Adding Checkpoint HEC response integration#707
Adding Checkpoint HEC response integration#707chkp-arvidb wants to merge 4 commits intochronicle:mainfrom
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a new integration for Check Point HEC, enabling users to interact with the platform directly from the SOAR environment. It provides a suite of actions for managing security exceptions, searching for emails, and performing remediation actions on entities, significantly enhancing the automation capabilities for security operations teams. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces the Check Point HEC integration, which includes actions for email searching, event management, and exception handling for various security tools. The review feedback highlights several critical improvements needed to meet repository standards, such as correcting parameter extraction logic, preventing PII leakage in logs, and providing mandatory unit tests and JSON result examples. Additionally, the feedback identifies multiple style guide violations concerning imports, docstrings, and standard Ping action messages, while also advising the removal of commented-out code and placeholder text in the project configuration.
| [project] | ||
| name = "CheckPointHEC" | ||
| version = "1.0" | ||
| description = "Add your description here" | ||
| requires-python = ">=3.11,<3.12" | ||
| dependencies = [ | ||
| "cached-property>=2.0.1", | ||
| "dateparser>=1.3.0", | ||
| "environmentcommon", | ||
| "python-jose>=3.5.0", | ||
| "requests>=2.32.5", | ||
| "tipcommon", | ||
| ] | ||
|
|
||
| [dependency-groups] | ||
| dev = [ | ||
| "pytest>=9.0.2", | ||
| "soar-sdk", | ||
| "integration-testing", | ||
| "pytest-json-report>=1.5.0", | ||
| ] | ||
|
|
||
| [tool.pytest.ini_options] | ||
| pythonpath = "." | ||
|
|
||
| [tool.uv.sources] | ||
| soar-sdk = { git = "https://github.com/chronicle/soar-sdk" } | ||
| tipcommon = { path = "../../../../../packages/tipcommon/whls/TIPCommon-2.3.1-py3-none-any.whl" } | ||
| environmentcommon = { path = "../../../../../packages/envcommon/whls/EnvironmentCommon-1.0.3-py3-none-any.whl" } | ||
| integration-testing = { path = "../../../../../packages/integration_testing_whls/integration_testing-2.3.1-py3-none-any.whl" } |
There was a problem hiding this comment.
New integrations added to content/response_integrations/** must include corresponding unit tests using pytest. Please add a tests/ directory with test suites modeled after the reference examples in the style guide.
References
- All new features, bug fixes, or integrations added to content/response_integrations/** must include corresponding unit tests. (link)
| ERROR_MESSAGE: str = "Failed creating Anomaly exception!" | ||
|
|
||
|
|
||
| class CreateAnomalyException(BaseAction): |
There was a problem hiding this comment.
Classes and methods should have Google-style docstrings to improve maintainability and readability.
References
- Follow the Google Style Docstrings for all modules, classes, and functions. (link)
| def _perform_action(self, _=None) -> None: | ||
| request_json = json.loads(self.params.request_json) | ||
| added_by = self.params.added_by | ||
| self.json_results = self.api_client.create_anomaly_exception(request_json=request_json, added_by=added_by) |
There was a problem hiding this comment.
Since this action assigns a value to self.json_results, a corresponding JSON example file must be provided in the resources/ directory following the naming convention: resources/create_anomaly_exc_JsonResult_example.json.
References
- If a JSON result is detected, a corresponding JSON example file must exist in the integration's resources/ directory. (link)
1 participant
Title (Please follow the convention below)
Please use a clear and concise title that summarizes your changes.
If this PR is related to an internal Buganizer ticket, please include its ID at the beginning.
Convention:
[Optional Buganizer ID: 123456789] Short, descriptive title of changesExamples:
Fix: Resolve issue with API endpoint returning 500 error[Buganizer ID: 987654321] Feature: Add support for custom data typesDocs: Update README with installation instructionsDescription
Please provide a detailed description of your changes. This helps reviewers understand your work and its context.
What problem does this PR solve?
(e.g., "Fixes a bug where X was happening," "Implements feature Y to allow Z," "Improves performance of function A.")
How does this PR solve the problem?
(e.g., "Modified algorithm in
src/foo.js," "Added new componentBar.vue," "Updated dependencybazto version 1.2.3.")Any other relevant information (e.g., design choices, tradeoffs, known issues):
(e.g., "Chose approach A over B due to performance considerations," "This change might affect X in certain edge cases," "Requires manual migration steps for existing users.")
Checklist:
Please ensure you have completed the following items before submitting your PR.
This helps us review your contribution faster and more efficiently.
General Checks:
Open-Source Specific Checks:
For Google Team Members and Reviewers Only:
Screenshots (If Applicable)
If your changes involve UI or visual elements, please include screenshots or GIFs here.
Ensure any sensitive data is redacted or generalized.
Further Comments / Questions
Any additional comments, questions, or areas where you'd like specific feedback.