Covalence For Security Providers

Triggers by any alert from endpoint, cloud, and network security monitoring, with mitigation steps where applicable. Query Covalence for more detail.

Endpoint · Covalence For Security Providers

Details

IDCovalence For Security Providers
ProviderCobalt Strike
CategoryEndpoint
From Version5.0.0
Docker Imagedemisto/xsoar-tools:1.0.0.11807991
Supported ModulesAgentix XSIAM

README

Triggers by any alert from endpoint, cloud, and network security monitoring, with mitigation steps where applicable. Query Covalence for more detail.
This integration was integrated and tested with version 3.0 of Covalence For Security Providers

Configure Covalence For Security Providers in Cortex

Parameter Description Required
Broker Set to true if connections are made through a broker False
Host Covalence’s host (IP or domain) or broker’s socket (ip:port) if using broker True
Credentials   True
Password   True
Verify SSL If set to false, will trust any certificate (not secure) False
Timeout Timeout in seconds False
First run time range When fetching incidents for the first time, this parameter specifies in days how far the integration looks for incidents. For instance if set to “2”, it will pull all alerts in Covalence for the last 2 days and will create corresponding incidents. False
Fetch limit Maximum number of alerts to be fetch per fetch command. It is advised to not fetch more than 200 alerts. False
Use system proxy settings   False
Fetch incidents   False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False
None   False
Incident type   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cov-secpr-list-alerts

Lists Covalence alerts

Base Command

cov-secpr-list-alerts

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
max_count Maximum number of alerts to be returned, if none provided will be set to 1000. Optional
initial_index Initial index where to start listing alerts. Optional
alert_type Alert type to be listed. Optional
alert_time_min Minimal alert time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
alert_time_max Maximal alert time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.Alert.acknowledgedStatus String Acknowledged Status
Covalence.Alert.alertCount Number Alert Count
Covalence.Alert.alertHash String Alert Hash
Covalence.Alert.analystDescription String Analyst Description
Covalence.Alert.analystTitle String Analyst Title
Covalence.Alert.assignee String Assignee
Covalence.Alert.blacklistDetails.blacklistedEntity String Blacklisted Entity
Covalence.Alert.blacklistDetails.bytesIn Number Bytes In
Covalence.Alert.blacklistDetails.bytesOut Number Bytes Out
Covalence.Alert.blacklistDetails.listLabels String List Labels
Covalence.Alert.blacklistDetails.listUuids String List Uuids
Covalence.Alert.createdTime Number Created Time
Covalence.Alert.destCiscoUmbrellaRanking Number Dest Cisco Umbrella Ranking
Covalence.Alert.destCiscoUmbrellaTopLevelDomainRanking Number Dest Cisco Umbrella Top Level Domain Ranking
Covalence.Alert.destCityName String Dest City Name
Covalence.Alert.destCountryName unknown Dest Country Name
Covalence.Alert.destDomainName String Dest Domain Name
Covalence.Alert.destGeoX Number Dest Geo X
Covalence.Alert.destGeoY Number Dest Geo Y
Covalence.Alert.destIp String Dest Ip
Covalence.Alert.destIpAttributes.k String Key
Covalence.Alert.destIpAttributes.t Number Type
Covalence.Alert.destIpAttributes.v String Value
Covalence.Alert.destMajesticMillionRanking Number Dest Majestic Million Ranking
Covalence.Alert.destMajesticMillionTopLevelDomainRanking Number Dest Majestic Million Top Level Domain Ranking
Covalence.Alert.destPort String Dest Port
Covalence.Alert.endpointAgentUuid String Endpoint Agent Uuid
Covalence.Alert.facility String Facility
Covalence.Alert.id String Id
Covalence.Alert.isFavorite Boolean Is Favorite
Covalence.Alert.lastAlertedTime Number Last Alerted Time
Covalence.Alert.notes String Notes
Covalence.Alert.organizationId String Organization Id
Covalence.Alert.pcapResourceUuid String Pcap Resource Uuid
Covalence.Alert.priority unknown Priority
Covalence.Alert.protocol String Protocol
Covalence.Alert.sensorId String Sensor Id
Covalence.Alert.severity String Severity
Covalence.Alert.sigEvalDetails.id Number Id
Covalence.Alert.sigEvalDetails.message String Message
Covalence.Alert.sourceCiscoUmbrellaRanking Number Source Cisco Umbrella Ranking
Covalence.Alert.sourceCiscoUmbrellaTopLevelDomainRanking Number Source Cisco Umbrella Top Level Domain Ranking
Covalence.Alert.sourceCityName String Source City Name
Covalence.Alert.sourceCountryName String Source Country Name
Covalence.Alert.sourceDomainName String Source Domain Name
Covalence.Alert.sourceGeoX Number Source Geo X
Covalence.Alert.sourceGeoY Number Source Geo Y
Covalence.Alert.sourceIp String Source Ip
Covalence.Alert.sourceIpAttributes.k String Key
Covalence.Alert.sourceIpAttributes.t Number Type
Covalence.Alert.sourceIpAttributes.v String Value
Covalence.Alert.sourceMajesticMillionRanking Number Source Majestic Million Ranking
Covalence.Alert.sourceMajesticMillionTopLevelDomainRanking Number Source Majestic Million Top Level Domain Ranking
Covalence.Alert.sourcePort String Source Port
Covalence.Alert.subType String Sub Type
Covalence.Alert.title String Title
Covalence.Alert.type String Type

Command Example


#### Context Example

```json
{
    "Covalence": {
        "Alert": [
            {
                "acknowledgedStatus": "None",
                "analystDescription": "We've detected suspicious persistent software, C:\\\\test.ps1, on the following system: DESKTOP-1.",
                "analystTitle": "Suspicious persistent software detected",
                "destIp": null,
                "sourceIp": null,
                "subType": "Analytic",
                "title": "Analyst alert",
                "type": "ANALYST GENERIC"
            }
        ]
    }
}

Human Readable Output

Alerts

Acknowledgedstatus Analystdescription Analysttitle Subtype Title Type
None We’ve detected suspicious persistent software, C:\test.ps1, on the following system: DESKTOP-1 Suspicious persistent software detected Analytic Analyst alert ANALYST GENERIC

cov-secpr-list-sensors

Lists Covalence sensors

Base Command

cov-secpr-list-sensors

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.Sensors.id String Id
Covalence.Sensors.name String Name
Covalence.Sensors.isAuthorized Boolean Is Authorized
Covalence.Sensors.isNetflowGenerator Boolean Is Netflow Generator
Covalence.Sensors.bytesIn Number Bytes In
Covalence.Sensors.bytesOut Number Bytes Out
Covalence.Sensors.lastActive String Last Active
Covalence.Sensors.listeningInterfaces String Listening Interfaces

Command Example


#### Context Example

```json
{
    "Covalence": {
        "Sensors": [
            {
                "isAuthorized": false,
                "isNetflowGenerator": true,
                "name": "External Sources"
            },
            {
                "isAuthorized": true,
                "isNetflowGenerator": false,
                "name": "1.1.1.1"
            }
        ]
    }
}

Human Readable Output

Sensors

Isauthorized Isnetflowgenerator Name
false true External Sources
true false 1.1.1.1

cov-secpr-get-sensor

Get sensor details when provided with the sensor id

Base Command

cov-secpr-get-sensor

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
sensor_id Sensor id. Required

Context Output

Path Type Description
Covalence.Sensor.id String Id
Covalence.Sensor.name String Name
Covalence.Sensor.isAuthorized Boolean Is Authorized
Covalence.Sensor.listeningInterfaces String Listening Interfaces
Covalence.Sensor.isNetflowGenerator Boolean Is Netflow Generator
Covalence.Sensor.bytesIn Number Bytes In
Covalence.Sensor.bytesOut Number Bytes Out
Covalence.Sensor.lastActive String Last Active

Command Example

!cov-secpr-get-sensor sensor_id=94397407-5577-4d14-8f21-9a65ad5ac7fe

Context Example

{
    "Covalence": {
        "Sensor": {
            "bytesIn": null,
            "bytesOut": null,
            "id": "94397407-5577-4d14-8f21-9a65ad5ac7fe",
            "isAuthorized": true,
            "isNetflowGenerator": false,
            "listeningInterfaces": [
                "eth0",
                "eth1"
            ],
            "name": "1.1.1.1"
        }
    }
}

Human Readable Output

Sensor

Id Isauthorized Isnetflowgenerator Listeninginterfaces Name
94397407-5577-4d14-8f21-9a65ad5ac7fe true false eth0,
eth1		 1.1.1.1

cov-secpr-connections-summary-ip

List summarized connections details by IP Address

Base Command

cov-secpr-connections-summary-ip

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
max_count Maximum number of connection summary by ip to be returned, if none provided will be set to 100. Optional
initial_index Initial index where to start listing connection summaries. Optional
source_ip source ip filter, if used only connections related to the specified source ip will be returned. Optional
start_time Minimal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
end_time Maximal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
clients_only if “clients_only=true”, only connections labeled as client connections will be returned. Optional
internal_only if “internal_only=true”, only internal connections will be returned. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.Connections.averageDuration Number Average Duration
Covalence.Connections.bytesIn Number Bytes In
Covalence.Connections.bytesOut Number Bytes Out
Covalence.Connections.clientServerRelationship String Client Server Relationship
Covalence.Connections.continuingConnectionCount Number Continuing Connection Count
Covalence.Connections.destinationCity String Destination City
Covalence.Connections.destinationCountry String Destination Country
Covalence.Connections.destinationId String Destination Id
Covalence.Connections.destinationIpAddress String Destination Ip Address
Covalence.Connections.destinationMacAddress String Destination Mac Address
Covalence.Connections.dstDomainName String Dst Domain Name
Covalence.Connections.id String Id
Covalence.Connections.packetsIn Number Packets In
Covalence.Connections.packetsOut Number Packets Out
Covalence.Connections.serverPortCount Number Server Port Count
Covalence.Connections.serverPorts String Server Ports
Covalence.Connections.sourceCity String Source City
Covalence.Connections.sourceCountry String Source Country
Covalence.Connections.sourceDomainName String Source Domain Name
Covalence.Connections.sourceId String Source Id
Covalence.Connections.sourceIpAddress String Source Ip Address
Covalence.Connections.sourceMacAddress String Source Mac Address
Covalence.Connections.terminatedConnectionCount Number Terminated Connection Count
Covalence.Connections.totalDuration Number Total Duration

Command Example

!cov-secpr-connections-summary-ip source_ip=1.1.1.1 max_count=10

Context Example

{
    "Covalence": {
        "Connections": [
            {
                "averageDuration": 0,
                "bytesIn": 13360769,
                "bytesOut": 8645498,
                "clientServerRelationship": "CLIENT",
                "destinationIpAddress": "8.8.8.8",
                "dstDomainName": "dns.google",
                "serverPorts": "0,53,443",
                "sourceDomainName": null,
                "sourceIpAddress": "1.1.1.1"
            }
        ]
    }
}

Human Readable Output

Connections

Averageduration Bytesin Bytesout Clientserverrelationship Destinationipaddress Dstdomainname Serverports Sourceipaddress
0 13360769 8645498 CLIENT 8.8.8.8 dns.google 0,53,443 1.1.1.1

cov-secpr-connections-summary-port

List summarized connections details by Port

Base Command

cov-secpr-connections-summary-port

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
max_count Maximum number of connection summary by port to be returned, if none provided will be set to 100. Optional
initial_index Initial index where to start listing connection summaries. Optional
source_ip source ip filter, only connections related to the specified source ip will be returned. Required
start_time Minimal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
end_time Maximal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
clients_only if “clients_only=true”, only connections labeled as client connections will be returned. Optional
internal_only if “internal_only=true”, only internal connections will be returned. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.Connections.averageDuration Number Average Duration
Covalence.Connections.bytesIn Number Bytes In
Covalence.Connections.bytesOut Number Bytes Out
Covalence.Connections.continuingConnectionCount Number Continuing Connection Count
Covalence.Connections.destinationCity String Destination City
Covalence.Connections.destinationCountry String Destination Country
Covalence.Connections.destinationId String Destination Id
Covalence.Connections.destinationIpAddress String Destination Ip Address
Covalence.Connections.destinationMacAddress String Destination Mac Address
Covalence.Connections.dstDomainName String Dst Domain Name
Covalence.Connections.endTime Date End Time
Covalence.Connections.id String Id
Covalence.Connections.packetsIn Number Packets In
Covalence.Connections.packetsOut Number Packets Out
Covalence.Connections.protocol String Protocol
Covalence.Connections.serverPort Number Server Port
Covalence.Connections.sourceCity String Source City
Covalence.Connections.sourceCountry String Source Country
Covalence.Connections.sourceDomainName String Source Domain Name
Covalence.Connections.sourceId String Source Id
Covalence.Connections.sourceIpAddress String Source Ip Address
Covalence.Connections.sourceMacAddress String Source Mac Address
Covalence.Connections.startTime Date Start Time
Covalence.Connections.terminatedConnectionCount Number Terminated Connection Count
Covalence.Connections.totalDuration Number Total Duration

Command Example

!cov-secpr-connections-summary-port source_ip=1.1.1.1 max_count=10

Context Example

{
    "Covalence": {
        "Connections": [
            {
                "averageDuration": 44,
                "bytesIn": 0,
                "bytesOut": 305837,
                "destinationIpAddress": "8.8.8.8",
                "dstDomainName": "dns.google",
                "serverPort": 0,
                "sourceDomainName": null,
                "sourceIpAddress": "1.1.1.1"
            }
        ]
    }
}

Human Readable Output

Connections

Averageduration Bytesin Bytesout Destinationipaddress Dstdomainname Serverport Sourceipaddress
44 0 305837 8.8.8.8 dns.google 0 1.1.1.1

cov-secpr-list-dns-resolutions

List summarized connections details by Port

Base Command

cov-secpr-list-dns-resolutions

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
max_count Maximum number of DNS resolutions to be returned, if none provided will be set to 100. Optional
initial_index Initial index where to start listing DNS resolutions. Optional
request_time_after Minimal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
request_time_before Maximal time in %Y-%m-%dT%H:%M:%S format and UTC time zone. Optional
domain_name Domain name filter, if used will only return DNS resolutions from the specified domain name. Optional
resolved_ip IP filter, if used will only return DNS resolutions to the specified IP. Optional
request_origin_ip Source IP filter, if used will only return DNS resolutions originating from the specified IP. Optional
nameserver_ip Nameserver IP filter, if used will only return DNS resolutions involving the specified nameserver IP. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.DNSResolutions.id String Id
Covalence.DNSResolutions.domainName String Domain Name
Covalence.DNSResolutions.resolvedIp String Resolved Ip
Covalence.DNSResolutions.requestOriginIp String Request Origin Ip
Covalence.DNSResolutions.nameserverIp String Nameserver Ip
Covalence.DNSResolutions.nodeLabel String Node Label
Covalence.DNSResolutions.requestTime Number Request Time
Covalence.DNSResolutions.byteCount Number Byte Count
Covalence.DNSResolutions.pktCount Number Pkt Count

Command Example

!cov-secpr-list-dns-resolutions max_count=10

Context Example

{
    "Covalence": {
        "DNSResolutions": [
            {
                "domainName": "ntp.ubuntu.com",
                "requestOriginIp": "1.1.1.1",
                "requestTime": 1625752183,
                "resolvedIp": "2001:67c:1560:8003::c7"
            }
        ]
    }
}

Human Readable Output

DNS Resolutions

Domainname Requestoriginip Requesttime Resolvedip
ntp.ubuntu.com 1.1.1.1 1625752183 2001:67c:1560:8003::c7

cov-secpr-list-internal-networks

List internal networks

Base Command

cov-secpr-list-internal-networks

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional

Context Output

Path Type Description
Covalence.InternalNetworks.cidr String Cidr
Covalence.InternalNetworks.notes String Notes

Command Example


#### Context Example

```json
{
    "Covalence": {
        "InternalNetworks": {
            "cidr": "'1.1.1.1/24'",
            "notes": "'update'"
        }
    }
}

Human Readable Output

Internal Networks

Cidr Notes
‘1.1.1.1/24’ ‘update’

cov-secpr-set-internal-networks

Set internal networks

Base Command

cov-secpr-set-internal-networks

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
cidr The network to be set as internal in CIDR notation. Required
notes Comment notes associated with the network, notes must be inside quotes. Required

Context Output

Path Type Description
Covalence.InternalNetworks.cidr String Cidr
Covalence.InternalNetworks.notes String Notes

Command Example

!cov-secpr-set-internal-networks cidr='1.2.1.1/24' notes=update

Context Example

{
    "Covalence": {
        "InternalNetworks": [
            "'1.2.1.1/24'",
            "update"
        ]
    }
}

Human Readable Output

Internal network set as ‘1.2.1.1/24’ with notes “update”

cov-secpr-list-endpoint-agents

List endpoint agents

Base Command

cov-secpr-list-endpoint-agents

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
advanced_filter Advanced filter query, if used any other parameters provided to the command will be ignored. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.EndpointAgents.agentUuid String Agent Uuid
Covalence.EndpointAgents.agentVersion String Agent Version
Covalence.EndpointAgents.firstSeenTime Date First Seen Time
Covalence.EndpointAgents.lastSeenTime Date Last Seen Time
Covalence.EndpointAgents.lastSessionUser String Last Session User
Covalence.EndpointAgents.isMobile Boolean Is Mobile
Covalence.EndpointAgents.isConnected Boolean Is Connected
Covalence.EndpointAgents.coreVersion String Core Version
Covalence.EndpointAgents.coreArchitecture String Core Architecture
Covalence.EndpointAgents.coreOs String Core Os
Covalence.EndpointAgents.operatingSystem String Operating System
Covalence.EndpointAgents.hostName String Host Name
Covalence.EndpointAgents.hardwareVendor String Hardware Vendor
Covalence.EndpointAgents.hardwareModel String Hardware Model
Covalence.EndpointAgents.arch String Arch
Covalence.EndpointAgents.osDistro String Os Distro
Covalence.EndpointAgents.osVersion String Os Version
Covalence.EndpointAgents.kernelVersion String Kernel Version
Covalence.EndpointAgents.operatingSystemReleaseId String Operating System Release Id
Covalence.EndpointAgents.ipAddress String Ip Address
Covalence.EndpointAgents.secondaryIpAddress String Secondary Ip Address
Covalence.EndpointAgents.ipAddresses String Ip Addresses
Covalence.EndpointAgents.serialNumber String Serial Number
Covalence.EndpointAgents.deviceIdentifier String Device Identifier
Covalence.EndpointAgents.cpuArchitectureEnum String Cpu Architecture Enum

Command Example


#### Context Example

```json
{
    "Covalence": {
        "EndpointAgents": [
            {
                "hardwareVendor": "VMware, Inc.",
                "hostName": "DESKTOP-0EENF9N",
                "ipAddress": "192.168.223.132",
                "isConnected": false,
                "lastSessionUser": "jsmith",
                "operatingSystem": "Windows 10 Home",
                "serialNumber": "VMware-56 4d 6d cd 58 53 49 e4-73 20 4b 2d b2 15 ca 36"
            },
            {
                "hardwareVendor": "VMware, Inc.",
                "hostName": "DESKTOP-N0E5EN6",
                "ipAddress": "192.168.223.130",
                "isConnected": false,
                "lastSessionUser": "jdoe",
                "operatingSystem": "Windows 10 Pro",
                "serialNumber": "VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91"
            }
        ]
    }
}

Human Readable Output

Endpoint Agents

Hardwarevendor Hostname Ipaddress Isconnected Lastsessionuser Operatingsystem Serialnumber
VMware, Inc. DESKTOP-0EENF9N 192.168.223.132 false jsmith Windows 10 Home VMware-56 4d 6d cd 58 53 49 e4-73 20 4b 2d b2 15 ca 36
VMware, Inc. DESKTOP-N0E5EN6 192.168.223.130 false jdoe Windows 10 Pro VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91

cov-secpr-find-endpoint-agents-by-user

List endpoint agents where the last session user is the one provided as parameter

Base Command

cov-secpr-find-endpoint-agents-by-user

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
user User filter. Required

Context Output

Path Type Description
Covalence.EndpointAgents.agentUuid String Agent Uuid
Covalence.EndpointAgents.agentVersion String Agent Version
Covalence.EndpointAgents.firstSeenTime Date First Seen Time
Covalence.EndpointAgents.lastSeenTime Date Last Seen Time
Covalence.EndpointAgents.lastSessionUser String Last Session User
Covalence.EndpointAgents.isMobile Boolean Is Mobile
Covalence.EndpointAgents.isConnected Boolean Is Connected
Covalence.EndpointAgents.coreVersion String Core Version
Covalence.EndpointAgents.coreArchitecture String Core Architecture
Covalence.EndpointAgents.coreOs String Core Os
Covalence.EndpointAgents.operatingSystem String Operating System
Covalence.EndpointAgents.hostName String Host Name
Covalence.EndpointAgents.hardwareVendor String Hardware Vendor
Covalence.EndpointAgents.hardwareModel String Hardware Model
Covalence.EndpointAgents.arch String Arch
Covalence.EndpointAgents.osDistro String Os Distro
Covalence.EndpointAgents.osVersion String Os Version
Covalence.EndpointAgents.kernelVersion String Kernel Version
Covalence.EndpointAgents.operatingSystemReleaseId String Operating System Release Id
Covalence.EndpointAgents.ipAddress String Ip Address
Covalence.EndpointAgents.secondaryIpAddress String Secondary Ip Address
Covalence.EndpointAgents.ipAddresses String Ip Addresses
Covalence.EndpointAgents.serialNumber String Serial Number
Covalence.EndpointAgents.deviceIdentifier String Device Identifier
Covalence.EndpointAgents.cpuArchitectureEnum String Cpu Architecture Enum

Command Example

!cov-secpr-find-endpoint-agents-by-user user=jdoe

Context Example

{
    "Covalence": {
        "EndpointAgents": {
            "agentUuid": "4dda9c12-b9ec-498b-8e89-1b2bc9078643",
            "agentVersion": "2.0.1.5",
            "arch": "X64",
            "coreArchitecture": "X64",
            "coreOs": "Windows",
            "coreVersion": "2.0.1.5",
            "cpuArchitectureEnum": "X64",
            "deviceIdentifier": "dff207a9-57e0-417d-b72f-667d1c310a65",
            "firstSeenTime": "2021-03-08 13:57:39",
            "hardwareModel": "VMware7,1",
            "hardwareVendor": "VMware, Inc.",
            "hostName": "DESKTOP-N0E5EN6",
            "ipAddress": "192.168.223.130",
            "ipAddresses": "192.168.223.130",
            "isConnected": false,
            "isMobile": false,
            "kernelVersion": "0.0.0.0",
            "lastSeenTime": "2021-07-07 14:14:58",
            "lastSessionUser": "jdoe",
            "operatingSystem": "Windows 10 Pro",
            "operatingSystemReleaseId": "2009",
            "osDistro": "Professional",
            "osVersion": "10.0.0.19042",
            "secondaryIpAddress": "",
            "serialNumber": "VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91"
        }
    }
}

Human Readable Output

Endpoint Agents

Agentuuid Agentversion Arch Corearchitecture Coreos Coreversion Cpuarchitectureenum Deviceidentifier Firstseentime Hardwaremodel Hardwarevendor Hostname Ipaddress Ipaddresses Isconnected Ismobile Kernelversion Lastseentime Lastsessionuser Operatingsystem Operatingsystemreleaseid Osdistro Osversion Serialnumber
4dda9c12-b9ec-498b-8e89-1b2bc9078643 2.0.1.5 X64 X64 Windows 2.0.1.5 X64 dff207a9-57e0-417d-b72f-667d1c310a65 2021-03-08 13:57:39 VMware7,1 VMware, Inc. DESKTOP-N0E5EN6 192.168.223.130 192.168.223.130 false false 0.0.0.0 2021-07-07 14:14:58 jdoe Windows 10 Pro 2009 Professional 10.0.0.19042 VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91

cov-secpr-find-endpoint-agents-by-uuid

Find the endpoint agent with the UUID provided as parameter

Base Command

cov-secpr-find-endpoint-agents-by-uuid

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
uuid Endpoint agent UUID. Required

Context Output

Path Type Description
Covalence.EndpointAgents.agentUuid String Agent Uuid
Covalence.EndpointAgents.agentVersion String Agent Version
Covalence.EndpointAgents.firstSeenTime Date First Seen Time
Covalence.EndpointAgents.lastSeenTime Date Last Seen Time
Covalence.EndpointAgents.lastSessionUser String Last Session User
Covalence.EndpointAgents.isMobile Boolean Is Mobile
Covalence.EndpointAgents.isConnected Boolean Is Connected
Covalence.EndpointAgents.coreVersion String Core Version
Covalence.EndpointAgents.coreArchitecture String Core Architecture
Covalence.EndpointAgents.coreOs String Core Os
Covalence.EndpointAgents.operatingSystem String Operating System
Covalence.EndpointAgents.hostName String Host Name
Covalence.EndpointAgents.hardwareVendor String Hardware Vendor
Covalence.EndpointAgents.hardwareModel String Hardware Model
Covalence.EndpointAgents.arch String Arch
Covalence.EndpointAgents.osDistro String Os Distro
Covalence.EndpointAgents.osVersion String Os Version
Covalence.EndpointAgents.kernelVersion String Kernel Version
Covalence.EndpointAgents.operatingSystemReleaseId String Operating System Release Id
Covalence.EndpointAgents.ipAddress String Ip Address
Covalence.EndpointAgents.secondaryIpAddress String Secondary Ip Address
Covalence.EndpointAgents.ipAddresses String Ip Addresses
Covalence.EndpointAgents.serialNumber String Serial Number
Covalence.EndpointAgents.deviceIdentifier String Device Identifier
Covalence.EndpointAgents.cpuArchitectureEnum String Cpu Architecture Enum

Command Example

!cov-secpr-find-endpoint-agents-by-uuid uuid=4dda9c12-b9ec-498b-8e89-1b2bc9078643

Context Example

{
    "Covalence": {
        "EndpointAgents": {
            "agentUuid": "4dda9c12-b9ec-498b-8e89-1b2bc9078643",
            "agentVersion": "2.0.1.5",
            "arch": "X64",
            "coreArchitecture": "X64",
            "coreOs": "Windows",
            "coreVersion": "2.0.1.5",
            "cpuArchitectureEnum": "X64",
            "deviceIdentifier": "dff207a9-57e0-417d-b72f-667d1c310a65",
            "firstSeenTime": "2021-03-08 13:57:39",
            "hardwareModel": "VMware7,1",
            "hardwareVendor": "VMware, Inc.",
            "hostName": "DESKTOP-N0E5EN6",
            "ipAddress": "192.168.223.130",
            "ipAddresses": "192.168.223.130",
            "isConnected": false,
            "isMobile": false,
            "kernelVersion": "0.0.0.0",
            "lastSeenTime": "2021-07-07 14:14:58",
            "lastSessionUser": "jdoe",
            "operatingSystem": "Windows 10 Pro",
            "operatingSystemReleaseId": "2009",
            "osDistro": "Professional",
            "osVersion": "10.0.0.19042",
            "secondaryIpAddress": "",
            "serialNumber": "VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91"
        }
    }
}

Human Readable Output

Endpoint Agents

Agentuuid Agentversion Arch Corearchitecture Coreos Coreversion Cpuarchitectureenum Deviceidentifier Firstseentime Hardwaremodel Hardwarevendor Hostname Ipaddress Ipaddresses Isconnected Ismobile Kernelversion Lastseentime Lastsessionuser Operatingsystem Operatingsystemreleaseid Osdistro Osversion Serialnumber
4dda9c12-b9ec-498b-8e89-1b2bc9078643 2.0.1.5 X64 X64 Windows 2.0.1.5 X64 dff207a9-57e0-417d-b72f-667d1c310a65 2021-03-08 13:57:39 VMware7,1 VMware, Inc. DESKTOP-N0E5EN6 192.168.223.130 192.168.223.130 false false 0.0.0.0 2021-07-07 14:14:58 jdoe Windows 10 Pro 2009 Professional 10.0.0.19042 VMware-56 4d 77 78 de 75 22 df-6a c9 62 b2 72 e9 6b 91

cov-secpr-search-endpoint-process

Search processes by name or advanced filter, at least one parameter is required

Base Command

cov-secpr-search-endpoint-process

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
name Process name. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.EndpointProcess.id Number Id
Covalence.EndpointProcess.agentUuid String Agent Uuid
Covalence.EndpointProcess.processName String Process Name
Covalence.EndpointProcess.processPath String Process Path
Covalence.EndpointProcess.parentProcessName String Parent Process Name
Covalence.EndpointProcess.parentProcessPath String Parent Process Path
Covalence.EndpointProcess.commandLine String Command Line
Covalence.EndpointProcess.username String Username
Covalence.EndpointProcess.firstSeenTime Date First Seen Time
Covalence.EndpointProcess.lastSeenTime Date Last Seen Time
Covalence.EndpointProcess.lastEndTime Date Last End Time
Covalence.EndpointProcess.seenCount Number Seen Count
Covalence.EndpointProcess.activeCount Number Active Count

Command Example

!cov-secpr-search-endpoint-process name=explorer.exe

Context Example

{
    "Covalence": {
        "EndpointProcess": [
            {
                "commandLine": "C:\\Windows\\Explorer.EXE",
                "firstSeenTime": "2021-03-08T12:25:54.100Z",
                "lastSeenTime": "2021-04-08T15:23:10.069Z",
                "processPath": "C:\\Windows\\explorer.exe",
                "username": "jdoe"
            },
            {
                "commandLine": "C:\\Windows\\Explorer.EXE",
                "firstSeenTime": "2021-04-23T07:24:25.570Z",
                "lastSeenTime": "2021-07-07T09:52:17.352Z",
                "processPath": "C:\\Windows\\explorer.exe",
                "username": "jsmith"
            }
        ]
    }
}

Human Readable Output

Endpoint Process

Commandline Firstseentime Lastseentime Processpath Username
C:\Windows\Explorer.EXE 2021-03-08T12:25:54.100Z 2021-04-08T15:23:10.069Z C:\Windows\explorer.exe jdoe
C:\Windows\Explorer.EXE 2021-04-23T07:24:25.570Z 2021-07-07T09:52:17.352Z C:\Windows\explorer.exe jsmith

cov-secpr-search-endpoint-installed-software

Search for endpoint installed software

Base Command

cov-secpr-search-endpoint-installed-software

Input

Argument Name Description Required
target_org Only required in broker mode, used to target a specific organization: target_org=”Acme Corporation”. Optional
name The name of installed software, quotes are required is space character is used. At least one parameter is required. Required
version The version of installed software. Optional
advanced_filter Advanced filter query. Optional
details if details=true, will return the complete response from Covalence API. Optional

Context Output

Path Type Description
Covalence.EndpointSoftware.arch Number Arch
Covalence.EndpointSoftware.type Number Type
Covalence.EndpointSoftware.packageManager Number Package Manager
Covalence.EndpointSoftware.installTimestamp Date Install Timestamp
Covalence.EndpointSoftware.uninstallTimestamp Date Uninstall Timestamp
Covalence.EndpointSoftware.name String Name
Covalence.EndpointSoftware.version String Version
Covalence.EndpointSoftware.vendor String Vendor
Covalence.EndpointSoftware.installPath String Install Path
Covalence.EndpointSoftware.appDataPath String App Data Path
Covalence.EndpointSoftware.sharedDataPath String Shared Data Path
Covalence.EndpointSoftware.installedForUser String Installed For User
Covalence.EndpointSoftware.installSource String Install Source
Covalence.EndpointSoftware.id Number Id
Covalence.EndpointSoftware.agentUuid String Agent Uuid
Covalence.EndpointSoftware.softwareNotifyAction String Software Notify Action

Command Example

!cov-secpr-search-endpoint-installed-software name=firefox

Context Example

{
    "Covalence": {
        "EndpointSoftware": {
            "installTimestamp": "1970-01-01T00:00:00.000Z",
            "name": "Mozilla Firefox 88.0 (x86 fr)",
            "uninstallTimestamp": null,
            "vendor": "Mozilla",
            "version": "88.0"
        }
    }
}

Human Readable Output

Endpoint Software

Installtimestamp Name Vendor Version
1970-01-01T00:00:00.000Z Mozilla Firefox 88.0 (x86 fr) Mozilla 88.0

cov-secpr-list-organizations

List monitored organizations, only available in broker mode

Base Command

cov-secpr-list-organizations

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
Covalence.Organization.org_name String Org_name

Command Example

!cov-secpr-list-organizations

Human Readable Output

No organizations found

Configuration parameters

  • broker — Broker
  • host — Host (required)
  • credentials — Credentials (required)
  • verify_ssl — Verify SSL
  • timeout — Timeout
  • first_run_time_range — First run time range
  • fetch_limit — Fetch limit
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • incidentType — Incident type
  • max_fetch — Fetch limit

Commands (14)

  • cov-secpr-connections-summary-ip

    List summarized connections details by IP Address.

  • cov-secpr-connections-summary-port

    List summarized connections details by Port.

  • cov-secpr-find-endpoint-agents-by-user

    List endpoint agents where the last session user is the one provided as parameter.

  • cov-secpr-find-endpoint-agents-by-uuid

    Find the endpoint agent with the UUID provided as parameter.

  • cov-secpr-get-sensor

    Get sensor details when provided with the sensor id.

  • cov-secpr-list-alerts

    Lists Covalence alerts.

  • cov-secpr-list-dns-resolutions

    List summarized connections details by Port.

  • cov-secpr-list-endpoint-agents

    List endpoint agents.

  • cov-secpr-list-internal-networks

    List internal networks.

  • cov-secpr-list-organizations

    List monitored organizations, only available in broker mode.

  • cov-secpr-list-sensors

    Lists Covalence sensors.

  • cov-secpr-search-endpoint-installed-software

    Search for endpoint installed software.

  • cov-secpr-search-endpoint-process

    Search processes by name or advanced filter, at least one parameter is required.

  • cov-secpr-set-internal-networks

    Set internal networks.

Source

CovalenceForSecurityProviders.py CovalenceForSecurityProviders_test.py CovalenceForSecurityProviders.yml CovalenceForSecurityProviders_description.md command_examples.txt
Download History Raw 
"""Base Integration for Cortex XSOAR - Unit Tests file

Pytest Unit Tests: all funcion names must start with "test_"

More details: https://xsoar.pan.dev/docs/integrations/unit-testing

MAKE SURE YOU REVIEW/REPLACE ALL THE COMMENTS MARKED AS "TODO"

You must add at least a Unit Test function for every XSOAR command
you are implementing with your integration
"""

import json
import os

import demistomock as demisto
import pytest
import requests


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


@pytest.fixture(autouse=True)
def init_tests(mocker):
    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "host": "foo.bar",
            "broker": False,
            "credentials": {"identifier": "foo", "password": "bar"},
            "verify_ssl": False,
            "timeout": "100",
            "first_run_time_range": "2",
            "fetch_limit": "250",
            "proxy": False,
        },
    )

    mocker.patch.dict(os.environ, {"HTTP_PROXY": "", "HTTPS_PROXY": "", "http_proxy": "", "https_proxy": ""})


def test_find_covs(mocker):
    """
    Making sure correct Cov ids are returned when provided with an org name
    """
    text = """<html>
    <head><title>Select Covalence</title></head><body><h1>Select Covalence</h1><p>
    <a href="/index/2016-001-AA">Capsule Corp</a><p>
    <a href="/index/2016-001-AB">Acme Inc.</a><p>
    <a href="/index/2016-001-AC">Acme Inc.</a><p>
    </body><html>"""
    r = requests.Response()
    r.status_code = 200
    type(r).text = mocker.PropertyMock(return_value=text)
    mocker.patch.object(requests, "get", return_value=r)

    from CovalenceForSecurityProviders import find_covs

    assert find_covs("Capsule Corp") == ["2016-001-AA"]
    assert find_covs("Acme Inc.") == ["2016-001-AB", "2016-001-AC"]


def test_build_host():
    """
    Making sure the Covalence url is correctly built
    """
    from CovalenceForSecurityProviders import build_host

    host = build_host("foo.bar")
    assert host == "https://foo.bar/CovalenceWebUI/services"


def test_send_request_direct_dict(mocker):
    """
    Making sure dict is returned for dict responses
    Direct mode
    """
    import CovalenceForSecurityProviders

    # direct mode, no need to find cov from org_name
    mocker.patch.object(CovalenceForSecurityProviders, "login", return_value=requests.Session())

    mock_get_sensor = util_load_json("test_data/get_sensor.json")
    r = requests.Response()
    r.status_code = 200
    r._content = json.dumps(mock_get_sensor).encode("utf-8")
    mocker.patch.object(requests.Session, "send", return_value=r)

    resp = CovalenceForSecurityProviders.send_request("GET", "/rest/v1/sensors/sensor_id", target_org=None)
    assert resp == [mock_get_sensor]


def test_send_request_direct_list(mocker):
    """
    Making sure list is returned for list responses
    Direct mode
    """
    import CovalenceForSecurityProviders

    # direct mode, no need to find cov from org_name
    mocker.patch.object(CovalenceForSecurityProviders, "login", return_value=requests.Session())

    mock_list_sensor = util_load_json("test_data/list_sensor.json")
    r = requests.Response()
    r.status_code = 200
    r._content = json.dumps(mock_list_sensor).encode("utf-8")
    mocker.patch.object(requests.Session, "send", return_value=r)

    resp = CovalenceForSecurityProviders.send_request("GET", "/rest/v1/sensors", target_org=None)
    assert resp == mock_list_sensor


def test_send_request_broker_dict(mocker):
    """
    Broker mode, the org has 2 covalences
    Making sure the request is sent to both covalences
    Making sure that both responses (dict) get merged in a list and returned
    """
    mocker.patch.object(demisto, "params", return_value={"broker": True})

    import CovalenceForSecurityProviders

    mocker.patch.object(CovalenceForSecurityProviders, "find_covs", return_value=["2016-001-AB", "2016-001-AC"])
    mocker.patch.object(CovalenceForSecurityProviders, "login", return_value=requests.Session())

    mock_get_sensor = util_load_json("test_data/get_sensor.json")
    r = requests.Response()
    r.status_code = 200
    r._content = json.dumps(mock_get_sensor).encode("utf-8")
    mocker.patch.object(requests.Session, "send", return_value=r)
    sensor_list = []
    sensor_list.append(mock_get_sensor)
    sensor_list.append(mock_get_sensor)

    resp = CovalenceForSecurityProviders.send_request("GET", "/rest/v1/sensors/sensor_id", target_org="Acme Inc.")
    assert resp == sensor_list


def test_send_request_broker_list(mocker):
    """
    Broker mode, the org has 2 covalences
    Making sure the request is sent to both covalences
    Making sure that both responses (list) get merged in a list and returned
    """
    mocker.patch.object(demisto, "params", return_value={"broker": True})

    import CovalenceForSecurityProviders

    mocker.patch.object(CovalenceForSecurityProviders, "find_covs", return_value=["2016-001-AB", "2016-001-AC"])
    mocker.patch.object(CovalenceForSecurityProviders, "login", return_value=requests.Session())

    mock_list_sensor = util_load_json("test_data/list_sensor.json")
    r = requests.Response()
    r.status_code = 200
    r._content = json.dumps(mock_list_sensor).encode("utf-8")
    mocker.patch.object(requests.Session, "send", return_value=r)
    sensor_list = []
    sensor_list = sensor_list + mock_list_sensor
    sensor_list = sensor_list + mock_list_sensor

    resp = CovalenceForSecurityProviders.send_request("GET", "/rest/v1/sensors/sensor_id", target_org="Acme Inc.")
    assert resp == sensor_list


def test_list_alerts(mocker):
    mock_list_alerts = util_load_json("test_data/list_alerts.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "false"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_list_alerts)

    r = CovalenceForSecurityProviders.list_alerts()

    assert len(r[0].keys()) == 8
    assert "acknowledgedStatus" in r[0]
    assert "analystDescription" in r[0]
    assert "destIp" in r[0]
    assert "sourceIp" in r[0]
    assert "subType" in r[0]
    assert "title" in r[0]
    assert "type" in r[0]


def test_list_alerts_details(mocker):
    mock_list_alerts = util_load_json("test_data/list_alerts.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "true"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_list_alerts)

    r = CovalenceForSecurityProviders.list_alerts()

    assert len(r[0].keys()) == 48
    assert "id" in r[0]
    assert "sensorId" in r[0]
    assert "type" in r[0]
    assert "organizationId" in r[0]
    assert "subType" in r[0]
    assert "severity" in r[0]
    assert "facility" in r[0]
    assert "priority" in r[0]
    assert "createdTime" in r[0]
    assert "lastAlertedTime" in r[0]
    assert "title" in r[0]
    assert "notes" in r[0]
    assert "alertHash" in r[0]
    assert "assignee" in r[0]
    assert "analystTitle" in r[0]
    assert "analystDescription" in r[0]
    assert "endpointAgentUuid" in r[0]
    assert "pcapResourceUuid" in r[0]
    assert "sourceCityName" in r[0]
    assert "sourceCountryName" in r[0]
    assert "destCityName" in r[0]
    assert "destCountryName" in r[0]
    assert "destIp" in r[0]
    assert "destPort" in r[0]
    assert "protocol" in r[0]
    assert "destDomainName" in r[0]
    assert "destCiscoUmbrellaRanking" in r[0]
    assert "destMajesticMillionRanking" in r[0]
    assert "destCiscoUmbrellaTopLevelDomainRanking" in r[0]
    assert "destMajesticMillionTopLevelDomainRanking" in r[0]
    assert "sourceIp" in r[0]
    assert "sourcePort" in r[0]
    assert "sourceDomainName" in r[0]
    assert "sourceCiscoUmbrellaRanking" in r[0]
    assert "sourceMajesticMillionRanking" in r[0]
    assert "sourceCiscoUmbrellaTopLevelDomainRanking" in r[0]
    assert "sourceMajesticMillionTopLevelDomainRanking" in r[0]
    assert "sourceGeoX" in r[0]
    assert "sourceGeoY" in r[0]
    assert "destGeoX" in r[0]
    assert "destGeoY" in r[0]
    assert "isFavorite" in r[0]
    assert "alertCount" in r[0]
    assert "acknowledgedStatus" in r[0]
    assert "blacklistDetails" in r[0]
    assert "sigEvalDetails" in r[0]
    assert "sourceIpAttributes" in r[0]
    assert "destIpAttributes" in r[0]


def test_list_sensors(mocker):
    mock_list_sensor = util_load_json("test_data/list_sensor.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "false"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_list_sensor)

    r = CovalenceForSecurityProviders.list_sensors()

    assert len(r[0].keys()) == 3
    assert "isAuthorized" in r[0]
    assert "isNetflowGenerator" in r[0]
    assert "name" in r[0]


def test_list_sensors_details(mocker):
    mock_list_sensor = util_load_json("test_data/list_sensor.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "true"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_list_sensor)

    r = CovalenceForSecurityProviders.list_sensors()

    assert len(r[0].keys()) == 7
    assert "id" in r[0]
    assert "name" in r[0]
    assert "isAuthorized" in r[0]
    assert "listeningInterfaces" in r[0]
    assert "isNetflowGenerator" in r[0]
    assert "bytesIn" in r[0]
    assert "bytesOut" in r[0]
    assert "lastActive" not in r[0]


def test_get_sensor(mocker):
    mock_get_sensor = [util_load_json("test_data/get_sensor.json")]

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "sensor_id": "id"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_get_sensor)

    r = CovalenceForSecurityProviders.get_sensor()

    assert isinstance(r, list)
    assert len(r[0].keys()) == 7
    assert "id" in r[0]
    assert "name" in r[0]
    assert "isAuthorized" in r[0]
    assert "listeningInterfaces" in r[0]
    assert "isNetflowGenerator" in r[0]
    assert "bytesIn" in r[0]
    assert "bytesOut" in r[0]
    assert "lastActive" not in r[0]


def test_connections_summary_by_ip(mocker):
    mock_connections_summary_by_ip = util_load_json("test_data/connections_summary_by_ip.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "false"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_connections_summary_by_ip)

    r = CovalenceForSecurityProviders.connections_summary_by_ip()

    assert len(r[0].keys()) == 9
    assert "averageDuration" in r[0]
    assert "bytesIn" in r[0]
    assert "clientServerRelationship" in r[0]
    assert "destinationIpAddress" in r[0]
    assert "dstDomainName" in r[0]
    assert "serverPorts" in r[0]
    assert "sourceDomainName" in r[0]
    assert "sourceIpAddress" in r[0]


def test_connections_summary_by_ip_details(mocker):
    mock_connections_summary_by_ip = util_load_json("test_data/connections_summary_by_ip.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "true"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_connections_summary_by_ip)

    r = CovalenceForSecurityProviders.connections_summary_by_ip()

    assert len(r[0].keys()) == 24
    assert "id" in r[0]
    assert "sourceId" in r[0]
    assert "sourceIpAddress" in r[0]
    assert "sourceMacAddress" in r[0]
    assert "destinationId" in r[0]
    assert "destinationIpAddress" in r[0]
    assert "destinationMacAddress" in r[0]
    assert "serverPortCount" in r[0]
    assert "serverPorts" in r[0]
    assert "bytesIn" in r[0]
    assert "bytesOut" in r[0]
    assert "packetsIn" in r[0]
    assert "packetsOut" in r[0]
    assert "continuingConnectionCount" in r[0]
    assert "terminatedConnectionCount" in r[0]
    assert "totalDuration" in r[0]
    assert "averageDuration" in r[0]
    assert "sourceCity" in r[0]
    assert "sourceCountry" in r[0]
    assert "destinationCity" in r[0]
    assert "destinationCountry" in r[0]
    assert "sourceDomainName" in r[0]
    assert "dstDomainName" in r[0]
    assert "clientServerRelationship" in r[0]


def test_connections_summary_by_port(mocker):
    mock_connections_summary_by_port = util_load_json("test_data/connections_summary_by_port.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "false"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_connections_summary_by_port)

    r = CovalenceForSecurityProviders.connections_summary_by_port()

    assert len(r[0].keys()) == 8
    assert "averageDuration" in r[0]
    assert "bytesIn" in r[0]
    assert "bytesOut" in r[0]
    assert "destinationIpAddress" in r[0]
    assert "dstDomainName" in r[0]
    assert "serverPort" in r[0]
    assert "sourceDomainName" in r[0]
    assert "sourceIpAddress" in r[0]


def test_connections_summary_by_port_details(mocker):
    mock_connections_summary_by_port = util_load_json("test_data/connections_summary_by_port.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "true"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_connections_summary_by_port)

    r = CovalenceForSecurityProviders.connections_summary_by_port()

    assert len(r[0].keys()) == 25
    assert "id" in r[0]
    assert "sourceId" in r[0]
    assert "sourceIpAddress" in r[0]
    assert "sourceMacAddress" in r[0]
    assert "destinationId" in r[0]
    assert "destinationIpAddress" in r[0]
    assert "destinationMacAddress" in r[0]
    assert "serverPort" in r[0]
    assert "protocol" in r[0]
    assert "continuingConnectionCount" in r[0]
    assert "terminatedConnectionCount" in r[0]
    assert "bytesIn" in r[0]
    assert "bytesOut" in r[0]
    assert "packetsIn" in r[0]
    assert "packetsOut" in r[0]
    assert "totalDuration" in r[0]
    assert "averageDuration" in r[0]
    assert "sourceCity" in r[0]
    assert "sourceCountry" in r[0]
    assert "destinationCity" in r[0]
    assert "destinationCountry" in r[0]
    assert "sourceDomainName" in r[0]
    assert "dstDomainName" in r[0]
    assert "startTime" in r[0]
    assert "endTime" in r[0]


def test_list_dns_resolutions(mocker):
    mock_list_dns_resolutions = util_load_json("test_data/list_dns_resolutions.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "false"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_list_dns_resolutions)

    r = CovalenceForSecurityProviders.list_dns_resolutions()

    assert len(r[0].keys()) == 4
    assert "domainName" in r[0]
    assert "requestOriginIp" in r[0]
    assert "requestTime" in r[0]
    assert "resolvedIp" in r[0]


def test_list_dns_resolutions_details(mocker):
    mock_list_dns_resolutions = util_load_json("test_data/list_dns_resolutions.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "true"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_list_dns_resolutions)

    r = CovalenceForSecurityProviders.list_dns_resolutions()

    assert len(r[0].keys()) == 9
    assert "id" in r[0]
    assert "domainName" in r[0]
    assert "resolvedIp" in r[0]
    assert "requestOriginIp" in r[0]
    assert "nameserverIp" in r[0]
    assert "nodeLabel" in r[0]
    assert "requestTime" in r[0]
    assert "byteCount" in r[0]
    assert "pktCount" in r[0]


def test_list_internal_networks(mocker):
    mock_list_internal_networks = util_load_json("test_data/list_internal_networks.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "true"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_list_internal_networks)

    r = CovalenceForSecurityProviders.list_internal_networks()

    assert len(r[0].keys()) == 2
    assert "notes" in r[0]
    assert "cidr" in r[0]


def test_list_endpoint_agents(mocker):
    mock_list_endpoint_agents = util_load_json("test_data/list_endpoint_agents.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "false"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_list_endpoint_agents)

    r = CovalenceForSecurityProviders.list_endpoint_agents()

    assert len(r[0].keys()) == 7
    assert "hardwareVendor" in r[0]
    assert "hostName" in r[0]
    assert "ipAddress" in r[0]
    assert "isConnected" in r[0]
    assert "lastSessionUser" in r[0]
    assert "operatingSystem" in r[0]
    assert "serialNumber" in r[0]


def test_list_endpoint_agents_details(mocker):
    mock_list_endpoint_agents = util_load_json("test_data/list_endpoint_agents.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "true"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_list_endpoint_agents)

    r = CovalenceForSecurityProviders.list_endpoint_agents()

    assert len(r[0].keys()) == 25
    assert "agentUuid" in r[0]
    assert "agentVersion" in r[0]
    assert "firstSeenTime" in r[0]
    assert "lastSeenTime" in r[0]
    assert "lastSessionUser" in r[0]
    assert "isMobile" in r[0]
    assert "isConnected" in r[0]
    assert "coreVersion" in r[0]
    assert "coreArchitecture" in r[0]
    assert "coreOs" in r[0]
    assert "operatingSystem" in r[0]
    assert "hostName" in r[0]
    assert "hardwareVendor" in r[0]
    assert "hardwareModel" in r[0]
    assert "arch" in r[0]
    assert "osDistro" in r[0]
    assert "osVersion" in r[0]
    assert "kernelVersion" in r[0]
    assert "operatingSystemReleaseId" in r[0]
    assert "ipAddress" in r[0]
    assert "secondaryIpAddress" in r[0]
    assert "ipAddresses" in r[0]
    assert "serialNumber" in r[0]
    assert "deviceIdentifier" in r[0]
    assert "cpuArchitectureEnum" in r[0]


def test_search_endpoint_process(mocker):
    mock_search_endpoint_process = util_load_json("test_data/search_endpoint_process.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "false"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_search_endpoint_process)

    r = CovalenceForSecurityProviders.search_endpoint_process()

    assert len(r[0].keys()) == 5
    assert "commandLine" in r[0]
    assert "firstSeenTime" in r[0]
    assert "lastSeenTime" in r[0]
    assert "processPath" in r[0]
    assert "username" in r[0]


def test_search_endpoint_process_details(mocker):
    mock_search_endpoint_process = util_load_json("test_data/search_endpoint_process.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "true"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_search_endpoint_process)

    r = CovalenceForSecurityProviders.search_endpoint_process()

    assert len(r[0].keys()) == 13
    assert "id" in r[0]
    assert "agentUuid" in r[0]
    assert "processName" in r[0]
    assert "processPath" in r[0]
    assert "parentProcessName" in r[0]
    assert "parentProcessPath" in r[0]
    assert "commandLine" in r[0]
    assert "username" in r[0]
    assert "firstSeenTime" in r[0]
    assert "lastSeenTime" in r[0]
    assert "lastEndTime" in r[0]
    assert "seenCount" in r[0]
    assert "activeCount" in r[0]


def test_search_endpoint_installed_software(mocker):
    mock_search_endpoint_installed_software = util_load_json("test_data/search_endpoint_installed_software.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "false"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_search_endpoint_installed_software)

    r = CovalenceForSecurityProviders.search_endpoint_installed_software()

    assert len(r[0].keys()) == 5
    assert "installTimestamp" in r[0]
    assert "name" in r[0]
    assert "uninstallTimestamp" in r[0]
    assert "vendor" in r[0]
    assert "version" in r[0]


def test_search_endpoint_installed_software_details(mocker):
    mock_search_endpoint_installed_software = util_load_json("test_data/search_endpoint_installed_software.json")

    import CovalenceForSecurityProviders

    mocker.patch.object(demisto, "args", return_value={"target_org": None, "details": "true"})
    mocker.patch.object(CovalenceForSecurityProviders, "send_request", return_value=mock_search_endpoint_installed_software)

    r = CovalenceForSecurityProviders.search_endpoint_installed_software()

    assert len(r[0].keys()) == 16
    assert "arch" in r[0]
    assert "type" in r[0]
    assert "packageManager" in r[0]
    assert "installTimestamp" in r[0]
    assert "uninstallTimestamp" in r[0]
    assert "name" in r[0]
    assert "version" in r[0]
    assert "vendor" in r[0]
    assert "installPath" in r[0]
    assert "appDataPath" in r[0]
    assert "sharedDataPath" in r[0]
    assert "installedForUser" in r[0]
    assert "installSource" in r[0]
    assert "id" in r[0]
    assert "agentUuid" in r[0]
    assert "softwareNotifyAction" in r[0]


def test_list_org(mocker):
    mocker.patch.object(demisto, "params", return_value={"broker": True})
    text = """<html>
    <head><title>Select Covalence</title></head><body><h1>Select Covalence</h1><p>
    <a href="/index/2016-001-AA">Capsule Corp</a><p>
    <a href="/index/2016-001-AB">Acme Inc.</a><p>
    <a href="/index/2016-001-AC">Acme Inc.</a><p>
    </body><html>"""
    r = requests.Response()
    r.status_code = 200
    type(r).text = mocker.PropertyMock(return_value=text)
    mocker.patch.object(requests, "get", return_value=r)

    import CovalenceForSecurityProviders

    org_names = CovalenceForSecurityProviders.list_org()

    assert len(org_names) == 2
    assert {"org_name": "Capsule Corp"} in org_names
    assert {"org_name": "Acme Inc."} in org_names