CIAC-16805: Add Token URL parameter for OAuth 2.0 endpoint override in FireEye ETP by lironcohen272 · Pull Request #45037 · demisto/content

lironcohen272 · 2026-07-12T14:12:12Z

Related Issues

related: CIAC-16806

Description

Add Token URL parameter for OAuth 2.0 endpoint override in FireEye ETP

…P integrations

content-bot · 2026-07-12T14:13:34Z

🤖 AI-Powered Code Review Available

You can leverage AI-powered code review to assist with this PR!

Available Commands:

@marketplace-ai-reviewer start review - Initiate a full AI code review
@marketplace-ai-reviewer re-review - Incremental review for new commits

github-actions · 2026-07-12T14:17:06Z

Coverage Report

File	Stmts	Miss	Cover	Missing
Packs/FireEyeETP/Integrations/FireEyeETP
FireEyeETP.py	555	280	49%	114–120, 144, 156–157, 164–165, 168–169, 176–177, 179–182, 184–185, 187, 247–248, 252, 265–272, 274–275, 278–280, 283–285, 288–290, 293–295, 298–300, 303–305, 308, 310–311, 314, 316–317, 321, 323–324, 328–330, 348, 350, 356, 361, 366, 370–374, 376–378, 380, 398, 401–406, 409–414, 417–422, 424–427, 430–435, 438, 440–441, 445, 449, 460, 463, 466–467, 469–471, 473–478, 480, 484–488, 490–492, 496–497, 499–500, 502, 504, 521, 524, 527–528, 530, 538, 542–546, 551, 553, 555, 558–560, 564, 572, 575, 582, 601, 648, 679, 682–693, 695–700, 705, 707–708, 710–711, 714, 722, 725–726, 738, 741, 749, 808, 810–812, 847, 867, 902, 904, 906, 959, 966, 970–978, 1042–1043, 1078–1081, 1083, 1085–1087, 1095–1097, 1099, 1101, 1103, 1105–1106, 1108, 1110–1154
Packs/FireEyeETP/Integrations/FireEyeETPEventCollector
FireEyeETPEventCollector.py	311	28	91%	289–291, 367, 406–407, 415–416, 470, 526–527, 590–591, 601–603, 634, 654, 677–681, 689–692, 694
TOTAL	866	308	64%

Tests	Skipped	Failures	Errors	Time
73	0 💤	0 ❌	0 🔥	26.051s ⏱️

content-bot · 2026-07-12T14:20:38Z

⚠️ The PR is missing the ready-for-pipeline-running label. Please add the label when the PR is ready in order to proceed.

marketplace-ai-reviewer · 2026-07-12T14:20:59Z

🤖 Analysis started. Please wait for results...

marketplace-ai-reviewer · 2026-07-12T14:43:48Z

🤖 AI Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

marketplace-ai-reviewer

Thanks for your contribution to the FireEye ETP pack! I've reviewed your changes and left a few notes to help align the integration with our standards.

Most importantly, since a new parameter was added, this requires a minor version bump (2.2.0) rather than a patch. You'll also need to adjust the YAML files so the root keys start with name or display, add the required isFetchEvents parameter to the event collector, and clean up some of the unit tests by avoiding __init__ mocks.

Thanks again, and let me know if you have any questions!

Additionally, please address the following file-level notes:

Packs/FireEyeETP/Integrations/FireEyeETP/FireEyeETP.yml: CRITICAL: The first key defined at the root level of the .yml file must always be name or display. Currently, it starts with commonfields. Please move name or display to the top of the file.
Packs/FireEyeETP/Integrations/FireEyeETPEventCollector/FireEyeETPEventCollector.yml: - CRITICAL: The first key defined at the root level of the .yml file must always be name or display. Currently, it starts with category. Please move name or display to the top of the file.
As per Event Collector guidelines, all event collectors must configure the isFetchEvents parameter in the configuration section. Please add it:

  - display: Fetch Events
    name: isFetchEvents
    type: 8
    required: false

The fireeye-etp-get-events command description must end with the exact sentence: "Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism." Please update the description to comply with the Event Collector guidelines.
Packs/FireEyeETP/ReleaseNotes/2_1_6.md: The release notes describe adding a new parameter (Added the *Token URL* parameter), which is a feature addition. According to the versioning guidelines, adding new features requires a minor version bump, but the current version is 2.1.6 (a patch bump). Please bump the version to 2.2.0 and rename this file to 2_2_0.md. You can do this by running demisto-sdk update-release-notes -i Packs/FireEyeETP -u minor.

For more information, see the Release Notes Documentation.

@kamalq97, @lironcohen272 please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

marketplace-ai-reviewer · 2026-07-12T14:43:46Z

+    Then:
+        - Ensure the OAuth token request is sent to the expected resolved URL.
+    """
+    mocker.patch.object(


Avoid mocking __init__ and manually replicating its logic. You can instantiate the Client normally by setting up your mocks beforehand.

marketplace-ai-reviewer · 2026-07-12T14:43:46Z

+    assert actual_url == expected_url
+
+
+def test_token_url_resolution_with_override():


Remove tests that only verify standard library functions or constant values.

marketplace-ai-reviewer · 2026-07-12T14:43:46Z

+  name: token_url
+  type: 0
+  required: false
+  additionalinfo: "Override the OAuth 2.0 token endpoint base URL. Leave empty to use the default Trellix IAM endpoint. For Trellix GovCloud tenants, set to https://iam.us.trellix-gov.com."


The additionalinfo description should start with "The " and end with a period, and use a descriptive form rather than an active form ("Override...").

marketplace-ai-reviewer · 2026-07-12T14:43:46Z

+  name: token_url
+  type: 0
+  required: false
+  additionalinfo: "Override the OAuth 2.0 token endpoint base URL. Leave empty to use the default Trellix IAM endpoint. For Trellix GovCloud tenants, set to https://iam.us.trellix-gov.com."


The additionalinfo description should start with "The " and end with a period, and use a descriptive form rather than an active form ("Override...").

marketplace-ai-reviewer · 2026-07-12T14:43:46Z

+
+##### Trellix Email Security - Cloud
+
+- Added the *Token URL* parameter to allow overriding the OAuth 2.0 token endpoint per-instance. Use `https://iam.us.trellix-gov.com` for Trellix GovCloud tenants.


Literal values surfaced to the user, such as configuration values or URLs, should be styled in italics rather than backticks. See Entity Styling for more details.

Suggested change

- Added the *Token URL* parameter to allow overriding the OAuth 2.0 token endpoint per-instance. Use `https://iam.us.trellix-gov.com` for Trellix GovCloud tenants.

- Added the *Token URL* parameter to allow overriding the OAuth 2.0 token endpoint per-instance. Use *https://iam.us.trellix-gov.com* for Trellix GovCloud tenants.

marketplace-ai-reviewer · 2026-07-12T14:43:46Z

+
+##### Trellix Email Security - Cloud Event Collector
+
+- Added the *Token URL* parameter to allow overriding the OAuth 2.0 token endpoint per-instance. Use `https://iam.us.trellix-gov.com` for Trellix GovCloud tenants.


Literal values surfaced to the user, such as configuration values or URLs, should be styled in italics rather than backticks. See Entity Styling for more details.

Suggested change

- Added the *Token URL* parameter to allow overriding the OAuth 2.0 token endpoint per-instance. Use `https://iam.us.trellix-gov.com` for Trellix GovCloud tenants.

- Added the *Token URL* parameter to allow overriding the OAuth 2.0 token endpoint per-instance. Use *https://iam.us.trellix-gov.com* for Trellix GovCloud tenants.

kamalq97

Approved from my end (a couple of minor things to validate below)

@DanielTal87 Please review the event collector changes and let us know if you have any feedback

content-bot · 2026-07-12T16:45:29Z

Validate summary
The following errors were reported as warnings: RM108, PB130, GR101, GR107, GR103, GR109, PB131, MC101.
The following errors were thrown as a part of this pr: .
If the AG100 validation in the pre-commit GitHub Action fails, the pull request cannot be force-merged.

Verdict: PR can be force merged from validate perspective? ✅

content-bot · 2026-07-12T16:56:07Z

🔍 AI Triage Report Available

An automated triage report has been generated for this pipeline.

Status: failed
Report ID: 5f8e1a2c599e0472

📋 Triage Report
💡 Resolutions are available in the full report.

⚠️ AI-generated triage. Validate before acting.

Add Token URL parameter for OAuth 2.0 endpoint override in FireEye ET…

758ab03

…P integrations

lironcohen272 requested a review from kamalq97 July 12, 2026 14:18

lironcohen272 added docs-approved ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. labels Jul 12, 2026

marketplace-ai-reviewer removed the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Jul 12, 2026

kamalq97 assigned lironcohen272 Jul 12, 2026

kamalq97 requested a review from DanielTal87 July 12, 2026 14:40

marketplace-ai-reviewer reviewed Jul 12, 2026

View reviewed changes

kamalq97 approved these changes Jul 12, 2026

View reviewed changes

Comment thread Packs/FireEyeETP/Integrations/FireEyeETPEventCollector/FireEyeETPEventCollector.py

Comment thread Packs/FireEyeETP/Integrations/FireEyeETP/FireEyeETP.py

		assert actual_url == expected_url


		def test_token_url_resolution_with_override():


		##### Trellix Email Security - Cloud

		- Added the Token URL parameter to allow overriding the OAuth 2.0 token endpoint per-instance. Use `https://iam.us.trellix-gov.com` for Trellix GovCloud tenants.


		##### Trellix Email Security - Cloud Event Collector

		- Added the Token URL parameter to allow overriding the OAuth 2.0 token endpoint per-instance. Use `https://iam.us.trellix-gov.com` for Trellix GovCloud tenants.

Uh oh!

Conversation

lironcohen272 commented Jul 12, 2026 • edited by kamalq97 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related Issues

Description

Uh oh!

content-bot commented Jul 12, 2026

🤖 AI-Powered Code Review Available

Uh oh!

github-actions Bot commented Jul 12, 2026

Uh oh!

content-bot commented Jul 12, 2026

Uh oh!

marketplace-ai-reviewer commented Jul 12, 2026

Uh oh!

marketplace-ai-reviewer commented Jul 12, 2026

Uh oh!

marketplace-ai-reviewer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

marketplace-ai-reviewer Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

marketplace-ai-reviewer Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

marketplace-ai-reviewer Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

marketplace-ai-reviewer Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

marketplace-ai-reviewer Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

marketplace-ai-reviewer Jul 12, 2026

Choose a reason for hiding this comment

Uh oh!

kamalq97 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

content-bot commented Jul 12, 2026

Uh oh!

content-bot commented Jul 12, 2026

🔍 AI Triage Report Available

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

lironcohen272 commented Jul 12, 2026 •

edited by kamalq97

Loading