SekoiaXDR - add commands to make SOL queries

[lvoloshyn-sekoia]

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Related Issues

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

🟡 Not ready to approve

It introduces user-facing bugs/inconsistencies (optional JSON arg parsing can break on empty values, jsonl downloads use a .jl extension, and community UUID context key is inconsistent between code/YAML/docs).

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR extends the SekoiaXDR integration pack by adding new commands for executing Sekoia SOL queries, checking their run status, and downloading results (including a convenience polling command), along with the related documentation, tests, and version bump.

Changes:

• Added query execution/status/download commands and a combined polling command (sekoia-xdr-run-query) to the integration.
• Updated integration docs/examples and added unit tests for the new commands.
• Bumped pack version to 1.1.17 and added release notes.

File summaries

File	Description
Packs/SekoiaXDR/ReleaseNotes/1_1_17.md	Release notes for the new SOL query commands.
Packs/SekoiaXDR/pack_metadata.json	Pack version bump to 1.1.17.
Packs/SekoiaXDR/Integrations/SekoiaXDR/SekoiaXDR.yml	Declares the new commands/args/outputs in the integration YAML.
Packs/SekoiaXDR/Integrations/SekoiaXDR/SekoiaXDR.py	Implements query execution, polling, and download logic.
Packs/SekoiaXDR/Integrations/SekoiaXDR/SekoiaXDR_test.py	Adds unit tests covering the new commands.
Packs/SekoiaXDR/Integrations/SekoiaXDR/README.md	Documents the new commands and their inputs/outputs.
Packs/SekoiaXDR/Integrations/SekoiaXDR/command_examples.txt	Adds usage examples for the new commands.

Review details

Suppressed comments (4)

Packs/SekoiaXDR/Integrations/SekoiaXDR/SekoiaXDR.py:1713

• Optional query_parameters parsing checks only for key presence ("query_parameters" in args). If the arg is present but empty (common for optional args), json.loads('') will raise and break polling execution.

    try:
        query_parameters = json.loads(args["query_parameters"]) if "query_parameters" in args else None

    except json.JSONDecodeError as e:
        raise DemistoException(f"query_parameters argument is not a valid JSON: {e}")

Packs/SekoiaXDR/Integrations/SekoiaXDR/SekoiaXDR.py:1740

• When result_format is "jsonl", the file is currently saved with a .jl extension, which is inconsistent with the selected format and common tooling expectations (.jsonl).

    filename = "result.csv" if result_format == "csv" else "result.jl"

Packs/SekoiaXDR/Integrations/SekoiaXDR/SekoiaXDR.yml:1256

• Typo in output description: "UUId" should be "UUID".

      description: Parent UUId.

Packs/SekoiaXDR/Integrations/SekoiaXDR/README.md:874

• Typo in output description: "UUId" should be "UUID".

| SekoiaXDR.QueryRun.parent_uuid | unknown | Parent UUId. | 

• Files reviewed: 7/7 changed files
• Comments generated: 4
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[content-bot]

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

[content-bot]

Hi @lvoloshyn-sekoia, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

[content-bot]

🤖 AI-Powered Code Review Available

Hi @kamalq97, you can leverage AI-powered code review to assist with this PR!

Available Commands:

• @marketplace-ai-reviewer start review - Initiate a full AI code review
• @marketplace-ai-reviewer re-review - Incremental review for new commits

[kamalq97]

Hi @lvoloshyn-sekoia

Thank you for your contribution,

Could you please confirm the exact status of this PR? is it ready for review?

[kamalq97]

Hi @lvoloshyn-sekoia,

Thank you for taking the time to contribute to our project!

Since this pull request has been in an "in progress" state without activity for the past two weeks, we are going to close it to help keep our queue manageable.

Please feel free to reopen this PR or submit a new one whenever you are ready to continue your work.

We look forward to reviewing it then!

[TOUFIKIzakarya]

Hello @kamalq97,

Can you please reopen this PR, it's ready.