Smokescreen IllusionBLACK

Smokescreen IllusionBLACK is a deception-based threat defense platform designed to accurately and efficiently detect targeted threats including reconnaissance, lateral movement, malware-less attacks, social engineering, Man-in-the-Middle attacks, and ransomware in real-time.

Deception & Breach Simulation · Smokescreen IllusionBLACK

Details

IDSmokescreen IllusionBLACK
ProviderZscaler
CategoryDeception & Breach Simulation
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.12042988
Supported ModulesAgentix XSIAM

README

Smokescreen IllusionBLACK is a deception-based threat defense platform designed to accurately and efficiently detect targeted threats including reconnaissance, lateral movement, malware-less attacks, social engineering, Man-in-the-Middle attacks, and ransomware in real-time.
This integration was integrated and tested with version v3.10.7.4 of Smokescreen IllusionBLACK

Permissions

Configure Smokescreen IllusionBLACK in Cortex

Parameter Description Required
url Server URL (e.g. https://example.net) True
client_id IllusionBLACK API Client Id True
token IllusionBLACK External API Token True
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False
first_fetch First fetch time for fetching incidents (2 days, 3 weeks, etc) False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

illusionblack-get-ad-decoys

Gets a list of Active Directory decoys.

Base Command

illusionblack-get-ad-decoys

Input

There are no input arguments for this command.

Context Output
Path Type Description
IllusionBlack.AdDecoy Unknown IllusionBLACK AD Decoy users.
Command Example

##### Context Example

{
“IllusionBlack”: {
“AdDecoy”: {
“first_name”: “felix”,
“last_name”: “hunt”,
“ou”: “mumbai”,
“state”: “added”,
“user_name”: “sqladmin”
}
}
}


##### Human Readable Output

### IllusionBLACK AD Decoys

|First Name|Last Name|Ou|State|User Name|
|---|---|---|---|---|
| felix | hunt | mumbai | added | sqladmin |

### illusionblack-get-network-decoys

***
Gets a list of Network decoys.

##### Base Command

`illusionblack-get-network-decoys`

##### Input

There are no input arguments for this command.

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| IllusionBlack.NetworkDecoy | Unknown | IllusionBLACK Network decoys. |

##### Command Example

```!illusionblack-get-network-decoys```

##### Context Example

{
“IllusionBlack”: {
“NetworkDecoy”: [
{
“ip”: “10.20.23.61”,
“mac”: “d0:43:1e:cd:cb:c2”,
“name”: “CTX-BACKUPS31”,
“services”: “web”
},
{
“ip”: “10.20.23.64”,
“mac”: “a0:48:1c:ee:08:38”,
“name”: “GCP-CYBERARK”,
“services”: “web”
},
{
“ip”: “10.20.23.63”,
“mac”: “00:fd:45:fa:6f:4d”,
“name”: “NEW-XEN”,
“services”: “web”
},
{
“ip”: “10.20.23.65”,
“mac”: “14:b3:1f:08:84:6d”,
“name”: “PRIM-CYBERARK”,
“services”: “web, shares”
},
{
“ip”: “10.20.23.62”,
“mac”: “20:a6:cd:00:6e:70”,
“name”: “SAP44”,
“services”: “web, shares”
},
{
“ip”: “10.20.23.60”,
“mac”: “90:b1:1c:73:64:fc”,
“name”: “ARCOSNEW”,
“services”: “web”
}
]
}
}


##### Human Readable Output

### IllusionBLACK Network Decoys

|Ip|Mac|Name|Services|
|---|---|---|---|
| 10.20.23.61 | d0:43:1e:cd:cb:c2 | CTX-BACKUPS31 | web |
| 10.20.23.64 | a0:48:1c:ee:08:38 | GCP-CYBERARK | web |
| 10.20.23.63 | 00:fd:45:fa:6f:4d | NEW-XEN | web |
| 10.20.23.65 | 14:b3:1f:08:84:6d | PRIM-CYBERARK | web, shares |
| 10.20.23.62 | 20:a6:cd:00:6e:70 | SAP44 | web, shares |
| 10.20.23.60 | 90:b1:1c:73:64:fc | ARCOSNEW | web |

### illusionblack-get-ti-decoys

***
Gets a list of Threat Intel decoys.

##### Base Command

`illusionblack-get-ti-decoys`

##### Input

There are no input arguments for this command.

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| IllusionBlack.TIDecoy | Unknown | IllusionBLACK TI Decoys. |

##### Command Example

```!illusionblack-get-ti-decoys```

##### Context Example

{
“IllusionBlack”: {
“TIDecoy”: {
“dataset”: “Finacle”,
“ip”: “10.20.23.67”,
“name”: “dev.smokescreen.io”,
“server_type”: “nginx/1.14.0 (Ubuntu)”
}
}
}


##### Human Readable Output

### IllusionBLACK TI Decoys

|Dataset|Ip|Name|Server Type|
|---|---|---|---|
| Finacle | 10.20.23.67 | dev.smokescreen.io | nginx/1.14.0 (Ubuntu) |

### illusionblack-is-host-decoy

***
Checks if a host or IP address is a network decoy.

##### Base Command

`illusionblack-is-host-decoy`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| host | Hostname or IP address to check. | Required |

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| IllusionBlack.IsHostDecoy.Host | String | The IP address or hostname submitted to IllusionBLACK to check. |
| IllusionBlack.IsHostDecoy.Value | Boolean | The boolean value whether the host is a decoy or not. |

##### Command Example

```!illusionblack-is-host-decoy host="SAP44"```

##### Context Example

{
“IllusionBlack”: {
“IsHostDecoy”: {
“Host”: “SAP44”,
“Value”: true
}
}
}


##### Human Readable Output

True

### illusionblack-is-user-decoy

***
Checks if an Active Directory user is a decoy.

##### Base Command

`illusionblack-is-user-decoy`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| user | Active Directory user name to check. | Required |

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| IllusionBlack.IsUserDecoy.User | String | The AD username submitted to IllusionBLACK to check. |
| IllusionBlack.IsUserDecoy.Value | Boolean | The boolean value whether the user is a decoy or not. |

##### Command Example

```!illusionblack-is-user-decoy user="sqladmin"```

##### Context Example

{
“IllusionBlack”: {
“IsUserDecoy”: {
“User”: “sqladmin”,
“Value”: true
}
}
}


##### Human Readable Output

True

### illusionblack-is-subdomain-decoy

***
Checks if a subdomain is a Threat Intel decoy.

##### Base Command

`illusionblack-is-subdomain-decoy`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| subdomain | Subdomain to check. For example: dec.smokescreen.io. | Required |

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| IllusionBlack.IsSubdomainDecoy.Subdomain | String | The subdomain submitted to IllusionBLACK to check. |
| IllusionBlack.IsSubdomainDecoy.Value | Boolean | The boolean value whether the subdomain is a decoy or not. |

##### Command Example

```!illusionblack-is-subdomain-decoy subdomain="experience.illusionblack.com"```

##### Context Example

{
“IllusionBlack”: {
“IsSubdomainDecoy”: {
“Subdomain”: “experience.illusionblack.com”,
“Value”: false
}
}
}


##### Human Readable Output

False

### illusionblack-get-events

***
Gets events from IllusionBLACK.

##### Base Command

`illusionblack-get-events`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| limit | Number of events. It can be between 1 and 1000. | Optional |
| query | IllusionBLACK query. For example: "attacker.ip is \"1.2.3.4\"" | Optional |
| from | ISO 8601 formatted date string. | Optional |
| to | ISO 8601 formatted date string. | Optional |

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| IllusionBlack.Event | Unknown | IllusionBLACK Events. |

##### Command Example

```!illusionblack-get-events limit=3```

##### Context Example

{
“IllusionBlack”: {
“Event”: [
{
“attacker.id”: “ADMIN-PC-001\admin”,
“attacker.name”: “ADMIN-PC-001\admin”,
“attacker.score”: 175,
“attacker.threat_parse_ids”: [
“lm_file_open”,
“lm_file_active_monitoring”
],
“decoy.appliance.id”: “cmc”,
“decoy.appliance.name”: “CMC”,
“decoy.client.id”: “experience”,
“decoy.client.name”: “experience”,
“decoy.group”: “Endpoint”,
“decoy.id”: “endpoint:admin-pc-001”,
“decoy.name”: “admin-pc-001”,
“decoy.type”: “endpoint”,
“file.name”: “C:\Users\admin\Desktop\passwords\Passwords.xlsx”,
“file.operation”: “67”,
“file.operation_string”: “Read”,
“file.process.command_line”: “"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass”,
“file.process.domain_name”: “ADMIN-PC-001”,
“file.process.exit_code”: -1,
“file.process.id”: “10228”,
“file.process.image_name”: “powershell.exe”,
“file.process.user_name”: “admin”,
“file.process.user_sid”: “S-1-5-21-399445878-2258755057-882339928-1000”,
“file.thread_id”: “8588”,
“id”: “2020-02-25T09:49:15Z-76c99a22-03b9-439e-8638-37306c2d8e7f”,
“kill_chain_phase”: “Data Theft”,
“mitre_ids”: [
“T1005”
],
“record_type”: “event”,
“severity”: “high”,
“sub_type”: “file”,
“threat_parse_ids”: [
“lm_file_open”
],
“timestamp”: “2020-04-12T08:57:01Z”,
“type”: “endpoint”,
“whitelisted”: false
},
{
“attacker.id”: “NT AUTHORITY\SYSTEM”,
“attacker.name”: “NT AUTHORITY\SYSTEM”,
“attacker.score”: 250,
“attacker.threat_parse_ids”: [
“filetheft_unattend”,
“lm_file_active_monitoring”,
“lm_file_open”
],
“decoy.appliance.id”: “cmc”,
“decoy.appliance.name”: “CMC”,
“decoy.client.id”: “experience”,
“decoy.client.name”: “experience”,
“decoy.group”: “Endpoint”,
“decoy.id”: “endpoint:admin-pc-001”,
“decoy.name”: “admin-pc-001”,
“decoy.type”: “endpoint”,
“file.name”: “C:\Users\admin\Desktop\passwords\Passwords.xlsx”,
“file.operation”: “67”,
“file.operation_string”: “Read”,
“file.process.command_line”: “”,
“file.process.domain_name”: “NT AUTHORITY”,
“file.process.exit_code”: -1,
“file.process.id”: “2824”,
“file.process.image_name”: “MsMpEng.exe”,
“file.process.user_name”: “SYSTEM”,
“file.process.user_sid”: “S-1-5-18”,
“file.thread_id”: “724”,
“id”: “2020-02-25T09:49:15Z-0950f80f-7571-4382-b4b8-5e04c160c4c0”,
“kill_chain_phase”: “Data Theft”,
“mitre_ids”: [
“T1005”
],
“record_type”: “event”,
“severity”: “high”,
“sub_type”: “file”,
“threat_parse_ids”: [
“lm_file_open”
],
“timestamp”: “2020-04-12T08:57:01Z”,
“type”: “endpoint”,
“whitelisted”: false
},
{
“attacker.id”: “ADMIN-PC-001\admin”,
“attacker.name”: “ADMIN-PC-001\admin”,
“attacker.score”: 175,
“attacker.threat_parse_ids”: [
“lm_file_open”,
“lm_file_active_monitoring”
],
“decoy.appliance.id”: “cmc”,
“decoy.appliance.name”: “CMC”,
“decoy.client.id”: “experience”,
“decoy.client.name”: “experience”,
“decoy.group”: “Endpoint”,
“decoy.id”: “endpoint:admin-pc-001”,
“decoy.name”: “admin-pc-001”,
“decoy.type”: “endpoint”,
“file.name”: “C:\Users\admin\Desktop\docs\vulnerability assessment report\vulnerability assessment report.xlsx”,
“file.operation”: “65”,
“file.operation_string”: “Cleanup”,
“file.process.command_line”: “"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass”,
“file.process.domain_name”: “ADMIN-PC-001”,
“file.process.exit_code”: -1,
“file.process.id”: “10228”,
“file.process.image_name”: “powershell.exe”,
“file.process.user_name”: “admin”,
“file.process.user_sid”: “S-1-5-21-399445878-2258755057-882339928-1000”,
“file.thread_id”: “0”,
“id”: “2020-02-25T09:45:48Z-fa248a98-bc8a-4275-93c7-e63ff1ee8d34”,
“kill_chain_phase”: “Data Theft”,
“mitre_ids”: [
“T1005”
],
“record_type”: “event”,
“severity”: “high”,
“sub_type”: “file”,
“threat_parse_ids”: [
“lm_file_active_monitoring”
],
“timestamp”: “2020-04-12T08:53:20Z”,
“type”: “endpoint”,
“whitelisted”: false
}
]
}
}


##### Human Readable Output

### IllusionBLACK Events

|attacker.id|attacker.name|attacker.score|attacker.threat_parse_ids|decoy.appliance.id|decoy.appliance.name|decoy.client.id|decoy.client.name|decoy.group|decoy.id|decoy.name|decoy.type|file.name|file.operation|file.operation_string|file.process.command_line|file.process.domain_name|file.process.exit_code|file.process.id|file.process.image_name|file.process.user_name|file.process.user_sid|file.thread_id|id|kill_chain_phase|mitre_ids|record_type|severity|sub_type|threat_parse_ids|timestamp|type|whitelisted|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ADMIN-PC-001\admin | ADMIN-PC-001\admin | 175 | lm_file_open,<br/>lm_file_active_monitoring | cmc | CMC | experience | experience | Endpoint | endpoint:admin-pc-001 | admin-pc-001 | endpoint | C:\Users\admin\Desktop\passwords\Passwords.xlsx | 67 | Read | "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass | ADMIN-PC-001 | -1 | 10228 | powershell.exe | admin | S-1-5-21-399445878-2258755057-882339928-1000 | 8588 | 2020-02-25T09:49:15Z-76c99a22-03b9-439e-8638-37306c2d8e7f | Data Theft | T1005 | event | high | file | lm_file_open | 2020-04-12T08:57:01Z | endpoint | false |
| NT AUTHORITY\SYSTEM | NT AUTHORITY\SYSTEM | 250 | filetheft_unattend,<br/>lm_file_active_monitoring,<br/>lm_file_open | cmc | CMC | experience | experience | Endpoint | endpoint:admin-pc-001 | admin-pc-001 | endpoint | C:\Users\admin\Desktop\passwords\Passwords.xlsx | 67 | Read |  | NT AUTHORITY | -1 | 2824 | MsMpEng.exe | SYSTEM | S-1-5-18 | 724 | 2020-02-25T09:49:15Z-0950f80f-7571-4382-b4b8-5e04c160c4c0 | Data Theft | T1005 | event | high | file | lm_file_open | 2020-04-12T08:57:01Z | endpoint | false |
| ADMIN-PC-001\admin | ADMIN-PC-001\admin | 175 | lm_file_open,<br/>lm_file_active_monitoring | cmc | CMC | experience | experience | Endpoint | endpoint:admin-pc-001 | admin-pc-001 | endpoint | C:\Users\admin\Desktop\docs\vulnerability assessment report\vulnerability assessment report.xlsx | 65 | Cleanup | "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass | ADMIN-PC-001 | -1 | 10228 | powershell.exe | admin | S-1-5-21-399445878-2258755057-882339928-1000 | 0 | 2020-02-25T09:45:48Z-fa248a98-bc8a-4275-93c7-e63ff1ee8d34 | Data Theft | T1005 | event | high | file | lm_file_active_monitoring | 2020-04-12T08:53:20Z | endpoint | false |

### illusionblack-get-event-by-id

***
Gets a single event by the event ID.

##### Base Command

`illusionblack-get-event-by-id`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | IllusionBLACK Event ID. | Required |

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| IllusionBlack.Event | Unknown | IllusionBLACK Single Event. |
| IllusionBlack.Event.attacker.id | Unknown | IllusionBLACK Event Attacker ID. |
| IllusionBlack.Event.decoy.id | Unknown | IllusionBLACK Event Decoy ID. |
| IllusionBlack.Event.id | Unknown | IllusionBLACK Event ID. |
| IllusionBlack.Event.severity | Unknown | IllusionBLACK Event Severity. |
| IllusionBlack.Event.type | Unknown | IllusionBLACK Event Attack Type. |

##### Command Example

```!illusionblack-get-event-by-id id="2020-02-25T09:49:15Z-0950f80f-7571-4382-b4b8-5e04c160c4c0"```

##### Context Example

{
“IllusionBlack”: {
“Event”: {
“attacker.id”: “NT AUTHORITY\SYSTEM”,
“attacker.name”: “NT AUTHORITY\SYSTEM”,
“attacker.score”: 250,
“attacker.threat_parse_ids”: [
“filetheft_unattend”,
“lm_file_active_monitoring”,
“lm_file_open”
],
“decoy.appliance.id”: “cmc”,
“decoy.appliance.name”: “CMC”,
“decoy.client.id”: “experience”,
“decoy.client.name”: “experience”,
“decoy.group”: “Endpoint”,
“decoy.id”: “endpoint:admin-pc-001”,
“decoy.name”: “admin-pc-001”,
“decoy.type”: “endpoint”,
“file.name”: “C:\Users\admin\Desktop\passwords\Passwords.xlsx”,
“file.operation”: “67”,
“file.operation_string”: “Read”,
“file.process.command_line”: “”,
“file.process.domain_name”: “NT AUTHORITY”,
“file.process.exit_code”: -1,
“file.process.id”: “2824”,
“file.process.image_name”: “MsMpEng.exe”,
“file.process.user_name”: “SYSTEM”,
“file.process.user_sid”: “S-1-5-18”,
“file.thread_id”: “724”,
“id”: “2020-02-25T09:49:15Z-0950f80f-7571-4382-b4b8-5e04c160c4c0”,
“kill_chain_phase”: “Data Theft”,
“mitre_ids”: [
“T1005”
],
“record_type”: “event”,
“severity”: “high”,
“sub_type”: “file”,
“threat_parse_ids”: [
“lm_file_open”
],
“timestamp”: “2020-04-12T08:57:01Z”,
“type”: “endpoint”,
“whitelisted”: false
}
}
}
```

Human Readable Output

IllusionBLACK Single Event

attacker.id attacker.name attacker.score attacker.threat_parse_ids decoy.appliance.id decoy.appliance.name decoy.client.id decoy.client.name decoy.group decoy.id decoy.name decoy.type file.name file.operation file.operation_string file.process.command_line file.process.domain_name file.process.exit_code file.process.id file.process.image_name file.process.user_name file.process.user_sid file.thread_id id kill_chain_phase mitre_ids record_type severity sub_type threat_parse_ids timestamp type whitelisted
NT AUTHORITY\SYSTEM NT AUTHORITY\SYSTEM 250 filetheft_unattend,
lm_file_active_monitoring,
lm_file_open		 cmc CMC experience experience Endpoint endpoint:admin-pc-001 admin-pc-001 endpoint C:\Users\admin\Desktop\passwords\Passwords.xlsx 67 Read   NT AUTHORITY -1 2824 MsMpEng.exe SYSTEM S-1-5-18 724 2020-02-25T09:49:15Z-0950f80f-7571-4382-b4b8-5e04c160c4c0 Data Theft T1005 event high file lm_file_open 2020-04-12T08:57:01Z endpoint false

Configuration parameters

  • url — Server URL (e.g. https://example.net) (required)
  • client_id — IllusionBLACK API Client Id (required)
  • token — IllusionBLACK External API Token (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • first_fetch — First fetch time for fetching incidents (2 days, 3 weeks, etc)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval

Commands (8)

  • illusionblack-get-ad-decoys

    Gets a list of Active Directory decoys.

  • illusionblack-get-event-by-id

    Gets a single event by the event ID.

  • illusionblack-get-events

    Gets events from IllusionBLACK.

  • illusionblack-get-network-decoys

    Gets a list of Network decoys.

  • illusionblack-get-ti-decoys

    Gets a list of Threat Intel decoys.

  • illusionblack-is-host-decoy

    Checks if a host or IP address is a network decoy.

  • illusionblack-is-subdomain-decoy

    Checks if a subdomain is a Threat Intel decoy.

  • illusionblack-is-user-decoy

    Checks if an Active Directory user is a decoy.

Source

Smokescreen_IllusionBLACK.py Smokescreen_IllusionBLACK_test.py Smokescreen_IllusionBLACK.yml Smokescreen_IllusionBLACK_description.md
Download History Raw 
import pytest
from Smokescreen_IllusionBLACK import Client

CLIENT = Client("", False, "", "", False)

RECON_DECOYS = {
    "items": [{"name": "experience.illusionblack.com", "ip": "1.2.3.4", "server_type": "nginx", "dataset": "generic"}]
}

USERS = {"items": [{"user_name": "foo_bar", "first_name": "foo", "last_name": "bar", "ou": "ou", "state": "success"}]}

HOSTS = {"items": [{"name": "FOO", "ip": "1.2.3.4", "services": ["ssh", "mariadb"], "mac": "aa:bb:cc:dd:ee:ff"}]}

EVENTS = {
    "threat_parse": [
        {
            "id": "smb_file_open",
            "title": "Files accessed from network shares",
            "type": "single",
            "description": "An adversary has tried to open a file on a decoy file share. These events can occur "
            "either when files or named pipes have been accessed. <br> Sensitive data can be collected "
            "from remote systems via shared network shared drives that are accessible on the network. "
            "<br> Adversaries may search network shares they have access to to discover files of "
            "interest.\n",
            "examples": [
                "When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the "
                "following extensions like .doc, .docx, .pdf, .ppt, .pptx, and .txt.",
                "BRONZE BUTLER has exfiltrated files stolen from file shares.",
                "CosmicDuke steals user files from network shared drives with file extensions and keywords that match "
                "a predefined list.",
                "menuPass has collected data from remote systems by mounting network shares with net use and using "
                "Robocopy to transfer data.",
                "Sowbug extracted Word documents from a file server on a victim network.",
            ],
            "score": 75,
            "mitigation": ["Validate whether the source system has any legitimate need to access file shares on the network."],
            "mitre_id": ["T1039"],
            "mitre_tactic": ["Collection"],
        },
        {
            "id": "web_access",
            "title": "Web application access",
            "type": "single",
            "description": "An attempt was made to access a decoy web-server. Since decoy services should never be "
            "accessed or enumerated, this should be investigated further.\n",
            "score": 25,
            "mitigation": [
                "Identify the source of this connection request and verify if the user has performed this activity.",
                "The request URI and user-agent may indicate what caused this connection.",
                "Identify the process running on the system that initiated this network connection.",
                "If it is an authorized process, either create a whitelist, or check for and correct any "
                "misconfigurations that may be causing it to connect to the decoy.",
                "If not, triage the system for indications of malicious activity by obtaining a memory dump of the machine. ",
            ],
        },
    ],
    "events": [
        {
            "type": "network",
            "sub_type": "smb_files",
            "severity": "medium",
            "kill_chain_phase": "Lateral Movement",
            "timestamp": "2020-03-16T13:02:07Z",
            "network.connection_uid": "CbyMpm1ivKb8v1Poj",
            "attacker.ip": "1.2.3.4",
            "attacker.port": 51563,
            "decoy.ip": "7.8.9.10",
            "decoy.port": 445,
            "smb_files.action": "SMB::FILE_OPEN",
            "smb_files.path": "\\\\7.8.9.10\\c$",
            "smb_files.name": "<share_root>",
            "smb_files.size": "0",
            "smb_files.times.modified": "1.466496657E9",
            "smb_files.times.accessed": "1.580470607851474E9",
            "smb_files.times.created": "1.466496657E9",
            "smb_files.times.changed": "1.466496657E9",
            "decoy.id": "network:smb58",
            "decoy.name": "smb58",
            "decoy.group": "Group 1",
            "decoy.type": "network",
            "decoy.network_name": "12PC DHCP",
            "decoy.appliance.id": "1.appliance.illusionblack",
            "decoy.appliance.name": "IllusionBLACK 12PC",
            "attacker.name": "1.2.3.4",
            "attacker.id": "1.2.3.4",
            "decoy.client.id": "illusionblack",
            "decoy.client.name": "illusionblack",
            "mitre_ids": ["T1039", "T1135"],
            "threat_parse_ids": ["smb_file_open", "shares_access"],
            "whitelisted": False,
            "id": "2020-03-16T13:02:11.097255-network-4c61c535-5239-4fe7-bd77-f6ca7040fecf",
            "record_type": "event",
            "attacker.score": 400,
            "attacker.threat_parse_ids": ["network_ntlm", "shares_access", "web_access", "smb_file_open"],
        },
        {
            "type": "network",
            "sub_type": "conn_init",
            "severity": "low",
            "kill_chain_phase": "Lateral Movement",
            "timestamp": "2020-03-16T13:02:05Z",
            "attacker.ip": "5.6.7.8",
            "attacker.port": 51563,
            "decoy.ip": "7.8.9.10",
            "decoy.port": 445,
            "network.connection_uid": "CbyMpm1ivKb8v1Poj",
            "decoy.id": "network:smb58",
            "decoy.name": "smb58",
            "decoy.group": "Group 1",
            "decoy.type": "network",
            "decoy.network_name": "12PC DHCP",
            "decoy.appliance.id": "1.appliance.smokescreen",
            "decoy.appliance.name": "Smokescreen 12PC",
            "attacker.name": "5.6.7.8",
            "attacker.id": "5.6.7.8",
            "decoy.client.id": "smokescreen",
            "decoy.client.name": "smokescreen",
            "whitelisted": False,
            "id": "2020-03-16T13:02:09.189408-network-7f63759b-4308-41ef-97c5-317043622f8c",
            "record_type": "event",
            "attacker.score": 400,
            "attacker.threat_parse_ids": ["network_ntlm", "shares_access", "web_access", "smb_file_open"],
        },
    ],
    "meta": {"paging": {"total": 10, "offset": 0, "limit": 2, "amount": 2}},
}


def mock_http_request(client, url_suffix=None, **kwargs):
    if url_suffix == "/decoy/hosts":
        return HOSTS
    elif url_suffix == "/decoy/users":
        return USERS
    elif url_suffix == "/decoy/recon":
        return RECON_DECOYS
    elif url_suffix == "/events":
        return EVENTS
    return None


def test_get_network_decoys(mocker):
    mocker.patch("Smokescreen_IllusionBLACK.Client._http_request", mock_http_request)
    assert len(CLIENT.get_network_decoys()[2]) == 1


def test_get_ad_decoys(mocker):
    mocker.patch("Smokescreen_IllusionBLACK.Client._http_request", mock_http_request)
    assert len(CLIENT.get_ad_decoys()[2]) == 1


def test_get_ti_decoys(mocker):
    mocker.patch("Smokescreen_IllusionBLACK.Client._http_request", mock_http_request)
    assert len(CLIENT.get_ti_decoys()[2]) == 1


@pytest.mark.parametrize("host, output", [("FOO", "True"), ("random", "False")])
def test_is_host_decoy(mocker, host, output):
    mocker.patch("Smokescreen_IllusionBLACK.Client._http_request", mock_http_request)
    assert CLIENT.is_host_decoy(host)[0] is output


@pytest.mark.parametrize("user, output", [("foo_bar", "True"), ("random", "False")])
def test_is_user_decoy(mocker, user, output):
    mocker.patch("Smokescreen_IllusionBLACK.Client._http_request", mock_http_request)
    assert CLIENT.is_user_decoy(user)[0] is output


@pytest.mark.parametrize("subdomain, output", [("experience.illusionblack.com", "True"), ("random", "False")])
def test_is_subdomain_decoy(mocker, subdomain, output):
    mocker.patch("Smokescreen_IllusionBLACK.Client._http_request", mock_http_request)
    assert CLIENT.is_subdomain_decoy(subdomain)[0] is output