Content pack structure - Developer Guide - Cortex XSIAM - Cortex - Security Operations

The directories within the pack represent all the possible content entities. Each pack is located in the Content repo under Packs/<Pack Name>.

- Integrations
- Scripts
- Playbooks
- Reports
- Dashboards
- IncidentTypes
- IncidentFields
- Layouts
- Classifiers
- IncidatorTypes
- IndicatorFields
- Connections
- TestPlaybooks
- ParsingRules
- ModelingRules
- CorrelationRules
- ReleaseNotes
- Triggers
- XSIAMDashboards

The pack directory contains multiple configuration files used for metadata and documentation.

pack_metadata.json

This file contains all the relevant metadata about the pack.

The following fields are populated in the pack metadata.

{
    "name": "Palo Alto Networks Cortex XDR - Investigation and Response",
    "description": "Cortex XDR is the world's first detection and response app that natively integrates network, endpoint and cloud data to stop sophisticated attacks.",
    "support": "xsoar",
    "currentVersion": "1.0.0",
    "author": "Cortex XSOAR",
    "url": "https://www.paloaltonetworks.com/cortex",
    "videos": "https://www.youtube.com/watch?v=ium2969zgn8",
    "email": "",
    "categories": [
        "Endpoint"
    ],
    "tags": [
        "Recommended by Cortex XSOAR",
        "xdr"
    ],
    "created": "2020-03-11T13:16:53Z",
    "useCases": [
        "Malware"
    ],
    "keywords": [
        "adaptive cyber protection",
        "apt"
    ],
    "dependencies": {
        "Base": {
            "mandatory": true,
            "name": "Base"
        },
        "CortexXDR": {
            "mandatory": false,
            "name": "Palo Alto Networks - Cortex XDR"
        }
    },
    "marketplaces": [
        "marketplacev2"
    ],
    "displayedImages": [
        "CortexXDR"
    ]
}

{
    "name": "Product name",
    "description": "Pack description",
    "support": "partner",
    "currentVersion": "1.1.0",
    "author": "Partner name",
    "url": "https://support.<partner>.com",
    "email": "support@<partner>.com",
    "devEmail": "dev@<partner>.com",
    "categories": [
        "Deception"
    ],
    "tags": [],
    "created": "2020-03-19T09:39:30Z",
    "useCases": [],
    "keywords": [],
    "dependencies": {},
    "marketplaces": ["marketplacev2"]
    "githubUser": [
        "<partner Github username>"
    ]    
}

Pack versions have the format MAJOR.MINOR.REVISION:

Revision when you make backward compatible bug fixes.

Minor when you add functionality in a backward compatible manner.

Major when you make incompatible API changes or revamp the pack by adding significant new backward compatible functionality.

This file contains a general explanation for the pack. You can add any information relevant for the pack. For more details see the Content Pack README.Content Pack README

This file is used while running demisto-sdk secrets as an allow list of approved words for the PR.

This file allows ignoring linter errors while lint checking and ignoring tests in the test collection.

To add ignored tests/linter errors in a file:

By default, script/integration unit tests run without a Docker network.

If one of the integrations/scripts inside a pack needs a network during the unit tests run, use this format:

[tests_require_network]
integration-id-1
script-id-1

Example: .pack-ignore

[file:playbook-Special-Test-Not-To-Run-Directly.yml]
ignore=auto-test

[file:integration-to-ignore.yml]
ignore=IN126,PA116

[tests_require_network]
integration-id-1
script-id-1

You can add an author image (logo of the contributing company) which is displayed on the Marketplace page for the content pack, under the the PUBLISHER section. The image should be saved in the root directory of the content pack, for example content/packs/MyPackName, and be named Author_image.png). Make sure to use this exact file name for the image to appear. The image size should be up to 4 KB and dimensions of 120x50 pixels.

For Partners, this image is mandatory and is validated as part of the build process. If the file is missing, the build fails with the following validationerror:

- Issues with unique files in pack: $PACK_NAME
  Packs/$PACK_NAME/Author_image.png: [IM109] - Partners must provide a non-empty author image under the path Packs/$PACK_NAME/Author_image.png

If the file Author_image.png does not exist, the name of the author is displayed in the PUBLISHER section instead.

If you are contributing to an existing pack, you can add a CONTRIBUTORS.json file to the root of the pack if one does not already exist. The file should contain a list of strings including your name.

Example: CONTRIBUTORS.json file

[
    "Jane Doe",
    "John Smith"
]

Once your contribution is merged, pack details shows the following: