LookoutMobileEndpointSecurity

Lookout Mobile Endpoint Security (MES) provides visibility and protection against mobile threats with AI-driven mobile security dataset.

Analytics & SIEM · Lookout Mobile Endpoint Security (MES)

Details

ID	`LookoutMobileEndpointSecurity`
Provider	Lookout Inc.
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/sse-client:1.0.0.10133006`
Supported Modules	Agentix XSIAM

README

Lookout Mobile Endpoint Security (MES) provides visibility and protection against mobile threats with AI-driven mobile security dataset.
This integration was integrated and tested with version v2 of LookoutMobileEndpointSecurity.

Configure Lookout Mobile Endpoint Security Event Collector in Cortex

Parameter	Required
Server URL	False
Application Key	False
Trust any certificate (not secure)	False
Use system proxy settings	False
Fetch interval in seconds	True
Event types to fetch	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Configuration parameters

server_url — Server URL
app_key —
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
fetch_interval — Fetch interval in seconds (required)
longRunning — Long Running Instance
event_types — Event types to fetch (required)

Commands (0)

This integration defines no commands.

Source

LookoutMobileEndpointSecurity.py LookoutMobileEndpointSecurity_test.py LookoutMobileEndpointSecurity.yml LookoutMobileEndpointSecurity_description.md command_examples.txt

Download History Raw

import pytest
import demistomock as demisto
from LookoutMobileEndpointSecurity import create_response_object, stream_events

EVENTS_OUTPUT = '{"events":[{"id":"1","created_time":"2025-03-24T11:13:24.915+00:00","type":"DEVICE","change_type":"UPDATED","device":{"guid":"guid","platform":"IOS","status":{"security_status":"SECURE","activation_status":"ACTIVATED","protection_status":"PROTECTED"},"hardware":{"manufacturer":"apple","model":"iphone17,2"},"software":{"os_version":"18.3.1","sdk_version":"0"},"client":{"ota_version":"1","package_name":"name","package_version":"9.2.0"},"parent_status":{}},"target":{"guid":"guid","type":"DEVICE"},"actor":{"guid":"guid","type":"DEVICE"}},{"id":"2","created_time":"2025-03-24T11:13:28.375+00:00","type":"THREAT","change_type":"CREATED","threat":{"guid":"guid","status":"RESOLVED","severity":"LOW","type":"WEB_CONTENT","classifications":["UNAUTHORIZED_CONTENT"],"details":{"reason":"OBJECTIONABLE_CONTENT","response":"NONE","reputation":0.6}},"target":{"guid":"guid","type":"THREAT"},"actor":{"guid":"guid","type":"DEVICE"}}]}'  # noqa: E501


class Event:
    """Representation of an event from the event stream."""

    def __init__(self, id=None, event="message", data="", retry=None):
        self.id = id
        self.event = event
        self.data = data
        self.retry = retry


@pytest.fixture(autouse=True)
def client(mocker):
    from LookoutMobileEndpointSecurity import Client

    event_type_query = "THREAT"
    app_key = "app_key"
    server_url = "https://www.test.com/"
    mocker.patch.object(Client, "_http_request", json={"access_token": "access_token", "expires_at": 0})
    return Client(
        base_url=server_url,
        verify=False,
        proxy=False,
        event_type_query=event_type_query,
        app_key=app_key,
    )


@pytest.fixture(autouse=True)
def sse_client(mocker):
    from LookoutMobileEndpointSecurity import SSEClient

    event = Event("2", "event", EVENTS_OUTPUT)
    mocker.patch.object(SSEClient, "events", return_value=[event])
    return SSEClient(R"https://www.test.com/")


def test_create_response_object(client, mocker, requests_mock):
    """
    Given: A mock client, and a mock response.
    When: Running create_response_object.
    Then: The response was build correctly.
    """
    mocker.patch.object(demisto, "getIntegrationContext", return_value={"token_expiration": 0})
    requests_mock.get("https://www.test.com/mra/stream/v2/events?type=THREAT&id=", status_code="200", json={})
    response = create_response_object(client=client)
    assert response.status_code == "200"


def test_stream_events(sse_client, mocker, requests_mock):
    """
    Given: A mock sse client, and a mock events response.
    When: Running stream_events.
    Then: The setIntegrationContext was called with the correct last_event_id.
    """
    mocker.patch.object(demisto, "getIntegrationContext", return_value={"token_expiration": 0})
    context = mocker.patch.object(demisto, "setIntegrationContext", return_value={"token_expiration": 0})
    mocker.patch("LookoutMobileEndpointSecurity.send_events_to_xsiam", return_value=None)
    stream_events(sse_client, 0)

    assert context.call_args[0][0] == {"token_expiration": 0, "last_event_id": "2"}