filter pairs that have exactly 2 parts (key and value) after splitting by "="
|
|
17
|
-
valid_pairs = [pair for pair in pairs if len(pair) == 2]
|
|
17
|
+
valid_pairs = [pair for pair in pairs if len(pair) == 2] # noqa: PLR2004
|
|
18
18
|
return {key.strip(): value.strip() for key, value in valid_pairs}
|
|
19
19
|
|
|
20
20
|
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: xsoar-cli
|
|
3
|
-
Version: 1.0.
|
|
3
|
+
Version: 1.0.6
|
|
4
4
|
Project-URL: Documentation, https://github.com/tlium/xsoar-cli#readme
|
|
5
5
|
Project-URL: Issues, https://github.com/tlium/xsoar-cli/issues
|
|
6
6
|
Project-URL: Source, https://github.com/tlium/xsoar-cli
|
|
@@ -23,13 +23,13 @@ Description-Content-Type: text/markdown
|
|
|
23
23
|
|
|
24
24
|
# xsoar-cli
|
|
25
25
|
|
|
26
|
-
|
|
26
|
+
 [](https://pypi.org/project/xsoar-cli/) [](https://github.com/astral-sh/ruff) [](https://opensource.org/licenses/MIT)
|
|
27
27
|
|
|
28
28
|
A command-line interface for managing Palo Alto Networks XSOAR (Cortex XSOAR) that streamlines content development and deployment workflows.
|
|
29
29
|
|
|
30
30
|
**Key Features:**
|
|
31
31
|
- **Content Management**: Validate and deploy content packs with declarative manifests
|
|
32
|
-
- **Case Operations**: Retrieve case details and clone cases between environments
|
|
32
|
+
- **Case Operations**: Retrieve case details and clone cases between environments
|
|
33
33
|
- **Playbook Development**: Download playbooks for local editing and testing
|
|
34
34
|
- **Dependency Analysis**: Generate visual graphs of content pack dependencies
|
|
35
35
|
- **Plugin System**: Extend functionality with custom commands
|
|
@@ -165,7 +165,7 @@ For more information on a specific command execute `xsoar-cli <command> --help`.
|
|
|
165
165
|
### Commands
|
|
166
166
|
|
|
167
167
|
- **[case](src/xsoar_cli/case/README.md)** - Retrieve case details and clone cases between environments
|
|
168
|
-
- **[config](src/xsoar_cli/config/README.md)** - Create, validate, and manage CLI configuration files
|
|
168
|
+
- **[config](src/xsoar_cli/config/README.md)** - Create, validate, and manage CLI configuration files
|
|
169
169
|
- **[graph](src/xsoar_cli/graph/README.md)** - Generate visual dependency graphs for content packs
|
|
170
170
|
- **[manifest](src/xsoar_cli/manifest/README.md)** - Validate and deploy content using declarative manifests
|
|
171
171
|
- **[pack](src/xsoar_cli/pack/README.md)** - Manage content pack operations and information
|
|
@@ -1,31 +1,31 @@
|
|
|
1
|
-
xsoar_cli/__about__.py,sha256=
|
|
1
|
+
xsoar_cli/__about__.py,sha256=GW2FEewJ8n3aYhdn_Mw4Wp6iKtgixzjB_UbHmq0x_1Y,127
|
|
2
2
|
xsoar_cli/__init__.py,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
|
|
3
3
|
xsoar_cli/cli.py,sha256=iAlSeZe2iR6ciTVrJYLt-CDZk7b5I-hzHFXbYoXhupA,1342
|
|
4
|
-
xsoar_cli/utilities.py,sha256=
|
|
5
|
-
xsoar_cli/case/README.md,sha256=
|
|
4
|
+
xsoar_cli/utilities.py,sha256=k3REV-d_RFYYjDj8Kb2ljPxADkYffwdfaj0HFeEArbo,5714
|
|
5
|
+
xsoar_cli/case/README.md,sha256=Qpf-HUdkboYoHU5GDkQG1EsQpX2wF7LKsW0CKxmqG1M,1903
|
|
6
6
|
xsoar_cli/case/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
7
|
-
xsoar_cli/case/commands.py,sha256=
|
|
8
|
-
xsoar_cli/config/README.md,sha256=
|
|
7
|
+
xsoar_cli/case/commands.py,sha256=06UEPoSKutrBtAIbgpp_g6YzYXW2N9zx_KtRi16nPlg,5135
|
|
8
|
+
xsoar_cli/config/README.md,sha256=v8xvmuTV-goDRDn48Ko7VG6YZRy89KajBsGx38Jfj_I,1718
|
|
9
9
|
xsoar_cli/config/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
10
10
|
xsoar_cli/config/commands.py,sha256=i6lWaR0LjAzMpNVPZyCsDPaT0GMVqTUXdau6Id0iOrs,4193
|
|
11
11
|
xsoar_cli/graph/README.md,sha256=kyWIGs2Sd-OdqAaCWJjyvGpAhXhFcuqQwVqFBgzgWzk,861
|
|
12
12
|
xsoar_cli/graph/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
13
13
|
xsoar_cli/graph/commands.py,sha256=LKOpUu8r6KThJ5HdyjZlhpwLKRgMcEu7btBOQXwDkMs,1069
|
|
14
|
-
xsoar_cli/manifest/README.md,sha256=
|
|
14
|
+
xsoar_cli/manifest/README.md,sha256=HfdhHlpyJFIm9fC37YaWAwXlG9arhGwpQf2aWO5OewY,3607
|
|
15
15
|
xsoar_cli/manifest/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
16
16
|
xsoar_cli/manifest/commands.py,sha256=nd7-xIJs9qda5iXfFvyfXUG6gctbW9yeUry5KWltisc,10127
|
|
17
|
-
xsoar_cli/pack/README.md,sha256=
|
|
17
|
+
xsoar_cli/pack/README.md,sha256=YYVBjxGT4aCQAu1CE16Yo5AnjdL_uh6T9bpAD2eSpl8,891
|
|
18
18
|
xsoar_cli/pack/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
19
19
|
xsoar_cli/pack/commands.py,sha256=1vGF8_mMemZt75qCBTau_M3dihSr79vc2vea8xr5h_Y,2063
|
|
20
|
-
xsoar_cli/playbook/README.md,sha256=
|
|
20
|
+
xsoar_cli/playbook/README.md,sha256=00ohD9gH_Dt4vWlnPGJIpl_GwVHb274Xao8fR9SHAVc,1474
|
|
21
21
|
xsoar_cli/playbook/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
22
22
|
xsoar_cli/playbook/commands.py,sha256=fZnL5L3pG2gKC4h6q6jmfOQFTa0Tpwnn4e8E5YhDbk0,2794
|
|
23
23
|
xsoar_cli/plugins/README.md,sha256=pxBZlEvWyhRhS4x79dPudYLJHctzuiVxLXBlQ8o2BPI,11236
|
|
24
24
|
xsoar_cli/plugins/__init__.py,sha256=81IZsMbZsqrLdB6TjA9t6s3yS8FkuihliBFX4xZUpTo,1753
|
|
25
25
|
xsoar_cli/plugins/commands.py,sha256=HC0sWu149uQG9Ztag4t2CNPKXTM4WJbEdLSvFMEjw80,10660
|
|
26
26
|
xsoar_cli/plugins/manager.py,sha256=7RPk3lAYDifGMLOU-hFOqyPxTVk8ibBVzBqH7R8wy4g,13012
|
|
27
|
-
xsoar_cli-1.0.
|
|
28
|
-
xsoar_cli-1.0.
|
|
29
|
-
xsoar_cli-1.0.
|
|
30
|
-
xsoar_cli-1.0.
|
|
31
|
-
xsoar_cli-1.0.
|
|
27
|
+
xsoar_cli-1.0.6.dist-info/METADATA,sha256=k4xkGmn4aS6o5czj5FrPKZaoftTSTzaw0pVe5SLNsSQ,9223
|
|
28
|
+
xsoar_cli-1.0.6.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
|
|
29
|
+
xsoar_cli-1.0.6.dist-info/entry_points.txt,sha256=s6Klu4QRekXsmZaBxMyFlE4Q-4_jIA9uijk4qIYUPvE,48
|
|
30
|
+
xsoar_cli-1.0.6.dist-info/licenses/LICENSE.txt,sha256=l6xnqWKshqwwTXt6ayO6MX8Uvygq0YnkUuFTNnR3ba4,1097
|
|
31
|
+
xsoar_cli-1.0.6.dist-info/RECORD,,
|
|
File without changes
|
|
File without changes
|
|
File without changes
|