Trend Micro Vision One

TrendAI Vision One™ is a purpose-built threat defense platform that provides added value and new benefits beyond XDR solutions, allowing you to see more and respond faster. Providing deep and broad extended detection and response (XDR) capabilities that collect and automatically correlate data across multiple security layers—email, endpoints, servers, cloud workloads, and networks—TrendAI Vision One™ prevents the majority of attacks with automated protection.

Data Enrichment & Threat Intelligence · TrendAI Vision One™

Details

IDTrend Micro Vision One
ProviderTrendAI™
CategoryData Enrichment & Threat Intelligence
From Version6.2.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Integration Author: TrendAI™

Support and maintenance for this integration are provided by the author. Please use the following contact details:


TrendAI Vision One™ is a purpose-built threat defense platform that provides added value and new benefits beyond XDR solutions, allowing you to see more and respond faster. Providing deep and broad extended detection and response (XDR) capabilities that collect and automatically correlate data across multiple security layers—email, endpoints, servers, cloud workloads, and networks—TrendAI Vision One™ prevents the majority of attacks with automated protection.

Configure TrendAI Vision One™ on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Trend.
  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    API URL (e.g. https://api.xdr.trendmicro.com) The base url for the TrendAI Vision One™ API True
    API Key The API token to access data True
    Fetch incidents   False
    Incidents Fetch Interval   False
    Incident type   False
    Sync On First Run (days)   False
    Max Incidents   False
    Use system proxy settings   False
    Trust any certificate (not secure)   False
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

trendmicro-visionone-add-to-block-list


Adds a file SHA-1, IP address, domain, or URL object to the User-Defined Suspicious Objects List, which blocks the objects on subsequent detections

Base Command

  1. trendmicro-visionone-add-to-block-list

Input

Argument Name Description Required
value_type The type of object you would like to add to the block list: “file_sha1”, “ip”, “domain”, “url” or “mailbox”. Possible values are: file_sha1, domain, ip, url, mailbox. Required
target_value The object you would like to add that matches the value-type. Required
product_id Target product. Optional
description Optional description for reference. Optional

Context Output

Path Type Description
VisionOne.BlockList.actionId string Action ID of task adding file SHA-1, IP address, domain, or URL to the User-Defined Suspicious Objects List
VisionOne.BlockList.taskStatus string Task status of adding file SHA-1, IP address, domain, or URL object to the User-Defined Suspicious Objects List

Note: To get the complete task status run polling command trendmicro-visionone-check-task-status giving actionId as input parameter.

trendmicro-visionone-remove-from-block-list


Removes a file SHA-1, IP address, domain, or URL from the User-Defined Suspicious Objects List

Base Command

  1. trendmicro-visionone-remove-from-block-list

Input

Argument Name Description Required
value_type The type of object you would like to remove from the block list: “file_sha1”, “ip”, “domain”, “url” or “mailbox”. Possible values are: file_sha1, domain, ip, url, mailbox. Required
target_value The object you would like to add that matches the value-type. Required
product_id Target product. Optional
description Optional description for reference. Optional

Context Output

Path Type Description
VisionOne.BlockList.actionId string Action ID of task removing file SHA-1, IP address, domain, or URL object from the User-Defined Suspicious Objects List
VisionOne.BlockList.taskStatus string Task Status of removing file SHA-1, IP address, domain, or URL object that was added to the User-Defined Suspicious Objects List from block list

Note: To get the complete task status run polling command trendmicro-visionone-check-task-status giving actionId as input parameter.

trendmicro-visionone-quarantine-email-message


Moves a message from a mailbox to the quarantine folder

Base Command

  1. trendmicro-visionone-quarantine-email-message

Input

Argument Name Description Required
message_id Email Message ID from TrendAI Vision One™ message activity data. Required
mailbox Email mailbox where the message will be quarantined from. Required
message_delivery_time Email message’s original delivery time. Required
product_id Target product. Default is sca. Optional
description Optional description for reference. Optional

Context Output

Path Type Description
VisionOne.Email.actionId string The Action Id of moving a message from a mailbox to the quarantine folder
VisionOne.Email.taskStatus string The status of moving a message from a mailbox to the quarantine folder

Note: To get the complete task status run polling command trendmicro-visionone-check-task-status giving actionId as input parameter.

trendmicro-visionone-delete-email-message


Deletes a message from a mailbox

Base Command

  1. trendmicro-visionone-delete-email-message

Input

Argument Name Description Required
message_id Email Message ID from TrendAI Vision One™ One message activity data. Required
mailbox Email mailbox where the message will be quarantined from. Required
message_delivery_time Email message’s delivery time. Required
product_id Target product. Default is sca. Optional
description Optional description for reference. Optional

Context Output

Path Type Description
VisionOne.Email.actionId string The action id of deleting a message from a mailbox
VisionOne.Email.taskStatus string The task status of deleting a message from a mailbox

Note: To get the complete task status run polling command trendmicro-visionone-check-task-status giving actionId as input parameter.

trendmicro-visionone-isolate-endpoint


Disconnects an endpoint from the network (but allows communication with the managing TrendAI™ product)

Base Command

  1. trendmicro-visionone-isolate-endpoint

Input

Argument Name Description Required
endpoint “hostname”, “macaddr” or “ip” of the endpoint to isolate. Required
product_id Target product: “sao”, “sds”, or “xes”. Possible values are: sao, sds, xes. Default is sao. Required
description Description. Optional

Context Output

Path Type Description
VisionOne.Endpoint_Connection.actionId string The action ID of isolate endpoint task
VisionOne.Endpoint_Connection.taskStatus string The task status of isolate endpoint

Note: To get the complete task status run polling command trendmicro-visionone-check-task-status giving actionId as input parameter.
Note: The above command should be added with execution timeout in the advanced field of playbook execution. The recommended timeout be 20 minutes.

trendmicro-visionone-restore-endpoint-connection


Restores network connectivity to an endpoint that applied the “isolate endpoint” action

Base Command

  1. trendmicro-visionone-restore-endpoint-connection

Input

Argument Name Description Required
endpoint “hostname”, “macaddr” or “ip” of the endpoint to restore. Required
product_id Target product: “sao”, “sds”, or “xes”. Possible values are: sao, sds, xes. Default is sao. Required
description Description. Optional

Context Output

Path Type Description
VisionOne.Endpoint_Connection.actionId string The action ID of the restore endpoint connection
VisionOne.Endpoint_Connection.taskStatus string The task status of restore endpoint connection

Note: To get the complete task status run polling command trendmicro-visionone-check-task-status giving actionId as input parameter.
Note: The above command should be added with execution timeout in the advanced field of playbook execution. The recommended timeout be 20 minutes.

trendmicro-visionone-add-objects-to-exception-list


Adds domains, file SHA-1 values, IP addresses, or URLs to the Exception List and prevents these objects from being added to the Suspicious Object List

Base Command

  1. trendmicro-visionone-add-objects-to-exception-list

Input

Argument Name Description Required
type Object type: “domain”, “ip”, “sha1”, or “url”. Possible values are: domain, ip, sha1, url. Required
value The object value. Full and partial matches supported. Domain partial match, (with a wildcard as the subdomain, example, .example.com) IP partial match, (IP range example, 192.168.35.1-192.168.35.254, cidr example, 192.168.35.1/24) URL Partial match, (Supports wildcards ‘http://.’’, ‘https://.’’ at beginning, or ‘’’ at the end. Multiple wild cards also supported, such as , https://.example.com/path1/) SHA1 Only full match”. Required
description Exception description. Optional

Context Output

Path Type Description
VisionOne.Exception_List.message string status message success after task completion
VisionOne.Exception_List.status_code string status code of response
VisionOne.Exception_List.total_items string count of item present in exception list

trendmicro-visionone-delete-objects-from-exception-list


Deletes domains, file SHA-1 values, IP addresses, or URLs from the Exception List.

Base Command

  1. trendmicro-visionone-delete-objects-from-exception-list

Input

Argument Name Description Required
type Object type: “domain”, “ip”, “sha1”, or “url”. Possible values are: domain, ip, sha1, url. Required
value The object value. Required

Context Output

Path Type Description
VisionOne.Exception_List.message string status message success after task completion
VisionOne.Exception_List.status_code number status code of response
VisionOne.Exception_List.total_items string count of item present in exception list

trendmicro-visionone-add-objects-to-suspicious-list


Adds domains, file SHA-1 values, IP addresses, or URLs to the Suspicious Object List.

Base Command

  1. trendmicro-visionone-add-objects-to-suspicious-list

Input

Argument Name Description Required
type Object type: “domain”, “ip”, “sha1”, or “url”. Possible values are: domain, ip, sha1, url. Required
value The object value. Required
description Description. Optional
scan_action The action to take if object is found. If you don’t use this parameter, the scan action specified in default_settings.riskLevel.type will be used instead. “block” or “log”. Possible values are: block, log. Optional
risk_level The Suspicious Object risk level. If you don’t use this parameter, high will be used instead. “high”, “medium” or “low”. Possible values are: high, medium, low. Optional
expiry_days The number of days to keep the object in the Suspicious Object List. If you don’t use this parameter, the default_settings.expiredDay scan action will be used instead. Optional

Context Output

Path Type Description
VisionOne.Suspicious_List.message string Status message of adding item to suspicious object list
VisionOne.Suspicious_List.status_code number Response code of adding item to suspicious object list
VisionOne.Suspicious_List.total_items number Number of items present in suspicious object list

trendmicro-visionone-delete-objects-from-suspicious-list


Deletes domains, file SHA-1 values, IP addresses, or URLs from the Suspicious Object List

Base Command

  1. trendmicro-visionone-delete-objects-from-suspicious-list

Input

Argument Name Description Required
type Object type: “domain”, “ip”, “sha1”, or “url”. Possible values are: domain, ip, sha1, url. Required
value The object value. Required

Context Output

Path Type Description
VisionOne.Suspicious_List.message string Status message of removing item from suspicious object list
VisionOne.Suspicious_List.status_code number Response code of removing item from suspicious object list
VisionOne.Suspicious_List.total_items number Number of items present in suspicious object list

trendmicro-visionone-get-endpoint-info


Retrieves information about a specific endpoint

Base Command

  1. trendmicro-visionone-get-endpoint-info

Input

Argument Name Description Required
endpoint “hostname”, “macaddr” or “ip” of the endpoint to query. Required

Context Output

Path Type Description
VisionOne.Endpoint_Info.message string Message information from the request
VisionOne.Endpoint_Info.errorCode integer Error code
VisionOne.Endpoint_Info.status string Status of the request
VisionOne.Endpoint_Info.logonAccount string Account currently logged on to the endpoint
VisionOne.Endpoint_Info.hostname string Hostname
VisionOne.Endpoint_Info.macAddr string MAC address
VisionOne.Endpoint_Info.ip string IP address
VisionOne.Endpoint_Info.osName string Operating System name
VisionOne.Endpoint_Info.osVersion string Operating System nersion
VisionOne.Endpoint_Info.osDescription string Description of the Operating System
VisionOne.Endpoint_Info.productCode string Product code of the TrendAI™ product running on the endpoint

trendmicro-visionone-terminate-process


Terminates a process that is running on an endpoint

Base Command

  1. trendmicro-visionone-terminate-process

Input

Argument Name Description Required
endpoint “hostname”, “macaddr” or “ip” of the endpoint to terminate process on. Required
file_sha1 SHA1 hash of the process to terminate. Required
product_id Target product. Possible values are: sao. Default is sao. Optional
description Description. Optional
filename Optional file name list for log. Optional

Context Output

Path Type Description
VisionOne.Terminate_Process.actionId string Action Id of the current running task
VisionOne.Terminate_Process.taskStatus string Status of current running task

Note: To get the complete task status run polling command trendmicro-visionone-check-task-status giving actionId as input parameter.
Note: The above command should be added with execution timeout in the advanced field of playbook execution. The recommended timeout is 20 minutes.

trendmicro-visionone-get-file-analysis-status


Retrieves the status of a sandbox analysis submission

Base Command

  1. trendmicro-visionone-get-file-analysis-status

Input

Argument Name Description Required
task_id task_id from the trendmicro-visionone-submit-file-to-sandbox command output. Required

Context Output

Path Type Description
VisionOne.File_Analysis_Status.message string Status of the sandbox analysis
VisionOne.File_Analysis_Status.code string Response code
VisionOne.File_Analysis_Status.task_id string task_id of the task queried
VisionOne.File_Analysis_Status.taskStatus string Sandbox analysis status
VisionOne.File_Analysis_Status.digest string The hash values of file analyzed
VisionOne.File_Analysis_Status.analysis_completion_time string Sample analysis completed time.
VisionOne.File_Analysis_Status.risk_level string Risk Level of the analyzed file.
VisionOne.File_Analysis_Status.descritption string Scan result description for NotAnalyzed.
VisionOne.File_Analysis_Status.detection_name_list unknown Detection name of this sample, if applicable.
VisionOne.File_Analysis_Status.threat_type_list unknown Threat type of this sample.
VisionOne.File_Analysis_Status.file_type string File type of this sample.
VisionOne.File_Analysis_Status.report_id string ID used to get the report and suspicious object. Empty means no report.
VisionOne.File_Analysis_Status.DBotScore.score number The DBot score.
VisionOne.File_Analysis_Status.DBotScore.Vendor string The Vendor name.
VisionOne.File_Analysis_Status.DBotScore.Reliability string The reliability level.

trendmicro-visionone-get-file-analysis-report


Retrieves the analysis report, investigation package, or Suspicious Object List of a submitted file

Base Command

  1. trendmicro-visionone-get-file-analysis-report

Input

Argument Name Description Required
report_id report_id of the sandbox submission retrieved from the trendmicro-visionone-get-file-analysis-status command. Required
type Type of report to retrieve: “vaReport”, “investigationPackage”, or “suspiciousObject”. Possible values are: vaReport, investigationPackage, suspiciousObject. Required

Context Output

Path Type Description
VisionOne.File_Analysis_Report.message string Status message of file report
VisionOne.File_Analysis_Report.code string status code of file report
VisionOne.File_Analysis_Report.type string Suspicious object type
VisionOne.File_Analysis_Report.value string Suspicious object value
VisionOne.File_Analysis_Report.risk_level string Risk Level of suspicious object
VisionOne.File_Analysis_Report.analysis_completion_time string Analyze time of suspicious object
VisionOne.File_Analysis_Report.expired_time string Expire time of suspicious object
VisionOne.File_Analysis_Report.root_file_sha1 string Sample sha1 generate this suspicious object

trendmicro-visionone-collect-forensic-file


Compresses a file on an endpoint in a password-protected archive and then sends the archive to the XDR service platform

Base Command

  1. trendmicro-visionone-collect-forensic-file

Input

Argument Name Description Required
endpoint “hostname”, “macaddr” or “ip” of the endpoint to collect file from. Required
product_id Product: “sao”, “sds” or “xes”. Possible values are: sao, xes, sds. Required
file_path Path to the file to collect. Required
os Type of OS. “windows”, “mac” or “linux”. Required
description Description of the file. Optional

Context Output

Path Type Description
VisionOne.Collect_Forensic_File.actionId string Action ID of the particular file.
VisionOne.Collect_Forensic_File.taskStatus string Task status of collected file

Note: To get the complete task status run polling command trendmicro-visionone-check-task-status giving actionId as input parameter.
Note: The above command should be added with execution timeout in the advanced field of playbook execution. The recommended timeout be 20 minutes.

trendmicro-visionone-download-information-for-collected-forensic-file


Retrieves a URL and other information required to download a collected file via the trendmicro-visionone-collect-forensic-file command

Base Command

  1. trendmicro-visionone-download-information-for-collected-forensic-file

Input

Argument Name Description Required
actionId actionId output from the collect command used to collect the file. Required

Context Output

Path Type Description
VisionOne.Download_Information_For_Collected_Forensic_File.url string URL of the collected file
VisionOne.Download_Information_For_Collected_Forensic_File.expires string URL expiration date
VisionOne.Download_Information_For_Collected_Forensic_File.password string Archive password for the protected forensic file
VisionOne.Download_Information_For_Collected_Forensic_File.filename string Name of the collected file

Note: The URL received from the trendmicro-visionone-download-information-for-collected-forensic-file will be valid for only 60 seconds

trendmicro-visionone-submit-file-to-sandbox


Submits a file to the sandbox for analysis (Note. For more information about the supported file types, see the TrendAI Vision One™ Online Help. Submissions require credits. Does not require credits in regions where Sandbox Analysis has not been officially released.)

Base Command

  1. trendmicro-visionone-submit-file-to-sandbox

Input

Argument Name Description Required
file_url URL pointing to the location of the file to be submitted. Required
filename Name of the file to be analyzed. Required
document_password The Base64 encoded password for decrypting the submitted document. sample. Optional
archive_password The Base64 encoded password for decrypting the submitted archive. Optional

Context Output

Path Type Description
VisionOne.Submit_File_to_Sandbox.message string Status message of the file submitted to sandbox.
VisionOne.Submit_File_to_Sandbox.code string status code of the file submitted to sandbox
VisionOne.Submit_File_to_Sandbox.task_id string Task ID of the submitted file
VisionOne.Submit_File_to_Sandbox.digest unknown The hash value of the file

trendmicro-visionone-submit-file-entry-to-sandbox


Submits the file corresponding to EntryID to the sandbox for analysis (Note. For more information about the supported file types, see the TrendAI Vision One™ One Online Help. Submissions require credits. Does not require credits in regions where Sandbox Analysis has not been officially released.)

Base Command

  1. trendmicro-visionone-submit-file-entry-to-sandbox

Input

Argument Name Description Required
entry_id Entry ID of the file to be submitted. Required
document_password The Base64 encoded password for decrypting the submitted document. sample. Optional
archive_password The Base64 encoded password for decrypting the submitted archive. Optional

Context Output

Path Type Description
VisionOne.Submit_File_Entry_to_Sandbox.message string Status message of the file submitted to sandbox.
VisionOne.Submit_File_Entry_to_Sandbox.code string status code of the file submitted to sandbox
VisionOne.Submit_File_Entry_to_Sandbox.task_id string Task ID of the submitted file
VisionOne.Submit_File_Entry_to_Sandbox.digest string The hash value of the file
VisionOne.Submit_File_Entry_to_Sandbox.filename string The name of the file submitted
VisionOne.Submit_File_Entry_to_Sandbox.file_path string The path to the file associated to incident
VisionOne.Submit_File_Entry_to_Sandbox.entryId string The Entry ID for the file

trendmicro-visionone-run-sandbox-submission-polling


Runs a polling command to retrieve the status of a sandbox analysis submission

Base Command

  1. trendmicro-visionone-run-sandbox-submission-polling

Input

Argument Name Description Required
polling polling the task for 30 seconds interval. Default is true. Optional
task_id task_id from the trendmicro-visionone-submit-file-to-sandbox or trendmicro-visionone-submit-file-entry-to-sandbox command output. Required

Context Output

Path Type Description
VisionOne.Sandbox_Submission_Polling.message string Status of the sandbox analysis
VisionOne.Sandbox_Submission_Polling.code string Response code
VisionOne.Sandbox_Submission_Polling.task_id string task_id of the task queried
VisionOne.Sandbox_Submission_Polling.taskStatus string Sandbox analysis status
VisionOne.Sandbox_Submission_Polling.digest string The hash values of file analyzed
VisionOne.Sandbox_Submission_Polling.analysis_completion_time string Sample analysis completed time.
VisionOne.Sandbox_Submission_Polling.risk_level string Risk Level of the analyzed file.
VisionOne.Sandbox_Submission_Polling.description string Scan result description for NotAnalyzed.
VisionOne.Sandbox_Submission_Polling.detection_name_list unknown Detection name of this sample, if applicable.
VisionOne.Sandbox_Submission_Polling.threat_type_list unknown Threat type of this sample.
VisionOne.Sandbox_Submission_Polling.file_type string File type of this sample.
VisionOne.Sandbox_Submission_Polling.report_id string ID used to get the report and suspicious object. Empty means no report.
VisionOne.Sandbox_Submission_Polling.DBotScore.score number The DBot score.
VisionOne.Sandbox_Submission_Polling.DBotScore.Vendor string The Vendor name.
VisionOne.Sandbox_Submission_Polling.DBotScore.Reliability string The reliability level.

trendmicro-visionone-check-task-status


Command gives the status of the running task based on the action id.

Base Command

  1. trendmicro-visionone-check-task-status

Input

Argument Name Description Required
polling polling the task for 30 seconds interval. Default is true. Optional
actionId Action id of the task you would like to check. Required

Context Output

Path Type Description
VisionOne.Task_Status.actionId unknown Action ID of the task queried.
VisionOne.Task_Status.taskStatus unknown Status of the task.

trendmicro-visionone-add-note


Attaches a note to a workbench alert

Base Command

  1. trendmicro-visionone-add-note

Input

Argument Name Description Required
workbench_id ID of the workbench you would like to attach the note to. Required
content Contents of the note to be attached. Required

Context Output

Path Type Description
VisionOne.Add_Note.Workbench_Id string The ID of the workbench that the note was added to.
VisionOne.Add_Note.Note_Id string The ID of the note that was added.
VisionOne.Add_Note.Response_Code string The response code from the command
VisionOne.Add_Note.Response_Msg string The response message from the command

trendmicro-visionone-update-status


Updates the status of a workbench alert

Base Command

  1. trendmicro-visionone-update-status

Input

Argument Name Description Required
workbench_id ID of the workbench you would like to update the status for. Required
status Status to assign to the workbench alert. Possible values are: new, in_progress, resolved_true_positive, resolved_false_positive. Required

Context Output

Path Type Description
VisionOne.Update_Status.Workbench_Id string The ID of the workbench that had the status updated.
VisionOne.Update_Status.Response_Code string The response code from the command
VisionOne.Update_Status.Response_Msg string The response message from the command

Configuration parameters

  • url — API URL (e.g. https://api.xdr.trendmicro.com) (required)
  • apikey — (required)
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type
  • first_fetch — Sync On First Run (days)
  • max_fetch — Max Incidents
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • integrationReliability — Source Reliability

Commands (22)

  • trendmicro-visionone-add-note

    Attaches a note to a workbench alert.

  • trendmicro-visionone-add-objects-to-exception-list

    Adds domains, file SHA-1 values, IP addresses, or URLs to the Exception List and prevents these objects from being added to the Suspicious Object List.

  • trendmicro-visionone-add-objects-to-suspicious-list

    Adds domains, file SHA-1 values, IP addresses, or URLs to the Suspicious Object List.

  • trendmicro-visionone-add-to-block-list

    Adds a file SHA-1, IP address, domain, or URL object to the User-Defined Suspicious Objects List, which blocks the objects on subsequent detections.

  • trendmicro-visionone-check-task-status

    Command gives the status of the running task based on the action id.

  • trendmicro-visionone-collect-forensic-file

    Compresses a file on an endpoint in a password-protected archive and then sends the archive to the XDR service platform.

  • trendmicro-visionone-delete-email-message

    Deletes a message from a mailbox.

  • trendmicro-visionone-delete-objects-from-exception-list

    Deletes domains, file SHA-1 values, IP addresses, or URLs from the Exception List.

  • trendmicro-visionone-delete-objects-from-suspicious-list

    Deletes domains, file SHA-1 values, IP addresses, or URLs from the Suspicious Object List.

  • trendmicro-visionone-download-information-for-collected-forensic-file

    Retrieves a URL and other information required to download a collected file via the trendmicro-visionone-collect-forensic-file command.

  • trendmicro-visionone-get-endpoint-info

    Retrieves information about a specific endpoint.

  • trendmicro-visionone-get-file-analysis-report

    Retrieves the analysis report, investigation package, or Suspicious Object List of a submitted file.

  • trendmicro-visionone-get-file-analysis-status

    Retrieves the status of a sandbox analysis submission.

  • trendmicro-visionone-isolate-endpoint

    Disconnects an endpoint from the network (but allows communication with the managing TrendAI™ product).

  • trendmicro-visionone-quarantine-email-message

    Moves a message from a mailbox to the quarantine folder.

  • trendmicro-visionone-remove-from-block-list

    Removes a file SHA-1, IP address, domain, or URL from the User-Defined Suspicious Objects List.

  • trendmicro-visionone-restore-endpoint-connection

    Restores network connectivity to an endpoint that applied the "isolate endpoint" action.

  • trendmicro-visionone-run-sandbox-submission-polling

    Runs a polling command to retrieve the status of a sandbox analysis submission.

  • trendmicro-visionone-submit-file-entry-to-sandbox

    Submits the file corresponding to EntryID to the sandbox for analysis (Note. For more information about the supported file types, see the TrendAI Vision One™ Online Help. Submissions require credits. Does not require credits in regions where Sandbox Analysis has not been officially released.)

  • trendmicro-visionone-submit-file-to-sandbox

    Submits a file to the sandbox for analysis (Note. For more information about the supported file types, see the TrendAI Vision One™ Online Help. Submissions require credits. Does not require credits in regions where Sandbox Analysis has not been officially released.)

  • trendmicro-visionone-terminate-process

    Terminates a process that is running on an endpoint.

  • trendmicro-visionone-update-status

    Updates the status of a workbench alert.

import demistomock as demisto
from TrendMicroVisionOne import (
    Client,
    add_note,
    add_or_delete_from_exception_list,
    add_or_remove_from_block_list,
    add_to_suspicious_list,
    collect_file,
    delete_from_suspicious_list,
    download_information_collected_file,
    get_endpoint_info,
    get_file_analysis_report,
    get_file_analysis_status,
    get_sandbox_submission_status,
    get_task_status,
    isolate_or_restore_connection,
    quarantine_or_delete_email_message,
    submit_file_entry_to_sandbox,
    submit_file_to_sandbox,
    terminate_process,
    update_status,
)

# Provide valid API KEY
api_key = "test api key"
proxy = "false"
verify = "true"


# Mock function for add to block list and remove from block list
def add_remove_blocklist_mock_response(*args, **kwargs):
    return_value = {
        "actionId": "88139521",
        "taskStatus": "pending",
        "data": {
            "createdTime": 1589525651,
            "executedTime": 1589525725,
            "finishedTime": 1589525725,
            "taskStatus": "success",
            "error": {},
        },
    }
    return return_value


# Test cases for add to block list
def test_add_blocklist(mocker):
    """Test add to block list with positive scenario."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", add_remove_blocklist_mock_response)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "valueType": "file_sha1",
        "targetValue": "2de5c1125d5f991842727ed8ea8b5fda0ffa249b",
        "productId": "sao",
        "description": "block info",
    }
    result = add_or_remove_from_block_list(client, "trendmicro-visionone-add-to-block-list", args)
    assert result.outputs["taskStatus"] == "pending"
    assert isinstance(result.outputs["actionId"], str)
    assert result.outputs_prefix == "VisionOne.BlockList"
    assert result.outputs_key_field == "actionId"


# Test cases for remove from block list
def test_remove_block_list(mocker):
    """Test remove block list positive scenario."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", add_remove_blocklist_mock_response)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "valueType": "file_sha1",
        "targetValue": "2de5c1125d5f991842727ed8ea8b5fda0ffa249b",
        "productId": "sao",
        "description": "block info",
    }
    result = add_or_remove_from_block_list(client, "trendmicro-visionone-remove-from-block-list", args)
    assert result.outputs["taskStatus"] == "pending"
    assert isinstance(result.outputs["actionId"], str)
    assert result.outputs_prefix == "VisionOne.BlockList"
    assert result.outputs_key_field == "actionId"


# Mock function for quarantine and delete email message
def quarantine_delete_email_mock_response(*args, **kwargs):
    return_value = {
        "actionId": "88139521",
        "taskStatus": "pending",
        "data": {
            "createdTime": 1589525651,
            "executedTime": 1589525725,
            "finishedTime": 1589525725,
            "taskStatus": "success",
            "error": {},
        },
    }
    return return_value


# Test cases for quarantine email message
def test_quarantine_email_message(mocker):
    """Test quarantine email message positive scenario."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", quarantine_delete_email_mock_response)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "messageId": ("<CANUJTKTjto9GAHTr9V=TFqMZhRXqVn=" + "MfSqmTdAMyv9PDX3k+vQ0w@mail.gmail.com>"),
        "mailBox": "kjshdfjksahd@trendenablement.com",
        "messageDeliveryTime": "2021-12-09T14:00:12.000Z",
        "productId": "sca",
        "description": "quarantine info",
    }
    result = quarantine_or_delete_email_message(client, "trendmicro-visionone-quarantine-email-message", args)
    assert result.outputs["taskStatus"] == "pending"
    assert isinstance(result.outputs["actionId"], str)
    assert result.outputs_prefix == "VisionOne.Email"
    assert result.outputs_key_field == "actionId"


# Test cases for delete email message
def test_delete_email_message(mocker):
    """Test delete email message with positive scenario."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", quarantine_delete_email_mock_response)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "messageId": ("<CANUJTKTqmuCT12v7mpbxZih_crrP" + "MfSqmTdAMyv9PDX3k+vQ0w@mail.gmail.com>"),
        "mailBox": "kjshdfjksahd@trendenablement.com",
        "messageDeliveryTime": "2021-12-09T14:00:55.000Z",
        "productId": "sca",
        "description": "quarantine info",
    }
    result = quarantine_or_delete_email_message(client, "trendmicro-visionone-delete-email-message", args)
    assert result.outputs["taskStatus"] == "pending"
    assert isinstance(result.outputs["actionId"], str)
    assert result.outputs_prefix == "VisionOne.Email"
    assert result.outputs_key_field == "actionId"


# Mock function for isolate and restore endpoint
def isolate_restore_mock_response(*args, **kwargs):
    return_value = {
        "status": "string",
        "actionId": "88139521",
        "taskStatus": "pending",
        "result": {
            "computerId": "string",
        },
        "data": {
            "createdTime": 1589525651,
            "executedTime": 1589525725,
            "finishedTime": 1589525725,
            "taskStatus": "success",
            "error": {},
        },
    }
    return return_value


# Test cases for isolate endpoint
def test_isolate_endpoint(mocker):
    """Test isolate endpoint postive scenario."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", isolate_restore_mock_response)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "endpoint": "hostname",
        "productId": "sao",
        "description": "isolate endpoint info",
    }
    result = isolate_or_restore_connection(client, "trendmicro-visionone-isolate-endpoint", args)
    assert result.outputs["taskStatus"] == "pending"
    assert result.outputs_prefix == "VisionOne.Endpoint_Connection"
    assert result.outputs_key_field == "actionId"


# Test cases for restore endpoint
def test_restore_endpoint(mocker):
    """Test restore endpoint positive scenario."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", isolate_restore_mock_response)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "endpoint": "hostname",
        "productId": "sao",
        "description": "restore endpoint info",
    }
    result = isolate_or_restore_connection(client, "trendmicro-visionone-restore-endpoint-connection", args)
    assert result.outputs["taskStatus"] == "pending"
    assert result.outputs_prefix == "VisionOne.Endpoint_Connection"
    assert result.outputs_key_field == "actionId"


# Test cases for terminate process endpoint
def test_terminate_process_endpoint(mocker):
    """Test terminate process positive scenario."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", isolate_restore_mock_response)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "endpoint": "00:50:56:81:87:A8",
        "fileSha1": "12a08b7a3c5a10b64700c0aca1a47941b50a4f8b",
        "productId": "sao",
        "description": "terminate info",
        "filename": "testfile",
    }
    result = terminate_process(client, args)
    assert result.outputs["taskStatus"] == "pending"
    assert isinstance(result.outputs["actionId"], str)
    assert result.outputs_prefix == "VisionOne.Terminate_Process"
    assert result.outputs_key_field == "actionId"


# Mock function for add and delete exception list
def add_delete_exception_mock_response(*args, **kwargs):
    return_value = 20
    return return_value


# Test cases for add exception list endpoint.
def test_add_object_to_exception_list(mocker):
    """Test add to exception list with positive scenario."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", add_delete_exception_mock_response)
    mocker.patch(
        "TrendMicroVisionOne.Client.exception_list_count",
        add_delete_exception_mock_response,
    )
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {"type": "domain", "value": "1.alisiosanguera.com", "description": "new key"}
    result = add_or_delete_from_exception_list(client, "trendmicro-visionone-add-objects-to-exception-list", args)
    assert result.outputs["status_code"] is None
    assert result.outputs_prefix == "VisionOne.Exception_List"
    assert isinstance(result.outputs["total_items"], int)
    assert result.outputs_key_field == "message"


# Test cases for delete exception list.
def test_delete_object_to_exception_list(mocker):
    """Test delete exception list positive scenario."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", add_delete_exception_mock_response)
    mocker.patch(
        "TrendMicroVisionOne.Client.exception_list_count",
        add_delete_exception_mock_response,
    )
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "type": "domain",
        "value": "1.alisiosanguera.com.cn",
        "description": "testing exception",
    }
    result = add_or_delete_from_exception_list(client, "trendmicro-visionone-delete-objects-from-exception-list", args)
    assert result.outputs["status_code"] is None
    assert isinstance(result.outputs["total_items"], int)
    assert result.outputs_prefix == "VisionOne.Exception_List"
    assert result.outputs_key_field == "message"


# Mock response for add and delete suspicious list
def add_delete_suspicious_mock_response(*args, **kwargs):
    return_value = 20
    return return_value


# Test cases for add suspicious object list
def test_add_object_to_suspicious_list(mocker):
    """Test add to suspicious list with poistive scenario."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", add_delete_suspicious_mock_response)
    mocker.patch(
        "TrendMicroVisionOne.Client.suspicious_list_count",
        add_delete_suspicious_mock_response,
    )
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "type": "domain",
        "value": "1.alisiosanguera.com.cn",
        "description": "Example Suspicious Object.",
        "scanAction": "log",
        "riskLevel": "high",
        "expiredDay": 15,
    }
    result = add_to_suspicious_list(client, args)
    assert result.outputs["status_code"] is None
    assert isinstance(result.outputs["total_items"], int)
    assert result.outputs_prefix == "VisionOne.Suspicious_List"
    assert result.outputs_key_field == "message"


# Test cases for delete suspicious object list
def test_delete_object_from_suspicious_list(mocker):
    """Test delete object from suspicious list."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", add_delete_suspicious_mock_response)
    mocker.patch(
        "TrendMicroVisionOne.Client.suspicious_list_count",
        add_delete_suspicious_mock_response,
    )
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {"type": "domain", "value": "1.alisiosanguera.com.cn"}
    result = delete_from_suspicious_list(client, args)
    assert result.outputs["status_code"] is None
    assert isinstance(result.outputs["total_items"], int)
    assert result.outputs_prefix == "VisionOne.Suspicious_List"
    assert result.outputs_key_field == "message"


# Mock response for Get file analysis status
def mock_file_status_response(*args, **kwargs):
    return_response = {
        "code": "Success",
        "message": "Success",
        "data": {
            "taskId": "012e4eac-9bd9-4e89-95db-77e02f75a6f3",
            "taskStatus": "finished",
            "digest": {
                "md5": "4ac174730d4143a119037d9fda81c7a9",
                "sha1": "fb5608fa03de204a12fe1e9e5275e4a682107471",
                "sha256": ("65b0f656e79ab84ca17807158e3eac206bd58be6689ddeb95956a48748d138f9"),
            },
            "analysisSummary": {
                "analysisCompletionTime": "2021-05-07T03:08:40Z",
                "riskLevel": "high",
                "description": "",
                "detectionNameList": [],
                "threatTypeList": [],
                "trueFileType": "exe",
            },
            "reportId": "012e4eac-9bd9-4e89-95db-77e02f75a6f3",
        },
    }
    return return_response


# Test Cases for Get file analysis status
def test_get_file_status(mocker):
    """Test to get status of file"""
    mocker.patch("TrendMicroVisionOne.Client.http_request", mock_file_status_response)
    args = {"taskId": "921674d0-9735-4f79-b7de-c852e00a003d"}
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    result = get_file_analysis_status(client, args)
    assert result.outputs["message"] == "Success"
    assert result.outputs["code"] == "Success"
    assert result.outputs["task_id"] == "012e4eac-9bd9-4e89-95db-77e02f75a6f3"
    assert result.outputs["taskStatus"] == "finished"
    assert result.outputs["report_id"] == ("012e4eac-9bd9-4e89-95db-77e02f75a6f3")
    assert result.outputs_prefix == "VisionOne.File_Analysis_Status"
    assert result.outputs_key_field == "message"


def test_get_report_id(mocker):
    """Test to get status of file with report id"""
    mocker.patch("TrendMicroVisionOne.Client.http_request", mock_file_status_response)
    args = {"taskId": "921674d0-9735-4f79-b7de-c852e00a003d"}
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    result = get_file_analysis_status(client, args)
    assert result.outputs["message"] == "Success"
    assert result.outputs["code"] == "Success"
    assert result.outputs["report_id"] == ("012e4eac-9bd9-4e89-95db-77e02f75a6f3")
    assert result.outputs_prefix == "VisionOne.File_Analysis_Status"
    assert result.outputs_key_field == "message"


# Mock response for Get file analysis report
def mock_file_report_response(*args, **kwargs):
    return_response = {
        "code": "Success",
        "message": "Success",
        "data": [
            {
                "type": "ip",
                "value": "6.6.6.6",
                "riskLevel": "high",
                "analysisCompletionTime": "2021-05-07T03:08:40Z",
                "expiredTime": "2021-06-07T03:08:40Z",
                "rootFileSha1": "fb5608fa03de204a12fe1e9e5275e4a682107471",
            }
        ],
    }
    return return_response


# Test cases for get file analysis report
def test_get_file_analysis_report(mocker):
    """Test get file analysis report data."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", mock_file_report_response)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "reportId": "800f908d-9578-4333-91e5-822794ed5483",
        "type": "suspiciousObject",
    }
    result = get_file_analysis_report(client, args)
    assert result.outputs["message"] == "Success"
    assert result.outputs["code"] == "Success"
    assert isinstance(result.outputs["data"][0]["type"], str)
    assert isinstance(result.outputs["data"][0]["value"], str)
    assert isinstance(result.outputs["data"][0]["risk_level"], str)
    assert isinstance(result.outputs["data"][0]["analysis_completion_time"], str)
    assert isinstance(result.outputs["data"][0]["expired_time"], str)
    assert isinstance(result.outputs["data"][0]["root_file_sha1"], str)


def test_get_file_analysis_report_1(mocker):
    """Test get file analysis report data."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", mock_file_report_response)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "reportId": "800f908d-9578-4333-91e5-822794ed5483",
        "type": "suspiciousObject",
    }
    result = get_file_analysis_report(client, args)
    assert result.outputs["message"] == "Success"
    assert result.outputs["code"] == "Success"
    assert len(result.outputs["data"]) > 0


# Mock function for isolate and restore endpoint
def mock_collect_file(*args, **kwargs):
    return_value = {
        "status": "string",
        "actionId": "88139521",
        "taskStatus": "pending",
        "result": {
            "computerId": "string",
        },
        "data": {
            "createdTime": 1589525651,
            "executedTime": 1589525725,
            "finishedTime": 1589525725,
            "taskStatus": "success",
            "error": {},
        },
    }
    return return_value


# Test cases for collect forensic file.
def test_collect_forensic_file(mocker):
    """Test collect file with positive scenario."""
    mocker.patch("TrendMicroVisionOne.Client.http_request", mock_collect_file)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {
        "endpoint": "hostname",
        "description": "collect file",
        "productId": "sao",
        "filePath": ("/file_path/sample.txt"),
        "os": "linux",
    }
    result = collect_file(client, args)
    assert result.outputs["taskStatus"] == "pending"
    assert isinstance(result.outputs["actionId"], str)
    assert result.outputs_prefix == "VisionOne.Collect_Forensic_File"
    assert result.outputs_key_field == "actionId"


# Mock for downloaded file information
def mock_download_collected_file_info_response(*args, **kwargs):
    return_response = {
        "data": {
            "url": "string",
            "expires": "2011-10-05T14:48:00.000Z",
            "password": "string",
            "filename": "string",
        }
    }
    return return_response


# Test Cases for Collected downloaded file information.
def test_get_forensic_file_information(mocker):
    """Test endpoint to get collected file infomation based on action id"""
    mocker.patch(
        "TrendMicroVisionOne.Client.http_request",
        mock_download_collected_file_info_response,
    )
    args = {"actionId": "00000700"}
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    result = download_information_collected_file(client, args)
    assert isinstance(result.outputs["url"], str)
    assert isinstance(result.outputs["expires"], str)
    assert isinstance(result.outputs["password"], str)
    assert isinstance(result.outputs["filename"], str)


# Mock response for submit file to sandbox.
def mock_submit_file_to_sandbox_reponse(*args, **kwargs):
    return_response = {
        "code": "Success",
        "message": "Success",
        "data": {
            "taskId": "012e4eac-9bd9-4e89-95db-77e02f75a6f3",
            "digest": {
                "md5": "4ac174730d4143a119037d9fda81c7a9",
                "sha1": "fb5608fa03de204a12fe1e9e5275e4a682107471",
                "sha256": ("65b0f656e79ab84ca17807158e3eac206bd58be6689ddeb95956a48748d138f9"),
            },
        },
    }
    return return_response


# Mock response for submit file to sandbox.
def mocked_requests_get(*args, **kwargs):
    class MockResponse:
        def __init__(self, json_data, status_code, content):
            self.json_data = json_data
            self.status_code = status_code
            self.content = content

        def json(self):
            return self.json_data

    if args[0] == "http://someurl.com/test.json":
        return MockResponse({"key1": "value1"}, 200, "response")
    elif args[0] == "http://someotherurl.com/anothertest.json":
        return MockResponse({"key2": "value2"}, 200, "response")

    return MockResponse(None, 404, None)


# Mock response for submit file to sandbox.
def mocked_requests_post(*args, **kwargs):
    class MockResponse:
        def __init__(self, json_data, status_code, content):
            self.json_data = json_data
            self.status_code = status_code
            self.content = content

        def json(self):
            return {
                "code": "Success",
                "message": "Success",
                "data": {
                    "taskId": "012e4eac-9bd9-4e89-95db-77e02f75a6f3",
                    "digest": {
                        "md5": "4ac174730d4143a119037d9fda81c7a9",
                        "sha1": "fb5608fa03de204a12fe1e9e5275e4a682107471",
                        "sha256": (
                            "65b0f656e79ab84ca17807158e3ea",
                            "c206bd58be6689ddeb95956a48748d138f9",
                        ),
                    },
                },
            }

        def raise_for_status(self):
            return True

    if args[0] == "http://someurl.com/test.json":
        return MockResponse({"key1": "value1"}, 200, "response")
    elif args[0] == "http://someotherurl.com/anothertest.json":
        return MockResponse({"key2": "value2"}, 200, "response")

    return MockResponse(None, 404, None)


def test_submit_file_to_sandbox(mocker):
    mocker.patch("TrendMicroVisionOne.requests.get", mocked_requests_get)
    mocker.patch("TrendMicroVisionOne.requests.post", mocked_requests_post)
    args = {
        "fileUrl": "http://adsd.com",
        "fileName": "XDR_ResponseApp_CollectFile_ID00000700_20211206T134158Z.7z",
        "archivePassword": "6hn467c8",
        "documentPassword": "",
    }
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    result = submit_file_to_sandbox(client, args)
    assert result.outputs["message"] == "Success"
    assert result.outputs["code"] == "Success"


# Test Cases for Submit file entry to sandbox.
def test_submit_file_entry_to_sandbox(mocker):
    mocker.patch.object(
        demisto,
        "getFilePath",
        return_value={"id": id, "path": "README.md", "name": "test.txt"},
    )
    mocker.patch("TrendMicroVisionOne.requests.get", mocked_requests_get)
    mocker.patch("TrendMicroVisionOne.requests.post", mocked_requests_post)
    args = {
        "entry_id": "123@1221",
        "archivePassword": "6hn467c8",
        "documentPassword": "",
    }
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    result = submit_file_entry_to_sandbox(client, args)
    assert result.outputs["message"] == "Success"
    assert result.outputs["code"] == "Success"


# Test Cases for Sandbox submission polling
def test_sandbox_submission_polling(mocker):
    """Test to get status of sandbox submission"""
    mocker.patch.object(
        demisto,
        "demistoVersion",
        return_value={"version": "6.2.0", "buildNumber": "12345"},
    )
    mocker.patch("TrendMicroVisionOne.Client.http_request", mock_file_status_response)
    args = {"task_id": "921674d0-9735-4f79-b7de-c852e00a003d"}
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    result = get_sandbox_submission_status(args, client)
    assert result.outputs["message"] == "Success"
    assert result.outputs["code"] == "Success"
    assert result.outputs["task_id"] == "012e4eac-9bd9-4e89-95db-77e02f75a6f3"
    assert result.outputs["taskStatus"] == "finished"
    assert result.outputs["report_id"] == ("012e4eac-9bd9-4e89-95db-77e02f75a6f3")
    assert result.outputs_prefix == "VisionOne.Sandbox_Submission_Polling"
    assert result.outputs_key_field == "report_id"


# Mock function for check task status
def check_task_status_mock_response(*args, **kwargs):
    return_value = {
        "data": {
            "createdTime": 1589525651,
            "executedTime": 1589525725,
            "finishedTime": 1589525725,
            "taskStatus": "success",
            "error": {},
        }
    }
    return return_value


def test_check_task_status(mocker):
    mocker.patch("TrendMicroVisionOne.Client.http_request", check_task_status_mock_response)
    mocker.patch("CommonServerPython.ScheduledCommand.raise_error_if_not_supported", lambda: None)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {"actionId": "00001108"}
    result = get_task_status(args, client)
    assert result.outputs["taskStatus"] == "success"


# Mock for downloaded file information
def mock_get_endpoint_info_response(*args, **kwargs):
    return_response = {
        "status": "SUCCESS",
        "errorCode": 0,
        "message": "message",
        "result": {
            "logonAccount": {"value": ["DOMAIN\\username"], "updateAt": 0},
            "hostname": {"value": "hostname", "updateAt": 0},
            "macAddr": {"value": "00:11:22:33:44:55", "updateAt": 0},
            "ip": {"value": "192.168.1.1", "updateAt": 0},
            "osName": "Windows",
            "osVersion": "10.0.19042",
            "osDescription": "Windows 10 Pro (64 bit) build 19042",
            "productCode": "xes",
        },
    }
    return return_response


# Test case for get endpoint information.
def test_get_endpoint_information(mocker):
    """Test get information from endpoint based on computerid"""
    mocker.patch("TrendMicroVisionOne.Client.http_request", mock_get_endpoint_info_response)
    args = {"endpoint": "hostname"}
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    result = get_endpoint_info(client, args)
    assert result.outputs["status"] == "SUCCESS"
    assert isinstance(result.outputs["message"], str)
    assert isinstance(result.outputs["hostname"], str)
    assert isinstance(result.outputs["ip"], str)
    assert isinstance(result.outputs["macAddr"], str)
    assert isinstance(result.outputs["osDescription"], str)
    assert isinstance(result.outputs["osName"], str)
    assert isinstance(result.outputs["osVersion"], str)
    assert isinstance(result.outputs["productCode"], str)


# Mock function for add note.
def add_note_mock_response(*args, **kwargs):
    return_value = {
        "data": {"id": 123},
        "info": {"code": 3021000, "msg": "Alert notes added successfully."},
    }
    return return_value


# Test case for add note
def test_add_note(mocker):
    mocker.patch("TrendMicroVisionOne.Client.http_request", add_note_mock_response)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {"workbench_id": "WB-20837-20220418-00000", "content": "This is a new note."}
    result = add_note(client, args)
    assert result.outputs["response_msg"] == "Alert notes added successfully."
    assert isinstance(result.outputs["Workbench_Id"], str)
    assert isinstance(result.outputs["noteId"], int)
    assert isinstance(result.outputs["response_code"], int)


# Mock function for update alert status
def update_status_mock_response(*args, **kwargs):
    return_value = {
        "data": {},
        "info": {"code": 3006000, "msg": "Alert status changed successfully."},
    }
    return return_value


# Test case for update alert status
def test_update_status(mocker):
    mocker.patch("TrendMicroVisionOne.Client.http_request", update_status_mock_response)
    client = Client("https://api.xdr.trendmicro.com", api_key, proxy, verify)
    args = {"workbench_id": "WB-20837-20220418-00000", "status": "in_progress"}
    result = update_status(client, args)
    assert result.outputs["response_msg"] == "Alert status changed successfully."
    assert isinstance(result.outputs["Workbench_Id"], str)
    assert isinstance(result.outputs["response_code"], int)