Skip to content

Commit

Permalink
[Elasticsearch] MyPy In Docker (demisto#37920)
Browse files Browse the repository at this point in the history
* mypy

* RN

* mypy

* pylint
  • Loading branch information
shmuel44 authored Jan 6, 2025
1 parent 04f1afc commit ae6efb4
Show file tree
Hide file tree
Showing 8 changed files with 38 additions and 25 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
from opensearch_dsl import Search
from opensearch_dsl.query import QueryString
elif ELASTIC_SEARCH_CLIENT == ELASTICSEARCH_V8:
from elasticsearch import Elasticsearch, NotFoundError
from elasticsearch import Elasticsearch, NotFoundError # type: ignore[assignment]
from elasticsearch_dsl import Search
from elasticsearch_dsl.query import QueryString
else: # Elasticsearch (<= v7)
Expand Down Expand Up @@ -125,6 +125,7 @@ def timestamp_to_date(timestamp_string):
Returns:
(datetime).represented by the timestamp in the format '%Y-%m-%d %H:%M:%S.%f'
"""
timestamp_number: float
# find timestamp in form of more than seconds since epoch: 1572164838000
if TIME_METHOD == 'Timestamp-Milliseconds':
timestamp_number = float(int(timestamp_string) / 1000)
Expand Down Expand Up @@ -160,7 +161,7 @@ def elasticsearch_builder(proxies):
}
if ELASTIC_SEARCH_CLIENT != ELASTICSEARCH_V8:
# Adding the proxy related parameters to the Elasticsearch client v7 and below or OpenSearch (BC)
connection_args["connection_class"] = RequestsHttpConnection
connection_args["connection_class"] = RequestsHttpConnection # type: ignore[assignment]
connection_args["proxies"] = proxies

# The input of proxy configuration is currently missing on client v8 - in this case we are dependent on the client using the
Expand All @@ -184,7 +185,7 @@ def elasticsearch_builder(proxies):
else: # Elasticsearch version v7 and below or OpenSearch (BC)
connection_args["http_auth"] = (USERNAME, PASSWORD)

es = Elasticsearch(**connection_args)
es = Elasticsearch(**connection_args) # type: ignore[arg-type]
# this should be passed as api_key via Elasticsearch init, but this code ensures it'll be set correctly
if API_KEY_ID and hasattr(es, 'transport'):
es.transport.get_connection().session.headers['authorization'] = get_api_key_header_val( # type: ignore[attr-defined]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -50,10 +50,10 @@ configuration:
- display: Query String
name: fetch_query
type: 0
additionalinfo: |-
The query will be used when fetching incidents. Index time field will be used as a filter in the query.
additionalinfo: |-
The query will be used when fetching incidents. Index time field will be used as a filter in the query.
The integration test button doesn't fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the '!es-integration-health-check' command.
The integration test button doesn't fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the '!es-integration-health-check' command.
section: Collect
required: false
- display: Index time field (for sorting sort and limiting data)
Expand All @@ -62,16 +62,16 @@ configuration:
section: Collect
required: false
additionalinfo: |-
The time field on which sorting and limiting are performed. If using a nested field, separate field names using dot notation.
The time field on which sorting and limiting are performed. If using a nested field, separate field names using dot notation.
The integration test button doesn't fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the '!es-integration-health-check' command.
The integration test button doesn't fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the '!es-integration-health-check' command.
- display: Raw Query
name: raw_query
type: 12
additionalinfo: |-
Will override the 'Query String' Lucene syntax string. Results will not be filtered.
additionalinfo: |-
Will override the 'Query String' Lucene syntax string. Results will not be filtered.
The integration test button doesn't fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the '!es-integration-health-check' command.
The integration test button doesn't fully test the fetch incidents validity. To verify that the instance is set up correctly for fetching incidents, run the '!es-integration-health-check' command.
section: Collect
advanced: true
required: false
Expand Down Expand Up @@ -424,7 +424,7 @@ script:
description: The result of the index operation.
type: string
description: Indexes a document into an Elasticsearch index.
dockerimage: demisto/elasticsearch:1.0.0.115427
dockerimage: demisto/elasticsearch:1.0.0.117175
isfetch: true
runonce: false
script: '-'
Expand Down
6 changes: 6 additions & 0 deletions Packs/Elasticsearch/ReleaseNotes/1_3_26.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Integrations

##### Elasticsearch v2

Updated the Docker image to: *demisto/elasticsearch:1.0.0.117175*.
2 changes: 1 addition & 1 deletion Packs/Elasticsearch/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Elasticsearch",
"description": "Search for and analyze data in real time. \n Supports version 6 and later.",
"support": "xsoar",
"currentVersion": "1.3.25",
"currentVersion": "1.3.26",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -41,13 +41,13 @@
from opensearch_dsl import Search
from opensearch_dsl.query import QueryString
elif ELASTIC_SEARCH_CLIENT == ELASTICSEARCH_V8:
from elasticsearch import Elasticsearch
from elasticsearch.helpers import scan
from elasticsearch import Elasticsearch # type: ignore[assignment]
from elasticsearch.helpers import scan # type: ignore[assignment]
from elasticsearch_dsl import Search
from elasticsearch_dsl.query import QueryString
else: # Elasticsearch (<= v7)
from elasticsearch7 import Elasticsearch, RequestsHttpConnection # type: ignore[assignment]
from elasticsearch7.helpers import scan
from elasticsearch7.helpers import scan # type: ignore[assignment]
from elasticsearch_dsl import Search
from elasticsearch_dsl.query import QueryString

Expand Down Expand Up @@ -95,7 +95,7 @@ def _elasticsearch_builder(self):

else: # Elasticsearch v7 and below or OpenSearch
if self._api_key:
es = Elasticsearch(hosts=[self._server], connection_class=RequestsHttpConnection,
es = Elasticsearch(hosts=[self._server], connection_class=RequestsHttpConnection, # pylint: disable=E0606
verify_certs=self._insecure, proxies=self._proxy, api_key=self._api_key)
else:
es = Elasticsearch(hosts=[self._server], connection_class=RequestsHttpConnection, http_auth=self._http_auth,
Expand Down Expand Up @@ -263,7 +263,7 @@ def get_generic_indicators_elastic_v7(es, search, src_val, src_type, default_typ
"""
limit = int(demisto.args().get('limit', FETCH_SIZE))
ioc_lst: list = []
scan_res = scan(es, query=search.to_dict(), index=search._index, **search._params)
scan_res = scan(es, query=search.to_dict(), index=search._index, **search._params) # pylint: disable=E0606
for hit in scan_res:
hit_lst = extract_indicators_from_generic_hit(hit, src_val, src_type, default_type, tags, tlp_color, enrichment_excluded)
ioc_lst.extend(hit_lst)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -146,21 +146,21 @@ configuration:
required: false
section: Collect
advanced: true
- additionalinfo: Source field that contains the indicator value in the index. Relevant for generic feed type only.
- additionalinfo: Source field that contains the indicator value in the index. Relevant for generic feed type only.
display: Indicator Value Field
name: src_val
type: 0
required: false
section: Collect
advanced: true
- additionalinfo: Source field that contains the indicator type in the index. Relevant for generic feed type only.
- additionalinfo: Source field that contains the indicator type in the index. Relevant for generic feed type only.
display: Indicator Type Field
name: src_type
type: 0
required: false
section: Collect
advanced: true
- additionalinfo: Default indicator type used in case no "Indicator Type Field" was provided. Relevant for generic feed type only.
- additionalinfo: Default indicator type used in case no "Indicator Type Field" was provided. Relevant for generic feed type only.
display: Indicator Type
name: default_type
type: 0
Expand All @@ -185,7 +185,7 @@ configuration:
- Timestamp-Milliseconds
section: Collect
advanced: true
- additionalinfo: Used for sorting and limiting data. If empty, results are not sorted. Relevant for generic feed type only.
- additionalinfo: Used for sorting and limiting data. If empty, results are not sorted. Relevant for generic feed type only.
display: Index Time Field
name: time_field
type: 0
Expand Down Expand Up @@ -230,7 +230,7 @@ script:
required: true
description: Gets indicators available in the configured Elasticsearch database.
name: es-get-indicators
dockerimage: demisto/elasticsearch:1.0.0.115427
dockerimage: demisto/elasticsearch:1.0.0.117175
feed: true
runonce: false
script: '-'
Expand All @@ -242,4 +242,4 @@ tests:
- Elasticsearch_Fetch_Demisto_Indicators_Test
sectionOrder:
- Connect
- Collect
- Collect
6 changes: 6 additions & 0 deletions Packs/FeedElasticsearch/ReleaseNotes/1_1_11.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

#### Integrations

##### Elasticsearch Feed

Updated the Docker image to: *demisto/elasticsearch:1.0.0.117175*.
2 changes: 1 addition & 1 deletion Packs/FeedElasticsearch/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Elasticsearch Feed",
"description": "Indicators feed from Elasticsearch database",
"support": "xsoar",
"currentVersion": "1.1.10",
"currentVersion": "1.1.11",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down

0 comments on commit ae6efb4

Please sign in to comment.