PantherFlow Investigator Helper

[arielkr256]

Background

Adds a helper function to convert an event into a PantherFlow query to investigate the context surrounding the event. It searches +/- 30 minutes, for the logtype of the event, with any similar p_any indicator fields.

Changes

• New pantherflow_investigation helper
• Updated AWS and Okta alert context to add PantherFlow Investigation query

Testing

• generated queries tested in dev environment

[arielkr256]

Example generated query:

union panther_signals.public.correlation_signals
, panther_logs.public.aws_cloudtrail
| where p_event_time between datetime('2024-11-25 15:06:52.343407388') - time.parse_timespan('30m') .. datetime('2024-11-25 15:06:52.343407388') + time.parse_timespan('30m')
| where arrays.overlap(p_any_ip_addresses, ['10.11.12.13'])
or arrays.overlap(p_any_trace_ids, ['ASIADFJLKEFINDLKFJLJ'])
or arrays.overlap(p_any_usernames, ['ariel.ropek'])
| sort p_event_time

[ben-githubs]

We should add a couple unit tests (in the global_helpers_test.py file) but otherwise looks good!

[arielkr256]

@ben-githubs good call on the unit tests, caught an issue with the Immutable event types.