Skip to content

Commit

Permalink
blacklist and whitelist changes to md and yml files (demisto#15858)
Browse files Browse the repository at this point in the history
* blacklist and whitelist changes to md and yml files

* Added rn

* Added rn

* Fixed UT as well

* Added new RN

* Update version

Co-authored-by: ShahafBenYakir <[email protected]>
  • Loading branch information
tschanfeld and ShahafBenYakir authored Dec 2, 2021
1 parent 56506d6 commit 6a8c845
Show file tree
Hide file tree
Showing 352 changed files with 1,681 additions and 1,243 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -331,7 +331,7 @@ script:
required: false
secret: false
deprecated: false
description: A list of trusted IP addresses that have been whitelisted for secure
description: A list of trusted IP addresses on allow list for secure
communication with AWS infrastructure and applications.
execution: false
name: aws-gd-create-ip-set
Expand Down
2 changes: 1 addition & 1 deletion Packs/AWS-GuardDuty/Integrations/AWSGuardDuty/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -185,7 +185,7 @@ There is no context output for this command.
### aws-gd-create-ip-set

***
A list of trusted IP addresses that have been whitelisted for secure communication with AWS infrastructure and applications.
A list of trusted IP addresses on allow list for secure communication with AWS infrastructure and applications.

##### AWS IAM Policy Permission

Expand Down
4 changes: 4 additions & 0 deletions Packs/AWS-GuardDuty/ReleaseNotes/1_2_1.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@

#### Integrations
##### AWS - GuardDuty
- Documentation fixes
2 changes: 1 addition & 1 deletion Packs/AWS-GuardDuty/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "AWS - GuardDuty",
"description": "Amazon Web Services Guard Duty Service (gd)",
"support": "xsoar",
"currentVersion": "1.2.0",
"currentVersion": "1.2.1",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
4 changes: 2 additions & 2 deletions Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.yml
Original file line number Diff line number Diff line change
Expand Up @@ -231,7 +231,7 @@ script:
name: limit
- auto: PREDEFINED
defaultValue: 'false'
description: Whether to save a list of blacklisted IPs in the Context Data in
description: Whether to save a list of IPs on a block list in the Context Data in
Demisto. Default is false.
name: saveToContext
predefined:
Expand All @@ -244,7 +244,7 @@ script:
name: abuseipdb-get-blacklist
outputs:
- contextPath: AbuseIPDB.Blacklist
description: A list of blacklisted IP addresses.
description: A list of IP addresses on a block list.
type: Unknown
- arguments: []
description: Returns a list of report categories from AbuseIPDB.
Expand Down
4 changes: 2 additions & 2 deletions Packs/AbuseDB/Integrations/AbuseDB/README.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<!-- HTML_DOC -->
<p>Use the AbuseIPDB integration to report and identify IP addresses that have been associated with malicious activity online.</p>
<h2>Use Cases</h2>
<p>Check, Report, and get Blacklist of top malicious IPs.</p>
<p>Check, Report, and get block list of top malicious IPs.</p>
<h2>Configure AbuseIPDB on Cortex XSOAR</h2>
<ol>
<li>Navigate to <strong>Settings</strong&gt; <strong>Integrations</strong&gt; <strong>Servers &amp; Services</strong>.</li>
Expand Down Expand Up @@ -345,7 +345,7 @@
<tr>
<td style="width: 288px;">AbuseIPDB.Blacklist</td>
<td style="width: 141px;">unknown</td>
<td style="width: 311px;">List of blacklisted IPs</td>
<td style="width: 311px;">List of IPs on block list</td>
</tr>
</tbody>
</table>
Expand Down
8 changes: 8 additions & 0 deletions Packs/AbuseDB/ReleaseNotes/1_0_11.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@

#### Integrations
##### AbuseIPDB
- Documentation fixes

#### Scripts
##### AbuseIPDBPopulateIndicators
- Documentation fixes
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ script: ''
type: python
subtype: python2
tags: []
comment: Extracts blacklisted IP addresses from AbuseIPDB, and Populates Indicators
comment: Extracts IP addresses on block lists from AbuseIPDB, and Populates Indicators
accordingly.
enabled: true
args:
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Extracts blacklisted IP addresses from AbuseIPDB, and populates indicators accordingly.
Extracts IP addresses on block lists from AbuseIPDB, and populates indicators accordingly.

## Script Data
---
Expand Down
2 changes: 1 addition & 1 deletion Packs/AbuseDB/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "AbuseIPDB",
"description": "Central repository to report and identify IP addresses that have been associated with malicious activity online. Check the Detailed Information section for more information on how to configure the integration.",
"support": "xsoar",
"currentVersion": "1.0.10",
"currentVersion": "1.0.11",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
8 changes: 4 additions & 4 deletions Packs/AnsibleLinux/Integrations/AnsibleLinux/AnsibleLinux.yml
Original file line number Diff line number Diff line change
Expand Up @@ -1206,19 +1206,19 @@ script:
isArray: true
name: host
required: true
- description: Name of kernel module to black- or whitelist.
- description: Name of kernel module to add to block list or allow list.
name: name
required: true
- auto: PREDEFINED
defaultValue: present
description: Whether the module should be present in the blacklist or absent.
description: Whether the module should be present in the block list or absent.
name: state
predefined:
- absent
- present
- description: If specified, use this blacklist file instead of `/etc/modprobe.d/blacklist-ansible.conf`.
- description: If specified, use this block list file instead of `/etc/modprobe.d/blacklist-ansible.conf`.
name: blacklist_file
description: "Blacklist kernel modules\n Further documentation available at https://docs.ansible.com/ansible/2.9/modules/kernel_blacklist_module.html"
description: "Block list kernel modules\n Further documentation available at https://docs.ansible.com/ansible/2.9/modules/kernel_blacklist_module.html"
name: linux-kernel-blacklist
outputs: []
- arguments:
Expand Down
8 changes: 4 additions & 4 deletions Packs/AnsibleLinux/Integrations/AnsibleLinux/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2026,7 +2026,7 @@ Further documentation available at https://docs.ansible.com/ansible/2.9/modules/

### linux-kernel-blacklist
***
Blacklist kernel modules
Deny list kernel modules
Further documentation available at https://docs.ansible.com/ansible/2.9/modules/kernel_blacklist_module.html


Expand All @@ -2038,9 +2038,9 @@ Further documentation available at https://docs.ansible.com/ansible/2.9/modules/
| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| host | hostname or IP of target. Optionally the port can be specified using :PORT. If multiple targets are specified using an array, the integration will use the configured concurrency factor for high performance. | Required |
| name | Name of kernel module to black- or whitelist. | Required |
| state | Whether the module should be present in the blacklist or absent. Possible values are: absent, present. Default is present. | Optional |
| blacklist_file | If specified, use this blacklist file instead of `/etc/modprobe.d/blacklist-ansible.conf`. | Optional |
| name | Name of kernel module to add to block list or allow list. | Required |
| state | Whether the module should be present in the block list or absent. Possible values are: absent, present. Default is present. | Optional |
| blacklist_file | If specified, use this block list file instead of `/etc/modprobe.d/blacklist-ansible.conf`. | Optional |


#### Context Output
Expand Down
4 changes: 4 additions & 0 deletions Packs/AnsibleLinux/ReleaseNotes/1_0_2.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@

#### Integrations
##### Linux
- Documentation fixes
2 changes: 1 addition & 1 deletion Packs/AnsibleLinux/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Ansible Linux",
"description": "Manage and control Linux hosts.",
"support": "xsoar",
"currentVersion": "1.0.1",
"currentVersion": "1.0.2",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5323,7 +5323,7 @@ script:
which updates are to be searched or installed. If an available update does
not match one of the entries, then it is skipped and not installed. Each entry
can either be the KB article or Update title as a regex according to the PowerShell
regex rules. The whitelist is only validated on updates that were found based
regex rules. The allow list is only validated on updates that were found based
on `category_names`. It will not force the module to install an update if
it was not in the category specified.'
isArray: true
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6163,7 +6163,7 @@ Further documentation available at https://docs.ansible.com/ansible/2.9/modules/
| server_selection | Defines the Windows Update source catalog.<br/>`default` Use the default search source. For many systems default is set to the Microsoft Windows Update catalog. Systems participating in Windows Server Update Services (WSUS), Systems Center Configuration Manager (SCCM), or similar corporate update server environments may default to those managed update sources instead of the Windows Update catalog.<br/>`managed_server` Use a managed server catalog. For environments utilizing Windows Server Update Services (WSUS), Systems Center Configuration Manager (SCCM), or similar corporate update servers, this option selects the defined corporate update source.<br/>`windows_update` Use the Microsoft Windows Update catalog. Possible values are: default, managed_server, windows_update. Default is default. | Optional |
| state | Controls whether found updates are downloaded or installed or listed<br/>This module also supports Ansible check mode, which has the same effect as setting state=searched. Possible values are: installed, searched, downloaded. Default is installed. | Optional |
| log_path | If set, `win_updates` will append update progress to the specified file. The directory must already exist. | Optional |
| whitelist | A list of update titles or KB numbers that can be used to specify which updates are to be searched or installed.<br/>If an available update does not match one of the entries, then it is skipped and not installed.<br/>Each entry can either be the KB article or Update title as a regex according to the PowerShell regex rules.<br/>The whitelist is only validated on updates that were found based on `category_names`. It will not force the module to install an update if it was not in the category specified. | Optional |
| allow list | A list of update titles or KB numbers that can be used to specify which updates are to be searched or installed.<br/>If an available update does not match one of the entries, then it is skipped and not installed.<br/>Each entry can either be the KB article or Update title as a regex according to the PowerShell regex rules.<br/>The allow list is only validated on updates that were found based on `category_names`. It will not force the module to install an update if it was not in the category specified. | Optional |
| use_scheduled_task | Will not auto elevate the remote process with `become` and use a scheduled task instead.<br/>Set this to `yes` when using this module with async on Server 2008, 2008 R2, or Windows 7, or on Server 2008 that is not authenticated with basic or credssp.<br/>Can also be set to `yes` on newer hosts where become does not work due to further privilege restrictions from the OS defaults. Possible values are: Yes, No. Default is No. | Optional |


Expand Down
4 changes: 4 additions & 0 deletions Packs/AnsibleMicrosoftWindows/ReleaseNotes/1_0_2.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@

#### Integrations
##### Ansible Microsoft Windows
- Documentation fixes
2 changes: 1 addition & 1 deletion Packs/AnsibleMicrosoftWindows/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Ansible Microsoft Windows",
"description": "Manage and control Windows hosts.",
"support": "xsoar",
"currentVersion": "1.0.1",
"currentVersion": "1.0.2",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -1085,20 +1085,20 @@ script:
isArray: true
name: host
required: true
- description: Name of kernel module to black- or whitelist.
- description: Name of kernel module to block list or add to allow list.
name: name
required: true
- auto: PREDEFINED
default: false
defaultValue: present
description: Whether the module should be present in the blacklist or absent.
description: Whether the module should be present in the block list or absent.
name: state
predefined:
- absent
- present
- description: If specified, use this blacklist file instead of `/etc/modprobe.d/blacklist-ansible.conf`.
- description: If specified, use this block list file instead of `/etc/modprobe.d/blacklist-ansible.conf`.
name: blacklist_file
description: Blacklist kernel modules
description: Block list kernel modules
name: linux-kernel-blacklist
- arguments:
- description: hostname or IP of target. Optionally the port can be specified
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4753,7 +4753,7 @@ script:
A list of update titles or KB numbers that can be used to specify which updates are to be searched or installed.
If an available update does not match one of the entries, then it is skipped and not installed.
Each entry can either be the KB article or Update title as a regex according to the PowerShell regex rules.
The whitelist is only validated on updates that were found based on `category_names`. It will not force the module to install an update if it was not in the category specified.
The allow list is only validated on updates that were found based on `category_names`. It will not force the module to install an update if it was not in the category specified.
isArray: true
name: whitelist
- default: false
Expand Down
6 changes: 6 additions & 0 deletions Packs/Ansible_Powered_Integrations/ReleaseNotes/2_0_1.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Integrations
##### Ansible Linux (Deprecated)
- Documentation fixes
##### Ansible Microsoft Windows (Deprecated)
- Documentation fixes
2 changes: 1 addition & 1 deletion Packs/Ansible_Powered_Integrations/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Ansible Powered Integrations",
"description": "Run Ansible modules as native XSOAR commands with these agent-less integrations:\nMicrosoft Windows Host\nLinux Host\nCisco IOS\nCisco NX-OS\nOpenSSL\nACME\nDNS\nKubernetes\nVMware vSphere\nAzure Compute\nAzure Networking\nHetzner Cloud\nAlibaba Cloud\n",
"support": "community",
"currentVersion": "2.0.0",
"currentVersion": "2.0.1",
"author": "Serge Bakharev",
"url": "https://github.com/SergeBakharev/Ansible-for-XSOAR",
"email": "[email protected]",
Expand Down
2 changes: 1 addition & 1 deletion Packs/ArcSightESM/Integrations/ArcSightESMv2/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ Cortex XSOAR is designed for an automatic response, so make sure to define condi
- **Fetch events** - New events that match the predefined condition will be fetched to Cortex XSOAR as an incident and will trigger playbooks for automation and response. Such events could be any kind of security events.
- **Fetch cases** - New cases that match the predefined condition will be fetched to Cortex XSOAR as an incident and will trigger playbooks for automation and response. Such cases could include any kind of security events. The final step of the playbook could be updating, closing or deleting the case.
- **Search events** - Query specific events based on an existing query viewer.
- **Getting active** list entries - Returning active list entries (such as “Blacklist IPS”, “Malicious MD5s”, etc) by using as-get-entries and providing the resource ID of the active list. The entries can be added as a list in Cortex XSOAR for cross-platform usage, additional automation, and data enrichment.
- **Getting active** list entries - Returning active list entries (such as “Block list IPS”, “Malicious MD5s”, etc) by using as-get-entries and providing the resource ID of the active list. The entries can be added as a list in Cortex XSOAR for cross-platform usage, additional automation, and data enrichment.

## Fetched Incidents Data
The integration can fetch events and cases.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@ tasks:
version: -1
name: Are there filtered results?
description: Checks whether the specified item is in a list. The default list
is the Demisto Indicators Whitelist.
is the Demisto Indicators allow list.
type: condition
iscommand: false
brand: ""
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ tasks:
task:
id: f48ed3d7-c1ec-453f-847a-c680be0d04ca
version: -1
name: Is there an ArcSight Black list Domain Active List and values?
name: Is there an ArcSight Block list Domain Active List and values?
type: condition
iscommand: false
brand: ""
Expand Down Expand Up @@ -209,7 +209,7 @@ tasks:
task:
id: ab9d83d4-8938-4456-8b0c-5405dcf4d664
version: -1
name: Add Domain to ArcSight Active list black list
name: Add Domain to ArcSight Active list block list
description: Adds new entries to the Active List.
script: ArcSight ESM v2|||as-add-entries
type: regular
Expand Down Expand Up @@ -305,7 +305,7 @@ tasks:
task:
id: 63d6017f-ccef-4f11-8d41-0c5e8dbe4ad5
version: -1
name: Is there an ArcSight White list Domain Active List and values?
name: Is there an ArcSight allow list Domain Active List and values?
type: condition
iscommand: false
brand: ""
Expand Down Expand Up @@ -372,7 +372,7 @@ tasks:
task:
id: c7cb6db4-316e-4c60-8c8b-bb945635c0e3
version: -1
name: Add Domain to ArcSight Active list white list
name: Add Domain to ArcSight Active list allow list
description: Adds new entries to the Active List.
script: ArcSight ESM v2|||as-add-entries
type: regular
Expand Down Expand Up @@ -836,25 +836,25 @@ inputs:
- key: ArcSightBlackListDomainActiveListID
value: {}
required: false
description: ID of the black list Domain Active List resource as it appears in
description: ID of the block list Domain Active List resource as it appears in
ArcSight.
playbookInputQuery: null
- key: ArcsightBlackDomainValueFieldName
value: {}
required: false
description: The name of the black list Active List field to insert the Domain value
description: The name of the block list Active List field to insert the Domain value
to.
playbookInputQuery: null
- key: ArcSightWhiteListDomainActiveListID
value: {}
required: false
description: ID of the white list Domain Active List resource as appears in
description: ID of the allow list Domain Active List resource as appears in
ArcSight.
playbookInputQuery: null
- key: ArcsightWhiteListDomainValueFieldName
value: {}
required: false
description: The name of the white list Active List field to insert the Domain value
description: The name of the allow list Active List field to insert the Domain value
to.
playbookInputQuery: null
- key: ArcSightWatchListDomainActiveListID
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,10 @@ This playbook does not use any scripts.

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| ArcSightBlackListDomainActiveListID | ID of the black list Domain Active List resource as it appears in ArcSight. | | Optional |
| ArcsightBlackDomainValueFieldName | The name of the black list Active List field to insert the Domain value to. | | Optional |
| ArcSightWhiteListDomainActiveListID | ID of the white list Domain Active List resource as appears in ArcSight. | | Optional |
| ArcsightWhiteListDomainValueFieldName | The name of the white list Active List field to insert the Domain value to. | | Optional |
| ArcSightBlackListDomainActiveListID | ID of the block list Domain Active List resource as it appears in ArcSight. | | Optional |
| ArcsightBlackDomainValueFieldName | The name of the block list Active List field to insert the Domain value to. | | Optional |
| ArcSightWhiteListDomainActiveListID | ID of the allow list Domain Active List resource as appears in ArcSight. | | Optional |
| ArcsightWhiteListDomainValueFieldName | The name of the allow list Active List field to insert the Domain value to. | | Optional |
| ArcSightWatchListDomainActiveListID | ID of the watch list Domain Active List resource as appears in ArcSight. | | Optional |
| ArcsightWatchListDomainValueFieldName | The name of the watch list Active List field to insert the Domain value to. | | Optional |

Expand Down
Loading

0 comments on commit 6a8c845

Please sign in to comment.