Hy/crtx 257330/standardized error messages

Packs/ApiModules/ReleaseNotes/2_4_34.md

@@ -0,0 +1,6 @@
+
+#### Scripts
+
+##### CoreIRApiModule
+
+- Documentation and metadata improvements.

Packs/ApiModules/Scripts/CoreIRApiModule/CoreIRApiModule.py

@@ -4484,7 +4484,12 @@ def fix_array_value(match: Match[str]) -> str:
             custom_filter = json.loads(fixed_json_str)
 
         except Exception as e:
-            raise DemistoException(f"custom_filter format is not valid. got: {str(e)}")
+            raise CortexInvalidArgError(
+                "custom_filter",
+                value=custom_filter_str,
+                reason=str(e),
+                override_message=f"custom_filter format is not valid. got: {str(e)}",
+            )
 
     if custom_filter:  # if exists, add custom filter to the built filter
         if not filter_dict:

Packs/ApiModules/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "ApiModules",
     "description": "API Modules",
     "support": "xsoar",
-    "currentVersion": "2.4.33",
+    "currentVersion": "2.4.34",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

Packs/CommonScripts/ReleaseNotes/1_22_31.md

@@ -0,0 +1,11 @@
+## Common Scripts
+
+- Documentation and metadata improvements.
+
+<!--
+#### Scripts
+
+##### SearchIndicatorAgentix
+
+- Updated error handling to use `CortexInvalidArgError` instead of `DemistoException` when the `value` argument contains invalid JSON. This enables Agentix agents to programmatically classify the failure and decide whether to retry or fix the argument.
+-->

Packs/CommonScripts/Scripts/SearchIndicatorAgentix/SearchIndicatorAgentix.py

@@ -58,7 +58,12 @@ def build_query_for_indicator_values(args: dict) -> list:
     try:
         values_as_list = json.loads(values)
     except (json.JSONDecodeError, TypeError) as e:
-        raise DemistoException(f"JSON decode failed for values {values}: {str(e)}.")
+        raise CortexInvalidArgError(
+            "value",
+            value=values,
+            reason=str(e),
+            override_message=f"JSON decode failed for values {values}: {str(e)}.",
+        )
 
     if not values_as_list:
         return []

Packs/CommonScripts/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Common Scripts",
     "description": "Frequently used scripts pack.",
     "support": "xsoar",
-    "currentVersion": "1.22.30",
+    "currentVersion": "1.22.31",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

Packs/Core/Integrations/CortexPlatformCore/CortexPlatformCore.py

@@ -2059,7 +2059,13 @@ def get_cases_command(client: Client, args: dict[str, Any]):
 
 def get_cases_sort_order(sort_by_creation_time, sort_by_modification_time):
     if sort_by_creation_time and sort_by_modification_time:
-        raise ValueError("Should be provide either sort_by_creation_time or sort_by_modification_time. Can't provide both")
+        raise CortexConflictingArgsError(
+            override_message="Should be provide either sort_by_creation_time or sort_by_modification_time. Can't provide both",
+            arguments=["sort_by_creation_time", "sort_by_modification_time"],
+            reason="Only one sort field can be specified at a time.",
+            resolution="Provide either sort_by_creation_time or sort_by_modification_time, not both.",
+            mutually_exclusive=True,
+        )
 
     if sort_by_creation_time:
         sort_field = "CREATION_TIME"
@@ -2307,7 +2313,12 @@ def search_assets_command(client: Client, args):
     if page_size is None:
         page_size = SEARCH_ASSETS_DEFAULT_LIMIT
     if page_size > SEARCH_ASSETS_MAX_LIMIT:
-        raise ValueError(f"page_size cannot exceed {SEARCH_ASSETS_MAX_LIMIT}")
+        raise CortexInvalidArgError(
+            "page_size",
+            value=page_size,
+            reason=f"must not exceed {SEARCH_ASSETS_MAX_LIMIT}",
+            override_message=f"page_size cannot exceed {SEARCH_ASSETS_MAX_LIMIT}",
+        )
 
     if page_size == 0:  # 0 Maps to max in the API, we will maintain this behavior with our max value instead
         page_size = SEARCH_ASSETS_MAX_LIMIT
@@ -3393,21 +3404,40 @@ def update_case_command(client: Client, args: dict) -> CommandResults:
     custom_fields = parse_custom_fields(args.get("custom_fields", []))
 
     if status == "resolved" and (not resolve_reason or not CaseManagement.STATUS_RESOLVED_REASON.get(resolve_reason, False)):
-        raise ValueError("In order to set the case to resolved, you must provide a resolve reason.")
+        raise CortexMissingArgError(
+            "resolve_reason",
+            override_message="In order to set the case to resolved, you must provide a resolve reason.",
+        )
 
-    if (resolve_reason or resolve_all_alerts or resolved_comment) and not status == "resolved":
-        raise ValueError(
-            "In order to use resolve_reason, resolve_all_alerts, or resolved_comment, the case status must be set to "
-            "'resolved'."
+    if (resolve_reason or resolve_all_alerts or resolved_comment) and status != "resolved":
+        conflicting = [arg for arg in ("resolve_reason", "resolve_all_alerts", "resolved_comment") if args.get(arg)]
+        raise CortexConflictingArgsError(
+            override_message=(
+                "In order to use resolve_reason, resolve_all_alerts, or resolved_comment, the case status must be set to "
+                "'resolved'."
+            ),
+            arguments=conflicting + ["status"],
+            reason="resolve_reason, resolve_all_alerts, and resolved_comment can only be used when status is 'resolved'.",
+            resolution="Set status to 'resolved' or remove the resolution-specific arguments.",
         )
 
     if status and not CaseManagement.STATUS.get(status):
-        raise ValueError(f"Invalid status '{status}'. Valid statuses are: {list(CaseManagement.STATUS.keys())}")
+        raise CortexInvalidArgError(
+            "status",
+            value=status,
+            allowed_values=list(CaseManagement.STATUS.keys()),
+            override_message=f"Invalid status '{status}'. Valid statuses are: {list(CaseManagement.STATUS.keys())}",
+        )
 
     if user_defined_severity and not CaseManagement.SEVERITY.get(user_defined_severity, False):
-        raise ValueError(
-            f"Invalid user_defined_severity '{user_defined_severity}'. Valid severities are: "
-            f"{list(CaseManagement.SEVERITY.keys())}"
+        raise CortexInvalidArgError(
+            "user_defined_severity",
+            value=user_defined_severity,
+            allowed_values=list(CaseManagement.SEVERITY.keys()),
+            override_message=(
+                f"Invalid user_defined_severity '{user_defined_severity}'. Valid severities are: "
+                f"{list(CaseManagement.SEVERITY.keys())}"
+            ),
         )
 
     valid_fields_to_update, error_messages = validate_custom_fields(custom_fields, client)
@@ -3429,7 +3459,23 @@ def update_case_command(client: Client, args: dict) -> CommandResults:
     remove_nulls_from_dictionary(case_update_payload)
 
     if not case_update_payload:
-        raise ValueError(f"No valid update parameters provided.\n{error_messages}")
+        raise CortexMissingArgError(
+            [
+                "case_name",
+                "description",
+                "assignee",
+                "status",
+                "notes",
+                "starred",
+                "user_defined_severity",
+                "resolve_reason",
+                "resolved_comment",
+                "resolve_all_alerts",
+                "custom_fields",
+            ],
+            require_one=True,
+            override_message=f"No valid update parameters provided.\n{error_messages}",
+        )
 
     def is_bulk_update_allowed(case_update_payload: dict) -> bool:
         # Bulk update supports only those fields
@@ -3562,7 +3608,15 @@ def repackage_to_update_case_format(case_list):
 
     if error_messages:
         return_results(command_results)
-        return_error(f"The following fields could not be updated:\n{error_messages}")
+        # The fields failed validation (unknown field, invalid value/type, system field),
+        # so surface a standardized INVALID_ARGUMENT error_code while keeping the
+        # original human-readable message for backward compatibility.
+        error = CortexInvalidArgError(
+            "custom_fields",
+            reason=error_messages,
+            override_message=f"The following fields could not be updated:\n{error_messages}",
+        )
+        return_error(error.build_message(), error=error)
 
     return command_results
 

Packs/Core/Integrations/CortexPlatformCore/CortexPlatformCore_test.py

@@ -980,11 +980,12 @@ def test_search_assets_page_size_exceeds_max_raises():
     WHEN:
         search_assets_command is invoked.
     THEN:
-        A ValueError is raised with a message mentioning the max value,
+        A CortexInvalidArgError is raised with a message mentioning the max value,
         and no request is sent to the API.
     """
     import pytest
 
+    from CommonServerPython import CortexInvalidArgError
     from CortexPlatformCore import Client, SEARCH_ASSETS_MAX_LIMIT, search_assets_command
 
     mock_client = Client(base_url="", headers={})
@@ -994,7 +995,7 @@ def test_search_assets_page_size_exceeds_max_raises():
     with (
         mock.patch.object(mock_client, "get_webapp_data") as mock_get_webapp_data,
         mock.patch("CortexPlatformCore.get_asset_group_ids_from_names", return_value=[]),
-        pytest.raises(ValueError, match=str(SEARCH_ASSETS_MAX_LIMIT)),
+        pytest.raises(CortexInvalidArgError, match=str(SEARCH_ASSETS_MAX_LIMIT)),
     ):
         search_assets_command(mock_client, {"page_size": str(SEARCH_ASSETS_MAX_LIMIT + 1)})
 
@@ -9010,9 +9011,10 @@ def test_update_case_command_status_resolved_without_reason_raises_error(mocker:
     WHEN:
         The update_case_command function is called.
     THEN:
-        ValueError is raised indicating resolve_reason is required.
+        CortexMissingArgError is raised indicating resolve_reason is required.
     """
     from CortexPlatformCore import update_case_command, Client
+    from CommonServerPython import CortexMissingArgError
 
     client = Client(base_url="", headers={})
 
@@ -9021,7 +9023,7 @@ def test_update_case_command_status_resolved_without_reason_raises_error(mocker:
         "status": "resolved",
     }
 
-    with pytest.raises(ValueError, match="In order to set the case to resolved, you must provide a resolve reason"):
+    with pytest.raises(CortexMissingArgError, match="In order to set the case to resolved, you must provide a resolve reason"):
         update_case_command(client, args)
 
 
@@ -9032,9 +9034,10 @@ def test_update_case_command_resolve_reason_without_resolved_status_raises_error
     WHEN:
         The update_case_command function is called.
     THEN:
-        ValueError is raised indicating status must be resolved.
+        CortexConflictingArgsError is raised indicating status must be resolved.
     """
     from CortexPlatformCore import update_case_command, Client
+    from CommonServerPython import CortexConflictingArgsError
 
     client = Client(base_url="", headers={})
 
@@ -9044,7 +9047,7 @@ def test_update_case_command_resolve_reason_without_resolved_status_raises_error
         "resolve_reason": "false_positive",
     }
 
-    with pytest.raises(ValueError, match="the case status must be set to 'resolved'."):
+    with pytest.raises(CortexConflictingArgsError, match="the case status must be set to 'resolved'."):
         update_case_command(client, args)
 
 
@@ -9055,9 +9058,10 @@ def test_update_case_command_invalid_status_raises_error(mocker: MockerFixture):
     WHEN:
         The update_case_command function is called.
     THEN:
-        ValueError is raised indicating invalid status.
+        CortexInvalidArgError is raised indicating invalid status.
     """
     from CortexPlatformCore import update_case_command, Client
+    from CommonServerPython import CortexInvalidArgError
 
     client = Client(base_url="", headers={})
 
@@ -9066,7 +9070,7 @@ def test_update_case_command_invalid_status_raises_error(mocker: MockerFixture):
         "status": "invalid_status",
     }
 
-    with pytest.raises(ValueError, match="Invalid status 'invalid_status'"):
+    with pytest.raises(CortexInvalidArgError, match="Invalid status 'invalid_status'"):
         update_case_command(client, args)
 
 
@@ -9077,9 +9081,10 @@ def test_update_case_command_invalid_severity_raises_error(mocker: MockerFixture
     WHEN:
         The update_case_command function is called.
     THEN:
-        ValueError is raised indicating invalid severity.
+        CortexInvalidArgError is raised indicating invalid severity.
     """
     from CortexPlatformCore import update_case_command, Client
+    from CommonServerPython import CortexInvalidArgError
 
     client = Client(base_url="", headers={})
 
@@ -9088,7 +9093,7 @@ def test_update_case_command_invalid_severity_raises_error(mocker: MockerFixture
         "user_defined_severity": "invalid_severity",
     }
 
-    with pytest.raises(ValueError, match="Invalid user_defined_severity 'invalid_severity'"):
+    with pytest.raises(CortexInvalidArgError, match="Invalid user_defined_severity 'invalid_severity'"):
         update_case_command(client, args)
 
 
@@ -9099,18 +9104,35 @@ def test_update_case_command_no_valid_parameters_raises_error(mocker: MockerFixt
     WHEN:
         The update_case_command function is called.
     THEN:
-        ValueError is raised indicating no valid update parameters.
+        CortexMissingArgError is raised indicating no valid update parameters.
     """
     from CortexPlatformCore import update_case_command, Client
+    from CommonServerPython import CortexMissingArgError
 
     client = Client(base_url="", headers={})
 
     args = {"case_id": "123"}
 
-    with pytest.raises(ValueError, match="No valid update parameters provided."):
+    with pytest.raises(CortexMissingArgError, match="No valid update parameters provided."):
         update_case_command(client, args)
 
 
+def test_get_cases_sort_order_both_sort_args_raises_error():
+    """
+    GIVEN:
+        Both sort_by_creation_time and sort_by_modification_time are provided.
+    WHEN:
+        get_cases_sort_order is called.
+    THEN:
+        CortexConflictingArgsError is raised with the original message preserved.
+    """
+    from CortexPlatformCore import get_cases_sort_order
+    from CommonServerPython import CortexConflictingArgsError
+
+    with pytest.raises(CortexConflictingArgsError, match="Can't provide both"):
+        get_cases_sort_order(sort_by_creation_time="asc", sort_by_modification_time="desc")
+
+
 def test_update_case_command_non_bulk_fields_trigger_individual_update(mocker: MockerFixture):
     """
     GIVEN:

Packs/Core/ReleaseNotes/3_5_69.md

@@ -0,0 +1,19 @@
+
+#### Integrations
+
+##### Investigation & Response
+
+- Documentation and metadata improvements.
+
+##### Indicators detection
+
+- Documentation and metadata improvements.
+
+##### Cortex Platform - Core
+
+- Documentation and metadata improvements.
+
+<!--
+
+- Updated error handling in **core-update-case**, **core-get-cases**, and **core-get-issues** commands to use standardized Cortex exception classes (`CortexMissingArgError`, `CortexInvalidArgError`, `CortexConflictingArgsError`) instead of generic `ValueError`/`DemistoException`.
+-->

Packs/Core/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Core",
     "description": "Automates incident response",
     "support": "xsoar",
-    "currentVersion": "3.5.68",
+    "currentVersion": "3.5.69",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

Packs/CortexXDR/ReleaseNotes/6_3_31.md

@@ -0,0 +1,6 @@
+
+#### Integrations
+
+##### Palo Alto Networks Cortex XDR - Investigation and Response
+
+- Documentation and metadata improvements.

Packs/CortexXDR/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Cortex XDR by Palo Alto Networks",
     "description": "Automates Cortex XDR incident response, and includes custom Cortex XDR incident views and layouts to aid analyst investigations.",
     "support": "xsoar",
-    "currentVersion": "6.3.30",
+    "currentVersion": "6.3.31",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",

Packs/ctf01/ReleaseNotes/1_1_9.md

@@ -0,0 +1,6 @@
+
+#### Integrations
+
+##### Cortex XDR - IR CTF
+
+- Documentation and metadata improvements.

Packs/ctf01/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Capture The Flag - 01",
     "description": "XSOAR's Capture the flag (CTF)",
     "support": "xsoar",
-    "currentVersion": "1.1.8",
+    "currentVersion": "1.1.9",
     "serverMinVersion": "8.2.0",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",