LogPoint SIEM Integration

import json


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_get_demisto_severity():
    from LogPoint_SIEM_Integration import get_demisto_severity

    assert get_demisto_severity("low") == 1
    assert get_demisto_severity("anything-else") == 0


def test_get_incidents_command(requests_mock):
    """Tests lp-get-incidents command function.

    Configures requests_mock instance to generate the appropriate
    /incidents API response, loaded from a json file. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, get_incidents_command

    mock_response = util_load_json("test_data/sample_incident_response.json")
    requests_mock.get("https://test.com/incidents", json=mock_response)

    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/json"},
    )
    args = {"ts_from": 1607314566, "ts_to": 1607228166, "limit": 50}

    response = get_incidents_command(client, args)

    assert response.outputs_prefix == "LogPoint.Incidents"
    assert response.outputs_key_field == "id"
    assert response.outputs == mock_response["incidents"]


def test_get_incident_data_command(requests_mock):
    """Tests lp-get-incident-data command function.

    Configures requests_mock instance to generate the appropriate
    /get_data_from_incident API response, loaded from a json file. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, get_incident_data_command

    mock_response = util_load_json("test_data/sample_incident_data_response.json")
    requests_mock.get("https://test.com/get_data_from_incident", json=mock_response)

    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/json"},
    )
    args = {
        "incident_obj_id": "5af12974007da85b99a3230b",
        "incident_id": "347b897e1f752cab7ae380918690b11e",
        "date": 1525754228.171028,
    }

    response = get_incident_data_command(client, args)

    assert response.outputs_prefix == "LogPoint.Incidents.data"
    assert response.outputs_key_field == ""
    assert response.outputs == mock_response["rows"]


def test_get_incident_states_command(requests_mock):
    """Tests lp-get-incident-states command function.

    Configures requests_mock instance to generate the appropriate
    /incident_states API response, loaded from a json file. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, get_incident_states_command

    # mock_response = SAMPLE_INCIDENT_STATES_RESPONSE
    mock_response = util_load_json("test_data/sample_incident_states_response.json")
    requests_mock.get("https://test.com/incident_states", json=mock_response)

    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/json"},
    )
    args = {"ts_from": 1607314566, "ts_to": 1607228166, "limit": 50}

    response = get_incident_states_command(client, args)

    assert response.outputs_prefix == "LogPoint.Incidents.states"
    assert response.outputs_key_field == "id"
    assert response.outputs == mock_response["states"]


def test_add_incident_comment_command(requests_mock):
    """Tests lp-add-incident-comment command function.

    Configures requests_mock instance to generate the appropriate
    /add_incident_comment API response. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, add_incident_comment_command

    sample_add_incident_comment_response = {"success": True, "message": "Comments added"}
    mock_response = sample_add_incident_comment_response
    requests_mock.post("https://test.com/add_incident_comment", json=mock_response)

    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/json"},
    )
    args = {"incident_obj_id": "1262bd8cce113de890854455", "comment": "Hello world"}

    response = add_incident_comment_command(client, args)

    assert response.outputs_prefix == "LogPoint.Incidents.comment"
    assert response.outputs_key_field == ""
    assert response.outputs == mock_response["message"]


def test_assign_incidents_command(requests_mock):
    """Tests lp-assign-incidents command function.

    Configures requests_mock instance to generate the appropriate
    /assign_incident API response. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, assign_incidents_command

    sample_assign_incidents_response = {"success": True, "message": "Incidents re-assigned"}
    mock_response = sample_assign_incidents_response
    requests_mock.post("https://test.com/assign_incident", json=mock_response)

    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/json"},
    )
    args = {"incident_obj_ids": "1262bd8cce113de890854455,1262bd8cce113de890854456", "new_assignee": "12b0eacfd8cce4334eef1700"}

    response = assign_incidents_command(client, args)

    assert response.outputs_prefix == "LogPoint.Incidents.assign"
    assert response.outputs_key_field == ""
    assert response.outputs == mock_response["message"]


def test_resolve_incidents_command(requests_mock):
    """Tests lp-resolve-incidents command function.

    Configures requests_mock instance to generate the appropriate
    /resolve_incident API response. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, resolve_incidents_command

    sample_resolve_incidents_response = {"success": True, "message": "Incidents resolved"}
    mock_response = sample_resolve_incidents_response
    requests_mock.post("https://test.com/resolve_incident", json=mock_response)

    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/json"},
    )
    args = {"version": "0.1", "incident_obj_ids": "1262bd8cce113de890854455,1262bd8cce113de890854456"}

    response = resolve_incidents_command(client, args)

    assert response.outputs_prefix == "LogPoint.Incidents.resolve"
    assert response.outputs_key_field == ""
    assert response.outputs == mock_response["message"]


def test_close_incidents_command(requests_mock):
    """Tests lp-close-incidents command function.

    Configures requests_mock instance to generate the appropriate
    /close_incident API response. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, close_incidents_command

    sample_close_incidents_response = {"success": True, "message": "Incidents closed"}
    mock_response = sample_close_incidents_response
    requests_mock.post("https://test.com/close_incident", json=mock_response)

    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/json"},
    )
    args = {"version": "0.1", "incident_obj_ids": "1262bd8cce113de890854455,1262bd8cce113de890854456"}

    response = close_incidents_command(client, args)

    assert response.outputs_prefix == "LogPoint.Incidents.close"
    assert response.outputs_key_field == ""
    assert response.outputs == mock_response["message"]


def test_reopen_incidents_command(requests_mock):
    """Tests lp-reopen-incidents command function.

    Configures requests_mock instance to generate the appropriate
    /reopen_incident API response. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, reopen_incidents_command

    sample_reopen_incidents_response = {"success": True, "message": "Incidents reopened"}
    mock_response = sample_reopen_incidents_response
    requests_mock.post("https://test.com/reopen_incident", json=mock_response)

    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/json"},
    )
    args = {"version": "0.1", "incident_obj_ids": "1262bd8cce113de890854455,1262bd8cce113de890854456"}

    response = reopen_incidents_command(client, args)

    assert response.outputs_prefix == "LogPoint.Incidents.reopen"
    assert response.outputs_key_field == ""
    assert response.outputs == mock_response["message"]


def test_get_users_command(requests_mock):
    """Tests lp-get-users command function.

    Configures requests_mock instance to generate the appropriate
    /get_users API response, loaded from a json file. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, get_users_command

    mock_response = util_load_json("test_data/sample_get_users_response.json")
    requests_mock.get("https://test.com/get_users", json=mock_response)

    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/json"},
    )

    response = get_users_command(client)

    assert response.outputs_prefix == "LogPoint.Incidents.users"
    assert response.outputs_key_field == "id"
    assert response.outputs == mock_response["users"]


def test_get_users_preference_command(requests_mock):
    """Tests lp-get-users-preference command function.

    Configures requests_mock instance to generate the appropriate
    /getalloweddata API response, loaded from a json file. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, get_users_preference_command

    mock_response = util_load_json("test_data/sample_get_users_preference_response.json")
    requests_mock.post("https://test.com/getalloweddata", json=mock_response)
    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
    response = get_users_preference_command(client)
    assert response.outputs_prefix == "LogPoint.User.Preference"
    del mock_response["success"]
    assert response.outputs == mock_response


def test_get_logpoints_command(requests_mock):
    """Tests lp-get-logpoints command function.

    Configures requests_mock instance to generate the appropriate
    /getalloweddata API response, loaded from a json file. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, get_logpoints_command

    mock_response = util_load_json("test_data/sample_get_logpoints_response.json")
    requests_mock.post("https://test.com/getalloweddata", json=mock_response)
    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
    response = get_logpoints_command(client)
    assert response.outputs_prefix == "LogPoint.LogPoints"
    assert response.outputs == mock_response["allowed_loginspects"]
    assert response.outputs_key_field == "ip"


def test_get_repos_command(requests_mock):
    """Tests lp-get-repos command function.

    Configures requests_mock instance to generate the appropriate
    /getalloweddata API response, loaded from a json file. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, get_repos_command

    mock_response = util_load_json("test_data/sample_get_repos_response.json")
    requests_mock.post("https://test.com/getalloweddata", json=mock_response)
    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
    response = get_repos_command(client)
    assert response.outputs_prefix == "LogPoint.Repos"
    assert response.outputs == mock_response["allowed_repos"]
    assert response.outputs_key_field == "repo"


def test_get_devices_command(requests_mock):
    """Tests lp-get-repos command function.

    Configures requests_mock instance to generate the appropriate
    /getalloweddata API response, loaded from a json file. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, get_devices_command

    mock_response = util_load_json("test_data/sample_get_devices_response.json")
    allowed_devices = mock_response["allowed_devices"]
    device_list = []
    for device in allowed_devices:
        for key, value in device.items():
            device_list.append(
                {
                    "name": value,
                    "address": key,
                }
            )
    requests_mock.post("https://test.com/getalloweddata", json=mock_response)
    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
    response = get_devices_command(client)
    assert response.outputs_prefix == "LogPoint.Devices"
    assert response.outputs == device_list


def test_get_livesearches_command(requests_mock):
    """Tests lp-get-repos command function.

    Configures requests_mock instance to generate the appropriate
    /getalloweddata API response, loaded from a json file. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, get_livesearches_command

    mock_response = util_load_json("test_data/sample_get_livesearches_response.json")
    requests_mock.post("https://test.com/getalloweddata", json=mock_response)
    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
    response = get_livesearches_command(client)
    assert response.outputs_prefix == "LogPoint.LiveSearches"
    assert response.outputs == mock_response["livesearches"]


def test_get_searchid_command(requests_mock):
    """Tests lp-get-repos command function.

    Configures requests_mock instance to generate the appropriate
    /getalloweddata API response, loaded from a json file. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, get_searchid_command

    mock_response = util_load_json("test_data/sample_get_searchid_response.json")
    requests_mock.post("https://test.com/getsearchlogs", json=mock_response)
    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
    args = {"query": "| chart count() by col_type", "time_range": "Last 30 minutes", "limit": 10, "repos": []}
    response = get_searchid_command(client, args)
    assert response.outputs_prefix == "LogPoint.search_id"
    assert response.outputs == mock_response["search_id"]


def test_search_logs_command(requests_mock):
    """Tests lp-get-repos command function.

    Configures requests_mock instance to generate the appropriate
    /getalloweddata API response, loaded from a json file. Checks
    the output of the command function with the expected output.
    """
    from LogPoint_SIEM_Integration import Client, search_logs_command

    mock_response = util_load_json("test_data/sample_search_logs_response.json")
    requests_mock.post("https://test.com/getsearchlogs", json=mock_response)
    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
    args = {"search_id": mock_response.get("search_id")}
    response = search_logs_command(client, args)
    assert response.outputs_prefix == "LogPoint.SearchLogs"
    assert response.outputs == mock_response["rows"]


def test_fetch_incidents(requests_mock):
    """Tests fetch-incidents command function."""
    from LogPoint_SIEM_Integration import Client, fetch_incidents

    mock_response = util_load_json("test_data/sample_incident_response.json")
    requests_mock.get("https://test.com/incidents", json=mock_response)

    client = Client(
        base_url="https://test.com",
        verify=False,
        proxy=False,
        username="username",
        apikey="apikey",
        headers={"Content-Type": "application/json"},
    )
    first_fetch = "1608189921"
    max_fetch = 10
    response = fetch_incidents(client, first_fetch, max_fetch)
    assert response == [
        {
            "name": "Potential SQL Injection attack",
            "occurred": "2018-05-08T04:37:08.171028Z",
            "severity": 4,
            "rawJSON": json.dumps(mock_response["incidents"][0]),
        }
    ]