Nbensalmon/ciac 13043/collection extrahop reveal x

[nbensalm-palo]

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Related Issues

fixes: link to the issue

[github-actions]

Your contributed ExtraHop pack has been modified on files:

Packs/ExtraHop/pack_metadata.json
Packs/ExtraHop/Integrations/ExtrahopRevealXEventCollector/ExtrahopRevealXEventCollector.py
Packs/ExtraHop/Integrations/ExtrahopRevealXEventCollector/ExtrahopRevealXEventCollector_image.png
Packs/ExtraHop/Integrations/ExtrahopRevealXEventCollector/command_examples.txt
Packs/ExtraHop/Integrations/ExtrahopRevealXEventCollector/test_data/detections-dummy.json
Packs/ExtraHop/Integrations/ExtrahopRevealXEventCollector/ExtrahopRevealXEventCollector.yml
Packs/ExtraHop/Integrations/ExtrahopRevealXEventCollector/ExtrahopRevealXEventCollector_test.py
Packs/ExtraHop/Integrations/ExtrahopRevealXEventCollector/README.md
Packs/ExtraHop/Integrations/ExtrahopRevealXEventCollector/ExtrahopRevealXEventCollector_description.md
Please review the changes here

• @Dan-at-Extrahop

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
Packs/ExtraHop/Integrations/ExtrahopRevealXEventCollector
ExtrahopRevealXEventCollector.py	162	76	53%	45, 59–62, 65–66, 69–70, 74, 76, 89, 91, 95, 100, 106–107, 109, 115–116, 131–134, 144, 146, 161, 165, 190, 243, 279, 286–287, 310, 314–315, 348–349, 352, 357–358, 360, 365, 370–372, 374–381, 383, 390, 392–408, 410, 412–413
TOTAL	162	76	53%

Tests	Skipped	Failures	Errors	Time
6	0 💤	0 ❌	0 🔥	2.891s ⏱️

[Dan-at-Extrahop]

@nbensalm-palo can you please provide me with some background on these additions? I'm curious how this new integration relates to the existing ExtraHop_v2 Integration, which already includes a fetch-incidents command.

Trying to understand if it makes more sense to add new features to the existing integration instead of creating a new separate integration.

Also I'm wondering if this is an internal contribution from Palo Alto Networks or a community contribution?

Thanks

[Shellyber]

Nice work

[Shellyber]

@ShirleyDenkberg please have a look when you got the chance.

[Shellyber]

Hi @Dan-at-Extrahop,
First, this is an internal contribution developed and supported by our content team.

Second, while we’re aware that the main integration you contributed includes a fetch_incidents function, the XSIAM platform requires a different approach for handling detections.
To support this, we follow a best practice of implementing a specialized integration type known as an event collector, which is tailored specifically for the XSIAM platform.

[Dan-at-Extrahop]

Hi @Dan-at-Extrahop, First, this is an internal contribution developed and supported by our content team.

Second, while we’re aware that the main integration you contributed includes a fetch_incidents function, the XSIAM platform requires a different approach for handling detections. To support this, we follow a best practice of implementing a specialized integration type known as an event collector, which is tailored specifically for the XSIAM platform.

Hi @Shellyber,

Thanks for the response and clarifications, that addresses both of my concerns. I appreciate the work that your teams continue to do to contribute and support these integrations. Nice work.

[content-bot]

⚠️ The PR is missing the ready-for-pipeline-running label. Please add the label when the PR is ready in order to proceed.

[content-bot]

Validate summary

Verdict: PR can be force merged from validate perspective? ✅