Skip to content

Commit

Permalink
remote access +syslog: deprecate + fix link + change to XSOAR (#899)
Browse files Browse the repository at this point in the history
* remote access: fix link + change to XSOAR

* add deprecated message

* maintain org id

* fix deprecated notice

* deprecate also syslog and add to deprecation page

* fix tests

* optimize node startup and mdx-parse-server

Co-authored-by: glicht <[email protected]>
  • Loading branch information
glicht and glicht authored Dec 29, 2021
1 parent b13a006 commit 46ed29a
Show file tree
Hide file tree
Showing 7 changed files with 44 additions and 15 deletions.
16 changes: 16 additions & 0 deletions content-repo/extra-docs/articles/deprecated_info.json
Original file line number Diff line number Diff line change
Expand Up @@ -245,6 +245,22 @@
"eol_start": "May 01, 2021",
"note": "Use the Generic SQL integration instead."
},
{
"id": "remoteaccess",
"name": "Remote Access",
"description": "Deprecated. Use the Remote Access v2 integration instead.",
"maintenance_start": "Jan 01, 2022",
"eol_start": "Jan 01, 2023",
"note": "Use the Remote Access v2 integration instead."
},
{
"id": "syslog",
"name": "Syslog",
"description": "Deprecated. Use the Syslog v2 integration instead.",
"maintenance_start": "Jan 01, 2022",
"eol_start": "Jan 01, 2023",
"note": "Use the Syslog v2 integration instead."
},
{
"id": "palo_alto_networks_pan_os_edl_management",
"note": "Use the Palo Alto Networks PAN-OS EDL Service integration instead. For customers with over 1000 Firewalls, this integration remains fully supported."
Expand Down
27 changes: 16 additions & 11 deletions content-repo/extra-docs/integrations/remote-access.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,16 @@
---
title: Remote Access
title: Remote Access (Deprecated)
id: remote-access
description: File transfer and execute commands via ssh, on remote machines.
---

This integration enables Demisto to access and run commands on a terminal in a remote location (via SSH). For example this could be used to connect to a remote machine and search for malicious files.
:::caution Deprecated
Use the Remote Access v2 integration instead.
:::

Can be used via the Demisto CLI or in a Playbook.
This integration enables Cortex XSOAR to access and run commands on a terminal in a remote location (via SSH). For example this could be used to connect to a remote machine and search for malicious files.

Can be used via the Cortex XSOAR CLI or in a Playbook.

## Use SSH with a Custom Certificate
To use the Remote Access integration with a custom certificate you need to add custom credential and then add the certificate.
Expand All @@ -23,25 +28,25 @@ To use the Remote Access integration with a custom certificate you need to add c

3. When you configure the integration instance, make sure you select the credentials you created.

## Configure the Remote Access Integration on Demisto
## Configure the Remote Access Integration on Cortex XSOAR
1. Go to ‘Settings > Integrations > Servers & Services’
1. Locate the Remote Access integration by searching for it using the search box on the top of the page.
1. Click ‘Add instance’ to create and configure a new integration. You should configure the following Remote Access and Demisto-specific settings:
1. Click ‘Add instance’ to create and configure a new integration. You should configure the following Remote Access and Cortex XSOAR specific settings:

**Name**: A textual name for the integration instance.

**Default Hostname or IP Address**: The hostname or IP address of the Remote Access Make sure the URL is reachable with respect to IP address and port.

**Credentials and Password**: Configure credentials in the Credentials section in Demisto, including a valid certificate. Ciphers: Specify the ciphers to use for the inception. To use more and one cipher divide between then with commas (,).
**Credentials and Password**: Configure credentials in the Credentials section in Cortex XSOAR, including a valid certificate. Ciphers: Specify the ciphers to use for the inception. To use more and one cipher divide between then with commas (,).
The supported ciphers are: “aes128-ctr”, “aes192-ctr”, “aes256-ctr” and “[email protected]”, “arcfour256”, “arcfour128".

**Interactive terminal mode (checkbox)**: When using this option Demisto cleans the response from the remote machine.
**Interactive terminal mode (checkbox)**: When using this option Cortex XSOAR cleans the response from the remote machine.

**Terminal Type**: The terminal emulator program to use such as xterm (default), GNOME Terminal, Konsole, and Terminal.

**Demisto engine**: If relevant, select the engine that acts as a proxy to the server.
Engines are used when you need to access a remote network segments and there are network devices such as proxies, firewalls, etc. that prevent the Demisto server from accessing the remote networks.
For more information on Demisto engines see [here](https://demisto.zendesk.com/hc/en-us/articles/226274727-Settings-Integrations-Engines)
**Cortex XSOAR Engine**: If relevant, select the engine that acts as a proxy to the server.
Engines are used when you need to access a remote network segments and there are network devices such as proxies, firewalls, etc. that prevent the Cortex XSOAR server from accessing the remote networks.
For more information on Cortex XSOAR engines see [here](https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-5/cortex-xsoar-admin/engines/understand-demisto-engines.html)

**Require users to enter additional password**: Select whether you’d like an additional step where users are required to authenticate themselves with a password.

Expand All @@ -51,4 +56,4 @@ After completing the test successfully, press the `Done` button.
## Commands
* **copy-from** - Copy file from remote system to war room
* **copy-to** - Copy file from war room to remote system
* **ssh** - Run command on remote system with ssh
* **ssh** - Run command on remote system with ssh
7 changes: 6 additions & 1 deletion content-repo/extra-docs/integrations/syslog.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,13 @@
---
title: Syslog
title: Syslog (Deprecated)
id: syslog
description: Syslog events logger. Automatically convert incoming logs to incidents.
---

:::caution Deprecated
Use the Syslog v2 integration instead.
:::

A Syslog server provides the ability to automatically open incidents from Syslog clients.
This integration provides the ability to filter which logs are to be converted to incidents (or choose to convert all logs).

Expand Down
2 changes: 1 addition & 1 deletion content-repo/gendocs_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -234,7 +234,7 @@ def test_process_extra_doc(tmp_path, mdx_server):
assert not res.error_msg
assert res.id == 'remote-access'
assert res.description.startswith('File transfer and execute commands')
assert res.name == 'Remote Access'
assert res.name == 'Remote Access (Deprecated)'
with open(str(tmp_path / f'{res.id}.md'), 'r') as f:
assert f.readline().startswith('---')
assert f.readline().startswith(f'id: {res.id}')
Expand Down
4 changes: 3 additions & 1 deletion content-repo/mdx_utils.py
Original file line number Diff line number Diff line change
Expand Up @@ -73,9 +73,11 @@ def verify_mdx_server(readme_content: str):
def start_mdx_server():
global MDX_SERVER_PROCESS
if not MDX_SERVER_PROCESS:
node_version_res = subprocess.run(["node", "--version"], capture_output=True, text=True)
print(f'starting mdx server with node version: {node_version_res}')
mdx_parse_server = f'{os.path.dirname(os.path.abspath(__file__))}/../mdx-parse-server.js'
MDX_SERVER_PROCESS = subprocess.Popen(['node', mdx_parse_server], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
time.sleep(1) # let the node process complete startup
time.sleep(2) # let the node process complete startup


def stop_mdx_server():
Expand Down
2 changes: 1 addition & 1 deletion content-repo/post_github_comment_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ def test_get_link_for_ref_file():
assert name == "Content Release 20.12.0"
assert url == "http://localhost/docs/reference/releases/20.12.0"
(name, url) = get_link_for_ref_file("http://localhost", f"{ROOT_DIR}/content-repo/extra-docs/integrations/syslog.md")
assert name == "Syslog"
assert name == "Syslog (Deprecated)"
assert url == "http://localhost/docs/reference/integrations/syslog"
(name, url) = get_link_for_ref_file("http://localhost", f"{ROOT_DIR}/content-repo/extra-docs/articles/IAM-premium-pack-readme.md")
assert name == "Identity Lifecycle Management (ILM)"
Expand Down
1 change: 1 addition & 0 deletions mdx-parse-server.js
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ function requestHandler(req, res) {
if (req.method != 'POST') {
res.statusCode = 405
res.end('Only POST is supported')
return
}
let body = ''
req.setEncoding('utf8');
Expand Down

0 comments on commit 46ed29a

Please sign in to comment.