Skip to content

Commit 7af5acb

Browse files
nicoloereninicoloereni
committed
* Added a new workflow file NN-Universal-Alert-Updated-Workflow.xml for improved alert retrieval and processing, including robust pagination, bookmarking, and error handling.
* Enhanced bearer token extraction logic in `NN-Universal-Alert-Workflow.xml` and `NN-Universal-Asset-Workflow.xml` to handle both `Authorization` and `authorization` header casing, improving compatibility with different API responses.
1 parent 9aba474 commit 7af5acb

4 files changed

Lines changed: 84 additions & 4 deletions

File tree

‎Community Developed/NozomiNetworks/Universal/NN-Universal-Alert-Updated-Workflow.xml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
<?xml version="1.0" encoding="UTF-8" ?>
2+
3+
<Workflow name="NN-Universal-Alert-Updated" version="1.0" minimumRecurrence="180" xmlns="http://qradar.ibm.com/UniversalCloudRESTAPI/Workflow/V1">
4+
<Parameters>
5+
<Parameter name="host" label="Host" required="true" />
6+
<Parameter name="key_name" label="Key Name" required="true" />
7+
<Parameter name="key_token" label="Key Token" required="true" secret="true" />
8+
</Parameters>
9+
10+
<Actions>
11+
<!-- <Initialize path="/bookmark_alert" value="0" />-->
12+
<Initialize path="/bookmark_alert" value="${time() - 36000000}" />
13+
<Initialize path="/size" value="500" />
14+
<Initialize path="/alert_page" value="1" />
15+
16+
<CallEndpoint url="https://${/host}/api/open/sign_in" method="POST" savePath="/sign_in">
17+
<RequestBody type="application/json" encoding="UTF-8">{ "key_name": "${/key_name}", "key_token": "${/key_token}" }</RequestBody>
18+
</CallEndpoint>
19+
20+
<Log type="INFO" message="NN Universal Alert Updated sign_in ${/sign_in/status_code}"/>
21+
22+
<If condition="/sign_in/status_code != 200">
23+
<Log type="ERROR" message="NN Universal Alert Updated sign_in fail ${/sign_in/status_code}" />
24+
<Abort reason="${/sign_in/status_code}" />
25+
</If>
26+
27+
<Set path="/bearer_token" value="${/sign_in/headers/Authorization}"/>
28+
<If condition="/bearer_token = null">
29+
<Set path="/bearer_token" value="${/sign_in/headers/authorization}"/>
30+
</If>
31+
32+
<Log type="INFO" message="NN Universal Alert Updated Sign in successfully done alert bookmark ${/bookmark_alert}" />
33+
34+
<!-- GET ALERTS-->
35+
<DoWhile condition="${count(/alerts/body/result)} = ${/size}">
36+
<CallEndpoint url="https://${/host}/api/open/query/do?query=alerts%20%7C%20select%20id%20type_id%20name%20protocol%20description%20ip_src%20ip_dst%20mac_src%20mac_dst%20time%20port_dst%20type_name%20appliance_host%20port_src%20port_dst%20severity%20risk%20src_roles%20dst_roles%20ack%20closed_time%20is_incident%20note%20transport_protocol%20is_security%20label_src%20label_dst%20created_time%20status%20zone_src%20zone_dst%20threat_name%20record_updated_at%20%7C%20where%20record_updated_at%20%3E%20${/bookmark_alert}%20%7C%20sort%20record_updated_at%20asc" method="GET" savePath="/alerts">
37+
<QueryParameter name="count" value="${/size}"/>
38+
<QueryParameter name="page" value="${/alert_page}"/>
39+
<QueryParameter name="default_filters" value="false"/>
40+
<QueryParameter name="skip_total_count" value="true"/>
41+
<RequestHeader name="Authorization" value="${/bearer_token}"/>
42+
<RequestHeader name="nn-app" value="qradar-app"/>
43+
<RequestHeader name="nn-app-version" value="1.0.1"/>
44+
</CallEndpoint>
45+
46+
<If condition="/alerts/status_code != 200">
47+
<Log type="ERROR" message="NN Universal Alert Updated fail status code ${/alerts/status_code}" />
48+
<Abort reason="${/alerts/status_code}"/>
49+
</If>
50+
51+
<If condition="${count(/alerts/body/result)} != 0">
52+
<PostEvents path="/alerts/body/result" source="${/host}_${/key_name}_Alert" />
53+
54+
<Set path="/alert_page" value="${/alert_page + 1}" />
55+
56+
<If condition="${count(/alerts/body/result)} != ${/size} or ${/alert_page} = 100">
57+
<If condition="max(/alerts/body/result/record_updated_at) != null">
58+
<Set path="/alert_page" value="1" />
59+
<Set path="/bookmark_alert" value="${max(/alerts/body/result/record_updated_at)}" />
60+
<Log type="INFO" message="NN Universal Alert Updated bookmark upgraded to ${/bookmark_alert}" />
61+
</If>
62+
</If>
63+
</If>
64+
65+
<Log type="INFO" message="NN Universal Alert Updated notified count => ${count(/alerts/body/result)} alert_page ${/alert_page} and bookmark ${/bookmark_alert}" />
66+
</DoWhile>
67+
</Actions>
68+
<Tests>
69+
<DNSResolutionTest host="${/host}" />
70+
<TCPConnectionTest host="${/host}" />
71+
<SSLHandshakeTest host="${/host}" />
72+
<HTTPConnectionThroughProxyTest url="https://${/host}" />
73+
</Tests>
74+
</Workflow>

‎Community Developed/NozomiNetworks/Universal/NN-Universal-Alert-Workflow.xml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
</Parameters>
99

1010
<Actions>
11-
<!-- <Initialize path="/bookmark_alert" value="0" />-->
11+
<!-- <Initialize path="/bookmark_alert" value="0" />-->
1212
<Initialize path="/bookmark_alert" value="${time() - 36000000}" />
1313
<Initialize path="/size" value="500" />
1414
<Initialize path="/alert_page" value="1" />
@@ -25,6 +25,9 @@
2525
</If>
2626

2727
<Set path="/bearer_token" value="${/sign_in/headers/Authorization}"/>
28+
<If condition="/bearer_token = null">
29+
<Set path="/bearer_token" value="${/sign_in/headers/authorization}"/>
30+
</If>
2831

2932
<!-- <Log type="INFO" message="NN Universal Alert Sign in successfully done alert bookmark ${/bookmark_alert}" />-->
3033

@@ -37,7 +40,7 @@
3740
<QueryParameter name="skip_total_count" value="true"/>
3841
<RequestHeader name="Authorization" value="${/bearer_token}"/>
3942
<RequestHeader name="nn-app" value="qradar-app"/>
40-
<RequestHeader name="nn-app-version" value="1.0.0"/>
43+
<RequestHeader name="nn-app-version" value="1.1.0"/>
4144
</CallEndpoint>
4245

4346
<If condition="/alerts/status_code != 200">

‎Community Developed/NozomiNetworks/Universal/NN-Universal-Asset-Workflow.xml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@
2424
<Abort reason="${/sign_in/status_code}" />
2525
</If>
2626
<Set path="/bearer_token" value="${/sign_in/headers/Authorization}"/>
27+
<If condition="/bearer_token = null">
28+
<Set path="/bearer_token" value="${/sign_in/headers/authorization}"/>
29+
</If>
2730

2831
<!-- <Log type="INFO" message="NN Universal Asset Sign in successfully done asset bookmark ${/bookmark_asset}" />-->
2932

@@ -36,7 +39,7 @@
3639
<QueryParameter name="skip_total_count" value="true"/>
3740
<RequestHeader name="Authorization" value="${/bearer_token}"/>
3841
<RequestHeader name="nn-app" value="qradar-app"/>
39-
<RequestHeader name="nn-app-version" value="1.0.0"/>
42+
<RequestHeader name="nn-app-version" value="1.1.0"/>
4043
</CallEndpoint>
4144

4245
<If condition="/assets/status_code != 200">

‎Community Developed/NozomiNetworks/Universal/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
#### Author Name: Nozomi Networks
44
#### Maintainer Name: NozomiNetworks
5-
#### Version Number: 1.0.0
5+
#### Version Number: 1.1.0
66
#### Event Types Currently Supported by the workflows: Alerts and Assets
77

88
#### Workflow Parameter Values

0 commit comments

Comments
 (0)