From 4775a2c369a9c3a10aac632e2abc29426e872a07 Mon Sep 17 00:00:00 2001 From: Yaakov Praisler <59408745+yaakovpraisler@users.noreply.github.com> Date: Thu, 9 Mar 2023 15:00:37 +0200 Subject: [PATCH] Fix parseCSV markdown output (#25161) * fix parseCSV markdown output * release notes * release notes * conflict * conflict * test-upload code owner * Revert "test-upload code owner" This reverts commit 9936ec646e9b76ed52d212848e2f6535225d3211. * flake8 --- Packs/CommonScripts/ReleaseNotes/1_11_47.md | 4 ++++ Packs/CommonScripts/Scripts/ParseCSV/ParseCSV.py | 10 +++++----- Packs/CommonScripts/Scripts/ParseCSV/ParseCSV_test.py | 3 ++- .../CommonScripts/Scripts/ParseCSV/test_data/IOCs.csv | 1 + .../Scripts/ParseCSV/test_data/IOCs_results.json | 9 +++++++-- .../ParseCSV/test_data/one_is_hash_results.json | 2 +- Packs/CommonScripts/pack_metadata.json | 2 +- 7 files changed, 21 insertions(+), 10 deletions(-) create mode 100644 Packs/CommonScripts/ReleaseNotes/1_11_47.md diff --git a/Packs/CommonScripts/ReleaseNotes/1_11_47.md b/Packs/CommonScripts/ReleaseNotes/1_11_47.md new file mode 100644 index 000000000000..0f1488c3ea28 --- /dev/null +++ b/Packs/CommonScripts/ReleaseNotes/1_11_47.md @@ -0,0 +1,4 @@ + +#### Scripts +##### ParseCSV +- Fixed an issue in the markdown output where multiple IOC types are in same column. diff --git a/Packs/CommonScripts/Scripts/ParseCSV/ParseCSV.py b/Packs/CommonScripts/Scripts/ParseCSV/ParseCSV.py index 0cd5d3f6d28d..fecc70f0f910 100644 --- a/Packs/CommonScripts/Scripts/ParseCSV/ParseCSV.py +++ b/Packs/CommonScripts/Scripts/ParseCSV/ParseCSV.py @@ -203,28 +203,28 @@ def main(): for row in csv_data: content += ','.join(row) + '\n' if parse_ip != -1: - md += (row[parse_ip] + '|' if row[parse_ip] else ' |') is_ip = re.search(r'([0-9]{1,3}\.){3}[0-9]{1,3}', row[parse_ip]) is_valid = is_ip_valid(row[parse_ip]) if is_ip and is_valid: ip_list.append(row[parse_ip]) - md += '\n' continue if parse_hash != -1: - md += (row[parse_hash] + '|' if row[parse_hash] else ' |') is_hash = re.search(r'[0-9A-Fa-f]{32,128}', row[parse_hash]) if is_hash: hash_list.append(row[parse_hash]) - md += '\n' continue if parse_domain != -1: - md += (row[parse_domain] + '|' if row[parse_domain] else ' |') has_dot = '.' in row[parse_domain] no_spaces = ' ' not in row[parse_domain] if has_dot and no_spaces: domain_list.append(row[parse_domain]) + + for c in range(max(len(ip_list), len(domain_list), len(hash_list))): + md += ip_list[c] + '|' if len(ip_list) >= c + 1 else ' |' + md += domain_list[c] + '|' if len(domain_list) >= c + 1 else ' |' + md += hash_list[c] + '|' if len(hash_list) >= c + 1 else ' |' md += '\n' context = {} # type: dict diff --git a/Packs/CommonScripts/Scripts/ParseCSV/ParseCSV_test.py b/Packs/CommonScripts/Scripts/ParseCSV/ParseCSV_test.py index 6a87d40afa1e..c6cdecb7d5ab 100644 --- a/Packs/CommonScripts/Scripts/ParseCSV/ParseCSV_test.py +++ b/Packs/CommonScripts/Scripts/ParseCSV/ParseCSV_test.py @@ -124,7 +124,8 @@ def test_parsecsv_with_iocs_same_column(self, mocker): "parseAll": "no", "codec": "utf-8", "ips": "1", - "domains": "1" + "domains": "1", + "hashes": "1" } file_obj = self.create_file_object("./test_data/IOCs.csv") self.mock_demisto(mocker, args_value=args, file_obj=file_obj) diff --git a/Packs/CommonScripts/Scripts/ParseCSV/test_data/IOCs.csv b/Packs/CommonScripts/Scripts/ParseCSV/test_data/IOCs.csv index 7f35e039becb..b7eb13203c53 100644 --- a/Packs/CommonScripts/Scripts/ParseCSV/test_data/IOCs.csv +++ b/Packs/CommonScripts/Scripts/ParseCSV/test_data/IOCs.csv @@ -3,3 +3,4 @@ Domain,www.example.com Domain,www.example.org IP,1.1.1.1 IP,8.8.8.8 +Hash,c8092abd8d581750c0530fa1fc8d8318 \ No newline at end of file diff --git a/Packs/CommonScripts/Scripts/ParseCSV/test_data/IOCs_results.json b/Packs/CommonScripts/Scripts/ParseCSV/test_data/IOCs_results.json index db1903416dab..0515139af866 100644 --- a/Packs/CommonScripts/Scripts/ParseCSV/test_data/IOCs_results.json +++ b/Packs/CommonScripts/Scripts/ParseCSV/test_data/IOCs_results.json @@ -1,6 +1,6 @@ { "ContentsFormat": "text", - "HumanReadable": "### Parsed Data Table\nIPs |Domains |\n- |- |\nValue|Value|\nwww.example.com|www.example.com|\nwww.example.org|www.example.org|\n1.1.1.1|\n8.8.8.8|\n", + "HumanReadable": "### Parsed Data Table\nIPs |Domains |Hashes |\n- |- |- |\n1.1.1.1|www.example.com|c8092abd8d581750c0530fa1fc8d8318|\n8.8.8.8|www.example.org| |\n", "EntryContext": { "IP": [ { @@ -17,8 +17,13 @@ { "Name": "www.example.org" } + ], + "File": [ + { + "MD5": "c8092abd8d581750c0530fa1fc8d8318" + } ] }, "Type": 1, - "Contents": "\ufeffType,Value\nDomain,www.example.com\nDomain,www.example.org\nIP,1.1.1.1\nIP,8.8.8.8\n" + "Contents": "\ufeffType,Value\nDomain,www.example.com\nDomain,www.example.org\nIP,1.1.1.1\nIP,8.8.8.8\nHash,c8092abd8d581750c0530fa1fc8d8318\n" } diff --git a/Packs/CommonScripts/Scripts/ParseCSV/test_data/one_is_hash_results.json b/Packs/CommonScripts/Scripts/ParseCSV/test_data/one_is_hash_results.json index 82136c3860fd..38d54f14db26 100644 --- a/Packs/CommonScripts/Scripts/ParseCSV/test_data/one_is_hash_results.json +++ b/Packs/CommonScripts/Scripts/ParseCSV/test_data/one_is_hash_results.json @@ -15,5 +15,5 @@ "Type": 1, "ContentsFormat": "text", "Contents": "randomValues,hashes\nyarden,c8092abd8d581750c0530fa1fc8d8318\nsade,52483514f07eb14570142f6927b77deb7b4da99f\npythonist,503ca1a4fc0d48b18c0336f544ba0f0abf305ae3a3f49b3c2b86b8645d6572dc\n", - "HumanReadable": "### Parsed Data Table\nHashes |\n- |\nhashes|\nc8092abd8d581750c0530fa1fc8d8318|\n52483514f07eb14570142f6927b77deb7b4da99f|\n503ca1a4fc0d48b18c0336f544ba0f0abf305ae3a3f49b3c2b86b8645d6572dc|\n" + "HumanReadable": "### Parsed Data Table\nHashes |\n- |\n | |c8092abd8d581750c0530fa1fc8d8318|\n | |52483514f07eb14570142f6927b77deb7b4da99f|\n | |503ca1a4fc0d48b18c0336f544ba0f0abf305ae3a3f49b3c2b86b8645d6572dc|\n" } \ No newline at end of file diff --git a/Packs/CommonScripts/pack_metadata.json b/Packs/CommonScripts/pack_metadata.json index 73049772464d..983d927efb25 100644 --- a/Packs/CommonScripts/pack_metadata.json +++ b/Packs/CommonScripts/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Common Scripts", "description": "Frequently used scripts pack.", "support": "xsoar", - "currentVersion": "1.11.46", + "currentVersion": "1.11.47", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "",