CadoResponse

Automate data collection. Process data at cloud speed. Analyze with purpose.

Forensics & Malware Analysis · Cado Response

Details

IDCadoResponse
ProviderDarktrace
CategoryForensics & Malware Analysis
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Cado Response Integration for Cortex XSOAR

Automate data collection. Process data at cloud speed. Analyze with purpose.
This integration was integrated and tested with version 1.2.0 of CadoResponse

Configure Cado Response in Cortex

Parameter Description Required
Cado Response Instance The URL for your Cado Response Instance True
API Key The API Key to use for connection True
Trust any certificate (not secure)   False
Use system proxy settings   False
Default Cado Response Project Provides a fallback Project ID from Cado Response if you forget to add an ID to a command. If you’re not sure, don’t change! True
Default AWS Region Provides a default AWS region to fallback to if you forget to add it to a command. True
Default S3 Bucket Provides a default S3 bucket to fallback to if you forget to add it to a command. True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cado-create-project


Create a project in Cado Response

Base Command

cado-create-project

Input

Argument Name Description Required
project_name Name of the project. Required
project_description Description for the project. Optional

Context Output

Path Type Description
CadoResponse.Project.id Number The Project ID of the newly created project

Command example

!cado-create-project project_name="Project Name" description="Project Description"

Context Example

{
    "CadoResponse": {
        "Project": {
            "id": 1,
            "msg": "Created"
        }
    }
}

Human Readable Output

Results

id msg
1 Created

cado-list-project


Get a list of projects from Cado Response

Base Command

cado-list-project

Input

Argument Name Description Required
project_id ID of the project to retrive. Optional
limit Limit results to retrieve. Optional

Context Output

Path Type Description
CadoResponse.Projects.id Number ID of the retrieved project
CadoResponse.Projects.caseName String Name of the retrieved project
CadoResponse.Projects.description String Description of the retrieved project
CadoResponse.Projects.users Array Array of users assigned to the retrieved project
CadoResponse.Projects.created Date Creation date of the project

Command example

!cado-list-project limit=100

Context Example

{
    "CadoResponse": {
        "Projects": {
            "caseName": "Project Name_XSOAR",
            "created": "2022-01-17T12:21:46.613814",
            "deleted": false,
            "description": "This is a project in Cado Response created through Cortex XSOAR!",
            "id": 1,
            "status": "Pending",
            "users": [
                {
                    "display_name": "admin",
                    "id": 1,
                    "is_admin": true,
                    "login_type": 0,
                    "username": "admin"
                }
            ]
        }
    }
}

Human Readable Output

Results

caseName created deleted description id status users
Project Name_XSOAR 2022-01-17T12:21:46.613814 false This is a project in Cado Response created through Cortex XSOAR! 1 Pending {‘display_name’: ‘admin’, ‘id’: 1, ‘is_admin’: True, ‘login_type’: 0, ‘username’: ‘admin’}

Command example

!cado-list-project project_id=1

Context Example

{
    "CadoResponse": {
        "Projects": {
            "caseName": "Project Name_XSOAR",
            "created": "2022-01-17T12:21:46.613814",
            "deleted": false,
            "description": "This is a project in Cado Response created through Cortex XSOAR!",
            "id": 1,
            "status": "Pending",
            "users": [
                {
                    "display_name": "admin",
                    "id": 1,
                    "is_admin": true,
                    "login_type": 0,
                    "username": "admin"
                }
            ]
        }
    }
}

Human Readable Output

Results

caseName created deleted description id status users
Project Name_XSOAR 2022-01-17T12:21:46.613814 false This is a project in Cado Response created through Cortex XSOAR! 1 Pending {‘display_name’: ‘admin’, ‘id’: 1, ‘is_admin’: True, ‘login_type’: 0, ‘username’: ‘admin’}

cado-get-pipeline


Get pipeline details from Cado Response

Base Command

cado-get-pipeline

Input

Argument Name Description Required
pipeline_id The id of the pipeline to retrieve. Optional
project_id The id of the project the pipeline belongs to. Optional
limit Limit results to retrieve. Optional

Context Output

Path Type Description
CadoResponse.Pipeline.pipeline_id Number The ID of the retrieved pipeline
CadoResponse.Pipeline.pipeline_type String The type of pipeline that was retrieved
CadoResponse.Pipeline.created Date The date at which the retrieved pipeline was started
CadoResponse.Pipeline.evidence_id Number The evidence ID linked to the retrieved pipeline
CadoResponse.Pipeline.project_id Number The ID of the project the pipeline belongs to
CadoResponse.Pipeline.is_terminated Boolean A boolean which says if the retrieved pipeline has been finished/terminated
CadoResponse.Pipeline.summary Array An array of values containing the cancelled, failed, pending, running and successful pipeline subtasks
CadoResponse.Pipeline.subtask Array An array of tasks in the retrieved pipeline

Command example

!cado-get-pipeline project_id=1 pipeline_id=1

Context Example

{
    "CadoResponse": {
        "Pipeline": {
            "pipeline_id": 1,
   "pipeline_type": "processing",
      "created": "2022-01-17T12:22:00.843869",
      "evidence_id": 1,
      "project_id": 1,
      "is_terminated": false,
   "subtasks": [
         {
     "execution_duration": 0,
     "finish_time": 0,
     "name": "Triage: Attaching disk for local data storage.",
     "name_key": "infrastructure.check_ssd",
     "notification_level": "Info",
     "progress_text": [],
     "start_time": 0,
     "state": "PENDING",
     "task_id": "3699827f-63c4-4408-88a4-0ae899187ed3",
     "total_stages": null
      }
   ],
   "summary": {
     "cancelled": 0,
     "failure": 0,
     "pending": 14,
     "running": 0,
     "success": 0,
     "total": 14
   }
        }
    }

}

Human Readable Output

Results

pipeline_id pipeline_type created evidence_id project_id is_terminated summary subtask
1 processing 2022-01-17T12:22:00.843869 1 1 false “execution_duration”: 0,
“finish_time”: 0,
“name”: “Triage: attaching disk for local data storage.”,
“name_key”: infrastructure.check_ssd”,
“notification_level”: “Info”,
“progress_text”: [],
“start_time”: 0,
“state”: “PENDING”,
“task_id”: “3699827f-63c4-4408-88a4-0ae899187ed3”,
“total_stages”: null
“cancelled”: 0,
“failure”: 0,
“pending”: 14,
“running”: 0,
“success”: 0,
“total”: 14

cado-list-ec2


Get a list of EC2 instances in a region

Base Command

cado-list-ec2

Input

Argument Name Description Required
region The AWS region to list instances in. Required
project_id The ID of the project you wish to attach the acquisition to. Optional
limit Limit results to retrieve. Optional

Context Output

Path Type Description
CadoResponse.EC2Instances.id Number AWS ID of the EC2 Instance
CadoResponse.EC2Instances.instance_name String Name of the EC2 Instance
CadoResponse.EC2Instances.instance_type String AWS Type of the EC2 instance
CadoResponse.EC2Instances.region String AWS region of the EC2 instance

Command example

!cado-list-ec2 project_id=1 region="us-east-1" limit=100

Context Example

{
    "CadoResponse": {
        "EC2Instances": [
            {
                "_placement": "us-east-1c",
                "_state": "stopped",
                "celery_worker_name": null,
                "deployment_id": null,
                "evidence_id": null,
                "id": "i-00000000000",
                "instance_name": "Instance",
                "instance_type": "t3a.2xlarge",
                "ip_address": null,
                "launch_time": "Thu, 25 Mar 2021 18:38:13 GMT",
                "processing_type": null,
                "project_id": null,
                "queue_name": null,
                "region": {
                    "name": "us-east-1"
                },
                "worker_used": null
            }
        ]
    }
}

Human Readable Output

Results

_placement _state celery_worker_name deployment_id evidence_id id instance_name instance_type ip_address launch_time processing_type project_id queue_name region worker_used
us-east-1c stopped       i-00000000000 Instance t3a.2xlarge   Thu, 25 Mar 2021 18:38:13 GMT       name: us-east-1  

cado-list-s3


Get a list of S3 buckets

Base Command

cado-list-s3

Input

Argument Name Description Required
project_id The ID of the project you wish to attach the acquisition to. Optional
limit Limit results to retrieve. Optional

Context Output

Path Type Description
CadoResponse.S3Buckets.buckets Array An array of S3 buckets available to the project

Command example

!cado-list-s3 project_id=1 limit=100

Context Example

{
    "CadoResponse": {
        "S3Buckets": {
            "buckets": [
                "bucket",
            ]
        }
    }
}

Human Readable Output

Results

buckets
bucket

cado-trigger-ec2


Trigger a disk acquisition and processing pipeline in Cado Response for a given EC2 instance

Base Command

cado-trigger-ec2

Input

Argument Name Description Required
project_id The ID of the project you wish to attach the acquisition to. Optional
instance_id ID of the EC2 instance to acquire. Required
region AWS region in which the EC2 instance is located. Optional
bucket S3 bucket where the uploaded disk image resides. Optional
compress Flag indicating if disk compression is enabled. Optional
include_disks Flag indicating if we include disk images in the acquisition. Optional
include_hash Flag indicating if we calculate the hash of the disk. Optional
include_logs Flag indicating if we include system logs in the acquisition. Optional
include_screenshot Flag indicating if we include a screenshot of the system in the acquisition. Optional

Context Output

Path Type Description
CadoResponse.EC2Acquisition.pipeline_id Number ID of the created pipeline

Command example

!cado-trigger-ec2 project_id=1 instance_id="i-00000000000" region="us-east-1" bucket="bucket" compress=true include_disks=true include_hash=true include_logs=true include_screenshot=true

Context Example

{
    "CadoResponse": {
        "EC2Acquistion": {
            "created": "2022-01-17T12:21:59.084282",
            "evidence_id": 0,
            "name": "Acquiring i-00000000000",
            "pipeline_id": 1,
            "pipeline_type": "acquisition",
            "project_id": 1,
            "subtasks": [
                {
                    "id": "1587a9c9-c02c-464b-a6f7-d4b7e720bd93"
                },
                {
                    "id": "4f798bf8-c7d3-427c-9498-10a85cfe3978"
                },
                {
                    "id": "c5fa26f1-e282-47a6-8335-1160766e089b"
                },
                {
                    "id": "82ec9a7e-47ac-4539-9623-166a44a59d0f"
                },
                {
                    "id": "88151005-a999-422e-b4cb-9e76699d6e42"
                }
            ],
            "user_id": 1
        }
    }
}

Human Readable Output

Results

created evidence_id name pipeline_id pipeline_type project_id subtasks user_id
2022-01-17T12:21:59.084282 0 Acquiring i-00000000000 1 acquisition 1 {‘id’: ‘1587a9c9-c02c-464b-a6f7-d4b7e720bd93’},
{‘id’: ‘4f798bf8-c7d3-427c-9498-10a85cfe3978’},
{‘id’: ‘c5fa26f1-e282-47a6-8335-1160766e089b’},
{‘id’: ‘82ec9a7e-47ac-4539-9623-166a44a59d0f’},
{‘id’: ‘88151005-a999-422e-b4cb-9e76699d6e42’}
1

cado-trigger-s3


Trigger a disk acquisition and processing pipeline in Cado Response for a given file in an S3 bucket

Base Command

cado-trigger-s3

Input

Argument Name Description Required
project_id The ID of the project you wish to attach the acquisition to. Optional
bucket The S3 bucket name containing the file. Required
file_name The name of the file to process. Required

Context Output

Path Type Description
CadoResponse.S3Acquisition.pipeline_id Number ID of the created pipeline

Command example

!cado-trigger-s3 project_id=1 bucket="bucket" file_name="file"

Context Example

{
    "CadoResponse": {
        "S3Acquisition": {
            "created": "2022-01-17T12:22:00.843869",
            "evidence_id": 1,
            "name": "",
            "pipeline_id": 2,
            "pipeline_type": "processing",
            "project_id": 1,
            "subtasks": [
                {
                    "id": "3699827f-63c4-4408-88a4-0ae899187ed3"
                },
                {
                    "id": "727e2072-8bf7-4847-89ea-9447f5fd8fd0"
                },
                {
                    "id": "857d48b8-abaf-4ea6-b159-d25c9784b837"
                },
                {
                    "id": "533f7deb-74bc-4ffb-b81f-788ed714bead"
                },
                {
                    "id": "3f1defde-3986-4292-a423-1bef62d4c52b"
                },
                {
                    "id": "e41a0934-266b-4868-9a7d-5f083b1efcc1"
                },
                {
                    "id": "75411e10-46e9-41dd-8bf7-9b5fbdc8df71"
                },
                {
                    "id": "0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c"
                },
                {
                    "id": "ca063c7b-1135-4922-8542-49f40ce71449"
                },
                {
                    "id": "67fdb0ea-dcee-4f65-a003-4f40fcd567fb"
                },
                {
                    "id": "1437ec33-6af2-4eb8-9c43-e071dcb7e0ac"
                },
                {
                    "id": "06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d"
                },
                {
                    "id": "e3cc930e-9a60-46c3-97a1-611824c24437"
                },
                {
                    "id": "ad2c8877-39e7-4bff-9756-81278802ee76"
                }
            ],
            "user_id": 1
        }
    }
}

Human Readable Output

Results

created evidence_id name pipeline_id pipeline_type project_id subtasks user_id
2022-01-17T12:22:00.843869 1   2 processing 1 {‘id’: ‘3699827f-63c4-4408-88a4-0ae899187ed3’},
{‘id’: ‘727e2072-8bf7-4847-89ea-9447f5fd8fd0’},
{‘id’: ‘857d48b8-abaf-4ea6-b159-d25c9784b837’},
{‘id’: ‘533f7deb-74bc-4ffb-b81f-788ed714bead’},
{‘id’: ‘3f1defde-3986-4292-a423-1bef62d4c52b’},
{‘id’: ‘e41a0934-266b-4868-9a7d-5f083b1efcc1’},
{‘id’: ‘75411e10-46e9-41dd-8bf7-9b5fbdc8df71’},
{‘id’: ‘0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c’},
{‘id’: ‘ca063c7b-1135-4922-8542-49f40ce71449’},
{‘id’: ‘67fdb0ea-dcee-4f65-a003-4f40fcd567fb’},
{‘id’: ‘1437ec33-6af2-4eb8-9c43-e071dcb7e0ac’},
{‘id’: ‘06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d’},
{‘id’: ‘e3cc930e-9a60-46c3-97a1-611824c24437’},
{‘id’: ‘ad2c8877-39e7-4bff-9756-81278802ee76’}
1

Configuration parameters

  • url — Cado Response Instance (required)
  • apikey — API Key (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • CadoResponse_DefaultProject — Default Cado Response Project (required)
  • CadoResponse_DefaultRegion — Default AWS Region (required)
  • CadoResponse_DefaultBucket — Default S3 Bucket (required)

Commands (7)

  • cado-create-project

    Create a project in Cado Response.

  • cado-get-pipeline

    Get pipeline details from Cado Response.

  • cado-list-ec2

    Get a list of EC2 instances in a region.

  • cado-list-project

    Get a list of projects from Cado Response.

  • cado-list-s3

    Get a list of S3 buckets.

  • cado-trigger-ec2

    Trigger a disk acquisition and processing pipeline in Cado Response for a given EC2 instance.

  • cado-trigger-s3

    Trigger a disk acquisition and processing pipeline in Cado Response for a given file in an S3 bucket.

"""Tests for the Cado Response API Integration for the Cortex XSOAR Platform"""

from typing import Any

from CommonServerPython import CommandResults, DemistoException
from pytest import raises  # noqa: PT013


def test_module_command_success(requests_mock: Any) -> None:
    """
    Successful test for the test-module command.
    """

    from CadoResponse import Client, test_module

    mock_get_response: dict[str, str] = {"status": "Running"}

    expected_mocked_command_result: str = "ok"

    requests_mock.get("https://test.com/api/v2/system/status", json=mock_get_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    mocked_command_result: str = test_module(client)

    assert mocked_command_result == expected_mocked_command_result


def test_module_command_fail(requests_mock: Any) -> None:
    """
    Unsuccessful test for the test-module command.
    """

    from CadoResponse import Client, test_module

    mock_get_response: dict[str, str] = {"status": "Down"}

    expected_mocked_command_result: str = "Cado Response is not running"

    requests_mock.get("https://test.com/api/v2/system/status", json=mock_get_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    mocked_command_result: str = test_module(client)

    assert mocked_command_result == expected_mocked_command_result


def test_create_project_command_success(requests_mock: Any) -> None:
    """
    Successful test for the cado-create-project command.
    """

    from CadoResponse import Client, create_project_command

    mock_post_response: dict[str, int] = {"id": 1}

    expected_mocked_command_result: dict[str, Any] = mock_post_response

    requests_mock.post("https://test.com/api/v2/projects", json=mock_post_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, str] = {"project_name": "testing-project", "project_description": "This is a testing project"}

    mocked_command_result: CommandResults = create_project_command(client, args)

    assert mocked_command_result.outputs_prefix == "CadoResponse.Project"
    assert mocked_command_result.outputs_key_field == "id"
    assert mocked_command_result.outputs == expected_mocked_command_result


def test_get_project_list_command_success(requests_mock: Any) -> None:
    """
    Successful test for the cado-get-project (list version) command.
    """

    from CadoResponse import Client, list_project_command

    mock_get_response: list[dict[str, Any]] = [
        {
            "caseName": "Project Name",
            "created": "2021-10-18T10:36:33.140305",
            "deleted": False,
            "description": "Project Description",
            "id": 1,
            "status": "Pending",
            "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}],
        }
    ]

    expected_mocked_command_result: list[dict[str, Any]] = mock_get_response

    requests_mock.get("https://test.com/api/v2/projects", json=mock_get_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, int] = {"limit": 1}

    mocked_command_result: CommandResults = list_project_command(client, args)

    assert mocked_command_result.outputs_prefix == "CadoResponse.Projects"
    assert mocked_command_result.outputs_key_field == "id"
    assert mocked_command_result.outputs == expected_mocked_command_result


def test_get_project_single_command_success(requests_mock: Any) -> Any:
    """
    Successful test for the cado-list-project (single project) command.
    """

    from CadoResponse import Client, list_project_command

    mock_get_response: list[dict[str, Any]] = [
        {
            "caseName": "Project Name",
            "created": "2021-10-18T10:36:33.140305",
            "deleted": False,
            "description": "Project Description",
            "id": 1,
            "status": "Pending",
            "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}],
        }
    ]

    expected_mocked_command_result: list[dict[str, Any]] = mock_get_response

    requests_mock.get("https://test.com/api/v2/projects/1", json=mock_get_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, int] = {"project_id": 1}

    mocked_command_result: CommandResults = list_project_command(client, args)

    assert mocked_command_result.outputs_prefix == "CadoResponse.Projects"
    assert mocked_command_result.outputs_key_field == "id"
    assert mocked_command_result.outputs == expected_mocked_command_result


def test_get_project_no_id_command_success(requests_mock: Any) -> Any:
    """
    Successful test for the cado-get-project (w/ no id) command.
    """

    from CadoResponse import Client, list_project_command

    mock_get_response: list[dict[str, Any]] = [
        {
            "caseName": "Project Name",
            "created": "2021-10-18T10:36:33.140305",
            "deleted": False,
            "description": "Project Description",
            "id": 1,
            "status": "Pending",
            "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}],
        }
    ]

    expected_mocked_command_result: list[dict[str, Any]] = mock_get_response

    requests_mock.get("https://test.com/api/v2/projects", json=mock_get_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict = {}
    mocked_command_result: CommandResults = list_project_command(client, args)

    assert mocked_command_result.outputs_prefix == "CadoResponse.Projects"
    assert mocked_command_result.outputs_key_field == "id"
    assert mocked_command_result.outputs == expected_mocked_command_result


def test_get_project_command_limit_success(requests_mock: Any) -> None:
    """
    Successful test for the cado-get-project (w/ limit) command.
    """

    from CadoResponse import Client, list_project_command

    mock_get_response: list[dict[str, Any]] = [
        {
            "caseName": "Project Name",
            "created": "2021-10-18T10:36:33.140305",
            "deleted": False,
            "description": "Project Description",
            "id": 1,
            "status": "Pending",
            "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}],
        },
        {
            "caseName": "Project Name",
            "created": "2021-10-18T10:36:33.140305",
            "deleted": False,
            "description": "Project Description",
            "id": 1,
            "status": "Pending",
            "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}],
        },
    ]

    expected_mocked_command_result: list[dict[str, Any]] = [
        {
            "caseName": "Project Name",
            "created": "2021-10-18T10:36:33.140305",
            "deleted": False,
            "description": "Project Description",
            "id": 1,
            "status": "Pending",
            "users": [{"display_name": "admin", "id": 1, "is_admin": True, "login_type": 0, "username": "admin"}],
        }
    ]

    requests_mock.get("https://test.com/api/v2/projects", json=mock_get_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, int] = {"limit": 1}

    mocked_command_result: CommandResults = list_project_command(client, args)

    assert mocked_command_result.outputs_prefix == "CadoResponse.Projects"
    assert mocked_command_result.outputs_key_field == "id"
    assert mocked_command_result.outputs == expected_mocked_command_result


def test_get_pipeline_command_success(requests_mock: Any) -> None:
    from CadoResponse import Client, get_pipeline_command

    mock_get_response: dict[str, Any] = {
        "pipelines": [
            {
                "can_be_terminated": False,
                "created": "2021-10-20T13:04:21.198423",
                "evidence_id": 10,
                "evidence_name": "import_test.dd",
                "name": "",
                "pipeline_id": 9,
                "pipeline_type": "processing",
                "project_id": 1,
                "project_name": "1",
                "subtasks": [
                    {
                        "execution_duration": 0,
                        "finish_time": 1634735123.8961182,
                        "name": "Shutdown: Stopping worker machine.",
                        "name_key": "infrastructure.self_shutdown",
                        "notification_level": "Info",
                        "progress_text": [],
                        "start_time": 1634735123.8948352,
                        "state": "SUCCESS",
                        "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e",
                        "total_stages": "null",
                    }
                ],
                "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15},
                "terminated": True,
                "user_id": 1,
                "user_name": "admin",
            }
        ]
    }

    expected_mocked_command_results: list[dict[str, Any]] = [
        {
            "can_be_terminated": False,
            "created": "2021-10-20T13:04:21.198423",
            "evidence_id": 10,
            "evidence_name": "import_test.dd",
            "name": "",
            "pipeline_id": 9,
            "pipeline_type": "processing",
            "project_id": 1,
            "project_name": "1",
            "subtasks": [
                {
                    "execution_duration": 0,
                    "finish_time": 1634735123.8961182,
                    "name": "Shutdown: Stopping worker machine.",
                    "name_key": "infrastructure.self_shutdown",
                    "notification_level": "Info",
                    "progress_text": [],
                    "start_time": 1634735123.8948352,
                    "state": "SUCCESS",
                    "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e",
                    "total_stages": "null",
                }
            ],
            "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15},
            "terminated": True,
            "user_id": 1,
            "user_name": "admin",
        }
    ]

    requests_mock.get("https://test.com/api/v2/tasks/pipelines", json=mock_get_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, int] = {"project_id": 1}

    mocked_command_result: CommandResults = get_pipeline_command(client, args)

    assert mocked_command_result.outputs_prefix == "CadoResponse.Pipelines"
    assert mocked_command_result.outputs_key_field == "pipeline_id"
    assert mocked_command_result.outputs == expected_mocked_command_results


def test_get_single_pipeline_command_success(requests_mock: Any) -> None:
    from CadoResponse import Client, get_pipeline_command

    mock_get_response: dict[str, Any] = {
        "pipelines": [
            {
                "can_be_terminated": False,
                "created": "2021-10-20T13:04:21.198423",
                "evidence_id": 10,
                "evidence_name": "import_test.dd",
                "name": "",
                "pipeline_id": 9,
                "pipeline_type": "processing",
                "project_id": 1,
                "project_name": "1",
                "subtasks": [
                    {
                        "execution_duration": 0,
                        "finish_time": 1634735123.8961182,
                        "name": "Shutdown: Stopping worker machine.",
                        "name_key": "infrastructure.self_shutdown",
                        "notification_level": "Info",
                        "progress_text": [],
                        "start_time": 1634735123.8948352,
                        "state": "SUCCESS",
                        "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e",
                        "total_stages": "null",
                    }
                ],
                "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15},
                "terminated": True,
                "user_id": 1,
                "user_name": "admin",
            }
        ]
    }

    expected_mocked_command_result: dict[str, Any] = mock_get_response

    requests_mock.get("https://test.com/api/v2/tasks/pipelines", json=mock_get_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, int] = {"project_id": 1, "pipeline_id": 1}

    mocked_command_result: CommandResults = get_pipeline_command(client, args)

    assert mocked_command_result.outputs_prefix == "CadoResponse.Pipelines"
    assert mocked_command_result.outputs_key_field == "pipeline_id"
    assert mocked_command_result.outputs == expected_mocked_command_result


def test_get_pipeline_command_limit_success(requests_mock: Any) -> None:
    from CadoResponse import Client, get_pipeline_command

    mock_get_response: dict[str, Any] = {
        "pipelines": [
            {
                "can_be_terminated": False,
                "created": "2021-10-20T13:04:21.198423",
                "evidence_id": 10,
                "evidence_name": "import_test.dd",
                "name": "",
                "pipeline_id": 9,
                "pipeline_type": "processing",
                "project_id": 1,
                "project_name": "1",
                "subtasks": [
                    {
                        "execution_duration": 0,
                        "finish_time": 1634735123.8961182,
                        "name": "Shutdown: Stopping worker machine.",
                        "name_key": "infrastructure.self_shutdown",
                        "notification_level": "Info",
                        "progress_text": [],
                        "start_time": 1634735123.8948352,
                        "state": "SUCCESS",
                        "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e",
                        "total_stages": "null",
                    }
                ],
                "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15},
                "terminated": True,
                "user_id": 1,
                "user_name": "admin",
            },
            {
                "can_be_terminated": False,
                "created": "2021-10-20T13:04:21.198423",
                "evidence_id": 10,
                "evidence_name": "import_test.dd",
                "name": "",
                "pipeline_id": 9,
                "pipeline_type": "processing",
                "project_id": 1,
                "project_name": "1",
                "subtasks": [
                    {
                        "execution_duration": 0,
                        "finish_time": 1634735123.8961182,
                        "name": "Shutdown: Stopping worker machine.",
                        "name_key": "infrastructure.self_shutdown",
                        "notification_level": "Info",
                        "progress_text": [],
                        "start_time": 1634735123.8948352,
                        "state": "SUCCESS",
                        "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e",
                        "total_stages": "null",
                    }
                ],
                "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15},
                "terminated": True,
                "user_id": 1,
                "user_name": "admin",
            },
        ]
    }

    expected_mocked_command_results: list[dict[str, Any]] = [
        {
            "can_be_terminated": False,
            "created": "2021-10-20T13:04:21.198423",
            "evidence_id": 10,
            "evidence_name": "import_test.dd",
            "name": "",
            "pipeline_id": 9,
            "pipeline_type": "processing",
            "project_id": 1,
            "project_name": "1",
            "subtasks": [
                {
                    "execution_duration": 0,
                    "finish_time": 1634735123.8961182,
                    "name": "Shutdown: Stopping worker machine.",
                    "name_key": "infrastructure.self_shutdown",
                    "notification_level": "Info",
                    "progress_text": [],
                    "start_time": 1634735123.8948352,
                    "state": "SUCCESS",
                    "task_id": "8b957153-fb64-47f0-8ad0-917e3411063e",
                    "total_stages": "null",
                }
            ],
            "summary": {"cancelled": 0, "failure": 0, "pending": 0, "running": 0, "success": 15, "total": 15},
            "terminated": True,
            "user_id": 1,
            "user_name": "admin",
        }
    ]

    requests_mock.get("https://test.com/api/v2/tasks/pipelines", json=mock_get_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, int] = {"project_id": 1, "limit": 1}

    mocked_command_results: CommandResults = get_pipeline_command(client, args)

    assert mocked_command_results.outputs_prefix == "CadoResponse.Pipelines"
    assert mocked_command_results.outputs_key_field == "pipeline_id"
    assert mocked_command_results.outputs == expected_mocked_command_results


def test_list_ec2_command_success(requests_mock: Any) -> None:
    from CadoResponse import Client, list_ec2_command

    mock_get_response: dict[str, Any] = {
        "instances": [
            {
                "_placement": "us-west-2c",
                "_state": "stopped",
                "evidence_id": "null",
                "id": "i-0408ccfaa00778f9c",
                "instance_name": "DONOTDELETE-S509 SOF-ELK",
                "instance_type": "t2.2xlarge",
                "ip_address": "null",
                "launch_time": "Fri, 27 Aug 2021 16:17:40 GMT",
                "processing_type": "null",
                "project_id": "null",
                "region": {"name": "us-west-2"},
            }
        ]
    }

    expected_mocked_command_results: list[dict[str, Any]] = [
        {
            "_placement": "us-west-2c",
            "_state": "stopped",
            "evidence_id": "null",
            "id": "i-0408ccfaa00778f9c",
            "instance_name": "DONOTDELETE-S509 SOF-ELK",
            "instance_type": "t2.2xlarge",
            "ip_address": "null",
            "launch_time": "Fri, 27 Aug 2021 16:17:40 GMT",
            "processing_type": "null",
            "project_id": "null",
            "region": {"name": "us-west-2"},
        }
    ]

    requests_mock.get("https://test.com/api/v2/projects/1/imports/ec2", json=mock_get_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, int | str] = {"project_id": 1, "region": "us-west-2"}

    mocked_command_results: CommandResults = list_ec2_command(client, args)

    assert mocked_command_results.outputs_prefix == "CadoResponse.EC2Instances"
    assert mocked_command_results.outputs_key_field == "id"
    assert mocked_command_results.outputs == expected_mocked_command_results


def test_list_s3_command_success(requests_mock: Any) -> None:
    from CadoResponse import Client, list_s3_command

    mock_get_response: dict[str, list[str]] = {"buckets": ["Bucket_name"]}

    expected_mocked_command_result: dict[str, list[str]] = mock_get_response

    requests_mock.get("https://test.com/api/v2/projects/1/imports/s3", json=mock_get_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, int] = {"project_id": 1, "limit": 1}

    mocked_command_results: CommandResults = list_s3_command(client, args)

    assert mocked_command_results.outputs_prefix == "CadoResponse.S3Buckets"
    assert mocked_command_results.outputs == expected_mocked_command_result


def test_trigger_ec2_command_success(requests_mock: Any) -> None:
    from CadoResponse import Client, trigger_ec2_command

    mock_post_response: dict[str, Any] = {
        "created": "2021-11-01T13:12:57.046424",
        "evidence_id": 0,
        "name": "Acquiring ...",
        "pipeline_id": 3,
        "pipeline_type": "acquisition",
        "project_id": 2,
        "subtasks": [
            {
                "id": "11a63efc-0fbd-4271-9756-0e92545fe4e3",
            }
        ],
        "user_id": 1,
    }

    expected_mocked_command_result: dict[str, Any] = mock_post_response

    requests_mock.post("https://test.com/api/v2/projects/1/imports/ec2", json=mock_post_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, Any] = {
        "project_id": 1,
        "instance_id": "test",
        "region": "us-east=1",
        "bucket": "test-bucket",
        "compress": True,
        "include_disks": True,
        "include_hash": True,
        "include_logs": True,
        "include_screenshot": True,
    }

    mocked_command_results: CommandResults = trigger_ec2_command(client, args)

    assert mocked_command_results.outputs_prefix == "CadoResponse.EC2Acquistion"
    assert mocked_command_results.outputs_key_field == "pipeline_id"
    assert mocked_command_results.outputs == expected_mocked_command_result


def test_trigger_s3_command_success(requests_mock: Any) -> None:
    from CadoResponse import Client, trigger_s3_command

    mock_post_response: dict[str, Any] = {
        "pipelines": [
            {
                "created": "2021-11-01T13:12:57.046424",
                "evidence_id": 0,
                "name": "Acquiring ...",
                "pipeline_id": 3,
                "pipeline_type": "acquisition",
                "project_id": 2,
                "subtasks": [
                    {
                        "id": "11a63efc-0fbd-4271-9756-0e92545fe4e3",
                    }
                ],
                "user_id": 1,
            }
        ]
    }

    expected_mocked_command_results: list[dict[str, Any]] = [
        {
            "created": "2021-11-01T13:12:57.046424",
            "evidence_id": 0,
            "name": "Acquiring ...",
            "pipeline_id": 3,
            "pipeline_type": "acquisition",
            "project_id": 2,
            "subtasks": [
                {
                    "id": "11a63efc-0fbd-4271-9756-0e92545fe4e3",
                }
            ],
            "user_id": 1,
        }
    ]

    requests_mock.post("https://test.com/api/v2/projects/1/imports/s3", json=mock_post_response)

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, int | str] = {"project_id": 1, "file_name": "test", "bucket": "test-bucket"}

    mocked_command_results: CommandResults = trigger_s3_command(client, args)

    assert mocked_command_results.outputs_prefix == "CadoResponse.S3Acquisition"
    assert mocked_command_results.outputs_key_field == "pipeline_id"
    assert mocked_command_results.outputs == expected_mocked_command_results


def test_trigger_s3_command_raises_bucket() -> None:
    from CadoResponse import Client, trigger_s3_command

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, int | str] = {
        "project_id": 1,
        "file_name": "test",
    }

    with raises(DemistoException, match="bucket is a required parameter!"):
        trigger_s3_command(client, args)


def test_trigger_s3_command_raises_file() -> None:
    from CadoResponse import Client, trigger_s3_command

    client: Client = Client(base_url="https://test.com/api/v2/", verify=False, headers={"Authentication": "Bearer some_api_key"})

    args: dict[str, int | str] = {
        "project_id": 1,
        "bucket": "test",
    }

    with raises(DemistoException, match="file_name is a required parameter!"):
        trigger_s3_command(client, args)