PanoraysFindingsAPI

Retrieve and monitor internal security findings for your organization from the Panorays platform to streamline self-assessment posture and automate internal incident response within Cortex XSOAR.

Vulnerability Management · Panorays

Details

ID	`PanoraysFindingsAPI`
Provider	Panorays
Category	Vulnerability Management
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

Retrieve and monitor internal security findings for your organization from the Panorays platform to streamline self-assessment posture and automate internal incident response within Cortex XSOAR.
This integration was integrated and tested with version v2 of PanoraysFindingsAPI.

Configure Panorays Findings API in Cortex

Parameter	Required
Panorays PAPI base URL	True
apikey	True
API Key	True
Trust any certificate (not secure)	False
Use system proxy settings	False
Maximum number of incidents to fetch per run	False
First fetch timestamp (e.g., 7 days)	False
Incident type	False
Fetch incidents	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

panorays-finding-list

Lists the company findings as detected by Panorays.

Base Command

panorays-finding-list

Input

Argument Name	Description	Required
limit	The maximum number of findings to return. Default is 50.	Optional
page	The page number of results to retrieve. Default is 1.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Panorays PAPI base URL (required)
apikey — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
max_fetch — Maximum number of incidents to fetch per run
first_fetch — First fetch timestamp (e.g., 7 days)
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
isFetch — Fetch incidents

Commands (1)

panorays-finding-list
Lists the company findings as detected by Panorays.

Source

PanoraysFindingsAPI.py PanoraysFindingsAPI_test.py PanoraysFindingsAPI.yml PanoraysFindingsAPI_description.md

Download History Raw

import json
import os
import pytest
import PanoraysFindingsAPI
from PanoraysFindingsAPI import Client, finding_list_command, verify_module, fetch_incidents_command


def load_test_data(filename: str) -> dict:
    """Load mock data from test_data directory."""
    with open(os.path.join(os.path.dirname(__file__), "test_data", filename)) as f:
        return json.load(f)


def get_client():
    return Client(base_url="https://test.com", verify=False, proxy=False, headers={})


def test_verify_module_success(mocker):
    client = get_client()
    mocker.patch.object(client, "_http_request", return_value={})
    assert verify_module(client) == "ok"


def test_verify_module_unauthorized(mocker):
    client = get_client()
    mocker.patch.object(client, "_http_request", side_effect=Exception("Unauthorized"))
    with pytest.raises(Exception, match="Authorization Error"):
        verify_module(client)


def test_finding_list_command_success(mocker):
    mock_response = load_test_data("findings.json")
    client = get_client()
    mocker.patch.object(client, "get_company_findings", return_value=mock_response)
    results = finding_list_command(client, {"limit": "1"})
    assert results.outputs[0]["id"] == "123"


def test_fetch_incidents_first_run(mocker):
    mock_response = load_test_data("findings.json")
    client = get_client()
    mocker.patch.object(client, "get_company_findings", return_value=mock_response)
    next_run, incidents = fetch_incidents_command(client=client, last_run={}, first_fetch_time="3 days", max_fetch=10)
    assert len(incidents) == 1


def test_fetch_incidents_no_new_data(mocker):
    mock_response = load_test_data("findings.json")
    client = get_client()
    mocker.patch.object(client, "get_company_findings", return_value=mock_response)
    # last_fetch is after the finding's insert_ts so nothing should be returned
    last_run = {"last_fetch": "2099-06-01T00:00:00Z"}
    next_run, incidents = fetch_incidents_command(client=client, last_run=last_run, first_fetch_time="3 days", max_fetch=10)
    assert len(incidents) == 0


def test_main_test_module_branch(mocker):
    """Tests the 'test-module' branch inside main() to boost coverage."""
    mocker.patch.object(
        PanoraysFindingsAPI.demisto,
        "params",
        return_value={"apikey": "123", "url": "https://test.com", "insecure": False, "proxy": False},
    )
    mocker.patch.object(PanoraysFindingsAPI.demisto, "command", return_value="test-module")
    mocker.patch.object(PanoraysFindingsAPI, "verify_module", return_value="ok")
    mock_results = mocker.patch.object(PanoraysFindingsAPI, "return_results")

    PanoraysFindingsAPI.main()
    assert mock_results.called


def test_main_failure(mocker):
    """Tests the global error handler in main()."""
    mocker.patch.object(PanoraysFindingsAPI.demisto, "params", side_effect=Exception("Global Error"))
    mock_error = mocker.patch.object(PanoraysFindingsAPI, "return_error")

    PanoraysFindingsAPI.main()
    assert mock_error.called