Etd xsoar connector by ashwinidoddamani · Pull Request #45019 · demisto/content

ashwinidoddamani · 2026-07-09T18:41:30Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

Must have

Tests
Documentation

relates: https://jira-dc.paloaltonetworks.com/browse/CIAC-17277

…ments

content-bot · 2026-07-09T18:44:32Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

content-bot · 2026-07-09T18:44:33Z

Hi @ashwinidoddamani, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

content-bot · 2026-07-09T18:44:35Z

🤖 AI-Powered Code Review Available

Hi @kamalq97, @Benimanela, you can leverage AI-powered code review to assist with this PR!

Available Commands:

@marketplace-ai-reviewer start review - Initiate a full AI code review
@marketplace-ai-reviewer re-review - Incremental review for new commits

marketplace-ai-reviewer · 2026-07-12T08:11:01Z

🤖 Analysis started. Please wait for results...

content-bot · 2026-07-12T08:16:13Z

For the Reviewer: Trigger build request has been accepted for this contribution PR.

content-bot · 2026-07-12T08:16:21Z

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/10934008

marketplace-ai-reviewer · 2026-07-12T08:48:08Z

🤖 AI Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

marketplace-ai-reviewer

Hi there! Thanks for your contribution with the ETDXsoarConnector pack. The integration looks solid, but there are a few areas that need refinement regarding standard practices, error handling, and documentation before we can merge.

Here are the main areas to focus on:

Code & Tests: Please add unit tests for the fetch and move commands, ensure proxy and timeout settings are properly handled in your API requests, and add missing docstrings.
Configuration: Standardize the YAML parameter order, remove the duplicate proxy parameter, and rename the main command to follow the standard vendor-entity-action format.
Documentation: Update the pack metadata to be a concise summary without mentioning internal files, replace placeholder texts, and ensure Cortex branding guidelines are followed across all READMEs.

Great work so far! Let me know if you have any questions.

Additionally, please address the following file-level notes:

Packs/ETDXsoarConnector/Playbooks/playbook-ETD_Email_Reclassification_And_Remediation.yml: Please consider adding a test playbook to validate the etd-move-message command and the incident lifecycle.
Packs/ETDXsoarConnector/Integrations/ETDXsoarConnector/ETDXsoarConnector_test.py: Missing unit tests for fetch_incidents and etd_move_message_command.

@kamalq97, @Benimanela please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

marketplace-ai-reviewer · 2026-07-12T08:48:01Z

+    "unmapped": false,
+    "unsearchable": false,
+    "caseInsensitive": true,
+    "sla": 0,


Please set unsearchable to true unless there is a specific requirement for this field to be searchable.

marketplace-ai-reviewer · 2026-07-12T08:48:01Z

+
+### Integrations
+
+* EtdXsoarConnector


The integration name should be ETDXsoarConnector instead of EtdXsoarConnector to match the brand name and pack name.

marketplace-ai-reviewer · 2026-07-12T08:48:01Z

+    def download_logs(self, links: list) -> list:
+        events = []
+        for link in links:
+            response = requests.get(link, timeout=120)


Wrap requests.get in a timeout exception block and pass proxy/verify settings.

Ensure proxy and SSL verification settings are respected.

marketplace-ai-reviewer · 2026-07-12T08:48:01Z

+    )
+    # Determine Fetch window
+    if not last_fetch:
+        start_dt = now - timedelta(hours=1)


Use a user-configured first_fetch parameter for the initial fetch window.

marketplace-ai-reviewer · 2026-07-12T08:48:01Z

+                    "name": (f"[ETD] " f"{verdict.upper()} "f"Email - {sender}"),
+                    "occurred": timestamp,
+                    "rawJSON": json.dumps(event),
+                    "severity": 3,


Use IncidentSeverity enum instead of hardcoded numeric values.

Consider making the incident severity configurable or mapping it dynamically.

marketplace-ai-reviewer · 2026-07-12T08:48:02Z

+# ETD XSOAR Connector
+
+
+## Overview


Consider adding a short paragraph linking real-world scenarios to the pack's use cases to provide real-life context.

marketplace-ai-reviewer · 2026-07-12T08:48:02Z

+## Overview
+
+
+The ETD XSOAR Connector integrates Cisco Email Threat Defense (ETD) with Cortex XSOAR. The integration fetches ETD message events, creates incidents for malicious and suspicious emails, and provides remediation and reclassification capabilities through Cisco ETD APIs.


Please confirm if this integration is also applicable to Cortex XSIAM or Cortex Platform. If it is product-agnostic, consider replacing Cortex XSOAR with the generic Cortex reference. If it is product-specific, consider adding conditional text to clarify applicability.

marketplace-ai-reviewer · 2026-07-12T08:48:02Z

+
+#### ETDXsoarConnector
+
+Fetches Cisco ETD message events and creates incidents in Cortex XSOAR.


This sentence is redundant with the description on line 30. Consider removing it or providing additional, unique details about the integration.

marketplace-ai-reviewer · 2026-07-12T08:48:02Z

+
+
+
+### Playbook


Please include a reference to the Cortex XSOAR Developer Docs for the main playbook. For example:

For more information, visit the Cortex XSOAR Developer Docs

marketplace-ai-reviewer · 2026-07-12T08:48:02Z

+
+
+
+#### ETD Email Reclassification and Remediation**


There is a trailing ** at the end of this header. Please remove it for correct Markdown formatting.

Suggested change

#### ETD Email Reclassification and Remediation**

#### ETD Email Reclassification and Remediation

ashwinidoddamani · 2026-07-13T05:46:45Z

I will review all the comments and will fix them ASAP

ashwinidoddamani added 3 commits July 6, 2026 15:44

Content pack for ETD to XSOAR Connector

8aca08e

Update Cisco ETD XSOAR fetch and authentication logic

1935830

Fix ETD XSOAR connector validation issues and add marketplace improve…

b9ed2e9

…ments

content-bot added Contribution Thank you! Contributions are always welcome! External PR Community Support Level Indicates that the contribution is for Community supported pack labels Jul 9, 2026

content-bot changed the base branch from master to contrib/ashwinidoddamani_ETD_XSOAR_Connector-1 July 9, 2026 18:44

content-bot assigned kamalq97 and Benimanela Jul 9, 2026

content-bot added the Security Review label Jul 9, 2026

content-bot requested review from Benimanela and kamalq97 July 9, 2026 18:44

content-bot added Community Contribution Form Filled Whether contribution form filled or not. labels Jul 10, 2026

kamalq97 added ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. labels Jul 12, 2026

marketplace-ai-reviewer removed the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Jul 12, 2026

content-bot removed the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Jul 12, 2026

marketplace-ai-reviewer reviewed Jul 12, 2026

View reviewed changes

		## Overview


		The ETD XSOAR Connector integrates Cisco Email Threat Defense (ETD) with Cortex XSOAR. The integration fetches ETD message events, creates incidents for malicious and suspicious emails, and provides remediation and reclassification capabilities through Cisco ETD APIs.


		#### ETDXsoarConnector

		Fetches Cisco ETD message events and creates incidents in Cortex XSOAR.

	#### ETD Email Reclassification and Remediation**
	#### ETD Email Reclassification and Remediation




		### Playbook

Uh oh!

Conversation

ashwinidoddamani commented Jul 9, 2026 • edited by marketplace-content-sync Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contributing to Cortex XSOAR Content

Status

Related Issues

Must have

Uh oh!

content-bot commented Jul 9, 2026

Uh oh!

content-bot commented Jul 9, 2026

Uh oh!

content-bot commented Jul 9, 2026

🤖 AI-Powered Code Review Available

Uh oh!

marketplace-ai-reviewer commented Jul 12, 2026

Uh oh!

content-bot commented Jul 12, 2026

Uh oh!

content-bot commented Jul 12, 2026

Uh oh!

marketplace-ai-reviewer commented Jul 12, 2026

Uh oh!

marketplace-ai-reviewer left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ashwinidoddamani commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ashwinidoddamani commented Jul 9, 2026 •

edited by marketplace-content-sync

Loading