joelwking / phantom-cyber Goto Github PK

F5 App 2.0

Ideally when possible, we would like action parameter descriptions to be limited to one line in the UI, so that fields are laid out in alignment. Currently, the block ip Launch Action dialog looks like this:

And unblock ip:

(Unblock ip isn't as much of a problem since there's no other field next to "Partition" to have a misalignment, but ideally would still be a one-liner. If you change it for block ip, probably want to make the fields in unblock ip match.)

Some suggestions for wording or other changes:
Action: Might just want the description to be Action,or Rule action, and have it be a fixed list of options that turns into a drop-down. (Based on the current description, it sounds like it's a fixed list.)

Doing that would look like:

      "action": {
        "description": "Rule action ",
        "data_type": "string",
        "required": true,
        "value_list":["accept","drop", "reject"]
      }

Partition: Might suggest "Partition or path for the firewall policy"

Looks like the rest are already one line.

Meraki App 1.6

It doesn't look like any of the current fields supplied nor returned have any "contains" values. In Phantom a contains value is used to "chain" actions together. A very common example is an ip address. If one App has a field that contains an ip address, all the other Apps and Actions that also contains an ip address can take that as input.

In the case of this App, an obvious candidate is any mac addresses returned. You do this by adding a line in the JSON like this:

"contains": ["mac address"]

So this:

    "output": [
    {
      "data_path": "action_result.data.*.client.mac",
      "data_type": "string",
      "column_name": "Client MAC",
      "column_order": 0
    },

would become:

    "output": [
    {
      "data_path": "action_result.data.*.client.mac",
      "contains": ["mac address"],
      "data_type": "string",
      "column_name": "Client MAC",
      "column_order": 0
    },

Similarly, the Action parameters should have a "primary" designation for the primary field. In your case, that's this:

      "search_string": {
        "description": "Characters to match in the client MAC address or description. Use asterisk * to return all clients.",
        "data_type": "string",
        "required": true
      }

It should probably be:

      "search_string": {
        "description": "Characters to match in the client MAC address or description. Use asterisk * to return all clients.",
        "primary": true,
        "data_type": "string",
        "required": true
      }

That tells Phantom that this is the main field that this action needs. So other results will have a contextual action on their mac address output (if they have "contains" on them), and then your located device Action will show up on the context menu, and take those MACs as input.

F5 App 2.0

(Apologies in advance if I'm misunderstanding the "source" field, I believe it must be the IP address. If that's not right please disregard and close.)

For the block ip action, I believe the "source" field is the IP address to be blocked, yes? If so, I recommend that it be tagged primary and contains "ip". So it would then look like this:

      "source": {
        "description": "packet source address",
        "contains": [ "ip" ],
        "primary": true,
        "data_type": "string",
        "required": true
      },

Note addition of the contains and primary lines.

Meraki App 1.6

If available, a vendor logo with a transparent or white background is idea. The current one has an off-white background. Screenshot with the current logo, and some neighboring ones for comparison:

F5 App 2.0

The unblock ip action should be action type "correct" rather than "contain". Contain is for actions that restrict something (so your block ip action is correct as it's under contain). But the undo/unrestrict actions go under "correct". Right now, installing your App with the ones that come with Phantom makes it so that "unblock ip" now appears under both correct and contain.

Recommend that the JSON for unblock ip be changed to:

  {
    "action": "unblock ip",
    "description": "Deletes the rule which blocks an IP address",
    "type": "correct",
    "identifier": "unblock ip",
    "read_only": false,
    "parameters": {
...

Where "type" has been changed to "correct".

Meraki App 1.6

The long description on the dashboard config parameter causes a layout issue on the Asset screen:

Normally the two fields would line up vertically.

It's possible to provide a default value for a field in the JSON. Suggest shortening the description to just "Dashboard URL" and supplying dashboard.meraki.com as the default value.

Meraki App 1.6

Whenever possible, Action parameter descriptions should be limited to one line when laid out on the Launch Action dialog. Currently, the parameters for the "locate device" Action take 2 and 3 lines, causing the fields to not align vertically:

Suggest something like "Partial MAC address or *" and "Timespan in seconds", and provide further documentation in the App doc.