AbuseIPDBPopulateIndicators
Extracts IP addresses on block lists from AbuseIPDB, and Populates Indicators accordingly.
python · AbuseIPDB
Details
| ID | AbuseIPDBPopulateIndicators |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
README
Extracts IP addresses on block lists from AbuseIPDB, and populates indicators accordingly.
Script Data
| Name | Description |
|---|---|
| Script Type | python |
| Tags |
Dependencies
This script uses the following commands and scripts.
- createNewIndicator
- abuseipdb-get-blacklist
Inputs
| Argument Name | Description |
|---|---|
| days | The time range to return reports for (in days). The default is 30. |
| limit | The maximum number of IP addressess to retrieve. The default is 50 |
| confidence | The Minimum confidence required for the retrieved IPs. The default is 100. |
Outputs
There are no outputs for this script.
import demistomock as demisto import pytest from CommonServerPython import * @pytest.mark.parametrize( "return_val, expected", [ (None, None), (["1.1.1.1"], ["1.1.1.1"]), (["1.1.1.1", "2.2.2.2"], ["1.1.1.1", "2.2.2.2"]), ], ) def test_get_contents(mocker, return_val, expected): """ Given: - All relevant arguments are passed When: - abuseipdb-get-blacklist command is executed in get_contents function Then: - Check if get_contents return value is valid """ from AbuseIPDBPopulateIndicators import get_contents mocker.patch("AbuseIPDBPopulateIndicators.execute_command", return_value=return_val) assert get_contents({}) == expected @pytest.mark.parametrize("input", ["Too many requests", None]) def test_check_ips_fail(input): """ Given: - Invalid argument is passed When: - check_ips function is executed Then: - Raise DemistoException """ from AbuseIPDBPopulateIndicators import check_ips with pytest.raises(DemistoException) as e: check_ips(input) assert str(e.value) == "No Indicators were created (possibly bad API key)" def test_check_ips(): """ Given: - Valid argument is passed When: - check_ips function is executed Then: - Return None """ from AbuseIPDBPopulateIndicators import check_ips assert check_ips(["1.1.1.1"]) is None def test_main(mocker): """ Given: - All return values from helper functions are valid When: - main function is executed Then: - Return results to War-Room """ from AbuseIPDBPopulateIndicators import main mocker.patch.object(demisto, "args", return_value={"days": 30, "limit": 200, "confidence": 100}) mocker.patch("AbuseIPDBPopulateIndicators.execute_command", return_value=None) mocker.patch("AbuseIPDBPopulateIndicators.get_contents", return_value=["1.1.1.1"]) return_results_mock = mocker.patch("AbuseIPDBPopulateIndicators.return_results") main() return_results_mock.assert_called_with("All Indicators were created successfully")