Nozomi Networks Add Alert Update Workflow and Improve Authentication Resilience #303

[nicoloereni]

• Added a new workflow file NN-Universal-Alert-Updated-Workflow.xml for improved alert retrieval and processing, including robust pagination, bookmarking, and error handling.
• Enhanced bearer token extraction logic in NN-Universal-Alert-Workflow.xml and NN-Universal-Asset-Workflow.xml to handle both Authorization and authorization header casing, improving compatibility with different API responses.

[nicoloereni]

Hi @ChrisCollinsIBM,

Could you please review the PR when you get a chance?

Thanks!

[ChrisCollinsIBM]

Hi @nicoloereni, can you provide some clarification on what Community Developed/NozomiNetworks/Universal/NN-Universal-Alert-Updated-Workflow.xml is specifically for?

It's a new file added this PR, but has the 1.0.1 version number still and isn't mentioned in the README.

When would someone want to use this workflow file?

[nicoloereni]

Hi @nicoloereni, can you provide some clarification on what Community Developed/NozomiNetworks/Universal/NN-Universal-Alert-Updated-Workflow.xml is specifically for?

It's a new file added this PR, but has the 1.0.1 version number still and isn't mentioned in the README.

When would someone want to use this workflow file?

@ChrisCollinsIBM good point, thanks.

The NN-Universal-Alert-Updated workflow is intended for environments where alerts need to be retrieved based on record_updated_at rather than record_created_at. This allows QRadar to receive not only newly created alerts but also updates to existing alerts.

The existing NN-Universal-Alert workflow instead retrieves alerts only based on record_created_at, so it only sends newly created alerts.

I’ve updated the README to clarify when each workflow should be used.

[ChrisCollinsIBM]

Hi @nicoloereni, can you provide some clarification on what Community Developed/NozomiNetworks/Universal/NN-Universal-Alert-Updated-Workflow.xml is specifically for?
It's a new file added this PR, but has the 1.0.1 version number still and isn't mentioned in the README.
When would someone want to use this workflow file?

@ChrisCollinsIBM good point, thanks.

The NN-Universal-Alert-Updated workflow is intended for environments where alerts need to be retrieved based on record_updated_at rather than record_created_at. This allows QRadar to receive not only newly created alerts but also updates to existing alerts.

The existing NN-Universal-Alert workflow instead retrieves alerts only based on record_created_at, so it only sends newly created alerts.

I’ve updated the README to clarify when each workflow should be used.

Perfect, that helps clarify things. Thanks!

[ChrisCollinsIBM]

Thanks for the update and the clarification on the README as to the use case for the new workflow file.