TIPCommon 2.1.0

The TIPCommon 2.1.0 library contains the following modules:

TIPCommon.adapters

• PubSubAdapter

TIPCommon.base

• parse_case_attachment()
• parse_case_comment()
• Action
  • _soar_action
  • _api_client
  • _name
  • _action_start_time
  • _logger
  • _params
  • global_context
  • _entity_types
  • _entities_to_update
  • json_results
  • _attachments
  • _contents
  • _data_tables
  • _html_reports
  • _links
  • _entity_insights
  • _case_insights
  • _result_value
  • _output_message
  • _error_output_message
  • action_start_time
  • api_client
  • attachments
  • case_insights
  • contents
  • data_tables
  • entities_to_update
  • entity_insights
  • entity_types
  • error_output_message
  • execution_state
  • html_reports
  • is_first_run
  • links
  • logger
  • name
  • output_message
  • params
  • result_value
  • run()
  • soar_action
• EnrichAction
  • enrichment_data
  • entity_results
  • global_context
• ActionParamType
  • BOOLEAN
  • CASE_PRIORITIES
  • CLOSE_CASE_REASONS
  • CLOSE_ROOT_CAUSE
  • CODE
  • CONTENT
  • DDL
  • EMAIL_CONTENT
  • ENTITY_TYPE
  • MULTI_VALUES
  • NULL
  • PASSWORD
  • PLAYBOOK_NAME
  • STAGE
  • STRING
  • USER
• Attachment
  • title
  • filename
  • file_contents
  • additional_data
• CaseAttachment
  • attachment_id
  • attachment_type
  • description
  • is_favorite
• CaseComment
  • comment
  • comment_for_client
  • modification_time_unix_time_in_ms_for_client
  • last_editor
  • last_editor_full_name
  • is_deleted
  • creator_user_id
  • creator_full_name
  • comment_id
  • comment_type
  • case_id
  • is_favorite
  • modification_time_unix_time_in_ms
  • creation_time_unix_time_in_ms§
  • alert_identifier
• CaseInsight
  • title
  • triggered_by
  • content
  • severity
  • insight_type
  • entity_identifier
  • additional_data
  • additional_data_type
  • additional_data_title
• CasePriority
  • CRITICAL
  • HIGH
  • INFORMATIONAL
  • LOW
  • MEDIUM
• CaseStage
  • ASSESSMENT
  • IMPROVEMENT
  • INCIDENT
  • INVESTIGATION
  • RESEARCH
  • TRIAGE
• CloseCaseOrAlertInconclusiveRootCauses
  • NO_CLEAR_CONCLUSION
• CloseCaseOrAlertMaintenanceRootCauses
  • LAB_TEST
  • OTHER
  • RULE_UNDER_CONSTRUCTION
• CloseCaseOrAlertMaliciousRootCauses
  • EXTERNAL_ATTACK
  • INFRASTRUCTURE_ISSUE
  • IRRELEVANT_TCP_UDP_PORT
  • MISCONFIGURED_SYSTEM
  • OTHER
  • SIMILAR_CASE_IS_ALREADY_UNDER_INVESTIGATION
  • SYSTEM_APPLICATION_MALFUNCTION
  • SYSTEM_CLOCKED_THE_ATTACK
  • UNFORESEEN_EFFECTS_OF_CHANGE
  • UNKNOWN
• CloseCaseOrAlertNotMaliciousRootCauses
  • EMPLOYEE_ERROR
  • HUMAN_ERROR
  • LAB_TEST
  • LEGIT_ACTION
  • MISCONFIGURED_SYSTEM
  • NONE
  • NORMAL_BEHAVIOR
  • OTHER
  • PENETRATION_TEST
  • RULE_UNDER_CONSTRUCTION
  • SIMILAR_CASE_IS_ALREADY_UNDER_INVESTIGATION
  • UNKNOWN
  • USER_MISTAKE
• CloseCaseOrAlertReasons
  • INCONCLUSIVE
  • MAINTENANCE
  • MALICIOUS
  • NOT_MALICIOUS


• Content
  • title
  • content
• DataTable
  • title
  • data_table
• EntityInsight
  • entity
  • message
  • triggered_by
  • original_requesting_user
• EntityTypesEnum
  • ADDRESS
  • ALERT
  • APPLICATION
  • CHILD_HASH
  • CHILD_PROCESS
  • CLUSTER
  • CONTAINER
  • CREDIT_CARD
  • CVE
  • CVE_ID
  • DATABASE
  • DEPLOYMENT
  • DESTINATION_DOMAIN
  • DOMAIN
  • EMAIL_MESSAGE
  • EVENT
  • FILE_HASH
  • FILE_NAME
  • GENERIC
  • HOST_NAME
  • IP_SET
  • MAC_ADDRESS
  • PARENT_HASH
  • PARENT_PROCESS
  • PHONE_NUMBER
  • POD
  • PROCESS
  • SERVICE
  • SOURCE_DOMAIN
  • THREAT_ACTOR
  • THREAT_CAMPAIGN
  • THREAT_SIGNATURE
  • URL
  • USB
  • USER
• ExecutionState
  • COMPLETED
  • FAILED
  • IN_PROGRESS
  • TIMED_OUT
• FullDetailsConfigurationParameter
  • full_dict
  • id
  • integration_identifier
  • creation_time
  • modification_time
  • is_mandatory
  • description
  • name
  • display_name
  • value
  • type
  • optional_values
• HTMLReport
  • title
  • report_name
  • report_contents
• IntegrationParamType
  • BOOLEAN
  • EMAIL
  • INTEGER
  • IP
  • NULL
  • PASSWORD
  • STRING
• Link
  • title
  • link
• ScriptParameter
  • full_dict
  • id
  • creation_time
  • modification_time
  • custom_action_id
  • is_mandatory
  • default_value
  • description
  • name
  • value
  • type
  • optional_values
• Apiable
• Authable
  • authenticat_session()
• Logger
  • debug()
  • error()
  • exception()
  • info()
  • warn()
• Session
  • headers
  • verify
  • delete()
  • get()
  • patch()
  • post()
  • put()
  • request()
• Job
  • api_client
  • error_msg
  • job_start_time
  • logger
  • name
  • params
  • soar_job
  • start()
• RefreshTokenRenewalJob
  • api_client
• SuccessFailureTuple
  • failure_list
  • success_list
• validate_param_csv_to_multi_value()
• JobParameter
  • full_dict
  • id
  • is_mandatory
  • name
  • type
  • value
• ActionJsonOutput
• ActionOutput
• ConnectorJsonOutput
• ConnectorOutput
• alert_info_from_json()

TIPCommon.rest

• build_credentials_from_sa()
• build_credentials_from_sa_attr()
• generate_jwt_from_credentials()
• generate_jwt_from_sa()
• get_adc()
• get_auth_request()
• get_impersonated_credentials()
• get_secops_siem_tenant_credentials()
• GcpErrorReason
  • IAM_PERMISSION_DENIED
• GcpPermissions
  • IAM_SA_GET_ACCESS_TOKEN
• extract_project_id_from_sa_email()
• extract_project_id_from_sa_key()
• get_http_client()
• get_workload_sa_email()
• retrieve_project_id()
• validate_impersonation()
• get_auth_session()
• SoarApiErrorServer
• batch_set_custom_field_values()
• get_alert_events()
• get_case_attachments()
• get_case_overview_details()
• get_connector_cards()
• get_entity_data()
• get_env_action_def_files()
• get_federation_cases()
• get_full_case_details()
• get_installed_integrations_of_environment()
• get_installed_jobs()
• get_integration_full_details()
• get_user_profile_cards()
• get_workflow_instance_card()
• list_custom_field_values()
• list_custom_fields()
• remove_case_tag()
• save_attachment_to_case_wall()
• set_alert_priority()
• set_case_score_bulk()
• set_custom_field_values()
• validate_response()

data_models Module

• AlertCard
  • from_json()
• AlertEvent
  • from_json()
• AlertPriority
  • CRITICAL
  • HIGH
  • INFORMATIVE
  • LOW
  • MEDIUM
  • UNCHANGED
• BaseAlert
  • raw_data
  • alert_id
  • to_json()
• BaseDataModel
  • raw_data
  • to_json()
• CaseDataStatus
  • ALL
  • CLOSED
  • CREATION_PENDING
  • MERGED
  • NEW
  • OPENED
• CaseDetails
  • from_json()
  • is_closed
  • is_open
• CasePriority
  • CRITICAL
  • HIGH
  • INFORMATIVE
  • LOW
  • MEDIUM
  • UNCHANGED
• CaseWallAttachment
  • base64_blob
  • case_id
  • file_type
  • is_important
  • name
• ConnectorCard
  • from_json()
• ConnectorConnectivityStatusEnum
  • LIVE
  • NO_CONNECTIVITY
• ConnectorParamTypes
  • BOOLEAN
  • DOMAIN
  • EMAIL
  • HOST
  • INTEGER
  • IP
  • NULL
  • PASSWORD
  • SCRIPT
  • STRING
  • URL
• ConnectorParameter
  • name
  • value
  • type
  • mode
  • is_mandatory
• Container
• CustomField
  • description
  • display_name
  • id
  • scopes
  • type
  • from_json()
• CustomFieldScope
  • ALERTS
  • CASE
  • build_parent_path()
• CustomFieldValue
  • custom_field_id
  • identifier
  • scope
  • values
  • from_json()
• DatabaseContextType
  • ALERT
  • CASE
  • CONNECTOR
  • GLOBAL
  • JOB
• EventPropertyField
  • from_json()
• FieldGroupItem
  • from_json()
• FieldItem
  • from_json()
• FieldsGroup
  • from_json()
• GoogleServiceAccount
  • to_dict()
• InstalledIntegrationInstance
  • to_dict()
• JobParamType
  • BOOLEAN
  • DOMAIN
  • HOST
  • INTEGER
  • IP
  • NULL
  • PASSWORD
  • STRING
  • URL
• Parameter
  • raw_data
• SLA
  • from_json()
• ScriptContext
  • action_definition_name
  • alert_id
  • async_polling_interval_in_sec
  • async_total_duration_deadline
  • case_id
  • connector_context
  • default_result_value
  • environment
  • environment_api_key
  • execution_deadline_unix_time_ms
  • integration_identifier
  • integration_instance
  • job_api_key
  • max_json_result_size
  • original_requesting_user
  • parameters
  • script_timeout_deadline
  • target_entities
  • unique_identifier
  • use_proxy_settings
  • vault_settings
  • workflow_id
  • workflow_instance_id
  • to_json()
  • update()
• SmimeEmailConfig
  • ca_certificate_b64
  • certificate_b64
  • email
  • private_key_b64
• SmimeType
  • ENCRYPTED
  • SIGNED
• TypedContainer
• UserProfileCard
  • from_json()

encryption Module

• decrypt()
• decrypt_email()
• encrypt()
• get_private_key()

exceptions Module

• ActionSetupError
• AlreadyExistsError
• BadGatewayError
• CaseResultError
• ConnectorContextError
• ConnectorProcessingError
• ConnectorSetupError
• ConnectorValidationError
• DeadlineExceededError
• EmptyMandatoryValues
• EnrichActionError
• FailedPreconditionError
• GeneralActionException
• GeneralConnectorException
• GeneralJobException
• GoogleCloudException
• ImpersonationUnauthorizedError
• InternalJSONDecoderError
• InvalidArgumentError
• InvalidTimeException
• JobSetupError
• NotFoundError
• OauthError
• ParameterExtractionError
• ParameterValidationError
• PermissionDeniedError
• RefreshTokenRenewalJobException
• ResourceExhaustedError
• SDKWrapperError
• SMIMEMailError
• UnauthenticatedError
• UnavailableError

extraction Module

• extract_action_param()
• extract_configuration_param()
• extract_connector_param()
• extract_job_param()
• extract_script_param()
• get_connector_detailed_params()

filters Module

• filter_list_by_type()
• filter_none_kwargs()
• filter_old_alerts()
• filter_old_ids()
• filter_old_ids_by_timestamp()
• pass_whitelist_filter()

ouath Module

• AuthenticationError
• AuthorizedOauthClient
  • close()
  • request()
• CredStorage
  • get_instance_identifier()
  • get_token()
  • set_token()
• EncryptionError
• OAuthAdapter
  • abstractcheck_signer()
  • abstractprepare_authorized_client()
  • abstractrefresh_token()
  • abstract static validate_bad_credentials()
• OauthManager
  • prepare_authorized_client()
  • refresh_if_bad_credentials()
  • refresh_if_expired()
  • save_token()
• OauthToken
  • access_token
  • additional_data
  • expiration_time
  • refresh_token
  • signer
  • from_cache()
  • to_cache()

smp_io Module

• read_and_repair_existing_content()
• read_content()
• read_ids()
• read_ids_by_timestamp()
• write_content()
• write_ids()
• write_ids_with_timestamp()

smp_time Module

• change_timezone()
• convert_string_to_timestamp()
• datetime_to_rfc3339()
• get_last_success_time()
• get_timestamps()
• get_timestamps_from_range()
• is_approaching_action_timeout()
• is_approaching_timeout()
• save_timestamp()
• siemplify_fetch_timestamp()
• siemplify_save_timestamp()
• validate_timestamp()

soar_ops Module

• create_slo_message()
• get_clean_comment_body()
• get_file()
• get_secops_mode()
• get_soar_case_comments()
• get_user_by_id()
• get_user_profile_cards_with_pagination()
• is_slo_comment()
• remove_prefix_from_comments()
• save_file()

transformation Module

• add_prefix_to_dict()
• add_prefix_to_dict_keys()
• adjust_to_csv()
• construct_csv()
• convert_comma_separated_to_list()
• convert_dict_to_json_result_dict()
• convert_list_to_comma_string()
• dict_to_flat()
• flat_dict_to_csv()
• get_unicode()
• removeprefix()
• removesuffix()
• rename_dict_key()
• string_to_multi_value()

utils Module

• camel_to_snake_case()
• cast_keys_to_int()
• clean_result()
• create_and_write_to_tempfiles()
• get_entity_original_identifier()
• get_function_arg_names()
• get_unique_items_by_difference()
• is_empty_string_or_none()
• is_first_run()
• is_overflowed()
• is_python_37()
• is_test_run()
• none_to_default_value()
• platform_supports_1p_api()
• platform_supports_db()
• safe_cast_bool_value_from_str()
• safe_cast_int_value_from_str()

validation Module

• ParameterValidator
  • validate_csv()
  • validate_ddl()
  • validate_email()
  • validate_float()
  • validate_integer()
  • validate_json()
  • lower_limit()
  • validate_non_negative()
  • validate_non_zero()
  • validate_percentage()
  • validate_positive()
  • validate_range()
  • validate_severity()
  • validate_upper_limit()

Need more help? Get answers from Community members and Google SecOps professionals.