CadoResponse
Automate data collection. Process data at cloud speed. Analyze with purpose.
Forensics & Malware Analysis · Cado Response
Details
| ID | CadoResponse |
|---|---|
| Provider | Darktrace |
| Category | Forensics & Malware Analysis |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Cado Response Integration for Cortex XSOAR
Automate data collection. Process data at cloud speed. Analyze with purpose.
This integration was integrated and tested with version 1.2.0 of CadoResponse
Configure Cado Response in Cortex
| Parameter | Description | Required |
|---|---|---|
| Cado Response Instance | The URL for your Cado Response Instance | True |
| API Key | The API Key to use for connection | True |
| Trust any certificate (not secure) | False | |
| Use system proxy settings | False | |
| Default Cado Response Project | Provides a fallback Project ID from Cado Response if you forget to add an ID to a command. If you’re not sure, don’t change! | True |
| Default AWS Region | Provides a default AWS region to fallback to if you forget to add it to a command. | True |
| Default S3 Bucket | Provides a default S3 bucket to fallback to if you forget to add it to a command. | True |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
cado-create-project
Create a project in Cado Response
Base Command
cado-create-project
Input
| Argument Name | Description | Required |
|---|---|---|
| project_name | Name of the project. | Required |
| project_description | Description for the project. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CadoResponse.Project.id | Number | The Project ID of the newly created project |
Command example
!cado-create-project project_name="Project Name" description="Project Description"
Context Example
{
"CadoResponse": {
"Project": {
"id": 1,
"msg": "Created"
}
}
}
Human Readable Output
Results
id msg 1 Created
cado-list-project
Get a list of projects from Cado Response
Base Command
cado-list-project
Input
| Argument Name | Description | Required |
|---|---|---|
| project_id | ID of the project to retrive. | Optional |
| limit | Limit results to retrieve. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CadoResponse.Projects.id | Number | ID of the retrieved project |
| CadoResponse.Projects.caseName | String | Name of the retrieved project |
| CadoResponse.Projects.description | String | Description of the retrieved project |
| CadoResponse.Projects.users | Array | Array of users assigned to the retrieved project |
| CadoResponse.Projects.created | Date | Creation date of the project |
Command example
!cado-list-project limit=100
Context Example
{
"CadoResponse": {
"Projects": {
"caseName": "Project Name_XSOAR",
"created": "2022-01-17T12:21:46.613814",
"deleted": false,
"description": "This is a project in Cado Response created through Cortex XSOAR!",
"id": 1,
"status": "Pending",
"users": [
{
"display_name": "admin",
"id": 1,
"is_admin": true,
"login_type": 0,
"username": "admin"
}
]
}
}
}
Human Readable Output
Results
caseName created deleted description id status users Project Name_XSOAR 2022-01-17T12:21:46.613814 false This is a project in Cado Response created through Cortex XSOAR! 1 Pending {‘display_name’: ‘admin’, ‘id’: 1, ‘is_admin’: True, ‘login_type’: 0, ‘username’: ‘admin’}
Command example
!cado-list-project project_id=1
Context Example
{
"CadoResponse": {
"Projects": {
"caseName": "Project Name_XSOAR",
"created": "2022-01-17T12:21:46.613814",
"deleted": false,
"description": "This is a project in Cado Response created through Cortex XSOAR!",
"id": 1,
"status": "Pending",
"users": [
{
"display_name": "admin",
"id": 1,
"is_admin": true,
"login_type": 0,
"username": "admin"
}
]
}
}
}
Human Readable Output
Results
caseName created deleted description id status users Project Name_XSOAR 2022-01-17T12:21:46.613814 false This is a project in Cado Response created through Cortex XSOAR! 1 Pending {‘display_name’: ‘admin’, ‘id’: 1, ‘is_admin’: True, ‘login_type’: 0, ‘username’: ‘admin’}
cado-get-pipeline
Get pipeline details from Cado Response
Base Command
cado-get-pipeline
Input
| Argument Name | Description | Required |
|---|---|---|
| pipeline_id | The id of the pipeline to retrieve. | Optional |
| project_id | The id of the project the pipeline belongs to. | Optional |
| limit | Limit results to retrieve. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CadoResponse.Pipeline.pipeline_id | Number | The ID of the retrieved pipeline |
| CadoResponse.Pipeline.pipeline_type | String | The type of pipeline that was retrieved |
| CadoResponse.Pipeline.created | Date | The date at which the retrieved pipeline was started |
| CadoResponse.Pipeline.evidence_id | Number | The evidence ID linked to the retrieved pipeline |
| CadoResponse.Pipeline.project_id | Number | The ID of the project the pipeline belongs to |
| CadoResponse.Pipeline.is_terminated | Boolean | A boolean which says if the retrieved pipeline has been finished/terminated |
| CadoResponse.Pipeline.summary | Array | An array of values containing the cancelled, failed, pending, running and successful pipeline subtasks |
| CadoResponse.Pipeline.subtask | Array | An array of tasks in the retrieved pipeline |
Command example
!cado-get-pipeline project_id=1 pipeline_id=1
Context Example
{
"CadoResponse": {
"Pipeline": {
"pipeline_id": 1,
"pipeline_type": "processing",
"created": "2022-01-17T12:22:00.843869",
"evidence_id": 1,
"project_id": 1,
"is_terminated": false,
"subtasks": [
{
"execution_duration": 0,
"finish_time": 0,
"name": "Triage: Attaching disk for local data storage.",
"name_key": "infrastructure.check_ssd",
"notification_level": "Info",
"progress_text": [],
"start_time": 0,
"state": "PENDING",
"task_id": "3699827f-63c4-4408-88a4-0ae899187ed3",
"total_stages": null
}
],
"summary": {
"cancelled": 0,
"failure": 0,
"pending": 14,
"running": 0,
"success": 0,
"total": 14
}
}
}
}
Human Readable Output
Results
pipeline_id pipeline_type created evidence_id project_id is_terminated summary subtask 1 processing 2022-01-17T12:22:00.843869 1 1 false “execution_duration”: 0,
“finish_time”: 0,
“name”: “Triage: attaching disk for local data storage.”,
“name_key”: infrastructure.check_ssd”,
“notification_level”: “Info”,
“progress_text”: [],
“start_time”: 0,
“state”: “PENDING”,
“task_id”: “3699827f-63c4-4408-88a4-0ae899187ed3”,
“total_stages”: null“cancelled”: 0,
“failure”: 0,
“pending”: 14,
“running”: 0,
“success”: 0,
“total”: 14
cado-list-ec2
Get a list of EC2 instances in a region
Base Command
cado-list-ec2
Input
| Argument Name | Description | Required |
|---|---|---|
| region | The AWS region to list instances in. | Required |
| project_id | The ID of the project you wish to attach the acquisition to. | Optional |
| limit | Limit results to retrieve. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CadoResponse.EC2Instances.id | Number | AWS ID of the EC2 Instance |
| CadoResponse.EC2Instances.instance_name | String | Name of the EC2 Instance |
| CadoResponse.EC2Instances.instance_type | String | AWS Type of the EC2 instance |
| CadoResponse.EC2Instances.region | String | AWS region of the EC2 instance |
Command example
!cado-list-ec2 project_id=1 region="us-east-1" limit=100
Context Example
{
"CadoResponse": {
"EC2Instances": [
{
"_placement": "us-east-1c",
"_state": "stopped",
"celery_worker_name": null,
"deployment_id": null,
"evidence_id": null,
"id": "i-00000000000",
"instance_name": "Instance",
"instance_type": "t3a.2xlarge",
"ip_address": null,
"launch_time": "Thu, 25 Mar 2021 18:38:13 GMT",
"processing_type": null,
"project_id": null,
"queue_name": null,
"region": {
"name": "us-east-1"
},
"worker_used": null
}
]
}
}
Human Readable Output
Results
_placement _state celery_worker_name deployment_id evidence_id id instance_name instance_type ip_address launch_time processing_type project_id queue_name region worker_used us-east-1c stopped i-00000000000 Instance t3a.2xlarge Thu, 25 Mar 2021 18:38:13 GMT name: us-east-1
cado-list-s3
Get a list of S3 buckets
Base Command
cado-list-s3
Input
| Argument Name | Description | Required |
|---|---|---|
| project_id | The ID of the project you wish to attach the acquisition to. | Optional |
| limit | Limit results to retrieve. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CadoResponse.S3Buckets.buckets | Array | An array of S3 buckets available to the project |
Command example
!cado-list-s3 project_id=1 limit=100
Context Example
{
"CadoResponse": {
"S3Buckets": {
"buckets": [
"bucket",
]
}
}
}
Human Readable Output
Results
buckets bucket
cado-trigger-ec2
Trigger a disk acquisition and processing pipeline in Cado Response for a given EC2 instance
Base Command
cado-trigger-ec2
Input
| Argument Name | Description | Required |
|---|---|---|
| project_id | The ID of the project you wish to attach the acquisition to. | Optional |
| instance_id | ID of the EC2 instance to acquire. | Required |
| region | AWS region in which the EC2 instance is located. | Optional |
| bucket | S3 bucket where the uploaded disk image resides. | Optional |
| compress | Flag indicating if disk compression is enabled. | Optional |
| include_disks | Flag indicating if we include disk images in the acquisition. | Optional |
| include_hash | Flag indicating if we calculate the hash of the disk. | Optional |
| include_logs | Flag indicating if we include system logs in the acquisition. | Optional |
| include_screenshot | Flag indicating if we include a screenshot of the system in the acquisition. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| CadoResponse.EC2Acquisition.pipeline_id | Number | ID of the created pipeline |
Command example
!cado-trigger-ec2 project_id=1 instance_id="i-00000000000" region="us-east-1" bucket="bucket" compress=true include_disks=true include_hash=true include_logs=true include_screenshot=true
Context Example
{
"CadoResponse": {
"EC2Acquistion": {
"created": "2022-01-17T12:21:59.084282",
"evidence_id": 0,
"name": "Acquiring i-00000000000",
"pipeline_id": 1,
"pipeline_type": "acquisition",
"project_id": 1,
"subtasks": [
{
"id": "1587a9c9-c02c-464b-a6f7-d4b7e720bd93"
},
{
"id": "4f798bf8-c7d3-427c-9498-10a85cfe3978"
},
{
"id": "c5fa26f1-e282-47a6-8335-1160766e089b"
},
{
"id": "82ec9a7e-47ac-4539-9623-166a44a59d0f"
},
{
"id": "88151005-a999-422e-b4cb-9e76699d6e42"
}
],
"user_id": 1
}
}
}
Human Readable Output
Results
created evidence_id name pipeline_id pipeline_type project_id subtasks user_id 2022-01-17T12:21:59.084282 0 Acquiring i-00000000000 1 acquisition 1 {‘id’: ‘1587a9c9-c02c-464b-a6f7-d4b7e720bd93’},
{‘id’: ‘4f798bf8-c7d3-427c-9498-10a85cfe3978’},
{‘id’: ‘c5fa26f1-e282-47a6-8335-1160766e089b’},
{‘id’: ‘82ec9a7e-47ac-4539-9623-166a44a59d0f’},
{‘id’: ‘88151005-a999-422e-b4cb-9e76699d6e42’}1
cado-trigger-s3
Trigger a disk acquisition and processing pipeline in Cado Response for a given file in an S3 bucket
Base Command
cado-trigger-s3
Input
| Argument Name | Description | Required |
|---|---|---|
| project_id | The ID of the project you wish to attach the acquisition to. | Optional |
| bucket | The S3 bucket name containing the file. | Required |
| file_name | The name of the file to process. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| CadoResponse.S3Acquisition.pipeline_id | Number | ID of the created pipeline |
Command example
!cado-trigger-s3 project_id=1 bucket="bucket" file_name="file"
Context Example
{
"CadoResponse": {
"S3Acquisition": {
"created": "2022-01-17T12:22:00.843869",
"evidence_id": 1,
"name": "",
"pipeline_id": 2,
"pipeline_type": "processing",
"project_id": 1,
"subtasks": [
{
"id": "3699827f-63c4-4408-88a4-0ae899187ed3"
},
{
"id": "727e2072-8bf7-4847-89ea-9447f5fd8fd0"
},
{
"id": "857d48b8-abaf-4ea6-b159-d25c9784b837"
},
{
"id": "533f7deb-74bc-4ffb-b81f-788ed714bead"
},
{
"id": "3f1defde-3986-4292-a423-1bef62d4c52b"
},
{
"id": "e41a0934-266b-4868-9a7d-5f083b1efcc1"
},
{
"id": "75411e10-46e9-41dd-8bf7-9b5fbdc8df71"
},
{
"id": "0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c"
},
{
"id": "ca063c7b-1135-4922-8542-49f40ce71449"
},
{
"id": "67fdb0ea-dcee-4f65-a003-4f40fcd567fb"
},
{
"id": "1437ec33-6af2-4eb8-9c43-e071dcb7e0ac"
},
{
"id": "06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d"
},
{
"id": "e3cc930e-9a60-46c3-97a1-611824c24437"
},
{
"id": "ad2c8877-39e7-4bff-9756-81278802ee76"
}
],
"user_id": 1
}
}
}
Human Readable Output
Results
created evidence_id name pipeline_id pipeline_type project_id subtasks user_id 2022-01-17T12:22:00.843869 1 2 processing 1 {‘id’: ‘3699827f-63c4-4408-88a4-0ae899187ed3’},
{‘id’: ‘727e2072-8bf7-4847-89ea-9447f5fd8fd0’},
{‘id’: ‘857d48b8-abaf-4ea6-b159-d25c9784b837’},
{‘id’: ‘533f7deb-74bc-4ffb-b81f-788ed714bead’},
{‘id’: ‘3f1defde-3986-4292-a423-1bef62d4c52b’},
{‘id’: ‘e41a0934-266b-4868-9a7d-5f083b1efcc1’},
{‘id’: ‘75411e10-46e9-41dd-8bf7-9b5fbdc8df71’},
{‘id’: ‘0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c’},
{‘id’: ‘ca063c7b-1135-4922-8542-49f40ce71449’},
{‘id’: ‘67fdb0ea-dcee-4f65-a003-4f40fcd567fb’},
{‘id’: ‘1437ec33-6af2-4eb8-9c43-e071dcb7e0ac’},
{‘id’: ‘06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d’},
{‘id’: ‘e3cc930e-9a60-46c3-97a1-611824c24437’},
{‘id’: ‘ad2c8877-39e7-4bff-9756-81278802ee76’}1
Configuration parameters
url— Cado Response Instance (required)apikey— API Key (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settingsCadoResponse_DefaultProject— Default Cado Response Project (required)CadoResponse_DefaultRegion— Default AWS Region (required)CadoResponse_DefaultBucket— Default S3 Bucket (required)
Commands (7)
-
cado-create-projectCreate a project in Cado Response.
-
cado-get-pipelineGet pipeline details from Cado Response.
-
cado-list-ec2Get a list of EC2 instances in a region.
-
cado-list-projectGet a list of projects from Cado Response.
-
cado-list-s3Get a list of S3 buckets.
-
cado-trigger-ec2Trigger a disk acquisition and processing pipeline in Cado Response for a given EC2 instance.
-
cado-trigger-s3Trigger a disk acquisition and processing pipeline in Cado Response for a given file in an S3 bucket.
"""Tests for the Cado Response API Integration for the Cortex XSOAR Platform""" from typing import Any from CommonServerPython import CommandResults, DemistoException from pytest import raises # noqa: PT013 def test_module_command_success(requests_mock: Any) -> None: """ Successful test for the test-module command. """ from CadoResponse import Client, test_module mock_get_response: dict[str, str] = {"status": "Running"} expected_mocked_command_result: str = "ok" requests_mock.get("https://test.com/api/v2/system/status", json=mock_get_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) mocked_command_result: str = test_module(client) assert mocked_command_result == expected_mocked_command_result def test_module_command_fail(requests_mock: Any) -> None: """ Unsuccessful test for the test-module command. """ from CadoResponse import Client, test_module mock_get_response: dict[str, str] = {"status": "Down"} expected_mocked_command_result: str = "Cado Response is not running" requests_mock.get("https://test.com/api/v2/system/status", json=mock_get_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) mocked_command_result: str = test_module(client) assert mocked_command_result == expected_mocked_command_result def test_create_project_command_success(requests_mock: Any) -> None: """ Successful test for the cado-create-project command. """ from CadoResponse import Client, create_project_command mock_post_response: dict[str, int] = {"id": 1} expected_mocked_command_result: dict[str, Any] = mock_post_response requests_mock.post("https://test.com/api/v2/projects", json=mock_post_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, str] = {"project_name": "testing-project", "project_description": "This is a testing project"} mocked_command_result: CommandResults = create_project_command(client, args) assert mocked_command_result.outputs_prefix == "CadoResponse.Project" assert mocked_command_result.outputs_key_field == "id" assert mocked_command_result.outputs == expected_mocked_command_result def test_get_project_list_command_success(requests_mock: Any) -> None: """ Successful test for the cado-get-project (list version) command. """ from CadoResponse import Client, list_project_command mock_get_response: list[dict[str, Any]] = [ { "caseName": "Project Name", "created": "2021-10-18T10:36:33.140305", "deleted": False, "description": "Project Description", "id": 1, "status": "Pending", "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}], } ] expected_mocked_command_result: list[dict[str, Any]] = mock_get_response requests_mock.get("https://test.com/api/v2/projects", json=mock_get_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, int] = {"limit": 1} mocked_command_result: CommandResults = list_project_command(client, args) assert mocked_command_result.outputs_prefix == "CadoResponse.Projects" assert mocked_command_result.outputs_key_field == "id" assert mocked_command_result.outputs == expected_mocked_command_result def test_get_project_single_command_success(requests_mock: Any) -> Any: """ Successful test for the cado-list-project (single project) command. """ from CadoResponse import Client, list_project_command mock_get_response: list[dict[str, Any]] = [ { "caseName": "Project Name", "created": "2021-10-18T10:36:33.140305", "deleted": False, "description": "Project Description", "id": 1, "status": "Pending", "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}], } ] expected_mocked_command_result: list[dict[str, Any]] = mock_get_response requests_mock.get("https://test.com/api/v2/projects/1", json=mock_get_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, int] = {"project_id": 1} mocked_command_result: CommandResults = list_project_command(client, args) assert mocked_command_result.outputs_prefix == "CadoResponse.Projects" assert mocked_command_result.outputs_key_field == "id" assert mocked_command_result.outputs == expected_mocked_command_result def test_get_project_no_id_command_success(requests_mock: Any) -> Any: """ Successful test for the cado-get-project (w/ no id) command. """ from CadoResponse import Client, list_project_command mock_get_response: list[dict[str, Any]] = [ { "caseName": "Project Name", "created": "2021-10-18T10:36:33.140305", "deleted": False, "description": "Project Description", "id": 1, "status": "Pending", "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}], } ] expected_mocked_command_result: list[dict[str, Any]] = mock_get_response requests_mock.get("https://test.com/api/v2/projects", json=mock_get_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict = {} mocked_command_result: CommandResults = list_project_command(client, args) assert mocked_command_result.outputs_prefix == "CadoResponse.Projects" assert mocked_command_result.outputs_key_field == "id" assert mocked_command_result.outputs == expected_mocked_command_result def test_get_project_command_limit_success(requests_mock: Any) -> None: """ Successful test for the cado-get-project (w/ limit) command. """ from CadoResponse import Client, list_project_command mock_get_response: list[dict[str, Any]] = [ { "caseName": "Project Name", "created": "2021-10-18T10:36:33.140305", "deleted": False, "description": "Project Description", "id": 1, "status": "Pending", "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}], }, { "caseName": "Project Name", "created": "2021-10-18T10:36:33.140305", "deleted": False, "description": "Project Description", "id": 1, "status": "Pending", "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}], }, ] expected_mocked_command_result: list[dict[str, Any]] = [ { "caseName": "Project Name", "created": "2021-10-18T10:36:33.140305", "deleted": False, "description": "Project Description", "id": 1, "status": "Pending", "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}], } ] requests_mock.get("https://test.com/api/v2/projects", json=mock_get_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, int] = {"limit": 1} mocked_command_result: CommandResults = list_project_command(client, args) assert mocked_command_result.outputs_prefix == "CadoResponse.Projects" assert mocked_command_result.outputs_key_field == "id" assert mocked_command_result.outputs == expected_mocked_command_result def test_get_pipeline_command_success(requests_mock: Any) -> None: from CadoResponse import Client, get_pipeline_command mock_get_response: dict[str, Any] = { "pipelines": [ { "can_be_terminated": False, "created": "2021-10-20T13:04:21.198423", "evidence_id": 10, "evidence_name": "import_test.dd", "name": "", "pipeline_id": 9, "pipeline_type": "processing", "project_id": 1, "project_name": "1", "subtasks": [ { "execution_duration": 0, "finish_time": 1634735123.8961182, "name": "Shutdown: Stopping worker machine.", "name_key": "infrastructure.self_shutdown", "notification_level": "Info", "progress_text": [], "start_time": 1634735123.8948352, "state": "SUCCESS", "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e", "total_stages": "null", } ], "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15}, "terminated": True, "user_id": 1, "user_name": "admin", } ] } expected_mocked_command_results: list[dict[str, Any]] = [ { "can_be_terminated": False, "created": "2021-10-20T13:04:21.198423", "evidence_id": 10, "evidence_name": "import_test.dd", "name": "", "pipeline_id": 9, "pipeline_type": "processing", "project_id": 1, "project_name": "1", "subtasks": [ { "execution_duration": 0, "finish_time": 1634735123.8961182, "name": "Shutdown: Stopping worker machine.", "name_key": "infrastructure.self_shutdown", "notification_level": "Info", "progress_text": [], "start_time": 1634735123.8948352, "state": "SUCCESS", "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e", "total_stages": "null", } ], "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15}, "terminated": True, "user_id": 1, "user_name": "admin", } ] requests_mock.get("https://test.com/api/v2/tasks/pipelines", json=mock_get_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, int] = {"project_id": 1} mocked_command_result: CommandResults = get_pipeline_command(client, args) assert mocked_command_result.outputs_prefix == "CadoResponse.Pipelines" assert mocked_command_result.outputs_key_field == "pipeline_id" assert mocked_command_result.outputs == expected_mocked_command_results def test_get_single_pipeline_command_success(requests_mock: Any) -> None: from CadoResponse import Client, get_pipeline_command mock_get_response: dict[str, Any] = { "pipelines": [ { "can_be_terminated": False, "created": "2021-10-20T13:04:21.198423", "evidence_id": 10, "evidence_name": "import_test.dd", "name": "", "pipeline_id": 9, "pipeline_type": "processing", "project_id": 1, "project_name": "1", "subtasks": [ { "execution_duration": 0, "finish_time": 1634735123.8961182, "name": "Shutdown: Stopping worker machine.", "name_key": "infrastructure.self_shutdown", "notification_level": "Info", "progress_text": [], "start_time": 1634735123.8948352, "state": "SUCCESS", "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e", "total_stages": "null", } ], "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15}, "terminated": True, "user_id": 1, "user_name": "admin", } ] } expected_mocked_command_result: dict[str, Any] = mock_get_response requests_mock.get("https://test.com/api/v2/tasks/pipelines", json=mock_get_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, int] = {"project_id": 1, "pipeline_id": 1} mocked_command_result: CommandResults = get_pipeline_command(client, args) assert mocked_command_result.outputs_prefix == "CadoResponse.Pipelines" assert mocked_command_result.outputs_key_field == "pipeline_id" assert mocked_command_result.outputs == expected_mocked_command_result def test_get_pipeline_command_limit_success(requests_mock: Any) -> None: from CadoResponse import Client, get_pipeline_command mock_get_response: dict[str, Any] = { "pipelines": [ { "can_be_terminated": False, "created": "2021-10-20T13:04:21.198423", "evidence_id": 10, "evidence_name": "import_test.dd", "name": "", "pipeline_id": 9, "pipeline_type": "processing", "project_id": 1, "project_name": "1", "subtasks": [ { "execution_duration": 0, "finish_time": 1634735123.8961182, "name": "Shutdown: Stopping worker machine.", "name_key": "infrastructure.self_shutdown", "notification_level": "Info", "progress_text": [], "start_time": 1634735123.8948352, "state": "SUCCESS", "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e", "total_stages": "null", } ], "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15}, "terminated": True, "user_id": 1, "user_name": "admin", }, { "can_be_terminated": False, "created": "2021-10-20T13:04:21.198423", "evidence_id": 10, "evidence_name": "import_test.dd", "name": "", "pipeline_id": 9, "pipeline_type": "processing", "project_id": 1, "project_name": "1", "subtasks": [ { "execution_duration": 0, "finish_time": 1634735123.8961182, "name": "Shutdown: Stopping worker machine.", "name_key": "infrastructure.self_shutdown", "notification_level": "Info", "progress_text": [], "start_time": 1634735123.8948352, "state": "SUCCESS", "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e", "total_stages": "null", } ], "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15}, "terminated": True, "user_id": 1, "user_name": "admin", }, ] } expected_mocked_command_results: list[dict[str, Any]] = [ { "can_be_terminated": False, "created": "2021-10-20T13:04:21.198423", "evidence_id": 10, "evidence_name": "import_test.dd", "name": "", "pipeline_id": 9, "pipeline_type": "processing", "project_id": 1, "project_name": "1", "subtasks": [ { "execution_duration": 0, "finish_time": 1634735123.8961182, "name": "Shutdown: Stopping worker machine.", "name_key": "infrastructure.self_shutdown", "notification_level": "Info", "progress_text": [], "start_time": 1634735123.8948352, "state": "SUCCESS", "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e", "total_stages": "null", } ], "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15}, "terminated": True, "user_id": 1, "user_name": "admin", } ] requests_mock.get("https://test.com/api/v2/tasks/pipelines", json=mock_get_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, int] = {"project_id": 1, "limit": 1} mocked_command_results: CommandResults = get_pipeline_command(client, args) assert mocked_command_results.outputs_prefix == "CadoResponse.Pipelines" assert mocked_command_results.outputs_key_field == "pipeline_id" assert mocked_command_results.outputs == expected_mocked_command_results def test_list_ec2_command_success(requests_mock: Any) -> None: from CadoResponse import Client, list_ec2_command mock_get_response: dict[str, Any] = { "instances": [ { "_placement": "us-west-2c", "_state": "stopped", "evidence_id": "null", "id": "i-0408ccfaa00778f9c", "instance_name": "DONOTDELETE-S509 SOF-ELK", "instance_type": "t2.2xlarge", "ip_address": "null", "launch_time": "Fri, 27 Aug 2021 16:17:40 GMT", "processing_type": "null", "project_id": "null", "region": {"name": "us-west-2"}, } ] } expected_mocked_command_results: list[dict[str, Any]] = [ { "_placement": "us-west-2c", "_state": "stopped", "evidence_id": "null", "id": "i-0408ccfaa00778f9c", "instance_name": "DONOTDELETE-S509 SOF-ELK", "instance_type": "t2.2xlarge", "ip_address": "null", "launch_time": "Fri, 27 Aug 2021 16:17:40 GMT", "processing_type": "null", "project_id": "null", "region": {"name": "us-west-2"}, } ] requests_mock.get("https://test.com/api/v2/projects/1/imports/ec2", json=mock_get_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, int | str] = {"project_id": 1, "region": "us-west-2"} mocked_command_results: CommandResults = list_ec2_command(client, args) assert mocked_command_results.outputs_prefix == "CadoResponse.EC2Instances" assert mocked_command_results.outputs_key_field == "id" assert mocked_command_results.outputs == expected_mocked_command_results def test_list_s3_command_success(requests_mock: Any) -> None: from CadoResponse import Client, list_s3_command mock_get_response: dict[str, list[str]] = {"buckets": ["Bucket_name"]} expected_mocked_command_result: dict[str, list[str]] = mock_get_response requests_mock.get("https://test.com/api/v2/projects/1/imports/s3", json=mock_get_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, int] = {"project_id": 1, "limit": 1} mocked_command_results: CommandResults = list_s3_command(client, args) assert mocked_command_results.outputs_prefix == "CadoResponse.S3Buckets" assert mocked_command_results.outputs == expected_mocked_command_result def test_trigger_ec2_command_success(requests_mock: Any) -> None: from CadoResponse import Client, trigger_ec2_command mock_post_response: dict[str, Any] = { "created": "2021-11-01T13:12:57.046424", "evidence_id": 0, "name": "Acquiring ...", "pipeline_id": 3, "pipeline_type": "acquisition", "project_id": 2, "subtasks": [ { "id": "11a63efc-0fbd-4271-9756-0e92545fe4e3", } ], "user_id": 1, } expected_mocked_command_result: dict[str, Any] = mock_post_response requests_mock.post("https://test.com/api/v2/projects/1/imports/ec2", json=mock_post_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, Any] = { "project_id": 1, "instance_id": "test", "region": "us-east=1", "bucket": "test-bucket", "compress": True, "include_disks": True, "include_hash": True, "include_logs": True, "include_screenshot": True, } mocked_command_results: CommandResults = trigger_ec2_command(client, args) assert mocked_command_results.outputs_prefix == "CadoResponse.EC2Acquistion" assert mocked_command_results.outputs_key_field == "pipeline_id" assert mocked_command_results.outputs == expected_mocked_command_result def test_trigger_s3_command_success(requests_mock: Any) -> None: from CadoResponse import Client, trigger_s3_command mock_post_response: dict[str, Any] = { "pipelines": [ { "created": "2021-11-01T13:12:57.046424", "evidence_id": 0, "name": "Acquiring ...", "pipeline_id": 3, "pipeline_type": "acquisition", "project_id": 2, "subtasks": [ { "id": "11a63efc-0fbd-4271-9756-0e92545fe4e3", } ], "user_id": 1, } ] } expected_mocked_command_results: list[dict[str, Any]] = [ { "created": "2021-11-01T13:12:57.046424", "evidence_id": 0, "name": "Acquiring ...", "pipeline_id": 3, "pipeline_type": "acquisition", "project_id": 2, "subtasks": [ { "id": "11a63efc-0fbd-4271-9756-0e92545fe4e3", } ], "user_id": 1, } ] requests_mock.post("https://test.com/api/v2/projects/1/imports/s3", json=mock_post_response) client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, int | str] = {"project_id": 1, "file_name": "test", "bucket": "test-bucket"} mocked_command_results: CommandResults = trigger_s3_command(client, args) assert mocked_command_results.outputs_prefix == "CadoResponse.S3Acquisition" assert mocked_command_results.outputs_key_field == "pipeline_id" assert mocked_command_results.outputs == expected_mocked_command_results def test_trigger_s3_command_raises_bucket() -> None: from CadoResponse import Client, trigger_s3_command client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, int | str] = { "project_id": 1, "file_name": "test", } with raises(DemistoException, match="bucket is a required parameter!"): trigger_s3_command(client, args) def test_trigger_s3_command_raises_file() -> None: from CadoResponse import Client, trigger_s3_command client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"}) args: dict[str, int | str] = { "project_id": 1, "bucket": "test", } with raises(DemistoException, match="file_name is a required parameter!"): trigger_s3_command(client, args)