From ca06a6999ccbea03f6adf7c5a7c2d985d9284ae9 Mon Sep 17 00:00:00 2001 From: splunk-soar-connectors-admin Date: Tue, 1 Aug 2023 11:59:08 -0700 Subject: [PATCH] 'convert readme.html to manual_readme_content.md' --- manual_readme_content.md | 76 ++++++++++++++++++++++++++++++++++++++ readme.html | 79 ---------------------------------------- 2 files changed, 76 insertions(+), 79 deletions(-) create mode 100644 manual_readme_content.md delete mode 100644 readme.html diff --git a/manual_readme_content.md b/manual_readme_content.md new file mode 100644 index 0000000..6d52965 --- /dev/null +++ b/manual_readme_content.md @@ -0,0 +1,76 @@ +[comment]: # " File: README.md" +[comment]: # " Copyright (c) 2017-2023 Splunk Inc." +[comment]: # "" +[comment]: # "Licensed under the Apache License, Version 2.0 (the 'License');" +[comment]: # "you may not use this file except in compliance with the License." +[comment]: # "You may obtain a copy of the License at" +[comment]: # "" +[comment]: # " http://www.apache.org/licenses/LICENSE-2.0" +[comment]: # "" +[comment]: # "Unless required by applicable law or agreed to in writing, software distributed under" +[comment]: # "the License is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND," +[comment]: # "either express or implied. See the License for the specific language governing permissions" +[comment]: # "and limitations under the License." +[comment]: # "" +Below points are considered for providing the **URL Category** parameter value. + +- Entire URL category string has to be mentioned in block letters + +- The most child category on UI has to be passed as the URL category parameter value to the action + +- From the URL category value on UI, every space has to be replaced by an underscore '\_' before + passing it in the action's parameter value + + + + - For example, **Alternate Lifestyle** on UI becomes **ALTERNATE_LIFESTYLE** + +- When you specify a **url_category** , you can give it either the name you created or the ID + which is assigned to it from Zscaler. The search will first search for the name, as opposed to + the ID. So if you create a category **phantom-block** , you could use either **phantom-block** + or **CUSTOM\_\*\*** . The name for these is case sensitive. + +The following are considered for providing the **URL** parameter value. + +- The comma-separated values of **URL** should correctly be given e.g. test.com,test1.com else the + Phantom framework's parameter validator will return the error mentioning **Exception occurred: + string index out of range** . + +Configure and set up permissions for the **lookup_url** action + +- Login to Zscaler UI using the Administrator credentials. +- Once logged in, go to **Administration -> Role Management** section. +- Click on the **Edit** icon beside the role that your account uses to configure the test + connectivity. +- Go to the **Functional Scope** section, enable **Security** if disabled, and save it. + +The above steps would help run the Lookup URL action as expected. + +The Sandbox Submission API requires a separate API key and uses a different host +(csbapi.\[zscaler-cloud-name\]). For the **submit_file** action, the **sandbox_base_url** and +**sandbox_api_token** asset configuration parameters should be configured. These two asset +parameters won't affect test_connectivity. Follow the below steps to fetch these credentials for the +**submit_file** action + +- Log in to the ZIA Admin Portal using your **admin** credentials. +- Once logged in, go to **Administration -> Cloud Service API Key Management** section. In order + to view the Cloud Service API Key Management page, the admin must be assigned an admin role. +- For the Cloud Sandbox Submission API used in this action, the base URL and token are displayed + on the **Sandbox Submission API Token** tab. +- The base URL and token displayed here can be configured in the asset parameters in + **sandbox_base_url** and **sandbox_api_token** parameters respectively and will be used for the + submit_file action. + +The above steps would help run the Submit File action as expected. + +**NOTE:** This action would work according to the API behavior + +Port Information + +The app uses HTTP/ HTTPS protocol for communicating with the Zscaler server. Below are the default +ports used by Splunk SOAR. + +|         Service Name | Transport Protocol | Port | +|----------------------|--------------------|------| +|         http | tcp | 80 | +|         https | tcp | 443 | diff --git a/readme.html b/readme.html deleted file mode 100644 index b00f74c..0000000 --- a/readme.html +++ /dev/null @@ -1,79 +0,0 @@ - - -

Below points are considered for providing the URL Category parameter value. -

-

- -

The following are considered for providing the URL parameter value. -

-

- -

Configure and set up permissions for the lookup_url action

-

-

- The above steps would help run the Lookup URL action as expected. -

- -

The Sandbox Submission API requires a separate API key and uses a different host (csbapi.[zscaler-cloud-name]). For the submit_file action, the sandbox_base_url and sandbox_api_token asset configuration parameters should be configured. These two asset parameters won't affect test_connectivity. Follow the below steps to fetch these credentials for the submit_file action

-

-

- The above steps would help run the Submit File action as expected. -

NOTE: This action would work according to the API behavior

-

- -

Port Information

-

- The app uses HTTP/ HTTPS protocol for communicating with the Zscaler server. Below are the default ports used by Splunk SOAR. - - - - - - - - - - - - - - - - -
        Service NameTransport ProtocolPort
        httptcp80
        httpstcp443
-