Repository navigation
Lumu SecOps Integration - SecOps Operation [update new API] - #46379
Merged
Merged
Conversation
* Lumu SecOps Integration - SecOps Operation [update new API] * add CONTRIBUTORS.json * Address security review updates for LumuSecops integration - Updated LumuSecops.yml security/config UX: - Changed api_key to credential type (type: 9) with hiddenusername: true. - Added parameter sections (Connect / Collect) and sectionorder. - Set fetch defaults and improved collect-time parameter grouping/labels. - Reused existing Lumu incident fields for Secops by associating LumuSecops with: - companyId, lumu_status, lumu_description, lumu_incidentId. - Updated classifier/mapper and layout artifacts to align with new LumuSecops incident mapping and UI. - Updated release notes for 1.0.32: - Header changed to Lumu Secops (display-name match). - Converted previous Changed: notes to New: for newly introduced entities/components. - Reformatted generated content artifacts (README/layout JSON) as part of staged updates. * Refactor LumuSecops to reuse existing Lumu incident fields - Remove duplicate LumuSecops incident fields: - lumu_secops_company_id - lumu_secops_description - lumu_secops_incident_id - lumu_secops_status - Update incoming mapper to stop mapping removed duplicate Secops field keys. - Keep Secops mapping focused on non-duplicated, Secops-specific fields. - Simplify integration fetch parameter configuration and labels in LumuSecops.yml. - Regenerate/update README.md to reflect current integration parameter definitions. * Harden LumuSecops input handling and refine integration configuration - Added HTML escaping in comment/description rendering paths to reduce injection risk in generated incident content. - Refactored fetch normalization flow to pass mirroring context explicitly (integration_instance, mirror_direction, mirror_tags) instead of relying on module-level globals. - Improved argument parsing robustness by using arg_to_number for label and fetch-size numeric inputs. - Switched to typed platform constants for incident defaults (IncidentSeverity.MEDIUM, IncidentStatus.ACTIVE). - Replaced direct return_error path in remote-data rate-limit handling with a dedicated CustomLumuException. - Updated LumuSecops.yml docs/parameter metadata (including mirror direction wording from SentinelOne -> Lumu) and regenerated README.md. - Removed obsolete helper test (add_prefix_to_comment) and aligned metadata update in Packs/Lumu/pack_metadata.json. * - Update LumuSecops integration documentation in Packs/Lumu/Integrations/LumuSecops/LumuSecops.yml: - Clarify multiple output date fields as ISO 8601 timestamps. - Clarify list-style args (adversary_types, labels, status) as comma-separated values. - Mark lumusecops-get-cache as hidden/internal and improve its description. - Improve cache reset behavior in Packs/Lumu/Integrations/LumuSecops/LumuSecops.py: - Replace partial cache reset with full expected cache structure (cache, lumu_secops_incident_ids, source_records, users, labels). - Clean up Python code and tests: - Remove unused urllib3 import in Packs/Lumu/Integrations/LumuSecops/LumuSecops.py. - Remove unused add_prefix_to_comment import in Packs/Lumu/Integrations/LumuSecops/LumuSecops_test.py. - Apply formatting/whitespace cleanup and line wrapping. - Refresh command examples in Packs/Lumu/Integrations/LumuSecops/command_examples.txt with updated sample IDs/labels. - Add pack keywords in Packs/Lumu/pack_metadata.json for better discoverability. * add lumusecops-clear-cache and align YAML/README description active voice writing * major version bump to 2.0.0 with LumuSecops updates and release note cleanup * lazy-load users/labels in remote sync and tighten test-module cache init * Convert string arguments to integers. * Added documentation blocks (command example, context example, human-readable output) for multiple commands. New example sections were added for: - lumusecops-retrieve-labels - lumusecops-retrieve-a-specific-label - lumusecops-mark-incident-as-read - lumusecops-begin-incident-work - lumusecops-comment-incident - lumusecops-mute-incident - lumusecops-unmute-incident - lumusecops-close-incident * - add wipe_cache() and invoke it after get-remote-data processing and close-incident updates - filter out invalid label IDs before incident-list API requests - extend tests * fix identantion * integration description updated * Update Packs/Lumu/pack_metadata.json Co-authored-by: Sergei Yakima <sergeiyakima1@gmail.com> * Fix LumuSecops incident field naming, mapper keys - Rename new LumuSecops incident field display names to start with Lumu (case-sensitive requirement), including Lumu SecOps Take Status Action. - Keep existing cliName and id values unchanged to preserve layouts/mirroring compatibility. - Update classifier-mapper-incoming-LumuSecops.json mapping keys to exactly match new field display names. - Fix invalid mapper targets from lumu_secops_description / lumu_secops_incident_id to lumu_description / lumu_incidentId. - Update ReleaseNotes/2_0_0.md to reflect new field display names. * - Keep a single New: line per new entity in 2_0_0.md (integration, incident type, classifier, mapper, layout, and each new field) - Remove duplicated classifier/mapper/layout entries * fix some tests and reach the test coverage quota --------- Co-authored-by: Sergei Yakima <sergeiyakima1@gmail.com>
content-bot
added
Contribution
Contributor
Author
🤖 AI-Powered Code Review AvailableHi @TheL0L, you can leverage AI-powered code review to assist with this PR! Available Commands:
|
Contributor
Author
🤖 AI-Powered Code Review AvailableYou can leverage AI-powered code review to assist with this PR! Available Commands:
|
Coverage Report
|
||||||||||||||||||||||||||||||
TheL0L
approved these changes
Oct 25, 2026
TheL0L
left a comment
TheL0L
left a comment
Contributor
There was a problem hiding this comment.
Fixed all failing validations, pending verification by build.
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
Contributor
Author
|
Validate summary Verdict: PR can be force merged from validate perspective? ❌ |
TheL0L
reviewed
Oct 25, 2026
…content into contrib/eparralumu_lumu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related PRs
Original External PR: #46058
Contributor
@eparralumu
Contributing to Cortex XSOAR Content
Make sure to register your contribution by filling the contribution registration form
The Pull Request will be reviewed only after the contribution registration form is filled.
Status
Related Issues
N/A
Description
Second version of Lumu Pack, include new Lumu SecOps Integration with its Layout, IncidentType, IncidentFields, Classifier, Mapping and Integration sections, check the introductory video https://www.youtube.com/watch?v=m1xki-jioI8
This update intends to use our latest Incident API. The old API is still supported but we intend to ease the transition for our customers. The integration will function like the current one but will use a broader range of incident types and the new infrastructure; however, the essence remains the same by using the Cortex XSOAR mirroring capabilities.
Must have
fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-18495