SLS - Clarify Constraints

Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py

@@ -1334,17 +1334,20 @@ def prepare_fetch_incidents_query(
     Returns:
         SQL query that matches the arguments
     """
-    if fetch_filter and (fetch_subtype or fetch_severity):
+    # "all" adds no condition to the query, so it does not conflict with a fetch filter.
+    has_subtype_restriction = bool(fetch_subtype) and "all" not in fetch_subtype
+    has_severity_restriction = bool(fetch_severity) and "all" not in fetch_severity
+    if fetch_filter and (has_subtype_restriction or has_severity_restriction):
         raise DemistoException("Fetch Filter parameter cannot be used with Subtype/Severity parameters.")
     query = f"SELECT {fetch_fields} FROM `{fetch_table}` "  # guardrails-disable-line # noqa: S608
     time_filter = "event_time" if "log" in fetch_table else "time_generated"
     query += f'WHERE {time_filter} Between TIMESTAMP("{fetch_timestamp}") AND CURRENT_TIMESTAMP'
     if fetch_filter:
         query += f" AND {fetch_filter}"
-    if fetch_subtype and "all" not in fetch_subtype:
+    if has_subtype_restriction:
         sub_types = [f'sub_type.value = "{sub_type}"' for sub_type in fetch_subtype]
         query += f' AND ({" OR ".join(sub_types)})'
-    if fetch_severity and "all" not in fetch_severity:
+    if has_severity_restriction:
         severities = [f'vendor_severity.value = "{severity}"' for severity in fetch_severity]
         query += f' AND ({" OR ".join(severities)})'
     query += f" ORDER BY {time_filter} ASC LIMIT {fetch_limit}"

Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml

@@ -142,7 +142,7 @@ configuration:
   type: 12
   required: false
   section: Collect
-- additionalinfo: 'Filter the fetched incidents according to the given query. Query example: "source_ip.value LIKE `192.168.1.*` AND dst = `192.168.1.12`" Note: Can not be used in combination with `Severity` and `Subtype` parameters.'
+- additionalinfo: 'Filter the fetched incidents according to the given query. Query example: "source_ip.value LIKE `192.168.1.*` AND dst = `192.168.1.12`" Note: Can not be used in combination with specific `Severity` and `Subtype` values. Leave them empty or set to "all".'
   display: Fetch Filter
   name: filter_query
   type: 12

Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_description.md

@@ -30,6 +30,8 @@ This integration was tested with version 2 of Strata Logging Service XSOAR Conne
     * **insecure**: Trust any certificate (not secure).
     * **Fetch incidents**: Whether to fetch incidents.
     * **First fetch time**: First fetch time (\<number\> \<time unit\>, e.g., 12 hours, 7 days, 3 months, 1 year).
+    * **Fetch Table**: The table incidents are fetched from.
+    * **Fetch Filter**: A query used to filter the fetched incidents. Cannot be used in combination with specific **Severity of events to fetch (Firewall)** or **Subtype of events to fetch (Firewall)** values. When using a Fetch Filter, leave those parameters empty or set them to "all".
     * **Severity of events to fetch (Firewall)**: Select from all, Critical, High, Medium, Low, Informational, or Unused.
     * **Subtype of events to fetch (Firewall)**: Select from all, attack, url, virus, spyware, vulnerability, file, scan, flood, packet, resource, data, url-content, wildfire, extpcap, wildfire-virus, http-hdr-insert, http-hdr, email-hdr, spyware-dns, spyware-wildfire-dns, spyware-wpc-dns, spyware-custom-dns, spyware-cloud-dns, spyware-raven, spyware-wildfire-raven, spyware-wpc-raven, wpc-virus, or sctp.
 7. Click **Test** to validate the credentials and connection.

Packs/CortexDataLake/Integrations/CortexDataLake/README.md

@@ -30,6 +30,8 @@ This integration was tested with version 2 of Strata Logging Service XSOAR Conne
     * **insecure**: Trust any certificate (not secure).
     * **Fetch incidents**: Whether to fetch incidents.
     * **First fetch time**: First fetch time (\<number\> \<time unit\>, e.g., 12 hours, 7 days, 3 months, 1 year).
+    * **Fetch Table**: The table incidents are fetched from.
+    * **Fetch Filter**: A query used to filter the fetched incidents. Cannot be used in combination with specific **Severity of events to fetch (Firewall)** or **Subtype of events to fetch (Firewall)** values. When using a Fetch Filter, leave those parameters empty or set them to "all".
     * **Severity of events to fetch (Firewall)**: Select from all, Critical, High, Medium, Low, Informational, or Unused.
     * **Subtype of events to fetch (Firewall)**: Select from all, attack, url, virus, spyware, vulnerability, file, scan, flood, packet, resource, data, url-content, wildfire, extpcap, wildfire-virus, http-hdr-insert, http-hdr, email-hdr, spyware-dns, spyware-wildfire-dns, spyware-wpc-dns, spyware-custom-dns, spyware-cloud-dns, spyware-raven, spyware-wildfire-raven, spyware-wpc-raven, wpc-virus, or sctp.
 7. Click **Test** to validate the credentials and connection.

Packs/CortexDataLake/ReleaseNotes/1_6_5.md

@@ -0,0 +1,7 @@
+
+#### Integrations
+
+##### Strata Logging Service XSOAR Connector
+
+- Fixed an issue where fetching incidents failed when the *Fetch Filter* parameter was used together with the *Severity of events to fetch (Firewall)* or *Subtype of events to fetch (Firewall)* parameters set to **all**.
+- Updated the integration documentation and the *Fetch Filter* parameter help text to clarify that *Fetch Filter* cannot be used with specific *Severity of events to fetch (Firewall)* or *Subtype of events to fetch (Firewall)* values.

Packs/CortexDataLake/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Strata Logging Service by Palo Alto Networks",
     "description": "Palo Alto Networks Strata Logging Service XSOAR Connector provides cloud-based, centralized log storage and aggregation for your on-premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR",
     "support": "xsoar",
-    "currentVersion": "1.6.4",
+    "currentVersion": "1.6.5",
     "author": "Cortex XSOAR",
     "url": "https://docs.paloaltonetworks.com/strata-logging-service",
     "email": "",