Uptycs

import demistomock as demisto

"""GLOBAL VARS"""

CUSTOMER_ID = "08c9f30e-5233-49d7-93ab-5b7c04ff97e9"
KEY = "OE5JFSEORJGXZPXANA4QHRMDMGVCC5CQ"
SECRET = "Y4SrBv/J/hqQQ8Rzxs2HErfm88WuEhR2XGsrphuPu5pQZNLHhGXmscnQfChOHzyE"
DOMAIN = "teststack.uptycs.io"


def test_uptycs_get_carves(mocker, requests_mock):
    """
    Tests uptycs-get-carves command function.

        Given:
            - requests_mock instance to generate the appropriate carves API
              response when the correct uptycs-get-carves API request is performed.

        When:
            - Running the 'uptycs-get-carves'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_carves_source_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "id": "e037cb0b-e9b0-4061-8966-5d3404cef9f6",
                "assetId": "2fb29ec9-5c16-4021-af7c-65528fead280",
                "path": "/etc/hosts",
                "createdAt": "2023-05-19T06:58:12.304Z",
                "updatedAt": "2023-05-19T06:58:13.576Z",
                "status": "FINISHED",
                "assetHostName": "uptycs-testhost",
                "offset": 0,
                "length": 197,
                "deletedUserName": "",
                "deletedAt": "",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/carves"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_carves_source_command()

    assert response["Contents"] == mock_response


def test_uptycs_get_carves_link(mocker, requests_mock):
    """
    Tests uptycs_get_carves_link_command command function.

        Given:
            - requests_mock instance to generate the appropriate carves link API
              response when the correct uptycs-get-carves-link API request is performed.

        When:
            - Running the 'uptycs-get-carves-link'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_carves_file_command, uptycs_get_carves_link_command

    carve_id = "e037cb0b-e9b0-4061-8966-5d3404cef9f6"

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mocker.patch.object(demisto, "args", return_value={"carve_id": carve_id})

    mock_response = {
        "url": f"https://uptycs-carves-testing.s3.us-west-2.amazonaws.com/{CUSTOMER_ID}/testurl?"  # disable-secrets-detection
    }
    access_control_headers = [
        "x-amz-server-side-encryption-customer-algorithm",
        "x-amz-server-side-encryption-customer-key",
        "x-amz-server-side-encryption-customer-key-md5",
        "x-requested-with",
    ]
    for header in access_control_headers:
        mock_response["url"] += header + "=" + "testvalue&"
    mock_response["url"] = mock_response["url"][:-1]

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/carves/{carve_id}/link"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_carves_link_command()
    assert response["Contents"] == mock_response

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/carves/{carve_id}/link"
    requests_mock.get(test_url, json=mock_response)

    with open("test_data/blob.tar", "rb") as file_mock:
        requests_mock.get(mock_response["url"], content=file_mock.read())

    result = uptycs_get_carves_file_command()
    assert result is None


def test_uptycs_get_assets(mocker, requests_mock):
    """
    Tests uptycs-get-assets command function.

        Given:
            - requests_mock instance to generate the appropriate assets API
              response when the correct uptycs-get-assets API request is performed.

        When:
            - Running the 'uptycs-get-assets'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_assets_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    mocker.patch.object(demisto, "args", return_value={"os": "mac", "host_name_like": "work", "object_group_id": "test"})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "status": "active",
                "last_enrolled_at": "2019-07-19 14:47:27.485",
                "os_version": "10.14.5",
                "osquery_version": "3.2.6.51-Uptycs",
                "created_at": "2018-09-25 16:38:16.440",
                "longitude": -97.822,
                "os_flavor": "darwin",
                "host_name": "kyle-mbp-work",
                "latitude": 37.751,
                "last_activity_at": "2019-07-19 17:02:41.704",
                "os": "Mac OS X",
                "id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "location": "United States",
            }
        ]
    }
    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_assets_command()

    assert response["Contents"] == mock_response["items"]


def test_uptycs_get_asset_with_id(mocker, requests_mock):
    """
    Tests uptycs-get-asset-with-id command function.

        Given:
            - requests_mock instance to generate the appropriate assets API
              response when the correct uptycs-get-asset-with-id API request is performed.

        When:
            - Running the 'uptycs-get-asset-with-id'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_asset_id_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    asset_id = "984d4a7a-9f3a-580a-a3ef-2841a561669b"
    mocker.patch.object(demisto, "args", return_value={"asset_id": asset_id})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "status": "active",
        "live": True,
        "disabled": False,
        "quarantinedStatus": False,
        "lastEnrolledAt": "2019-07-19 14:47:27.485",
        "osVersion": "10.14.5",
        "osqueryVersion": "3.x.x.x-Uptycs",
        "agentVersion": "5.x.x.x-Uptycs",
        "osFlavor": "darwin",
        "hostName": "kyle-mbp-work",
        "gateway": "x.y.z.a",
        "os": "Mac OS X",
        "osKey": "darwin_10.14.5",
        "objectGroupId": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
        "cpuBrand": "Intel(R) Xeon(R) CPU E5-2686 v4 @ 2.30GHz",
        "hardwareModel": "HVM domU",
        "hardwareVendor": "Xen",
        "cores": 2,
        "logicalCores": 2,
        "memoryMb": 8192,
        "arch": "x86_64",
        "osDisplay": "macOS 10.14.5",
        "location": "United States",
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/assets/{asset_id}"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_asset_id_command()
    mock_response["tags"] = ""
    assert response["Contents"] == mock_response


def test_uptycs_get_tag(mocker, requests_mock):
    """
    Tests uptycs-get-tag command function.

        Given:
            - requests_mock instance to generate the appropriate tags API
              response when the correct uptycs-get-tag API request is performed.

        When:
            - Running the 'uptycs-get-tag'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_tag_with_id_source_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    tag_id = "984d4a7a-9f3a-580a-a3ef-2841a561669b"
    mocker.patch.object(demisto, "args", return_value={"tag_id": tag_id})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "tag": "asset-group=Asset test 1",
        "resourceType": "asset",
        "seedId": "14e579e4-3661-4bd6-ace3-082cf6fc4ec5",
        "key": "asset-group",
        "value": "Asset test 1",
        "flagProfileId": "5d894e7c-5606-4380-8711-123ee2a7d96c",
        "customProfileId": "",
        "complianceProfileId": "",
        "processBlockRuleId": "ec272101-e5c1-58b2-f847-c439abdadcf4",
        "dnsBlockRuleId": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
        "windowsDefenderPreferenceId": "",
        "createdBy": "testuser",
        "updatedBy": "testuser",
        "createdAt": "2019-07-19 14:47:27.485",
        "updatedAt": "2019-07-19 14:47:27.485",
        "status": "active",
        "source": "direct",
        "system": False,
        "custom": False,
        "tagRuleId": "",
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/tags/{tag_id}"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_tag_with_id_source_command()

    assert response["Contents"] == mock_response


def test_uptycs_get_tags(mocker, requests_mock):
    """
    Tests uptycs-get-tags command function.

        Given:
            - requests_mock instance to generate the appropriate tags API
              response when the correct uptycs-get-tags API request is performed.

        When:
            - Running the 'uptycs-get-tags'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_tags_source_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "tag": "asset-group=Asset test 1",
                "resourceType": "asset",
                "seedId": "14e579e4-3661-4bd6-ace3-082cf6fc4ec5",
                "key": "asset-group",
                "value": "Asset test 1",
                "flagProfileId": "5d894e7c-5606-4380-8711-123ee2a7d96c",
                "customProfileId": "",
                "complianceProfileId": "",
                "processBlockRuleId": "ec272101-e5c1-58b2-f847-c439abdadcf4",
                "dnsBlockRuleId": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "windowsDefenderPreferenceId": "",
                "createdBy": "testuser",
                "updatedBy": "testuser",
                "createdAt": "2019-07-19 14:47:27.485",
                "updatedAt": "2019-07-19 14:47:27.485",
                "status": "active",
                "source": "direct",
                "system": False,
                "custom": False,
                "tagRuleId": "",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/tags"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_tags_source_command()

    assert response["Contents"] == mock_response


def test_uptycs_get_lookuptable(mocker, requests_mock):
    """
    Tests uptycs-get-lookuptable command function.

        Given:
            - requests_mock instance to generate the appropriate lookuptble API
              response when the correct uptycs-get-lookuptable API request is performed.

        When:
            - Running the 'uptycs-get-lookuptable'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_lookuptable_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    table_id = "984d4a7a-9f3a-580a-a3ef-2841a561669b"
    mocker.patch.object(demisto, "args", return_value={"table_id": table_id})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "active": True,
        "createdAt": "2023-04-21T08:27:20.888Z",
        "createdBy": "f976bda8-d5dc-468f-8283-20d5368352e2",
        "dataLookupTable": "",
        "description": "look up table with remote address",
        "fetchRowsquery": "SELECT id_field_value,data FROM upt_lookup_rows",
        "forRuleEngine": "",
        "idField": "remote_address",
        "name": "test_table_new",
        "rowCount": 24,
        "seedId": "",
        "updatedAt": "2023-04-25T04:11:04.664Z",
        "updatedBy": "f976bda8-d5dc-468f-8283-20d5368352e2",
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/lookupTables/{table_id}"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_lookuptable_command()

    assert response["Contents"] == mock_response


def test_uptycs_get_lookuptables(mocker, requests_mock):
    """
    Tests uptycs-get-lookuptables command function.

        Given:
            - requests_mock instance to generate the appropriate lookuptble API
              response when the correct uptycs-get-lookuptables API request is performed.

        When:
            - Running the 'uptycs-get-lookuptables'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_lookuptables_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "active": True,
                "createdAt": "2023-04-21T08:27:20.888Z",
                "createdBy": "f976bda8-d5dc-468f-8283-20d5368352e2",
                "dataLookupTable": "",
                "description": "look up table with remote address",
                "fetchRowsquery": "SELECT id_field_value,data FROM upt_lookup_rows",
                "forRuleEngine": "",
                "id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "idField": "remote_address",
                "name": "test_table_new",
                "rowCount": 24,
                "seedId": "",
                "updatedAt": "2023-04-25T04:11:04.664Z",
                "updatedBy": "f976bda8-d5dc-468f-8283-20d5368352e2",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/lookupTables"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_lookuptables_command()

    assert response["Contents"] == mock_response


def test_uptycs_edit_lookuptable(mocker, requests_mock):
    """
    Tests uptycs-edit-lookuptable command function.

        Given:
            - requests_mock instance to generate the appropriate lookuptble API
              response when the correct uptycs-edit-lookuptable API request is performed.

        When:
            - Running the 'uptycs-edit-lookuptable'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_edit_lookuptable_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    table_id = "984d4a7a-9f3a-580a-a3ef-2841a561669b"
    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "table_id": table_id,
            "name": "test_table_new_1",
            "description": "look up table with new address",
            "active": True,
        },
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "active": True,
        "createdAt": "2023-04-21T08:27:20.888Z",
        "createdBy": "f976bda8-d5dc-468f-8283-20d5368352e2",
        "customerId": "b1c3b08c-eedd-4b94-8ba0-9ca322401016",
        "dataLookupTable": "",
        "description": "look up table with new address",
        "fetchRowsquery": "SELECT id_field_value,data FROM upt_lookup_rows",
        "forRuleEngine": "",
        "id": table_id,
        "idField": "remote_address",
        "name": "test_table_new_1",
        "rowCount": 24,
        "seedId": "",
        "updatedAt": "2023-04-25T04:11:04.664Z",
        "updatedBy": "f976bda8-d5dc-468f-8283-20d5368352e2",
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/lookupTables/{table_id}"
    requests_mock.put(test_url, json=mock_response)

    response = uptycs_edit_lookuptable_command()

    assert response["Contents"] == mock_response
    assert response["HumanReadable"] == "Uptycs Edited lookuptable"


def test_uptycs_delete_lookuptable(mocker, requests_mock):
    """
    Tests uptycs-delete-lookuptable command function.

        Given:
            - requests_mock instance to generate the appropriate lookuptble API
              response when the correct uptycs-delete-lookuptable API request is performed.

        When:
            - Running the 'uptycs-delete-lookuptable'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_delete_lookuptable_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    table_id = "984d4a7a-9f3a-580a-a3ef-2841a561669b"
    mocker.patch.object(demisto, "args", return_value={"table_id": table_id})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/lookupTables/{table_id}"
    requests_mock.delete(test_url, json={})

    response = uptycs_delete_lookuptable_command()

    assert response["HumanReadable"] == "Uptycs Deleted lookuptable"


def test_uptycs_delete_assets_tag(mocker, requests_mock):
    """
    Tests uptycs-delete-assets-tag command function.

        Given:
            - requests_mock instance to generate the appropriate assets tag API
              response when the correct uptycs-delete-assets-tag API request is performed.

        When:
            - Running the 'uptycs-delete-assets-tag'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_delete_assets_tag_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    asset_id = "984d4a7a-9f3a-580a-a3ef-2841a561669b"
    tag_id = "984d4a7a-9f3a-580a-a3ef-2841a561669b"
    mocker.patch.object(demisto, "args", return_value={"asset_id": asset_id, "tagId": tag_id})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/assets/tags"
    requests_mock.delete(test_url, json={})

    response = uptycs_delete_assets_tag_command()

    assert response["HumanReadable"] == "Uptycs disassociated assets tags"


def test_uptycs_delete_tag(mocker, requests_mock):
    """
    Tests uptycs-delete-tag command function.

        Given:
            - requests_mock instance to generate the appropriate tag API
              response when the correct uptycs-delete-tag API request is performed.

        When:
            - Running the 'uptycs-delete-tag'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_delete_tag_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    tag_id = "984d4a7a-9f3a-580a-a3ef-2841a561669b"
    mocker.patch.object(demisto, "args", return_value={"tag_id": tag_id})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/tags/{tag_id}"
    requests_mock.delete(test_url, json={})

    response = uptycs_delete_tag_command()

    assert response["HumanReadable"] == "Uptycs Deleted tag"


def test_uptycs_get_threat_indicators(mocker, requests_mock):
    """
    Tests uptycs-get-threat-indicators command function.

        Given:
            - requests_mock instance to generate the appropriate threat indicators API
              response when the correct uptycs-get-threat-indicators API request is performed.

        When:
            - Running the 'uptycs-get-threat-indicators'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_threat_indicators_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    mocker.patch.object(demisto, "args", return_value={"limit": "1"})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "indicator": "54.165.17.209",
                "description": "malware.com",
                "threatId": "b3f44b34-f6a1-46bc-88f1-9755e3ac1a65",
                "indicatorType": "IPv4",
                "createdAt": "2019-07-19T16:44:17.511Z",
                "id": "8e54f94c-469a-4737-9eef-4e650a93ab58",
                "isActive": True,
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/threatIndicators?limit=1"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_threat_indicators_command()

    assert response["Contents"] == mock_response


def test_uptycs_get_threat_indicator(mocker, requests_mock):
    """
    Tests uptycs-get-threat-indicator command function.

        Given:
            - requests_mock instance to generate the appropriate threat indicators API
              response when the correct uptycs-get-threat-indicator API request is performed.

        When:
            - Running the 'uptycs-get-threat-indicator'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_threat_indicator_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    indicator_id = "0ab619bb-cfe0-4db0-8a31-0a71fcc2a362"
    mocker.patch.object(demisto, "args", return_value={"indicator_id": indicator_id})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "indicator": "92.242.140.21",
        "description": "nishant.uptycs.io",
        "threatId": "60e2e9eb-f756-4a4d-a85d-55aa8167d59d",
        "indicatorType": "IPv4",
        "createdAt": "2019-01-10T21:25:49.280Z",
        "updatedAt": "2019-01-10T21:25:49.280Z",
        "id": indicator_id,
        "isActive": True,
        "threat": {"threatSourceId": "testsourceid", "threatSource": {"threatVendorId": "testvendor", "name": "testsource"}},
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/threatIndicators/{indicator_id}"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_threat_indicator_command()
    mock_response["threat_source_id"] = "testsourceid"
    mock_response["threat_vendor_id"] = "testvendor"
    mock_response["threat_source_name"] = "testsource"
    del mock_response["threat"]
    assert response["Contents"] == mock_response


def test_uptycs_get_threat_source(mocker, requests_mock):
    """
    Tests uptycs-get-threat-source command function.

        Given:
            - requests_mock instance to generate the appropriate threat source API
              response when the correct uptycs-get-threat-source API request is performed.

        When:
            - Running the 'uptycs-get-threat-source'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_threat_source_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    threat_source_id = "0ab619bb-cfe0-4db0-8a31-0a71fcc2a362"
    mocker.patch.object(demisto, "args", return_value={"threat_source_id": threat_source_id})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "name": "AlienVault Open Threat Exchange Malicious Domains and IPs",
        "url": "4533da856e43f06ee00bb5f1adf170a0ce5cacaca5992ab1279733c2bdd0a88c",
        "enabled": True,
        "custom": False,
        "lastDownload": "2019-05-13T01:00:05.934Z",
        "createdAt": "2019-05-12T01:01:04.154Z",
        "description": "A feed of malicious domains and IP addresses",
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/threatSources/{threat_source_id}"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_threat_source_command()

    assert response["Contents"] == mock_response


def test_uptycs_get_threat_sources(mocker, requests_mock):
    """
    Tests uptycs-get-threat-sources command function.

        Given:
            - requests_mock instance to generate the appropriate threat source API
              response when the correct uptycs-get-threat-sources API request is performed.

        When:
            - Running the 'uptycs-get-threat-sources'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_threat_sources_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    mocker.patch.object(demisto, "args", return_value={"limit": "1"})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "name": "AlienVault Open Threat Exchange Malicious Domains and IPs",
                "url": "4533da856e43f06ee00bb5f1adf170a0ce5cacaca5992ab1279733c2bdd0a88c",
                "enabled": True,
                "custom": False,
                "lastDownload": "2019-05-13T01:00:05.934Z",
                "createdAt": "2019-05-12T01:01:04.154Z",
                "description": "A feed of malicious domains and IP addresses",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/threatSources?limit=1"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_threat_sources_command()

    assert response["Contents"] == mock_response


def test_uptycs_get_threat_vendors(mocker, requests_mock):
    """
    Tests uptycs-get-threat-vendors command function.

        Given:
            - requests_mock instance to generate the appropriate threat vendors API
              response when the correct uptycs-get-threat-vendors API request is performed.

        When:
            - Running the 'uptycs-get-threat-vendors'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_threat_vendors_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    mocker.patch.object(demisto, "args", return_value={"limit": "1"})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "name": "Bschmoll Inc.-Threats",
                "url": "testurl",
                "updatedAt": "2018-11-20T19:15:05.611Z",
                "customerId": "e8213ef3-ef92-460e-a542-46dccd700c16",
                "numThreats": 1,
                "numIocs": 0,
                "lastDownload": "2018-11-20T19:15:05.611Z",
                "id": "42b9220c-7e29-4fd8-9cf7-9f811e851f8e",
                "createdAt": "2018-11-20T19:15:05.611Z",
                "description": "Uptycs threat vendor",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/threatVendors?limit=1"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_threat_vendors_command()

    assert response["Contents"] == mock_response["items"]


def test_uptycs_get_alerts(mocker, requests_mock):
    """
    Tests uptycs-get-alerts command function.

        Given:
            - requests_mock instance to generate the appropriate alerts API
              response when the correct uptycs-get-alerts API request is performed.

        When:
            - Running the 'uptycs-get-alerts'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_alerts_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    mocker.patch.object(
        demisto, "args", return_value={"limit": "1", "host_name": "testhost", "time_ago": "1 day", "host_name_like": "test"}
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "status": "open",
                "code": "OSX_CRASHES",
                "description": "Crash",
                "severity": "medium",
                "created_at": "2019-07-02 11:41:25.915",
                "updated_at": "2019-07-02 11:41:25.915",
                "value": "Amazon Music Helper",
                "upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "alert_time": "2019-07-02 11:41:22.000",
                "host_name": "kyle-mbp-work",
                "key": "identifier",
                "assigned_to": "testuser",
                "metadata": '{"type":"application","pid":"437"}',
                "id": "0049641c-1645-4b98-830f-7f1ce783bfcc",
                "grouping": "OS X Crashes",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_alerts_command()

    mock_response["items"][0]["threat_source_name"] = "No threat source for this alert"
    mock_response["items"][0]["pid"] = "437"
    mock_response["items"][0]["threat_indicator_id"] = "No threat indicator for this alert"

    assert response["Contents"] == mock_response


def test_uptycs_get_events(mocker, requests_mock):
    """
    Tests uptycs-get-events command function.

        Given:
            - requests_mock instance to generate the appropriate events API
              response when the correct uptycs-get-events API request is performed.

        When:
            - Running the 'uptycs-get-events'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_events_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    mocker.patch.object(
        demisto, "args", return_value={"limit": "1", "host_name": "testhost", "time_ago": "1 day", "host_name_like": "test"}
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "status": "open",
                "code": "OSX_CRASHES",
                "description": "Crash",
                "severity": "medium",
                "created_at": "2019-07-02 11:41:25.915",
                "value": "Amazon Music Helper",
                "upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "event_time": "2019-07-02 11:41:22.000",
                "host_name": "kyle-mbp-work",
                "key": "identifier",
                "assigned_to": "testuser",
                "id": "0049641c-1645-4b98-830f-7f1ce783bfcc",
                "grouping": "OS X Crashes",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_events_command()

    assert response["Contents"] == mock_response


def test_uptycs_get_alert_rules(mocker, requests_mock):
    """
    Tests uptycs-get-alert-rules command function.

        Given:
            - requests_mock instance to generate the appropriate alert rules API
              response when the correct uptycs-get-alert-rules API request is performed.

        When:
            - Running the 'uptycs-get-alert-rules'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_alert_rules_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    mocker.patch.object(demisto, "args", return_value={"limit": "1"})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "name": "Bschmoll Inc.-Threats",
                "code": "test",
                "grouping": "test",
                "enabled": True,
                "updatedAt": "2018-11-20T19:15:05.611Z",
                "description": "Uptycs threat vendor",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/alertRules?limit=1"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_alert_rules_command()

    assert response["Contents"] == mock_response["items"]


def test_uptycs_get_event_rules(mocker, requests_mock):
    """
    Tests uptycs-get-event-rules command function.

        Given:
            - requests_mock instance to generate the appropriate event rules API
              response when the correct uptycs-get-event-rules API request is performed.

        When:
            - Running the 'uptycs-get-event-rules'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_event_rules_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    mocker.patch.object(demisto, "args", return_value={"limit": "1"})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "name": "Bschmoll Inc.-Threats",
                "code": "test",
                "grouping": "test",
                "enabled": True,
                "updatedAt": "2018-11-20T19:15:05.611Z",
                "description": "Uptycs threat vendor",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/eventRules?limit=1"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_event_rules_command()

    assert response["Contents"] == mock_response["items"]


def test_uptycs_get_users(mocker, requests_mock):
    """
    Tests uptycs-get-users and uptycs-get-user-asset-groups command function.

        Given:
            - requests_mock instance to generate the appropriate users API
              response when the correct uptycs-get-users or
              uptycs-get-user-asset-groups API request is performed.

        When:
            - Running the 'uptycs-get-users'.
            - Running the 'uptycs-get-user-asset-groups'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_user_asset_groups_command, uptycs_get_users_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    user_id = "33436e24-f30f-42d0-8438-d948be12b5af"
    object_group_id = "8963abf8-9c8d-4ef5-8a80-af836fe69be4"
    mocker.patch.object(demisto, "args", return_value={"limit": "1", "asset_group_id": object_group_id})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_user = {
        "name": "Bschmoll",
        "id": user_id,
        "email": "goo@test.com",
        "admin": True,
        "active": True,
        "createdAt": "2018-11-20T19:15:05.611Z",
        "updatedAt": "2018-11-20T19:15:05.611Z",
        "userObjectGroups": [{"objectGroupId": object_group_id}],
    }

    mock_response = {}
    mock_response["items"] = [mock_user]

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/users?limit=1"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_users_command()

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/users"
    requests_mock.get(test_url, json=mock_response)

    test_url_extra = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/users/{user_id}"
    requests_mock.get(test_url_extra, json=mock_user)

    asset_groups = uptycs_get_user_asset_groups_command()

    del mock_user["userObjectGroups"]
    assert response["Contents"] == mock_response

    users_in_group = {mock_user["name"]: {"email": mock_user["email"], "id": mock_user["id"]}}

    assert asset_groups["Contents"] == users_in_group


def test_uptycs_get_user_information(mocker, requests_mock):
    """
    Tests uptycs-get-user-information command function.

        Given:
            - requests_mock instance to generate the appropriate users API
              response when the correct uptycs-get-user-information API request is performed.

        When:
            - Running the 'uptycs-get-user-information'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_user_information_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    user_id = "33436e24-f30f-42d0-8438-d948be12b5af"
    mocker.patch.object(demisto, "args", return_value={"user_id": user_id})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "name": "Bschmoll",
        "id": user_id,
        "email": "goo@test.com",
        "userRoles": [{"role": {"name": "admin"}}],
        "userObjectGroups": "testuser",
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/users/{user_id}"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_user_information_command()

    for key in ["name", "id", "email", "userObjectGroups"]:
        assert response["Contents"][key] == mock_response[key]


def test_uptycs_get_asset_groups(mocker, requests_mock):
    """
    Tests uptycs-get-asset-groups command function.

        Given:
            - requests_mock instance to generate the appropriate asset groups API
              response when the correct uptycs-get-asset-groups API request is performed.

        When:
            - Running the 'uptycs-get-asset-groups'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_asset_groups_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    mocker.patch.object(demisto, "args", return_value={"limit": "1"})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "name": "assets",
                "description": "Default asset group",
                "custom": False,
                "updatedAt": "2018-09-24T17:24:45.604Z",
                "id": "106eef5e-c3a6-44eb-bb3d-1a2087cded3d",
                "createdAt": "2018-09-24T17:24:45.604Z",
                "objectType": "ASSET",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/objectGroups?limit=1"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_asset_groups_command()

    assert response["Contents"] == mock_response


def test_uptycs_get_saved_queries(mocker, requests_mock):
    """
    Tests uptycs-get-saved-queries command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-saved-queries API request is performed.

        When:
            - Running the 'uptycs-get-saved-queries'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_saved_queries_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    query_id = "16de057d-6f69-46b0-80d0-46cb9348c8fe"
    query_name = "test_saved_query"
    mocker.patch.object(demisto, "args", return_value={"query_id": query_id, "name": query_name})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "query": "select * from upt_assets limit 1",
                "id": query_id,
                "grouping": "default",
                "description": "this is a test query",
                "name": query_name,
                "executionType": "realtime",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/queries/{query_id}?name={query_name}"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_saved_queries_command()

    assert response["Contents"] == mock_response["items"]


def test_uptycs_run_saved_query(mocker, requests_mock):
    """
    Tests uptycs-run-saved-query command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-run-saved-query API request is performed.

        When:
            - Running the 'uptycs-run-saved-query'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_run_saved_query_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )
    query_id = "16de057d-6f69-46b0-80d0-46cb9348c8fe"
    query_name = "test_saved_query"
    mocker.patch.object(demisto, "args", return_value={"query_id": query_id, "name": query_name, "host_name_like": "test"})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    mock_response = {
        "items": [
            {
                "query": "select * from upt_assets limit 1",
                "id": query_id,
                "grouping": "default",
                "description": "this is a test query",
                "name": query_name,
                "executionType": "realtime",
            }
        ]
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/queries/{query_id}?name={query_name}"
    requests_mock.get(test_url, json=mock_response)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/assets/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_run_saved_query_command()
    assert response["Contents"] == mock_response["items"]


def test_uptycs_run_query(mocker, requests_mock):
    """
    Tests uptycs-run-query command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-run-query API request is performed.

        When:
            - Running the 'uptycs-run-query'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_run_query_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "query": "select * from upt_assets limit 1",
        "asset_id": "testassetid",
        "description": "this is a test query",
        "name": "test_saved_query",
        "executionType": "realtime",
        "type": "default",
        "custom": True,
    }

    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "name": mock_response["name"],
            "type": mock_response["type"],
            "description": mock_response["description"],
            "execution_type": mock_response["executionType"],
            "query": mock_response["query"],
            "asset_id": mock_response["asset_id"],
        },
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/assets/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_run_query_command()
    assert response["Contents"] == mock_response


def test_uptycs_get_process_open_sockets(mocker, requests_mock):
    """
    Tests uptycs-get-process-open-sockets command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-process-open-sockets API request is performed.

        When:
            - Running the 'uptycs-get-process-open-sockets'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_process_open_sockets_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "items": [
            {
                "protocol": 6,
                "socket": 0,
                "family": 2,
                "local_port": 54755,
                "remote_port": 443,
                "pid": 704,
                "remote_address": "69.147.92.12",
                "upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "upt_time": "2019-07-19 17:03:31.000",
                "state": "ESTABLISHED",
                "upt_hostname": "kyle-mbp-work",
                "path": "",
                "local_address": "192.168.86.61",
            }
        ]
    }

    mocker.patch.object(
        demisto, "args", return_value={"limit": "1", "host_name_is": "testhost", "host_name_like": "test", "time_ago": "1 day"}
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_process_open_sockets_command()
    assert response["Contents"] == mock_response


def test_uptycs_get_process_information(mocker, requests_mock):
    """
    Tests uptycs-get-process-open-information command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-process-information API request is performed.

        When:
            - Running the 'uptycs-get-process-information'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_process_information_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "items": [
            {
                "pid": 5119,
                "parent": 484,
                "upt_hostname": "kyle-mbp-work",
                "path": "/Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless",
                "cmdline": "/Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless",
                "name": "VBoxHeadless",
            }
        ]
    }

    mocker.patch.object(
        demisto, "args", return_value={"pid": "5119", "host_name_is": "testhost", "host_name_like": "test", "time_ago": "1 day"}
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_process_information_command()
    assert response["Contents"] == mock_response


def test_uptycs_get_process_child_processes(mocker, requests_mock):
    """
    Tests uptycs-get-process-child-processes command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-process-child-processes API request is performed.

        When:
            - Running the 'uptycs-get-process-child-processes'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_process_child_processes_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "items": [
            {
                "upt_time": "2019-01-29 16:14:27.000",
                "upt_add_time": "2019-01-29 16:14:27.000",
                "pid": 5119,
                "upt_hostname": "kyle-mbp-work",
                "path": "/Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless",
                "cmdline": "/Applications/VirtualBox.app/Contents/MacOS/VBoxHeadless",
                "name": "VBoxHeadless",
            }
        ]
    }

    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "parent": "5119",
            "limit": "1",
            "asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
            "parent_start_time": "2023-01-28 14:16:58.000",
            "parent_end_time": "2019-01-29 14:16:58.000",
            "time_ago": "1 day",
        },
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_process_child_processes_command()
    assert response["Contents"] == mock_response


def test_uptycs_processes(mocker, requests_mock):
    """
    Tests uptycs-get-processes command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-processes API request is performed.

        When:
            - Running the 'uptycs-get-processes'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_processes_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "items": [
            {
                "name": "SCHelper",
                "parent": 1,
                "upt_time": "2019-07-19 07:29:32.000",
                "pid": 60051,
                "upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "cmdline": "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper",
                "upt_hostname": "kyle-mbp-work",
                "pgroup": 60051,
                "path": "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper",
                "cwd": "/",
            }
        ]
    }

    mocker.patch.object(
        demisto, "args", return_value={"limit": "1", "time_ago": "1 day", "host_name_is": "test", "host_name_like": "test"}
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_processes_command()
    assert response["Contents"] == mock_response


def test_uptycs_process_open_files(mocker, requests_mock):
    """
    Tests uptycs-get-process-open-files command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-process-open-files API request is performed.

        When:
            - Running the 'uptycs-get-process-open-files'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_process_open_files_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "items": [
            {
                "upt_time": "2019-07-19 07:29:32.000",
                "pid": 60051,
                "upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "upt_hostname": "kyle-mbp-work",
                "path": "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper",
                "fd": 35,
            }
        ]
    }

    mocker.patch.object(
        demisto, "args", return_value={"limit": "1", "time_ago": "1 day", "host_name_is": "test", "host_name_like": "test"}
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_process_open_files_command()
    assert response["Contents"] == mock_response


def test_uptycs_process_event_information(mocker, requests_mock):
    """
    Tests uptycs-get-process-event-information command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-process-event-information API request is performed.

        When:
            - Running the 'uptycs-get-process-event-information'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_process_event_information_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "items": [
            {
                "upt_time": "2019-07-19 07:29:32.000",
                "parent": 5001,
                "pid": 60051,
                "upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "upt_hostname": "kyle-mbp-work",
                "path": "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper",
                "cmdline": "xpcproxy com.apple.WebKit.WebContent.024FB342-0ECE-4E09-82E1-B9C9CF5F9CDF 3266",
                "cwd": "/",
            }
        ]
    }

    mocker.patch.object(
        demisto, "args", return_value={"limit": "1", "time_ago": "1 day", "host_name_is": "test", "host_name_like": "test"}
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_process_event_information_command()
    assert response["Contents"] == mock_response


def test_uptycs_process_events(mocker, requests_mock):
    """
    Tests uptycs-get-process-events command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-process-events API request is performed.

        When:
            - Running the 'uptycs-get-process-events'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_process_events_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "items": [
            {
                "upt_time": "2019-07-19 07:29:32.000",
                "parent": 5001,
                "pid": 60051,
                "upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "upt_hostname": "kyle-mbp-work",
                "path": "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper",
                "cmdline": "xpcproxy com.apple.WebKit.WebContent.024FB342-0ECE-4E09-82E1-B9C9CF5F9CDF 3266",
                "cwd": "/",
            }
        ]
    }

    mocker.patch.object(
        demisto, "args", return_value={"limit": "1", "time_ago": "1 day", "host_name_is": "test", "host_name_like": "test"}
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_process_events_command()
    assert response["Contents"] == mock_response


def test_uptycs_socket_events(mocker, requests_mock):
    """
    Tests uptycs-get-socker-events command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-socker-events API request is performed.

        When:
            - Running the 'uptycs-get-socket-events'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_socket_events_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "items": [
            {
                "upt_time": "2019-07-19 07:29:32.000",
                "family": 2,
                "pid": 60051,
                "local_port": 47873,
                "remote_port": "",
                "protocol": "",
                "socket": "",
                "remote_address": "17.142.171.8",
                "local_address": "0.0.0.0",
                "upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "upt_hostname": "kyle-mbp-work",
                "path": "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper",
                "action": "connect",
            }
        ]
    }

    mocker.patch.object(
        demisto, "args", return_value={"limit": "1", "time_ago": "1 day", "host_name_is": "test", "host_name_like": "test"}
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_socket_events_command()
    assert response["Contents"] == mock_response


def test_uptycs_parent_event_information(mocker, requests_mock):
    """
    Tests uptycs-get-parent-event-information command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-parent-event-information API request is performed.

        When:
            - Running the 'uptycs-get-parent-event-information'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_parent_event_information_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "items": [
            {
                "upt_time": "2019-07-19 07:29:32.000",
                "parent": 5005,
                "pid": 60051,
                "upt_hostname": "kyle-mbp-work",
                "upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "path": "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper",
                "cmdline": "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper",
                "cwd": "",
            }
        ]
    }

    mocker.patch.object(
        demisto, "args", return_value={"limit": "1", "time_ago": "1 day", "host_name_is": "test", "host_name_like": "test"}
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_parent_event_information_command()
    assert response["Contents"] == mock_response


def test_uptycs_socket_event_information(mocker, requests_mock):
    """
    Tests uptycs-get-socket-event-information command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-socket-event-information API request is performed.

        When:
            - Running the 'uptycs-get-socket-event-information'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_socket_event_information_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "items": [
            {
                "upt_time": "2019-07-19 07:29:32.000",
                "family": 2,
                "pid": 60051,
                "local_port": 47873,
                "remote_port": "",
                "protocol": "",
                "socket": "",
                "remote_address": "17.142.171.8",
                "local_address": "0.0.0.0",
                "upt_asset_id": "984d4a7a-9f3a-580a-a3ef-2841a561669b",
                "upt_hostname": "kyle-mbp-work",
                "path": "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/Helpers/SCHelper",
                "action": "connect",
            }
        ]
    }

    mocker.patch.object(
        demisto, "args", return_value={"limit": "1", "time_ago": "1 day", "host_name_is": "test", "host_name_like": "test"}
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/query"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_get_socket_event_information_command()
    assert response["Contents"] == mock_response


def test_uptycs_get_asset_tags(mocker, requests_mock):
    """
    Tests uptycs-get-asset-tags command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-get-asset-tags API request is performed.

        When:
            - Running the 'uptycs-get-asset-tags'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_get_asset_tags_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "tags": ["Uptycs=work laptop", "owner=Uptycs office", "network=low", "cpu=unknown", "memory=unknown", "disk=high"]
    }

    asset_id = "984d4a7a-9f3a-580a-a3ef-2841a561669b"
    mocker.patch.object(demisto, "args", return_value={"asset_id": asset_id})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/assets/{asset_id}"
    requests_mock.get(test_url, json=mock_response)

    response = uptycs_get_asset_tags_command()
    assert response["Contents"] == mock_response["tags"]


def test_uptycs_set_alert_status(mocker, requests_mock):
    """
    Tests uptycs-set-alert-status command function.

        Given:
            - requests_mock instance to generate the appropriate queries API
              response when the correct uptycs-set-alert-status API request is performed.

        When:
            - Running the 'uptycs-set-alert-status'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_set_alert_status_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    mock_response = {
        "status": "assigned",
        "code": "OUTBOUND_CONNECTION_TO_THREAT_IOC",
        "updatedAt": "2019-07-19T17:07:27.447Z",
        "id": "9cb18abd-2c9a-43a8-988a-0601e9140f6c",
        "createdAt": "2019-02-22T21:13:21.238Z",
        "updatedByUser": {"name": "B schmoll", "admin": "True", "email": "goo@test.com"},
    }

    mocker.patch.object(demisto, "args", return_value={"alert_id": "testalert", "status": "open"})

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/alerts/testalert"
    requests_mock.put(test_url, json=mock_response)

    response = uptycs_set_alert_status_command()

    del mock_response["updatedByUser"]
    mock_response["updatedByEmail"] = "goo@test.com"
    mock_response["updatedByAdmin"] = "True"
    mock_response["updatedBy"] = "B schmoll"

    assert response["Contents"] == mock_response


def test_uptycs_create_lookuptable(mocker, requests_mock):
    """
    Tests uptycs-create-lookuptable command function.

        Given:
            - requests_mock instance to generate the appropriate lookuptble API
              response when the correct uptycs-create-lookuptable API request is performed.

        When:
            - Running the 'uptycs-create-lookuptable'.
            - Running the 'uptycs_post_lookuptable_data_source_command'.

        Then:
            -  Checks the output of the command function with the expected output.

    """
    from Uptycs import uptycs_post_lookuptable_data_source_command, uptycs_post_new_lookuptable_command

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "key": KEY,
            "secret": SECRET,
            "domain": DOMAIN,
            "customer_id": CUSTOMER_ID,
            "proxy": "false",
            "fetch_time": "7 days",
        },
    )

    table_id = "984d4a7a-9f3a-580a-a3ef-2841a561669b"
    id_field = "remote_address"
    description = "look up table with remote address"
    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "name": "test_table_new",
            "id_field": id_field,
            "description": description,
            "table_id": table_id,
            "filename": "test_data/look_up_table_test.csv",
        },
    )

    mocker.patch("Uptycs.KEY", new=KEY)
    mocker.patch("Uptycs.SECRET", new=SECRET)
    mocker.patch("Uptycs.CUSTOMER_ID", new=CUSTOMER_ID)
    mocker.patch("Uptycs.DOMAIN", new=DOMAIN)
    # Mocking demisto.getFilePath
    mocker.patch.object(demisto, "getFilePath", return_value={"path": "./test_data/look_up_table_test.csv"})

    mock_response = {
        "active": True,
        "createdAt": "2023-04-21T08:27:20.888Z",
        "createdBy": "f976bda8-d5dc-468f-8283-20d5368352e2",
        "dataLookupTable": "",
        "description": description,
        "fetchRowsquery": "SELECT id_field_value,data FROM upt_lookup_rows",
        "forRuleEngine": "",
        "idField": id_field,
        "name": "test_table_new",
        "rowCount": 24,
        "seedId": "",
        "updatedAt": "2023-04-25T04:11:04.664Z",
        "updatedBy": "f976bda8-d5dc-468f-8283-20d5368352e2",
        "id": table_id,
    }

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/lookupTables"
    requests_mock.post(test_url, json=mock_response)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/lookupTables/{table_id}/csvdata"
    requests_mock.post(test_url, json=mock_response)

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/lookupTables/{table_id}"
    requests_mock.put(test_url, json=mock_response)

    response = uptycs_post_new_lookuptable_command()

    assert response["Contents"] == mock_response

    test_url = f"https://{DOMAIN}/public/api/customers/{CUSTOMER_ID}/lookupTables/{table_id}/csvdata"
    requests_mock.post(test_url, json=mock_response)

    response = uptycs_post_lookuptable_data_source_command()

    assert response["Contents"] == mock_response