DeepInstinct v3

Deep Instinct is a prevention-first approach to stopping ransomware and other malware using the world's first purpose-built, deep learning cybersecurity framework.

Endpoint · DeepInstinct

Details

IDDeepInstinct v3
ProviderDeep Instinct
CategoryEndpoint
From Version6.2.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Deep Instinct is a prevention-first approach to stopping ransomware and other malware using the world’s first purpose-built, deep learning cybersecurity framework.
This integration was integrated and tested with version 3.3.x of DeepInstinct v3

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure DeepInstinct v3 in Cortex

Parameter Required
Base server URL True
API Key True
First event ID to fetch from False
Fetch incidents False
Incidents Fetch Interval False
Incident type False
Trust any certificate (not secure) False
Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

deepinstinctv3-get-device

Get device information from its ID

Base Command

deepinstinctv3-get-device

Input

Argument Name Description Required
device_id Get device information from its ID. Required

Context Output

Path Type Description
deepinstinctv3.devices.ID number Device ID
deepinstinctv3.devices.os string Device OS
deepinstinctv3.devices.osv string Device OS version
deepinstinctv3.devices.ip_address string Device IP address
deepinstinctv3.devices.email sting Device email ip_address
deepinstinctv3.devices.mac_address string Device mac address
deepinstinctv3.devices.hostname string Device hostname
deepinstinctv3.devices.domain string Device domain
deepinstinctv3.devices.scanned_files number Num of device scanned files
deepinstinctv3.devices.comment string Device comment
deepinstinctv3.devices.tag string Device tag
deepinstinctv3.devices.connectivity_status string Device connectivity status
deepinstinctv3.devices.deployment_status string Device deployment status
deepinstinctv3.devices.deployment_status_last_update string Device last client version update
deepinstinctv3.devices.license_status string Device license status
deepinstinctv3.devices.last_registration string Device last registration datetime
deepinstinctv3.devices.last_contact string Device last contact datetime
deepinstinctv3.devices.distinguished_name string Device distinguished name
deepinstinctv3.devices.group_name string Device group name
deepinstinctv3.devices.group_id number Device group ID
deepinstinctv3.devices.policy_name string Device policy name
deepinstinctv3.devices.policy_id number Device policy ID
deepinstinctv3.devices.log_status string Device log status
deepinstinctv3.devices.agent_version string Device agent version
deepinstinctv3.devices.brain_version string Device brain version
deepinstinctv3.devices.logged_in_users string Device logged in user(s)
deepinstinctv3.devices.msp_name string Device msp name
deepinstinctv3.devices.msp_id number Device msp ID
deepinstinctv3.devices.tenant_name string Device tenant name
deepinstinctv3.devices.tenant_id number Device tenant ID

deepinstinctv3-get-events

Get all events after given event ID

Base Command

deepinstinctv3-get-events

Input

Argument Name Description Required
first_event_id Get all events. Max events in response is 50, use first_event_id parameter to define first event id to get. Default is 0. Required

Context Output

Path Type Description
deepinstinctv3.Events.events.id number event ID
deepinstinctv3.Events.events.device_id number event device ID
deepinstinctv3.Events.events.timestamp string event timestamp from device
deepinstinctv3.Events.events.insertion_timestamp string event timestamp from console
deepinstinctv3.Events.events.close_timestamp string event closed timestamp
deepinstinctv3.Events.events.last_action string event last last_action
deepinstinctv3.Events.events.status string event status
deepinstinctv3.Events.events.comment string event comment
deepinstinctv3.Events.events.recorded_device_info unknown event device information
deepinstinctv3.Events.events.msp_name string event msp name
deepinstinctv3.Events.events.msp_id number event msp id
deepinstinctv3.Events.events.tenant_name string event tenant name
deepinstinctv3.Events.events.tenant_id number event tenant id
deepinstinctv3.Events.events.mitre_classifications unknown event MITRE classification
deepinstinctv3.Events.events.type string event type
deepinstinctv3.Events.events.trigger string event trigger
deepinstinctv3.Events.events.action string event action
deepinstinctv3.Events.events.close_trigger string event close trigger
deepinstinctv3.Events.events.reoccurrence_count number event reoccurrence_count
deepinstinctv3.Events.events.file_type string event file type
deepinstinctv3.Events.events.file_hash string event file hash
deepinstinctv3.Events.events.file_archive_hash string event file archive hash
deepinstinctv3.Events.events.path unknown event file path
deepinstinctv3.Events.events.file_size number event file size
deepinstinctv3.Events.events.threat_severity string event threat severity
deepinstinctv3.Events.events.certificate_thumbprint string event certificate certificate thumbprint
deepinstinctv3.Events.events.certificate_vendor_name string event certificate certificate vendor name
deepinstinctv3.Events.events.deep_classification string Deep Instinct classification
deepinstinctv3.Events.events.file_status string event file status
deepinstinctv3.Events.events.sandbox_status string event sandbox status

deepinstinctv3-get-suspicious-events

Get all suspicious events after given event ID

Base Command

deepinstinctv3-get-suspicious-events

Input

Argument Name Description Required
first_event_id Get all suspicious events. Max events in response is 50, use first_event_id parameter to define first event id to get. Default is 0. Required

Context Output

Path Type Description
deepinstinctv3.Suspicious-Events.events.ID number event ID
deepinstinctv3.Suspicious-Events.events.device_id number event device ID
deepinstinctv3.Suspicious-Events.events.timestamp string event timestamp from device
deepinstinctv3.Suspicious-Events.events.insertion_timestamp string event timestamp from console
deepinstinctv3.Suspicious-Events.events.status string event status
deepinstinctv3.Suspicious-Events.events.recorded_device_info unkown event device info
deepinstinctv3.Suspicious-Events.events.msp_name string event msp name
deepinstinctv3.Suspicious-Events.events.msp_id number event msp id
deepinstinctv3.Suspicious-Events.events.tenant_name string event tenant name
deepinstinctv3.Suspicious-Events.events.tenant_id number event tenant id
deepinstinctv3.Suspicious-Events.events.mitre_classifications unknown event MITRE classification
deepinstinctv3.Suspicious-Events.events.type string event type
deepinstinctv3.Suspicious-Events.events.trigger string event trigger
deepinstinctv3.Suspicious-Events.events.action string event action
deepinstinctv3.Suspicious-Events.events.close_trigger string event close trigger
deepinstinctv3.Suspicious-Events.events.file_type string event file type
deepinstinctv3.Suspicious-Events.events.rule_trigger string event rule trigger
deepinstinctv3.Suspicious-Events.events.file_archive_hash string event file archive hash
deepinstinctv3.Suspicious-Events.events.remediation unknown event remediation
deepinstinctv3.Suspicious-Events.events.path unknown event file path

deepinstinctv3-get-all-groups

Get all groups

Base Command

deepinstinctv3-get-all-groups

Input

There are no input arguments for this command.

Context Output

Path Type Description
deepinstinctv3.Groups.ID number group id
deepinstinctv3.Groups.is_default_group boolean True if group is a default group, false otherwise
deepinstinctv3.Groups.msp_id number msp ID
deepinstinctv3.Groups.name string group name
deepinstinctv3.Groups.os string group operation system
deepinstinctv3.Groups.policy_id number group policy ID

deepinstinctv3-get-all-policies

Get list of all policies

Base Command

deepinstinctv3-get-all-policies

Input

There are no input arguments for this command.

Context Output

Path Type Description
deepinstinctv3.Policies.ID number policy ID
deepinstinctv3.Policies.name string policy name
deepinstinctv3.Policies.os string policy operating system
deepinstinctv3.Policies.is_default_policy boolean True if policy is a default policy, False otherwise
deepinstinctv3.Policies.msp_id number msp ID
deepinstinctv3.Policies.msp_name string msp name

deepinstinctv3-add-hash-to-deny-list

Add file hash to Deny List

Base Command

deepinstinctv3-add-hash-to-deny-list

Input

Argument Name Description Required
policy_id Policy ID. Required
file_hash file hash. Required
comment comment to hash field. Optional

Context Output

There is no context output for this command.

deepinstinctv3-add-hash-to-allow-list

Add file hash to Allow List

Base Command

deepinstinctv3-add-hash-to-allow-list

Input

Argument Name Description Required
policy_id Policy ID. Required
file_hash file hash. Required
comment comment to hash field. Optional

Context Output

There is no context output for this command.

deepinstinctv3-remove-hash-from-deny-list

Remove hash from Deny List

Base Command

deepinstinctv3-remove-hash-from-deny-list

Input

Argument Name Description Required
policy_id Policy ID. Required
file_hash file hash. Required

Context Output

There is no context output for this command.

deepinstinctv3-remove-hash-from-allow-list

Remove hash from Allow List

Base Command

deepinstinctv3-remove-hash-from-allow-list

Input

Argument Name Description Required
policy_id Policy ID. Required
file_hash file hash. Required

Context Output

There is no context output for this command.

deepinstinctv3-add-devices-to-group

Add multiple devices to a group

Base Command

deepinstinctv3-add-devices-to-group

Input

Argument Name Description Required
group_id group ID. Required
device_ids comma seperated list of device ids to address. Required

Context Output

There is no context output for this command.

deepinstinctv3-remove-devices-from-group

Remove list of devices from groups

Base Command

deepinstinctv3-remove-devices-from-group

Input

Argument Name Description Required
group_id Group ID to remove from. Required
device_ids Comma seperated list of device ids to remove. Required

Context Output

There is no context output for this command.

deepinstinctv3-delete-files-remotely

Delete multiple files remotely

Base Command

deepinstinctv3-delete-files-remotely

Input

Argument Name Description Required
event_ids comma separated list of event ids. Required

Context Output

There is no context output for this command.

deepinstinctv3-terminate-processes

Terminate list of processes

Base Command

deepinstinctv3-terminate-processes

Input

Argument Name Description Required
event_ids comma separated list of event ids. Required

Context Output

There is no context output for this command.

deepinstinctv3-close-events

Close list of events

Base Command

deepinstinctv3-close-events

Input

Argument Name Description Required
event_ids comma separated list of event ids. Required

Context Output

There is no context output for this command.

deepinstinctv3-disable-device

Disable device at next check-in

Base Command

deepinstinctv3-disable-device

Input

Argument Name Description Required
device_id single device id. Required

Context Output

There is no context output for this command.

deepinstinctv3-enable-device

Enable device at next check-in

Base Command

deepinstinctv3-enable-device

Input

Argument Name Description Required
device_id single device id. Required

Context Output

There is no context output for this command.

deepinstinctv3-isolate-from-network

Isolate device(s) from Network

Base Command

deepinstinctv3-isolate-from-network

Input

Argument Name Description Required
device_ids comma separated list of device ids. Required

Context Output

There is no context output for this command.

deepinstinctv3-release-from-isolation

Release device(s) from isolation

Base Command

deepinstinctv3-release-from-isolation

Input

Argument Name Description Required
device_ids comma separated list of device ids. Required

Context Output

There is no context output for this command.

deepinstinctv3-remote-file-upload

Upload file associated with given event id at next check-in

Base Command

deepinstinctv3-remote-file-upload

Input

Argument Name Description Required
event_id the event id. Required

Context Output

There is no context output for this command.

deepinstinctv3-upload-logs

Upload device logs from given device at next check-in

Base Command

deepinstinctv3-upload-logs

Input

Argument Name Description Required
device_id single device id. Required

Context Output

There is no context output for this command.

deepinstinctv3-remove-device

Remove agent from device at next check-in

Base Command

deepinstinctv3-remove-device

Input

Argument Name Description Required
device_id single device id. Required

Context Output

There is no context output for this command.

Configuration parameters

  • base_url — Base server URL (required)
  • apikey — API Key (required)
  • first_fetch — First event ID to fetch from
  • max_fetch — Maximum number of indicators per fetch, max is 1000.
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (21)

  • deepinstinctv3-add-devices-to-group

    Add multiple devices to a group.

  • deepinstinctv3-add-hash-to-allow-list

    Add file hash to Allow List.

  • deepinstinctv3-add-hash-to-deny-list

    Add file hash to Deny List.

  • deepinstinctv3-close-events

    Close list of events.

  • deepinstinctv3-delete-files-remotely

    Delete multiple files remotely.

  • deepinstinctv3-disable-device

    Disable device at next check-in.

  • deepinstinctv3-enable-device

    Enable device at next check-in.

  • deepinstinctv3-get-all-groups

    Get all groups.

  • deepinstinctv3-get-all-policies

    Get list of all policies.

  • deepinstinctv3-get-device

    Get device information from its ID.

  • deepinstinctv3-get-events

    Get all events after given event ID.

  • deepinstinctv3-get-suspicious-events

    Get all suspicious events after given event ID.

  • deepinstinctv3-isolate-from-network

    Isolate device(s) from Network.

  • deepinstinctv3-release-from-isolation

    Release device(s) from isolation.

  • deepinstinctv3-remote-file-upload

    Upload file associated with given event id at next check-in.

  • deepinstinctv3-remove-device

    Remove agent from device at next check-in.

  • deepinstinctv3-remove-devices-from-group

    Remove list of devices from groups.

  • deepinstinctv3-remove-hash-from-allow-list

    Remove hash from Allow List.

  • deepinstinctv3-remove-hash-from-deny-list

    Remove hash from Deny List.

  • deepinstinctv3-terminate-processes

    Terminate list of processes.

  • deepinstinctv3-upload-logs

    Upload device logs from given device at next check-in.

Source

DeepInstinct3x.py DeepInstinct3x_test.py DeepInstinct3x.yml DeepInstinct3x_description.md
Download History Raw 
import json

import DeepInstinct3x
import demistomock as demisto

params = {"apikey": "key", "base_url": "https://demisto.poc.deepinstinctweb.com", "after_id": 0}

mock_device = {
    "id": 1,
    "os": "WINDOWS",
    "osv": "Windows",
    "ip_address": "192.168.88.80",
    "mac_address": "00:00:00:00:00:00",
    "hostname": "Mock_2020-04-09 17:49:39.408405_1",
    "domain": "",
    "scanned_files": 0,
    "tag": "",
    "connectivity_status": "OFFLINE",
    "deployment_status": "REGISTERED",
    "last_registration": "2020-04-09T14:49:39.722292Z",
    "last_contact": "2020-04-09T14:49:39.711487Z",
    "distinguished_name": "OU=Organizations & Sites,DC=bancshares,DC=mib",
    "group_name": "Windows Default Group",
    "group_id": 3,
    "policy_name": "Windows Default Policy",
    "policy_id": 3,
    "log_status": "NA",
    "agent_version": "2.3.1.12",
    "brain_version": "115wt",
    "msp_name": "MSP 1",
    "msp_id": 1,
    "tenant_name": "Tenant 1",
    "tenant_id": 1,
}

mock_groups = [
    {
        "name": "Android Default Group",
        "os": "ANDROID",
        "policy_id": 1,
        "id": 1,
        "is_default_group": True,
        "msp_name": "MSP 1",
        "msp_id": 1,
    },
    {
        "name": "iOS Default Group",
        "os": "IOS",
        "policy_id": 2,
        "id": 2,
        "is_default_group": True,
        "msp_name": "MSP 1",
        "msp_id": 1,
    },
]

mock_policies = [
    {"id": 2, "os": "IOS", "name": "iOS Default Policy", "is_default_policy": True, "msp_name": "MSP 1", "msp_id": 1},
    {"id": 3, "os": "WINDOWS", "name": "Windows Default Policy", "is_default_policy": True, "msp_name": "MSP 1", "msp_id": 1},
]


mock_events = {
    "last_id": 2,
    "events": [
        {
            "file_type": "ZIP",
            "file_hash": "d1838b541ff7ffe6489d120d89dfa855665fd2c708491f336c7267069387053f",
            "file_archive_hash": "d1838b541ff7ffe6489d120d89dfa855665fd2c708491f336c7267069387053f",
            "path": "c:\\temp\\file.exe",
            "file_size": 18127052,
            "threat_severity": "NONE",
            "certificate_thumbprint": None,
            "certificate_vendor_name": None,
            "deep_classification": None,
            "file_status": "NOT_UPLOADED",
            "sandbox_status": "NOT_READY_TO_GENERATE",
            "model": "FileEvent",
            "id": 1,
            "device_id": 1,
            "type": "STATIC_ANALYSIS",
            "trigger": "BRAIN",
            "action": "PREVENTED",
            "timestamp": "2020-04-09T14:49:41.154850Z",
            "insertion_timestamp": "2020-04-09T14:49:41.170331Z",
            "close_timestamp": "2020-04-12T14:11:39.145856Z",
            "close_trigger": "CLOSED_BY_ADMIN",
            "reoccurrence_count": 0,
            "last_reoccurrence": None,
            "last_action": None,
            "status": "CLOSED",
            "comment": None,
            "recorded_device_info": {
                "os": "WINDOWS",
                "mac_address": "00:00:00:00:00:00",
                "hostname": "Mock_2020-04-09 17:49:39.408405_1",
                "tag": "",
                "group_name": "Windows Default Group",
                "policy_name": "Windows Default Policy",
                "tenant_name": "Tenant 1",
            },
            "msp_name": "MSP 1",
            "msp_id": 1,
            "tenant_name": "Tenant 1",
            "tenant_id": 1,
        },
        {
            "file_type": "ZIP",
            "file_hash": "edf34902ff17838b4bc709ff15b5265dd49f652ee75a1adf69df9ae5bc52f960",
            "file_archive_hash": "edf34902ff17838b4bc709ff15b5265dd49f652ee75a1adf69df9ae5bc52f960",
            "path": "c:\\temp\\file2.exe",
            "file_size": 15090736,
            "threat_severity": "NONE",
            "certificate_thumbprint": None,
            "certificate_vendor_name": None,
            "deep_classification": None,
            "file_status": "NOT_UPLOADED",
            "sandbox_status": "NOT_READY_TO_GENERATE",
            "model": "FileEvent",
            "id": 2,
            "device_id": 2,
            "type": "STATIC_ANALYSIS",
            "trigger": "BRAIN",
            "action": "PREVENTED",
            "timestamp": "2020-04-09T14:49:41.805228Z",
            "insertion_timestamp": "2020-04-09T14:49:41.810047Z",
            "close_timestamp": None,
            "close_trigger": None,
            "reoccurrence_count": 0,
            "last_reoccurrence": None,
            "last_action": None,
            "status": "OPEN",
            "comment": None,
            "recorded_device_info": {
                "os": "WINDOWS",
                "mac_address": "00:00:00:00:00:00",
                "hostname": "Mock_2020-04-09 17:49:41.170765_1",
                "tag": "",
                "group_name": "Windows Default Group",
                "policy_name": "Windows Default Policy",
                "tenant_name": "Tenant 1",
            },
            "msp_name": "MSP 1",
            "msp_id": 1,
            "tenant_name": "Tenant 1",
            "tenant_id": 1,
        },
    ],
}


def test_get_device_command(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"device_id": mock_device["id"]})
    requests_mock.get(f"{params['base_url']}/api/v1/devices/{mock_device['id']}", json=mock_device)
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.get_specific_device()
    result = demisto.results.call_args[0][0]
    assert result["Contents"] == mock_device


def test_get_all_groups(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    requests_mock.get(f"{params['base_url']}/api/v1/groups", json=mock_groups)
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.get_all_groups()
    result = demisto.results.call_args[0][0]
    assert result["Contents"] == mock_groups


def test_get_all_policies(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    requests_mock.get(f"{params['base_url']}/api/v1/policies", json=mock_policies)
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.get_all_policies()
    result = demisto.results.call_args[0][0]
    assert result["Contents"] == mock_policies


def test_get_events(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"first_event_id": 0})
    requests_mock.get(f"{params['base_url']}/api/v1/events?after_event_id=0", json=mock_events)
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.get_events()
    result = demisto.results.call_args[0][0]
    assert result["Contents"] == mock_events["events"]


def test_fetch_incidents(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"first_fetch": 0})
    mocker.patch.object(demisto, "getLastRun", return_value={"last_id": 0})
    requests_mock.get(f"{params['base_url']}/api/v1/events?after_event_id=0", json=mock_events)
    requests_mock.get(f"{params['base_url']}/api/v1/events?after_event_id=2", json={})
    mocker.patch.object(demisto, "incidents")
    DeepInstinct3x.fetch_incidents()
    incidents = demisto.incidents.call_args[0][0]
    assert len(incidents) == len(mock_events["events"])
    assert incidents[0]["rawJSON"] == json.dumps(mock_events["events"][0])
    assert incidents[1]["rawJSON"] == json.dumps(mock_events["events"][1])


def test_get_suspicious_events_command(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"first_event_id": 0})
    requests_mock.get(f"{params['base_url']}/api/v1/suspicious-events?after_event_id=0", json=mock_events)
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.get_suspicious_events()
    result = demisto.results.call_args[0][0]
    assert result["Contents"] == mock_events["events"]


def test_add_hash_to_denylist(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"policy_id": 0, "file_hash": "dummyhash", "comment": ""})
    requests_mock.post(f"{params['base_url']}/api/v1/policies/0/deny-list/hashes/dummyhash")
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.add_hash_to_denylist()
    result = demisto.results.call_args[0][0]
    assert result == "ok"


def test_add_hash_to_allowlist(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"policy_id": 0, "file_hash": "dummyhash", "comment": ""})
    requests_mock.post(f"{params['base_url']}/api/v1/policies/0/allow-list/hashes/dummyhash")
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.add_hash_to_allowlist()
    result = demisto.results.call_args[0][0]
    assert result == "ok"


def test_remove_hash_from_denylist(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"policy_id": 0, "file_hash": "dummyhash"})
    requests_mock.delete(f"{params['base_url']}/api/v1/policies/0/deny-list/hashes")
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.remove_hash_from_denylist()
    result = demisto.results.call_args[0][0]
    assert result == "ok"


def test_remove_hash_from_allowlist(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"policy_id": 0, "file_hash": "dummyhash"})
    requests_mock.delete(f"{params['base_url']}/api/v1/policies/0/allow-list/hashes")
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.remove_hash_from_allowlist()
    result = demisto.results.call_args[0][0]
    assert result == "ok"


def test_add_devices_to_group(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"group_id": 0, "device_ids": "0,1"})
    requests_mock.post(f"{params['base_url']}/api/v1/groups/0/add-devices")
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.add_devices_to_group()
    result = demisto.results.call_args[0][0]
    assert result == "ok"


def test_isolate_from_network(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"device_ids": "0,1"})
    requests_mock.post(f"{params['base_url']}/api/v1/devices/actions/isolate-from-network")
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.isolate_from_network()
    result = demisto.results.call_args[0][0]
    assert result == "ok"


def test_release_from_isolation(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"device_ids": "0,1"})
    requests_mock.post(f"{params['base_url']}/api/v1/devices/actions/release-from-isolation")
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.release_from_isolation()
    result = demisto.results.call_args[0][0]
    assert result == "ok"


def test_terminate_remote_processes(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"event_ids": "0,1"})
    requests_mock.post(f"{params['base_url']}/api/v1/devices/actions/terminate-remote-process")
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.terminate_remote_processes()
    result = demisto.results.call_args[0][0]
    assert result == "ok"


def test_close_events(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"event_ids": "0,1"})
    requests_mock.post(f"{params['base_url']}/api/v1/events/actions/close")
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.close_events()
    result = demisto.results.call_args[0][0]
    assert result == "ok"


def test_upload_logs(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"device_id": 0})
    requests_mock.post(f"{params['base_url']}/api/v1/devices/0/actions/upload-logs")
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.upload_logs()
    result = demisto.results.call_args[0][0]
    assert result == "ok"


def test_enable_device(requests_mock, mocker):
    mocker.patch.object(demisto, "params", return_value=params)
    mocker.patch.object(demisto, "args", return_value={"device_id": 0})
    requests_mock.post(f"{params['base_url']}/api/v1/devices/0/actions/enable")
    mocker.patch.object(demisto, "results")
    DeepInstinct3x.enable_device()
    result = demisto.results.call_args[0][0]
    assert result == "ok"