Lumu SecOps Integration - SecOps Operation [update new API] by eparralumu · Pull Request #46058 · demisto/content

eparralumu · 2026-09-30T21:11:21Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

N/A

Description

Second version of Lumu Pack, include new Lumu SecOps Integration with its Layout, IncidentType, IncidentFields, Classifier, Mapping and Integration sections, check the introductory video https://www.youtube.com/watch?v=m1xki-jioI8
This update intends to use our latest Incident API. The old API is still supported but we intend to ease the transition for our customers. The integration will function like the current one but will use a broader range of incident types and the new infrastructure; however, the essence remains the same by using the Cortex XSOAR mirroring capabilities.

Must have

Tests
Documentation

relates: https://jira-dc.paloaltonetworks.com/browse/CIAC-18495

CLAassistant · 2026-09-30T21:11:38Z

All committers have signed the CLA.

content-bot · 2026-09-30T21:13:10Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

content-bot · 2026-09-30T21:13:12Z

Hi @eparralumu, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

content-bot · 2026-09-30T21:13:13Z

🤖 AI-Powered Code Review Available

Hi @kamalq97, @Benimanela, you can leverage AI-powered code review to assist with this PR!

Available Commands:

@marketplace-ai-reviewer start review - Initiate a full AI code review
@marketplace-ai-reviewer re-review - Incremental review for new commits

kamalq97 · 2026-10-01T08:47:28Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.

Hi @eparralumu

Thank you for your contribution!

Please read through and sign our recently updated Contributor License Agreement to enable us to proceed with handling this PR.

Regards,

Benimanela

Hi @eparralumu, Thank you for the work on this contribution. The implementation looks good overall.

I have a few comments from a security perspective at this stage:

General

Please run demisto-sdk format on the changed files to ensure they comply with XSOAR standards.

Integration parameters (`LumuSecops.yml`)

Required:
- api_key: please use type: 9 (credentials, with hiddenusername: true) instead of type: 4.
- mirror_direction additionalinfo mentions SentinelOne. Please update it to Lumu.
Recommended:
- Add section: Connect / section: Collect to the params (docs).
- max_fetch has no display and overlaps with total_items_per_lumu_fetch / fetch_offset. Please label them clearly or remove the redundant ones.
- Please document the permissions/scope the API key requires.

Release Notes

Since the integration, incident type, mapper and layout are all new in 1.0.32, please keep a single New: entry per entity and drop the Changed: bullets.
The RN header Lumu SecOps should match the integration display name (Lumu Secops).

Incident Fields

Some new fields appear to duplicate existing Lumu fields, for example:
- lumu_secops_company_id / companyId
- lumu_secops_status / lumu_status
- lumu_secops_description / lumu_description
If the semantics are the same, please consider reusing the existing fields by associating them with the LumuSecops type.

Let me know once you've addressed the feedback so I can review again!

marketplace-ai-reviewer · 2026-10-12T07:41:00Z

🤖 Analysis started. Please wait for results...

marketplace-ai-reviewer · 2026-10-12T08:40:26Z

🤖 AI Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

marketplace-ai-reviewer

Hi there! Thanks for submitting this integration for Lumu. I've reviewed your code and found a few areas that need adjustment, primarily around Python best practices, YAML configuration standards, and documentation formatting.

Here are the key areas to focus on:

Code Quality & Context: Please use safe dictionary access (.get()), standard parsing functions (like arg_to_datetime), and avoid unbounded loops. Ensure exceptions are raised properly for mirroring and avoid overloading the integration context with large caches. Don't forget to add the missing unit tests!
YAML Standards: Update the configuration to use type: 9 for secrets, implement sectionorder for newer Cortex versions, and ensure all descriptions follow standard phrasing (active voice, starting with "The").
Documentation: Move general product overviews and usage examples from the description file to the README, generate command examples, and fix minor copy-paste errors and release note formatting.

Thanks again for your hard work on this, and let me know if you have any questions!

Additionally, please address the following file-level notes:

Packs/Lumu/Integrations/LumuSecops/LumuSecops.yml: - Missing Integration_description.md file.
Please ensure that the README.md file is updated to reflect all the new commands, arguments, and outputs introduced in this YML file, including format examples for time/date outputs.
Packs/Lumu/Integrations/LumuSecops/LumuSecops.py: Missing unit tests and unused YAML parameters.
Packs/Lumu/pack_metadata.json: - The mandatory created key is missing from the pack metadata.
The vendor name 'Lumu' is missing from the keywords list.
Packs/Lumu/ReleaseNotes/1_0_32.md: The version bump does not match the nature of the changes.

@TheL0L, @Benimanela please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

… close-incident updates - filter out invalid label IDs before incident-list API requests - extend tests

content-bot · 2026-10-18T11:16:53Z

For the Reviewer: Trigger build request has been accepted for this contribution PR.

content-bot · 2026-10-18T11:17:06Z

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/13869878

TheL0L · 2026-10-18T13:38:15Z

Hi @eparralumu, multiple validations are failing on the new incident fields in Packs/Lumu/IncidentFields/.

What's wrong: a new incident field's name must start with the pack name, and the check is case-sensitive. For this pack that prefix is Lumu.

18 fields are named lumu_secops_.... The lowercase lumu doesn't match.
incidentfield-LumuSecops-lumu_secops_take_status_action.json is named Take Status Action, which has no prefix.

How to fix it:

Rename the name value in each file so it starts with Lumu. For example:
- lumu_secops_total_targets_count -> Lumu SecOps Total Targets Count
- lumu_secops_last_action_user_id -> Lumu SecOps Last Action User ID
- Take Status Action -> Lumu SecOps Take Status Action
Please keep the existing cliName and id values (lumusecops... / incident_lumusecops...) so layouts and mirroring keep working.
Update the keys in Classifiers/classifier-mapper-incoming-LumuSecops.json to use the new field names. Mapper keys must match the field display name exactly.
The mapper also points to lumu_secops_description and lumu_secops_incident_id, but those incident fields don't exist. Please point these at lumu_description / lumu_incidentId.
Update ReleaseNotes/2_0_0.md to use the new field names.

Co-authored-by: Sergei Yakima <sergeiyakima1@gmail.com>

- Rename new LumuSecops incident field display names to start with Lumu (case-sensitive requirement), including Lumu SecOps Take Status Action. - Keep existing cliName and id values unchanged to preserve layouts/mirroring compatibility. - Update classifier-mapper-incoming-LumuSecops.json mapping keys to exactly match new field display names. - Fix invalid mapper targets from lumu_secops_description / lumu_secops_incident_id to lumu_description / lumu_incidentId. - Update ReleaseNotes/2_0_0.md to reflect new field display names.

Benimanela

Hi @eparralumu, Thank you for addressing the previous feedback. The type 9 credentials, sections, field reuse and naming all look good now.

I have a few remaining comments from a security perspective:

General

Please run demisto-sdk format on the changed files to ensure they comply with XSOAR standards.

Mapper (`classifier-mapper-incoming-LumuSecops.json`)

Required:
- lumu_status, Source Status and State are mapped from status, but on fetch normalize_incident_record overwrites status with IncidentStatus.ACTIVE (1). The original Lumu status is stored in lumu_secops_status. Please map these fields from lumu_secops_status.
- lumu_status only has the options mute/unmute. Please extend its select values to cover the SecOps statuses (e.g. open, muted, closed).
Recommended:
- statusTimestamp is mapped, but that field is only associated with the Lumu type. Please add LumuSecops to its associatedTypes or remove the mapping.

Integration parameters (`LumuSecops.yml`)

Required:
- api_key: please add displaypassword: API Key so the key field is labelled correctly with hiddenusername: true.

Release Notes (`2_0_0.md`)

Required: The RN still includes development history. Please keep a single New: line per new entity (integration, incident type, classifier, mapper, layout, each new field) and remove:
- the duplicated classifier, mapper and layout lines
- the "Updated…" / "Fixed lumu_secops_status mapping" bullets (that field no longer exists)
- the un-headed bullet list at the end of the Incident Fields section

Pack Metadata

Recommended:
- Please remove the created key. It shouldn't be set manually for an existing pack.

Let me know once you've addressed the feedback so I can review again!

…cident type, classifier, mapper, layout, and each new field) - Remove duplicated classifier/mapper/layout entries

eparralumu · 2026-10-20T22:21:19Z

Let me know once you've addressed the feedback so I can review again!

@Benimanela , we think we are finish the latest changes requests

content-bot · 2026-10-25T08:06:04Z

For the Reviewer: Trigger build request has been accepted for this contribution PR.

content-bot · 2026-10-25T08:06:12Z

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/14070829

github-actions · 2026-10-25T12:02:34Z

Thank you for your contribution. Your external PR has been merged and the changes are now included in one or more internal PRs for further review.

Note

Contributions containing XSIAM content (Modeling Rules, Parsing Rules, Correlation Rules, or Dashboards) are subject to an additional review process and may take longer to be merged to master.

* Lumu SecOps Integration - SecOps Operation [update new API] (#46058) * Lumu SecOps Integration - SecOps Operation [update new API] * add CONTRIBUTORS.json * Address security review updates for LumuSecops integration - Updated LumuSecops.yml security/config UX: - Changed api_key to credential type (type: 9) with hiddenusername: true. - Added parameter sections (Connect / Collect) and sectionorder. - Set fetch defaults and improved collect-time parameter grouping/labels. - Reused existing Lumu incident fields for Secops by associating LumuSecops with: - companyId, lumu_status, lumu_description, lumu_incidentId. - Updated classifier/mapper and layout artifacts to align with new LumuSecops incident mapping and UI. - Updated release notes for 1.0.32: - Header changed to Lumu Secops (display-name match). - Converted previous Changed: notes to New: for newly introduced entities/components. - Reformatted generated content artifacts (README/layout JSON) as part of staged updates. * Refactor LumuSecops to reuse existing Lumu incident fields - Remove duplicate LumuSecops incident fields: - lumu_secops_company_id - lumu_secops_description - lumu_secops_incident_id - lumu_secops_status - Update incoming mapper to stop mapping removed duplicate Secops field keys. - Keep Secops mapping focused on non-duplicated, Secops-specific fields. - Simplify integration fetch parameter configuration and labels in LumuSecops.yml. - Regenerate/update README.md to reflect current integration parameter definitions. * Harden LumuSecops input handling and refine integration configuration - Added HTML escaping in comment/description rendering paths to reduce injection risk in generated incident content. - Refactored fetch normalization flow to pass mirroring context explicitly (integration_instance, mirror_direction, mirror_tags) instead of relying on module-level globals. - Improved argument parsing robustness by using arg_to_number for label and fetch-size numeric inputs. - Switched to typed platform constants for incident defaults (IncidentSeverity.MEDIUM, IncidentStatus.ACTIVE). - Replaced direct return_error path in remote-data rate-limit handling with a dedicated CustomLumuException. - Updated LumuSecops.yml docs/parameter metadata (including mirror direction wording from SentinelOne -> Lumu) and regenerated README.md. - Removed obsolete helper test (add_prefix_to_comment) and aligned metadata update in Packs/Lumu/pack_metadata.json. * - Update LumuSecops integration documentation in Packs/Lumu/Integrations/LumuSecops/LumuSecops.yml: - Clarify multiple output date fields as ISO 8601 timestamps. - Clarify list-style args (adversary_types, labels, status) as comma-separated values. - Mark lumusecops-get-cache as hidden/internal and improve its description. - Improve cache reset behavior in Packs/Lumu/Integrations/LumuSecops/LumuSecops.py: - Replace partial cache reset with full expected cache structure (cache, lumu_secops_incident_ids, source_records, users, labels). - Clean up Python code and tests: - Remove unused urllib3 import in Packs/Lumu/Integrations/LumuSecops/LumuSecops.py. - Remove unused add_prefix_to_comment import in Packs/Lumu/Integrations/LumuSecops/LumuSecops_test.py. - Apply formatting/whitespace cleanup and line wrapping. - Refresh command examples in Packs/Lumu/Integrations/LumuSecops/command_examples.txt with updated sample IDs/labels. - Add pack keywords in Packs/Lumu/pack_metadata.json for better discoverability. * add lumusecops-clear-cache and align YAML/README description active voice writing * major version bump to 2.0.0 with LumuSecops updates and release note cleanup * lazy-load users/labels in remote sync and tighten test-module cache init * Convert string arguments to integers. * Added documentation blocks (command example, context example, human-readable output) for multiple commands. New example sections were added for: - lumusecops-retrieve-labels - lumusecops-retrieve-a-specific-label - lumusecops-mark-incident-as-read - lumusecops-begin-incident-work - lumusecops-comment-incident - lumusecops-mute-incident - lumusecops-unmute-incident - lumusecops-close-incident * - add wipe_cache() and invoke it after get-remote-data processing and close-incident updates - filter out invalid label IDs before incident-list API requests - extend tests * fix identantion * integration description updated * Update Packs/Lumu/pack_metadata.json Co-authored-by: Sergei Yakima <sergeiyakima1@gmail.com> * Fix LumuSecops incident field naming, mapper keys - Rename new LumuSecops incident field display names to start with Lumu (case-sensitive requirement), including Lumu SecOps Take Status Action. - Keep existing cliName and id values unchanged to preserve layouts/mirroring compatibility. - Update classifier-mapper-incoming-LumuSecops.json mapping keys to exactly match new field display names. - Fix invalid mapper targets from lumu_secops_description / lumu_secops_incident_id to lumu_description / lumu_incidentId. - Update ReleaseNotes/2_0_0.md to reflect new field display names. * - Keep a single New: line per new entity in 2_0_0.md (integration, incident type, classifier, mapper, layout, and each new field) - Remove duplicated classifier/mapper/layout entries * fix some tests and reach the test coverage quota --------- Co-authored-by: Sergei Yakima <sergeiyakima1@gmail.com> * revert single line format change * fix validation * update docker image * fix validations * revert single line format change * fix validation * revert outdated metadata field --------- Co-authored-by: eparralumu <123758248+eparralumu@users.noreply.github.com> Co-authored-by: Sergei Yakima <sergeiyakima1@gmail.com> Co-authored-by: Sergei Yakima <syakima@paloaltonetworks.com>

Lumu SecOps Integration - SecOps Operation [update new API]

f5cb117

content-bot added Contribution Thank you! Contributions are always welcome! External PR Partner Support Level Indicates that the contribution is for Partner supported pack labels Sep 30, 2026

content-bot changed the base branch from master to contrib/eparralumu_lumu September 30, 2026 21:12

content-bot assigned kamalq97 and Benimanela Sep 30, 2026

content-bot added the Security Review label Sep 30, 2026

content-bot requested review from Benimanela and kamalq97 September 30, 2026 21:13

kamalq97 added pending-contributor The PR is pending the response of its creator Partner Contribution Form Filled Whether contribution form filled or not. Partner-Approved labels Oct 1, 2026

kamalq97 assigned TheL0L and unassigned kamalq97 Oct 1, 2026

kamalq97 requested review from TheL0L and removed request for kamalq97 October 1, 2026 10:23

add CONTRIBUTORS.json

6efed1d

Benimanela suggested changes Oct 7, 2026

View reviewed changes

TheL0L added the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Oct 12, 2026

marketplace-ai-reviewer removed the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Oct 12, 2026

marketplace-ai-reviewer reviewed Oct 12, 2026

View reviewed changes

eparralumu added 3 commits October 15, 2026 20:22

- add wipe_cache() and invoke it after get-remote-data processing and…

11f1f11

… close-incident updates - filter out invalid label IDs before incident-list API requests - extend tests

fix identantion

ec26495

integration description updated

04d4e44

TheL0L added docs-approved ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. labels Oct 18, 2026

content-bot removed the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Oct 18, 2026

TheL0L reviewed Oct 18, 2026

View reviewed changes

Comment thread Packs/Lumu/pack_metadata.json

TheL0L added the pending-contributor The PR is pending the response of its creator label Oct 18, 2026

eparralumu and others added 2 commits October 19, 2026 15:44

Update Packs/Lumu/pack_metadata.json

1ee4116

Co-authored-by: Sergei Yakima <sergeiyakima1@gmail.com>

Benimanela suggested changes Oct 20, 2026

View reviewed changes

- Keep a single New: line per new entity in 2_0_0.md (integration, in…

78385ff

…cident type, classifier, mapper, layout, and each new field) - Remove duplicated classifier/mapper/layout entries

eparralumu requested a review from Benimanela October 22, 2026 01:02

fix some tests and reach the test coverage quota

c1506b8

Benimanela approved these changes Oct 25, 2026

View reviewed changes

Benimanela added the Security Approved If a contribution has been approved for merge by the security team, then this will allow a merge label Oct 25, 2026

TheL0L added ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. and removed pending-contributor The PR is pending the response of its creator labels Oct 25, 2026

content-bot removed the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Oct 25, 2026

TheL0L approved these changes Oct 25, 2026

View reviewed changes

TheL0L merged commit 3d0464c into demisto:contrib/eparralumu_lumu Oct 25, 2026
60 of 61 checks passed

content-bot mentioned this pull request Oct 25, 2026

Lumu SecOps Integration - SecOps Operation [update new API] #46379

Merged

3 of 5 tasks

Conversation

eparralumu commented Sep 30, 2026 • edited by marketplace-content-sync Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contributing to Cortex XSOAR Content

Status

Related Issues

Description

Must have

Uh oh!

CLAassistant commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

content-bot commented Sep 30, 2026

Uh oh!

content-bot commented Sep 30, 2026

Uh oh!

content-bot commented Sep 30, 2026

🤖 AI-Powered Code Review Available

Uh oh!

kamalq97 commented Oct 1, 2026

Uh oh!

Benimanela left a comment

Choose a reason for hiding this comment

General

Integration parameters (LumuSecops.yml)

Release Notes

Incident Fields

Uh oh!

marketplace-ai-reviewer commented Oct 12, 2026

Uh oh!

marketplace-ai-reviewer commented Oct 12, 2026

Uh oh!

marketplace-ai-reviewer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

content-bot commented Oct 18, 2026

Uh oh!

content-bot commented Oct 18, 2026

Uh oh!

TheL0L commented Oct 18, 2026

Uh oh!

Uh oh!

Benimanela left a comment

Choose a reason for hiding this comment

General

Mapper (classifier-mapper-incoming-LumuSecops.json)

Integration parameters (LumuSecops.yml)

Release Notes (2_0_0.md)

Pack Metadata

Uh oh!

eparralumu commented Oct 20, 2026

Uh oh!

content-bot commented Oct 25, 2026

Uh oh!

content-bot commented Oct 25, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 25, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

eparralumu commented Sep 30, 2026 •

edited by marketplace-content-sync

Loading

CLAassistant commented Sep 30, 2026 •

edited

Loading

Integration parameters (`LumuSecops.yml`)

Mapper (`classifier-mapper-incoming-LumuSecops.json`)

Integration parameters (`LumuSecops.yml`)

Release Notes (`2_0_0.md`)