diff --git a/.doctrees/environment.pickle b/.doctrees/environment.pickle index dac4a7221..04815e503 100644 Binary files a/.doctrees/environment.pickle and b/.doctrees/environment.pickle differ diff --git a/.doctrees/fn_rsa_netwitness/README.doctree b/.doctrees/fn_rsa_netwitness/README.doctree index ff693645e..f28db1d30 100644 Binary files a/.doctrees/fn_rsa_netwitness/README.doctree and b/.doctrees/fn_rsa_netwitness/README.doctree differ diff --git a/.doctrees/fn_vmray_analyzer/README.doctree b/.doctrees/fn_vmray_analyzer/README.doctree index e5456d4ca..bd95ab90b 100644 Binary files a/.doctrees/fn_vmray_analyzer/README.doctree and b/.doctrees/fn_vmray_analyzer/README.doctree differ diff --git a/.doctrees/sc_email_parser/README.doctree b/.doctrees/sc_email_parser/README.doctree index a2ee88a61..92239610a 100644 Binary files a/.doctrees/sc_email_parser/README.doctree and b/.doctrees/sc_email_parser/README.doctree differ diff --git a/_images/rule_artifact.jpeg b/_images/rule_artifact.jpg similarity index 100% rename from _images/rule_artifact.jpeg rename to _images/rule_artifact.jpg diff --git a/_images/rule_attachment.jpeg b/_images/rule_attachment.jpg similarity index 100% rename from _images/rule_attachment.jpeg rename to _images/rule_attachment.jpg diff --git a/_images/workflow_attachment.jpeg b/_images/workflow_attachment.jpg similarity index 100% rename from _images/workflow_attachment.jpeg rename to _images/workflow_attachment.jpg diff --git a/_sources/fn_rsa_netwitness/README.md.txt b/_sources/fn_rsa_netwitness/README.md.txt index 9b010d5bf..6c6695ec7 100644 --- a/_sources/fn_rsa_netwitness/README.md.txt +++ b/_sources/fn_rsa_netwitness/README.md.txt @@ -14,6 +14,7 @@ The RSA NetWitness functions query for metadata and return pcap and log files fo | Version | Date | Notes | |---------|---------|----------------------------------------------------------------------------------------------------------------------------------------------------| +| 1.1.3 | 04/2024 | Converted a post process script to Python3 | 1.1.2 | 11/2023 | Convert workflows to Python3 | | 1.1.1 | 6/2021 | Bug fix for json logs output, updated execute_call to execute_call_v2, fix for convert_to_nw_time, removed create_tmp_file, fixed workflow scripts | | 1.1.0 | 3/2020 | Initial commit | diff --git a/_sources/fn_vmray_analyzer/README.md.txt b/_sources/fn_vmray_analyzer/README.md.txt index eb86d6597..0f21d29e9 100644 --- a/_sources/fn_vmray_analyzer/README.md.txt +++ b/_sources/fn_vmray_analyzer/README.md.txt @@ -27,7 +27,7 @@ **This package contains a function that executes a VMRay Malware Sandbox Analysis using VMRay Cloud API. Also included are two example workflows and two example rules that demonstrate how to use this function.** - ![screenshot](./screenshots/workflow_attachment.jpeg) + ![screenshot](./screenshots/workflow_attachment.jpg) * The attachment or artifact to be analyzed must be a file. * The report only supports JSON format. HTML and PDF are not supported. @@ -267,7 +267,7 @@ incident.addNote(helper.createRichText(noteText)) | --------- | :---------: | ------------------ | | Example: VMRay Sandbox Analysis [Artifact]| `Artifact` | `Example: VMRay Sandbox Analyzer [Artifact]` | -![screenshot](./screenshots/rule_artifact.jpeg) +![screenshot](./screenshots/rule_artifact.jpg) --- | Rule Name | Object Type | Workflow Triggered | @@ -275,5 +275,5 @@ incident.addNote(helper.createRichText(noteText)) | Example: VMRay Sandbox Analyzer [Attachment]| `Attachment` | `Example: VMRay Sandbox Analyzer [Attachment]` | -![screenshot](./screenshots/rule_attachment.jpeg) +![screenshot](./screenshots/rule_attachment.jpg) diff --git a/_sources/sc_email_parser/README.md.txt b/_sources/sc_email_parser/README.md.txt index 0b184f19c..39248f8f6 100644 --- a/_sources/sc_email_parser/README.md.txt +++ b/_sources/sc_email_parser/README.md.txt @@ -4,6 +4,7 @@ This package consists of the **RuleAndScript.res** and **ScriptAlone.res** IBM S ## History | Version | Date | Comments | | ------: | ---: | -------: | +| 2.3.3 | 4/2023 | Fix for 31 character MD5 values | | 2.3.2 | 2/2023 | Fix index error | | 2.3.1 | 10/2022 | Fix for defanging logic | | 2.3.0 | 9/2022 | Support for Outbound Email 2.0 conversations | @@ -47,7 +48,7 @@ Be aware that any url, mailto email address, url etc. is modified so that it is ## Installation instructions Before installing, verify that your environment meets the following prerequisites: -* IBM SOAR platform is version 39 or later. +* IBM SOAR platform is version 50 or later. * You have a IBM SOAR account to use for the installation. This can be any account that has the permission to view and modify administrator and customization settings, and read and update incidents. You need to know the account username and password. ### Procedure @@ -64,14 +65,14 @@ Before installing, verify that your environment meets the following prerequisite 8. Select **Proceed**. ### Result -After installing from **RuleAndScript.res**, the IBM SOAR platform will have a new Python script called "Generic email script v2.3.0" and a new rule called "Process email message v2.3.0". The rule runs the script when it is triggered by a new email message being received by the IBM SOAR platform. If instead you imported **ScriptAlone.res** then you will only have the new script and not the rule. +After installing from **RuleAndScript.res**, the IBM SOAR platform will have a new Python script called "Generic email script v2.3.3" and a new rule called "Process email message v2.3.3". The rule runs the script when it is triggered by a new email message being received by the IBM SOAR platform. If instead you imported **ScriptAlone.res** then you will only have the new script and not the rule. **Note**: This new rule is disabled by default. To enable: 1. Navigate to **Customization Settings**. 2. Select the "Rules" tab. -3. Modify the "Generic email script v2.3.0" with any custom Allowlist IP address changes -4. Enable the rule "Process email message v2.3.0". +3. Modify the "Generic email script v2.3.3" with any custom Allowlist IP address changes +4. Enable the rule "Process email message v2.3.3". If you are using an older email script: 5. Disable any previous email rule this new script is replacing. diff --git a/fn_rsa_netwitness/README.html b/fn_rsa_netwitness/README.html index 38cf2a5cd..64027c711 100644 --- a/fn_rsa_netwitness/README.html +++ b/fn_rsa_netwitness/README.html @@ -370,15 +370,19 @@
1.1.2
1.1.3
04/2024
Converted a post process script to Python3
1.1.2
11/2023
Convert workflows to Python3
1.1.1
1.1.1
6/2021
Bug fix for json logs output, updated execute_call to execute_call_v2, fix for convert_to_nw_time, removed create_tmp_file, fixed workflow scripts
1.1.0
1.1.0
3/2020
Initial commit
This package contains a function that executes a VMRay Malware Sandbox Analysis using VMRay Cloud API. Also included are two example workflows and two example rules that demonstrate how to use this function.
- +The attachment or artifact to be analyzed must be a file.
The report only supports JSON format. HTML and PDF are not supported.
2.3.2
2.3.3
4/2023
Fix for 31 character MD5 values
2.3.2
2/2023
Fix index error
2.3.1
2.3.1
10/2022
Fix for defanging logic
2.3.0
2.3.0
9/2022
Support for Outbound Email 2.0 conversations
2.2.0
2.2.0
7/2021
Support for Python 3
2.0.2
2.0.2
4/2020
Bug fixes for phishing incident type
2.0.1
2.0.1
10/2019
Fix when email address contains unicode characters
2.0.0
2.0.0
7/2019
Unicode bug fixes
1.0.1
1.0.1
2/2019
Added automatic rule for script execution
1.0.0
1.0.0
1/2019
Initial release
Before installing, verify that your environment meets the following prerequisites:
IBM SOAR platform is version 39 or later.
IBM SOAR platform is version 50 or later.
You have a IBM SOAR account to use for the installation. This can be any account that has the permission to view and modify administrator and customization settings, and read and update incidents. You need to know the account username and password.
After installing from RuleAndScript.res, the IBM SOAR platform will have a new Python script called “Generic email script v2.3.0” and a new rule called “Process email message v2.3.0”. The rule runs the script when it is triggered by a new email message being received by the IBM SOAR platform. If instead you imported ScriptAlone.res then you will only have the new script and not the rule.
+After installing from RuleAndScript.res, the IBM SOAR platform will have a new Python script called “Generic email script v2.3.3” and a new rule called “Process email message v2.3.3”. The rule runs the script when it is triggered by a new email message being received by the IBM SOAR platform. If instead you imported ScriptAlone.res then you will only have the new script and not the rule.
Note: This new rule is disabled by default. To enable:
Navigate to Customization Settings.
Select the “Rules” tab.
Modify the “Generic email script v2.3.0” with any custom Allowlist IP address changes
Enable the rule “Process email message v2.3.0”. +
Modify the “Generic email script v2.3.3” with any custom Allowlist IP address changes
Enable the rule “Process email message v2.3.3”. If you are using an older email script:
Disable any previous email rule this new script is replacing.