CheckTags

Check DomainTools domain tags and if a tag is found mark incident as high severity.

python · DomainTools Iris Investigate

Details

IDCheckTags
Languagepython
From Version6.6.0
Docker Imagedemisto/python3:3.12.13.10116658
TagsDomainTools

README

Check DomainTools domain tags and if a tag is found mark incident as high severity

Script Data

Name Description
Script Type python3
Tags DomainTools
Cortex XSOAR Version 6.9.0

Inputs

Argument Name Description
incident_id Incident ID
domain_tags Array of tags in the form of [{‘label’: ‘tag1’},{‘label’: ‘tag2’},{‘label’: ‘tag3’}]
malicious_tags Comma-seperated value of malicious tags to check. tag1,tag2,tag3

Outputs

There are no outputs for this script.

Source

CheckTags.py CheckTags_test.py CheckTags.yml
Download History Raw 
from CheckTags import main
from CommonServerPython import *


def test_check_tags_tags_match(mocker):
    domain_tags = [{"label": "mal1"}, {"label": "cool1"}]
    malicious_tags = '["mal1", "cool2"]'
    mocker.patch.object(
        demisto, "args", return_value={"incident_id": 1, "domain_tags": domain_tags, "malicious_tags": malicious_tags}
    )
    mocker.patch.object(demisto, "executeCommand")
    mocker.patch.object(demisto, "results")

    main()
    assert demisto.results.call_count == 1
    # call_args is tuple (args list, kwargs). we only need the first one
    results = demisto.results.call_args[0]
    assert len(results) == 1
    assert results[0]["Type"] == entryTypes["note"]
    assert results[0]["ContentsFormat"] == formats["json"]
    assert results[0]["Contents"] is None
    assert results[0]["HumanReadable"] == "No matching tags found."
    assert results[0]["EntryContext"] == {}


def test_check_tags_tags_dont_match(mocker):
    domain_tags = [{"label": "mal1"}, {"label": "cool1"}]
    malicious_tags = '["mal2", "cool2"]'
    mocker.patch.object(
        demisto, "args", return_value={"incident_id": 1, "domain_tags": domain_tags, "malicious_tags": malicious_tags}
    )
    mocker.patch.object(demisto, "executeCommand")
    mocker.patch.object(demisto, "results")

    main()
    assert demisto.results.call_count == 1
    # call_args is tuple (args list, kwargs). we only need the first one
    results = demisto.results.call_args[0]
    assert len(results) == 1
    assert results[0]["Type"] == entryTypes["note"]
    assert results[0]["ContentsFormat"] == formats["json"]
    assert results[0]["Contents"] is None
    assert results[0]["HumanReadable"] == "No matching tags found."
    assert results[0]["EntryContext"] == {}