diff --git a/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.py b/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.py index d2cad18583d4..655e754ec004 100644 --- a/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.py +++ b/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.py @@ -2537,7 +2537,7 @@ def get_indicators(client: Client, **kwargs): next_page = res.get('meta', {}).get('next', None) while len(iocs_context) < limit and next_page: next_page = next_page.replace('api/', '') - res = client.http_request("GET", next_page, without_credentials=True) + res = client.http_request("GET", next_page, without_credentials="api_key" in next_page) iocs_list = res.get('objects', None) next_page = res.get('meta', {}).get('next', None) if iocs_list: diff --git a/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.yml b/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.yml index 850c7f0d3bb6..a0b01265ba88 100644 --- a/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.yml +++ b/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3.yml @@ -6456,7 +6456,7 @@ script: required: true description: JSON data of edits to be made {"is_public":false,"circles":[12866]}. description: Edit the values for observable that have been cloned. - dockerimage: demisto/py3-tools:1.0.0.99035 + dockerimage: demisto/py3-tools:1.0.0.112434 runonce: false script: '-' subtype: python3 diff --git a/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3_test.py b/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3_test.py index 5083dd1cf1ee..776ab269f701 100644 --- a/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3_test.py +++ b/Packs/Anomali_ThreatStream/Integrations/AnomaliThreatStreamv3/AnomaliThreatStreamv3_test.py @@ -1084,6 +1084,38 @@ def test_pagination(mocker): assert len(results.outputs) == 7000 + @staticmethod + def test_pagination_without_credentials(mocker): + """ + Given + - An on-prem user + When + - Calling the get_indicator command + - The 'next' url is expected to have credentials from the response + Then + - Verify the first API call is made with credentials + - Verify the second API call is made without credentials + """ + http_request = mocker.patch.object(Client, 'http_request', side_effect=[ + {'objects': INDICATOR * 1000, 'meta': {'next': '/api/v2/intelligence/?&search_after=test&api_key=test'}}, + {'objects': INDICATOR * 1000, 'meta': {'next': None}}, + ]) + client = Client( + base_url='', + user_name='', + api_key='', + verify=False, + proxy=False, + reliability='B - Usually reliable', + should_create_relationships=False, + remote_api=False, + ) + + _ = get_indicators(client, limit='7000') + + assert not http_request.call_args_list[0].kwargs.get("without_credentials") + assert http_request.call_args_list[1].kwargs["without_credentials"] + def test_search_intelligence(mocker): """ diff --git a/Packs/Anomali_ThreatStream/ReleaseNotes/2_2_23.md b/Packs/Anomali_ThreatStream/ReleaseNotes/2_2_23.md new file mode 100644 index 000000000000..05517d10237d --- /dev/null +++ b/Packs/Anomali_ThreatStream/ReleaseNotes/2_2_23.md @@ -0,0 +1,7 @@ + +#### Integrations + +##### Anomali ThreatStream v3 + +- Fixed an issue where the ***threatstream-get-indicators*** command failed when more than 1000 indicators were expected to be retrieved. +- Updated the docker image to: *demisto/py3-tools:1.0.0.112434*. diff --git a/Packs/Anomali_ThreatStream/pack_metadata.json b/Packs/Anomali_ThreatStream/pack_metadata.json index 804af41e933c..25f9d43a415d 100644 --- a/Packs/Anomali_ThreatStream/pack_metadata.json +++ b/Packs/Anomali_ThreatStream/pack_metadata.json @@ -2,7 +2,7 @@ "name": "Anomali ThreatStream", "description": "Use Anomali ThreatStream to query and submit threats.", "support": "xsoar", - "currentVersion": "2.2.22", + "currentVersion": "2.2.23", "author": "Cortex XSOAR", "url": "https://www.paloaltonetworks.com/cortex", "email": "",