Add Export Commands

[socautomator]

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Description

This PR adds two new commands, that allows to export the threat Timeline and the Threat events from SentinelOne.
The exported timeline / events is stored as a File in XSOAR and can be accessed via the Context.

Must have

• Tests
• Documentation

relates: https://jira-dc.paloaltonetworks.com/browse/CIAC-17231

[content-bot]

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

[content-bot]

Hi @socautomator, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

[content-bot]

🤖 AI-Powered Code Review Available

Hi @kamalq97, you can leverage AI-powered code review to assist with this PR!

Available Commands:

• @marketplace-ai-reviewer start review - Initiate a full AI code review
• @marketplace-ai-reviewer re-review - Incremental review for new commits

[noydavidi]

Hey @socautomator, thank you so much for your contribution! the PR looks great. I added some comments and I have two questions:

1. Why do we need to return the output json as file and not as context as we usually do? what is the use case for it?
2. Can you please share screenshots or a small demo for the commands?
   Please feel free to tag me again once all the changes are done :)
   Thank you.

[socautomator]

@noydavidi I'll have a look at your review today. To answer your first Question: Depending on the Threat, the Events / Timeline can become quite large (i had seen one case, where we had > 1 million characters). That would massively blow up the context, so i choose to write them to a file instead.