diff --git a/.doctrees/environment.pickle b/.doctrees/environment.pickle index dac4a7221..04815e503 100644 Binary files a/.doctrees/environment.pickle and b/.doctrees/environment.pickle differ diff --git a/.doctrees/fn_rsa_netwitness/README.doctree b/.doctrees/fn_rsa_netwitness/README.doctree index ff693645e..f28db1d30 100644 Binary files a/.doctrees/fn_rsa_netwitness/README.doctree and b/.doctrees/fn_rsa_netwitness/README.doctree differ diff --git a/.doctrees/fn_vmray_analyzer/README.doctree b/.doctrees/fn_vmray_analyzer/README.doctree index e5456d4ca..bd95ab90b 100644 Binary files a/.doctrees/fn_vmray_analyzer/README.doctree and b/.doctrees/fn_vmray_analyzer/README.doctree differ diff --git a/.doctrees/sc_email_parser/README.doctree b/.doctrees/sc_email_parser/README.doctree index a2ee88a61..92239610a 100644 Binary files a/.doctrees/sc_email_parser/README.doctree and b/.doctrees/sc_email_parser/README.doctree differ diff --git a/_images/rule_artifact.jpeg b/_images/rule_artifact.jpg similarity index 100% rename from _images/rule_artifact.jpeg rename to _images/rule_artifact.jpg diff --git a/_images/rule_attachment.jpeg b/_images/rule_attachment.jpg similarity index 100% rename from _images/rule_attachment.jpeg rename to _images/rule_attachment.jpg diff --git a/_images/workflow_attachment.jpeg b/_images/workflow_attachment.jpg similarity index 100% rename from _images/workflow_attachment.jpeg rename to _images/workflow_attachment.jpg diff --git a/_sources/fn_rsa_netwitness/README.md.txt b/_sources/fn_rsa_netwitness/README.md.txt index 9b010d5bf..6c6695ec7 100644 --- a/_sources/fn_rsa_netwitness/README.md.txt +++ b/_sources/fn_rsa_netwitness/README.md.txt @@ -14,6 +14,7 @@ The RSA NetWitness functions query for metadata and return pcap and log files fo | Version | Date | Notes | |---------|---------|----------------------------------------------------------------------------------------------------------------------------------------------------| +| 1.1.3 | 04/2024 | Converted a post process script to Python3 | 1.1.2 | 11/2023 | Convert workflows to Python3 | | 1.1.1 | 6/2021 | Bug fix for json logs output, updated execute_call to execute_call_v2, fix for convert_to_nw_time, removed create_tmp_file, fixed workflow scripts | | 1.1.0 | 3/2020 | Initial commit | diff --git a/_sources/fn_vmray_analyzer/README.md.txt b/_sources/fn_vmray_analyzer/README.md.txt index eb86d6597..0f21d29e9 100644 --- a/_sources/fn_vmray_analyzer/README.md.txt +++ b/_sources/fn_vmray_analyzer/README.md.txt @@ -27,7 +27,7 @@ **This package contains a function that executes a VMRay Malware Sandbox Analysis using VMRay Cloud API. Also included are two example workflows and two example rules that demonstrate how to use this function.** - ![screenshot](./screenshots/workflow_attachment.jpeg) + ![screenshot](./screenshots/workflow_attachment.jpg) * The attachment or artifact to be analyzed must be a file. * The report only supports JSON format. HTML and PDF are not supported. @@ -267,7 +267,7 @@ incident.addNote(helper.createRichText(noteText)) | --------- | :---------: | ------------------ | | Example: VMRay Sandbox Analysis [Artifact]| `Artifact` | `Example: VMRay Sandbox Analyzer [Artifact]` | -![screenshot](./screenshots/rule_artifact.jpeg) +![screenshot](./screenshots/rule_artifact.jpg) --- | Rule Name | Object Type | Workflow Triggered | @@ -275,5 +275,5 @@ incident.addNote(helper.createRichText(noteText)) | Example: VMRay Sandbox Analyzer [Attachment]| `Attachment` | `Example: VMRay Sandbox Analyzer [Attachment]` | -![screenshot](./screenshots/rule_attachment.jpeg) +![screenshot](./screenshots/rule_attachment.jpg) diff --git a/_sources/sc_email_parser/README.md.txt b/_sources/sc_email_parser/README.md.txt index 0b184f19c..39248f8f6 100644 --- a/_sources/sc_email_parser/README.md.txt +++ b/_sources/sc_email_parser/README.md.txt @@ -4,6 +4,7 @@ This package consists of the **RuleAndScript.res** and **ScriptAlone.res** IBM S ## History | Version | Date | Comments | | ------: | ---: | -------: | +| 2.3.3 | 4/2023 | Fix for 31 character MD5 values | | 2.3.2 | 2/2023 | Fix index error | | 2.3.1 | 10/2022 | Fix for defanging logic | | 2.3.0 | 9/2022 | Support for Outbound Email 2.0 conversations | @@ -47,7 +48,7 @@ Be aware that any url, mailto email address, url etc. is modified so that it is ## Installation instructions Before installing, verify that your environment meets the following prerequisites: -* IBM SOAR platform is version 39 or later. +* IBM SOAR platform is version 50 or later. * You have a IBM SOAR account to use for the installation. This can be any account that has the permission to view and modify administrator and customization settings, and read and update incidents. You need to know the account username and password. ### Procedure @@ -64,14 +65,14 @@ Before installing, verify that your environment meets the following prerequisite 8. Select **Proceed**. ### Result -After installing from **RuleAndScript.res**, the IBM SOAR platform will have a new Python script called "Generic email script v2.3.0" and a new rule called "Process email message v2.3.0". The rule runs the script when it is triggered by a new email message being received by the IBM SOAR platform. If instead you imported **ScriptAlone.res** then you will only have the new script and not the rule. +After installing from **RuleAndScript.res**, the IBM SOAR platform will have a new Python script called "Generic email script v2.3.3" and a new rule called "Process email message v2.3.3". The rule runs the script when it is triggered by a new email message being received by the IBM SOAR platform. If instead you imported **ScriptAlone.res** then you will only have the new script and not the rule. **Note**: This new rule is disabled by default. To enable: 1. Navigate to **Customization Settings**. 2. Select the "Rules" tab. -3. Modify the "Generic email script v2.3.0" with any custom Allowlist IP address changes -4. Enable the rule "Process email message v2.3.0". +3. Modify the "Generic email script v2.3.3" with any custom Allowlist IP address changes +4. Enable the rule "Process email message v2.3.3". If you are using an older email script: 5. Disable any previous email rule this new script is replacing. diff --git a/fn_rsa_netwitness/README.html b/fn_rsa_netwitness/README.html index 38cf2a5cd..64027c711 100644 --- a/fn_rsa_netwitness/README.html +++ b/fn_rsa_netwitness/README.html @@ -370,15 +370,19 @@

Release History

1.1.2

+

1.1.3

+

04/2024

+

Converted a post process script to Python3

+ +

1.1.2

11/2023

Convert workflows to Python3

-

1.1.1

+

1.1.1

6/2021

Bug fix for json logs output, updated execute_call to execute_call_v2, fix for convert_to_nw_time, removed create_tmp_file, fixed workflow scripts

-

1.1.0

+

1.1.0

3/2020

Initial commit

diff --git a/fn_vmray_analyzer/README.html b/fn_vmray_analyzer/README.html index b4a412541..697570fe7 100644 --- a/fn_vmray_analyzer/README.html +++ b/fn_vmray_analyzer/README.html @@ -387,7 +387,7 @@

v1.0.0#

Overview#

This package contains a function that executes a VMRay Malware Sandbox Analysis using VMRay Cloud API. Also included are two example workflows and two example rules that demonstrate how to use this function.

-

screenshot

+

screenshot