Add Tessian Event Collector by amshamah419 · Pull Request #43760 · demisto/content

amshamah419 · 2026-04-05T06:39:07Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-15730

Description

Added the new Tessian Event Collector

Must have

Tests
Documentation

content-bot · 2026-04-05T06:40:29Z

🤖 AI-Powered Code Review Available

You can leverage AI-powered code review to assist with this PR!

Available Commands:

@marketplace-ai-reviewer start review - Initiate a full AI code review
@marketplace-ai-reviewer re-review - Incremental review for new commits

marketplace-ai-reviewer · 2026-04-05T06:41:13Z

🤖 Analysis started. Please wait for results...

github-actions · 2026-04-05T06:43:13Z

Coverage Report

File	Stmts	Miss	Cover	Missing
Packs/Tessian/Integrations/TessianEventCollector
TessianEventCollector.py	105	7	93%	50, 55, 60, 237, 330–331, 333
TOTAL	105	7	93%

Tests	Skipped	Failures	Errors	Time
26	0 💤	0 ❌	0 🔥	2.608s ⏱️

Copilot

Pull request overview

Adds a new collector-style integration to the Tessian pack to ingest Proofpoint Tessian security events into Cortex XSIAM, alongside the accompanying pack metadata and documentation updates.

Changes:

Introduces the Tessian Event Collector integration (YML + Python implementation) with checkpoint-based pagination and XSIAM event forwarding.
Adds unit tests and test fixture responses for the new integration.
Updates pack metadata/versioning and adds release notes + integration documentation.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
Packs/Tessian/ReleaseNotes/1_1_0.md	Adds release notes entry for the new event collector integration.
Packs/Tessian/pack_metadata.json	Bumps pack version and updates support/author/url; adds `defaultDataSource` and keywords.
Packs/Tessian/Integrations/TessianEventCollector/test_data/security_events_response.json	Adds a representative API response fixture for tests.
Packs/Tessian/Integrations/TessianEventCollector/test_data/security_events_empty_response.json	Adds an empty API response fixture for tests.
Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector.yml	Defines the new event collector integration configuration and command schema.
Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector.py	Implements API client, pagination, enrichment, manual command, and fetch-events flow.
Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector_test.py	Adds unit test coverage for helpers, pagination, and command flows.
Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector_image.png	Adds integration image asset.
Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector_description.md	Adds setup guidance for portal URL and API token generation.
Packs/Tessian/Integrations/TessianEventCollector/README.md	Documents behavior (pagination limits) and enrichment fields.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Packs/Tessian/pack_metadata.json

Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector.py

Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector_test.py

amshamah419 · 2026-04-05T07:01:02Z

@marketplace-ai-reviewer re-review

marketplace-ai-reviewer · 2026-04-05T07:11:00Z

🤖 Analysis started. Please wait for results...

marketplace-ai-reviewer · 2026-04-05T07:42:48Z

🤖 AI Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

marketplace-ai-reviewer

Thanks for contributing this Tessian Event Collector integration! I've reviewed the PR and have a few suggestions to help align it with XSOAR standards.

Primarily, please generate the README using demisto-sdk generate-docs, fix a few pack metadata issues (like the missing created key), and ensure the YAML integration parameters follow the standard order (Proxy, then Insecure). In the Python code, make sure to support a first_fetch parameter, enforce the API's minimum fetch limit of 2, and use standard XSOAR helpers like arg_to_datetime.

Let me know if you have any questions!

Additionally, please address the following file-level notes:

Packs/Tessian/Integrations/TessianEventCollector/README.md: This README appears to be manually written and is missing standard sections (e.g., Setup, Commands, Troubleshooting). Please use demisto-sdk generate-docs to generate a complete and compliant README that includes all commands defined in the YAML file. See Creating Documentation for more details.
Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector_image.png: Consider using only the logo mark (the colorful cube icon) without the text.
Packs/Tessian/pack_metadata.json: - The mandatory key created is missing from the pack metadata.
The githubUser field contains usernames, but support is set to xsoar.

@copilot-pull-request-reviewer[bot], @marketplace-ai-reviewer, @DanielTal87 please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

marketplace-ai-reviewer · 2026-04-05T07:42:44Z

Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector.py

@@ -0,0 +1,402 @@
+from typing import Any
+
+import demistomock as demisto  # noqa: F401


Add missing imports for datetime and timezone.

marketplace-ai-reviewer · 2026-04-05T07:42:45Z

Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector.py

+    initial_checkpoint: str | None,
+    max_fetch: int,
+) -> tuple[list[dict], str | None]:
+    """Fetches events using checkpoint-based pagination.


Use more precise type hints for event lists.

marketplace-ai-reviewer · 2026-04-05T07:42:45Z

Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector.py

+        created_after = datetime.now(timezone.utc).strftime(DATE_FORMAT)
+        demisto.debug(f"First fetch, starting from: {created_after}")
+
+    events, new_checkpoint = fetch_events_with_pagination(


Use arg_to_datetime to parse the created_after argument.

marketplace-ai-reviewer · 2026-04-05T07:42:45Z

Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector.py

+
+def main() -> None:  # pragma: no cover
+    """Main function, parses params and runs command functions."""
+    params = demisto.params()


Include the raw response in CommandResults.

Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector.py

Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector.yml

Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector_description.md

marketplace-ai-reviewer · 2026-04-05T07:42:45Z

Packs/Tessian/ReleaseNotes/1_1_0.md

+
+#### Integrations
+
+##### New: Tessian Event Collector


The content item header must match the display name exactly.

content-bot · 2026-04-05T09:53:37Z

Validate summary
The following errors were reported as warnings: PB130, RM108, PB131.
The following errors were thrown as a part of this pr: .
If the AG100 validation in the pre-commit GitHub Action fails, the pull request cannot be force-merged.

Verdict: PR can be force merged from validate perspective? ✅

github-actions · 2026-04-12T10:16:56Z

Your contributed Tessian pack has been modified on files:

Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector_test.py
Packs/Tessian/Integrations/TessianEventCollector/test_data/security_events_empty_response.json
Packs/Tessian/Integrations/TessianEventCollector/test_data/security_events_response.json
Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector.yml
Packs/Tessian/pack_metadata.json
Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector.py
Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector_description.md
Packs/Tessian/Integrations/TessianEventCollector/TessianEventCollector_image.png
Packs/Tessian/ReleaseNotes/1_1_0.md
Packs/Tessian/Integrations/TessianEventCollector/README.md
Please review the changes here

Add Tessian Event Collector

c17a8f9

amshamah419 self-assigned this Apr 5, 2026

Copilot AI review requested due to automatic review settings April 5, 2026 06:39

amshamah419 added docs-approved ready-for-pipeline-running Whether the pr is ready for running the whole pipeline, including testing on SAAS machines ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. labels Apr 5, 2026

Copilot started reviewing on behalf of amshamah419 April 5, 2026 06:40 View session

marketplace-ai-reviewer removed the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Apr 5, 2026

amshamah419 requested a review from DanielTal87 April 5, 2026 06:44

Copilot AI reviewed Apr 5, 2026

View reviewed changes

Changes per CR

1cdfaaf

amshamah419 requested a review from marketplace-ai-reviewer April 5, 2026 07:04

marketplace-ai-reviewer reviewed Apr 5, 2026

View reviewed changes

Changes per CR

38cb78b

Changes per Demo

c1cbd75

		@@ -0,0 +1,402 @@
		from typing import Any

		import demistomock as demisto # noqa: F401

Conversation

amshamah419 commented Apr 5, 2026

Contributing to Cortex XSOAR Content

Status

Related Issues

Description

Must have

Uh oh!

content-bot commented Apr 5, 2026

🤖 AI-Powered Code Review Available

Uh oh!

marketplace-ai-reviewer commented Apr 5, 2026

Uh oh!

github-actions bot commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amshamah419 commented Apr 5, 2026

Uh oh!

marketplace-ai-reviewer commented Apr 5, 2026

Uh oh!

marketplace-ai-reviewer commented Apr 5, 2026

Uh oh!

marketplace-ai-reviewer left a comment

Choose a reason for hiding this comment

Uh oh!

marketplace-ai-reviewer Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

marketplace-ai-reviewer Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

marketplace-ai-reviewer Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

marketplace-ai-reviewer Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

marketplace-ai-reviewer Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

content-bot commented Apr 5, 2026

Uh oh!

github-actions bot commented Apr 12, 2026

Your contributed Tessian pack has been modified on files:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Apr 5, 2026 •

edited

Loading