Skip to content

Commit

Permalink
Merge remote-tracking branch 'origin/master' into m-defender-cloud-ev…
Browse files Browse the repository at this point in the history
…ent-collector
  • Loading branch information
michal-dagan committed Nov 22, 2023
2 parents 0feb2a8 + 45607ed commit 112d88d
Show file tree
Hide file tree
Showing 19 changed files with 197 additions and 95 deletions.
9 changes: 6 additions & 3 deletions content-repo/extra-docs/articles/microsoft-auth-guide.md
Original file line number Diff line number Diff line change
Expand Up @@ -76,13 +76,14 @@ Alternatively, instead of providing the *Client Secret*, you can authenticate us
* Private Key - The private key of the registered certificate


### Authorize on Behalf of a User
### Authorization Code flow
Some Cortex XSOAR-Microsoft integrations (e.g., Microsoft Graph Mail Single User) require authorization on behalf of a user (not admin consent). For more information about this authorization flow, refer to the [authorization code flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow).

To configure a Microsoft integration that uses this authorization flow with a self-deployed Azure application:

1. Make sure the needed permissions are granted for the app registration, e.g., for Microsoft Graph User: API/Permission name `Directory.AccessAsUser.All` of type `Delegated`.
2. The Redirect URI can direct any web application that you wish to receive responses from Azure AD. If you are not sure what to set, you can use `https://localhost`.
2. In your app. click **Authentication** > **Platform configurations** > **Add a platform.** Choose **Web** and add [Redirect URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-redirect-uri).
The Redirect URI can direct any web application that you wish to receive responses from Azure AD. If you are not sure what to set, you can use `https://localhost`.
3. Enter your client ID in the *ID* parameter field.
4. Enter your client secret in the *Key* parameter field.
5. Enter your tenant ID in the *Token* parameter field.
Expand Down Expand Up @@ -149,7 +150,7 @@ After you a redirected to the next page, in the **Overview** tab you will find y
![Overview](../../../docs/doc_imgs/tutorials/tut-microsoft-auth-guide/subscription_id_resourse_group.png)


## Self Deployed Application - Example
## Self Deployed Application - Example for [Microsoft Graph User integration](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user)

1. In Microsoft Azure portal, create a new app registration.
1. Select Azure Active Directory> App registrations> New registration.
Expand Down Expand Up @@ -268,3 +269,5 @@ For example, when using the "self-deployed Azure app" for Microsoft Graph Mail S
2. Validate that all the credentials you entered are correct (Client ID, Client Secret, Tenant ID, Application redirect URI).
3. Run !msgraph-mail-generate-login-url to generate a new *Authorization code*.
4. Run !msgraph-mail-test to test the connectivity of the email.

**Note**: If encountering an "Insufficient privileges to complete the operation" error, ensure the necessary permissions were added, according to the integration documentation. Subsequently, reset the authentication and initiate the authentication process again.
2 changes: 1 addition & 1 deletion content-repo/extra-docs/articles/splunk-add-on.md
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ In order to use the add-on and create incidents in XSOAR, you must complete the
* Additional Settings (optional):
* If you have an SSL certificate, provide its full path under the **"Location to Certificate"** field.
By default, **"Validate SSL"** is enabled.
* If you would like to extend the incident creatiin request timeout, provide the desired timeout under the "Timeout Value" field.
* If you would like to extend the incident creation request timeout, provide the desired timeout under the "Timeout Value" field.
By default, timeout value is 10 seconds.

![splunk-add-on-config.png](../../../docs/doc_imgs/reference/splunk-add-on-config.png)
Expand Down
15 changes: 8 additions & 7 deletions content-repo/extra-docs/articles/troubleshooting.md
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,14 @@ For example for an integration instance name of: `Cortex_XDR_instance_1` run the
!Cortex_XDR_instance_1-test-module debug-mode=true
```

**Note:**
- If the instance name contains spaces, replace the space with an underscore (`_`).
- The "Do not use by default" checkbox should be unchecked on the integration instance you are testing.

Screenshot of running a `test-module` command with `debug-mode=true` and the resulting log file (`test-module.log`):

![test-module-debug](../../../docs/doc_imgs/reference/test-module-debug.png)


### Fetch Incidents in `debug-mode`
Starting with Cortex XSOAR 6.0 it is possible to run the fetch incidents command from the Cortex XSOAR CLI with `debug-mode=true`. This is done by issuing a command of the form:
Expand All @@ -250,13 +258,6 @@ For example for an integration instance name of: `Cortex_XDR_instance_1` run the
Screenshot of running a `fetch` command with `debug-mode=true` and the resulting log file (`fetch-incidents.log`):
![fetch-incidents-debug](../../../docs/doc_imgs/reference/fetch-incidents-debug.png)

**Note:**
- If the instance name contains spaces, replace the space with an underscore (`_`).
- The "Do not use by default" checkbox should be unchecked on the integration instance you are testing.

Screenshot of running a `test-module` command with `debug-mode=true` and the resulting log file (`test-module.log`):

![test-module-debug](../../../docs/doc_imgs/reference/test-module-debug.png)

## Integration Debug Logs
:::caution Important Note
Expand Down
2 changes: 1 addition & 1 deletion content-repo/extra-docs/packs/content-management.md
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ For general information about the CI/CD process, see [CI/CD FAQs](#cicd-faqs).
| `config.yml` | The CI/CD configuration file (in the `.github\workflows` folder), which validates the content pack, creates an ID set, runs tests, etc. When you want to deploy your content, you need to update the file with your repository and whether you want to use an artifact server. For more information, see Configure the config.yml file in [Deployment](#deployment). |
| `pre-commit` | Within the `.hooks` folder, the pre-commit file uses the Git rebase interactive tool for manual control of your history revision process. |
| `.vscode` | Used when using VSC as your IDE. |
| `build_related_scripts` | Contains the CI/CD scripts. The `build_related_scripts/bucket_upload.py` script enables you to upload to Google Cloud Storage (artifact server). Before deploying your content, you need to update the name of the bucket list when uploading the Google Cloud Storage. For more information, see Configure the the bucket_upload.py file in [Deployment](#deployment). <br/> **NOTE**: If using another storage application such AWS, you need to replace Google Cloud Storage. Contact Customer Support to assist with this. <br/> The `get_modified_packs.py` script enables you to get the latest version of the content pack before merging. |
| `build_related_scripts` | Contains the CI/CD scripts. The `build_related_scripts/bucket_upload.py` script enables you to upload to Google Cloud Storage (artifact server) and the `build_related_scripts/bucket_upload_aws.py` script enables you to upload to AWS s3. Before deploying your content, you need to update the name of the bucket list when uploading the Google Cloud Storage. For more information, see Configure the the bucket_upload.py file in [Deployment](#deployment). <br/> The `get_modified_packs.py` script enables you to get the latest version of the content pack before merging. |
| `dev_envs/pytest`| A folder that contains the `conftest.py`, which validates python files. |
| `.demisto-sdk-conf`| The custom configuration file for the `demisto-sdk` commands. For more information, see [Setting a preset custom command configuration](https://xsoar.pan.dev/docs/concepts/demisto-sdk#setting-a-preset-custom-command-configuration). |
| `.gitignore` | Specifies intentionally untracked files that Git should ignore. |
Expand Down
Loading

0 comments on commit 112d88d

Please sign in to comment.