Skip to content

migrate observe_it & outpost24#697

Open
haggit-eliyahu wants to merge 5 commits intomainfrom
migrate-observe_it--outpost24
Open

migrate observe_it & outpost24#697
haggit-eliyahu wants to merge 5 commits intomainfrom
migrate-observe_it--outpost24

Conversation

@haggit-eliyahu
Copy link
Copy Markdown
Contributor

No description provided.

@haggit-eliyahu haggit-eliyahu requested a review from a team as a code owner April 20, 2026 08:01
@gemini-code-assist
Copy link
Copy Markdown
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces two new integrations, ObserveIT and Outpost24, into the repository. The changes include the necessary infrastructure, such as actions, connectors, data models, and configuration files, to support these new integrations. Additionally, the project configuration has been updated to ensure these new modules are correctly included in the linting process.

Highlights

  • New Integrations: Added full integration support for ObserveIT and Outpost24, including actions, connectors, and core logic.
  • Codebase Updates: Updated ruff.toml to include the new integrations in the linting configuration.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@github-actions
Copy link
Copy Markdown

Marketplace Validation Failed

Click to view the full report

Validation Report

🧩 Integrations
Pre-Build Stage

observe_it

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 304ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'observe_it' has connectors but doesn't have default mapping rules
⚠️ SSL Connectors Validation - ObserveIT - Alerts Connector is missing a 'Verify SSL' parameter

outpost24

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 200ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'outpost24' has connectors but doesn't have default mapping rules
⚠️ JSON Result Example Validation Actions with JSON results missing example files in resources/: EnrichEntities

@github-actions
Copy link
Copy Markdown

Marketplace Validation Failed

Click to view the full report

Validation Report

🧩 Integrations
Pre-Build Stage

outpost24

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 658ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'outpost24' has connectors but doesn't have default mapping rules
⚠️ JSON Result Example Validation Actions with JSON results missing example files in resources/: EnrichEntities

observe_it

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 198ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'observe_it' has connectors but doesn't have default mapping rules
⚠️ SSL Connectors Validation - ObserveIT - Alerts Connector is missing a 'Verify SSL' parameter

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces two new integrations for Google SecOps: ObserveIT and Outpost24. The changes include the implementation of Ping actions, alert/finding connectors, and entity enrichment capabilities, along with associated metadata and resource files. Feedback is provided to ensure compliance with repository style guides, specifically regarding the mandatory use of pathlib.Path for file system operations, the prohibition of bare except: blocks, the requirement for comprehensive type annotations on all functions, and the use of specific Python version constraints in pyproject.toml.


siemplify.LOGGER.info("=" * 20 + " Main - Started " + "=" * 20)

map_file_path = os.path.join(siemplify.run_folder, MAP_FILE)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The use of os.path.join is discouraged. Per the repository style guide, pathlib.Path should be used for all file system operations to ensure safe path handling.

Suggested change
map_file_path = os.path.join(siemplify.run_folder, MAP_FILE)
map_file_path = pathlib.Path(siemplify.run_folder) / MAP_FILE
References
  1. Always use pathlib.Path for file system operations. Do not use os.path.join. (link)

try:
for chunk in json.JSONEncoder().iterencode(ids):
f.write(chunk)
except:
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Avoid using bare except: blocks. Always bind the exception to a variable (e.g., except Exception as e:) as required by the repository style guide.

Suggested change
except:
except Exception as e:
References
  1. No bare except: without as e — always bind the exception variable. (link)



class ObserveITManager:
def __init__(self, api_root, client_id, client_secret, verify_ssl=False):
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Function parameters and return types must be annotated using Python type hints, as specified in the repository style guide. This applies to all methods in this class.

Suggested change
def __init__(self, api_root, client_id, client_secret, verify_ssl=False):
def __init__(self, api_root: str, client_id: str, client_secret: str, verify_ssl: bool = False) -> None:
References
  1. All function parameters and return types must be annotated. (link)

name = "ObserveIT"
version = "6.0"
description = "The ObserveIT platform correlates activity and data movement, empowering security teams to identify user risk, detect to insider-led data breaches, and accelerate security incident response. Leveraging a powerful contextual intelligence engine and a library of over 400 threat templates drawn from customers and leading cybersecurity frameworks, ObserveIT delivers rapid time to value and proven capability to streamline insider threat programs."
requires-python = ">=3.11"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The requires-python constraint should be more specific to ensure compatibility with the target environment. The repository style guide recommends ">=3.11,<3.12".

Suggested change
requires-python = ">=3.11"
requires-python = ">=3.11,<3.12"
References
  1. requires-python should be ">=3.11,<3.12". (link)



class Outpost24Manager:
def __init__(self, api_root, username, password, verify_ssl, siemplify_logger=None):
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Function parameters and return types must be annotated using Python type hints. This is a requirement across all integrations in this repository.

Suggested change
def __init__(self, api_root, username, password, verify_ssl, siemplify_logger=None):
def __init__(self, api_root: str, username: str, password: str, verify_ssl: bool, siemplify_logger: object | None = None) -> None:
References
  1. All function parameters and return types must be annotated. (link)

:param environment_regex_pattern: {str} The environment regex pattern
:param map_file: {str} The map file
:return: {EnvironmentHandle}
"""
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Use pathlib.Path for path manipulation instead of os.path.join, as required by the repository style guide.

    map_file_path = pathlib.Path(siemplify.run_folder) / map_file
References
  1. Always use pathlib.Path for file system operations. Do not use os.path.join. (link)

try:
for chunk in json.JSONEncoder().iterencode(ids):
f.write(chunk)
except:
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Bare except: blocks are prohibited. Always use except Exception as e: to capture and handle exceptions properly.

Suggested change
except:
except Exception as e:
References
  1. No bare except: without as e — always bind the exception variable. (link)

name = "Outpost24"
version = "9.0"
description = "Outpost24 is a leading cyber assessment product focused on enabling its customers to achieve maximum value from their evolving technology investments. By leveraging their full stack security insights to reduce the attack surface for any architecture, Outpost24 customers continuously improve their security posture with the least effort."
requires-python = ">=3.11"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Update the requires-python field to match the standard versioning constraint ">=3.11,<3.12" as per the repository style guide.

Suggested change
requires-python = ">=3.11"
requires-python = ">=3.11,<3.12"
References
  1. requires-python should be ">=3.11,<3.12". (link)

@github-actions
Copy link
Copy Markdown

Marketplace Validation Failed

Click to view the full report

Validation Report

🧩 Integrations
Pre-Build Stage

observe_it

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 369ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'observe_it' has connectors but doesn't have default mapping rules
⚠️ SSL Connectors Validation - ObserveIT - Alerts Connector is missing a 'Verify SSL' parameter

outpost24

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 101ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'outpost24' has connectors but doesn't have default mapping rules
⚠️ JSON Result Example Validation Actions with JSON results missing example files in resources/: EnrichEntities

@github-actions
Copy link
Copy Markdown

Marketplace Validation Failed

Click to view the full report

Validation Report

🧩 Integrations
Pre-Build Stage

observe_it

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 571ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'observe_it' has connectors but doesn't have default mapping rules
⚠️ SSL Connectors Validation - ObserveIT - Alerts Connector is missing a 'Verify SSL' parameter

outpost24

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 396ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'outpost24' has connectors but doesn't have default mapping rules
⚠️ JSON Result Example Validation Actions with JSON results missing example files in resources/: EnrichEntities

@github-actions
Copy link
Copy Markdown

Marketplace Validation Failed

Click to view the full report

Validation Report

🧩 Integrations
Pre-Build Stage

outpost24

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 727ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'outpost24' has connectors but doesn't have default mapping rules
⚠️ JSON Result Example Validation Actions with JSON results missing example files in resources/: EnrichEntities

observe_it

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 192ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'observe_it' has connectors but doesn't have default mapping rules
⚠️ SSL Connectors Validation - ObserveIT - Alerts Connector is missing a 'Verify SSL' parameter

@github-actions
Copy link
Copy Markdown

Marketplace Validation Failed

Click to view the full report

Validation Report

🧩 Integrations
Pre-Build Stage

observe_it

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 398ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'observe_it' has connectors but doesn't have default mapping rules
⚠️ SSL Connectors Validation - ObserveIT - Alerts Connector is missing a 'Verify SSL' parameter

outpost24

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 242ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'outpost24' has connectors but doesn't have default mapping rules
⚠️ JSON Result Example Validation Actions with JSON results missing example files in resources/: EnrichEntities

@github-actions
Copy link
Copy Markdown

Marketplace Validation Failed

Click to view the full report

Validation Report

🧩 Integrations
Pre-Build Stage

outpost24

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 381ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'outpost24' has connectors but doesn't have default mapping rules
⚠️ JSON Result Example Validation Actions with JSON results missing example files in resources/: EnrichEntities

observe_it

Validation Name Details
⚠️ Uv Lock Error happened while executing a command: uv lock --check: Using CPython 3.11.15 interpreter at: /opt/hostedtoolcache/Python/3.11.15/x64/bin/python Resolved 31 packages in 98ms The lockfile at uv.lock needs to be updated, but --check was provided. To update the lockfile, run uv lock.
⚠️ Integration Version Bump New integration project.toml and release_note.yaml version must be initialize to 1.0
⚠️ Mapping Rules Validation 'observe_it' has connectors but doesn't have default mapping rules
⚠️ SSL Connectors Validation - ObserveIT - Alerts Connector is missing a 'Verify SSL' parameter

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants