fix(normalize): make issue and case fields addressable from the contract - #1053
Merged
Conversation
SOCNormalizeFromList mapped only out of CustomFields, so contract rows naming an incident attribute (name, details, linkedCount) resolved empty on every source in every band. Merge an allowlist of those attributes into the field surface; CustomFields wins any name collision.
parentIncidentFields carries what the issue does not — incident_sources, aggregated_score, the alert/user/host counts, and the fused MITRE arrays. Playbooks already read it; the normalize map could not. Merged under a case. prefix so a row names its surface and cannot collide with an issue field. Absent on an ungrouped issue, where rows skip empty as usual.
parentIncidentFields is a DT root the playbook engine resolves at task
time; it is not a key in demisto.context(), so every case.* row resolved
empty and landed in skipped_empty. Foundation - Normalize Artifacts now
passes ${parentIncidentFields} as case_fields.
Observed on a grouped Turla replay case: the case carried alert_count
106 across 3 hosts while Investigation.* stayed empty, and the AI
concluded spread_level: isolated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three fixes to
SOCNormalizeFromListinsoc-optimization-unified. All three are running on a dev tenant and have been gated green with upload.a39b3b0make top-level issue attributes addressablec739d7bexpose case fields to the contract undercase.*54da680take case fields from the caller, notdemisto.context()Why
The normalize map could only reach fields under
CustomFields, so top-level issue attributes and case-scoped values were unreachable from a mapping. That is what blocked contract entries likeEndpoint.alert_sourcefromcase.incident_sources.[0]— the mapping could be written but never resolved.The third commit matters for correctness rather than reach: reading case fields from
demisto.context()picks up whatever the calling playbook happened to leave behind, which is not stable across the lifecycle. Taking them from the caller makes the value deterministic.Effect
Measured on the tenant when these landed:
Analysis.*populated went from 1 of 23 fields to 17 of 18, andcase_scorefrom 0 to 57. Before this, the phase contract initialised its typed empties and almost nothing wrote over them — issues presented as an empty contract and a layout stuck on "Analysis phase running...".This is also a prerequisite for the NIST IR normalize map work in #1052, which adds mappings that depend on the addressability this provides.
Verification
check_contributiongreen with upload against deathstar: normalize, correlation_rule_preflight, playbook_condition_lint, pack_prep, fix_errors, check_contracts, validate_shadow_mode, prep_docs, upload. Contracts checked on 1 playbook, correlation write path healthy.Labelled
version:patch.