ChronicleAssetIdentifierScript

Collect all asset identifiers - Hostname, IP address and MAC address in the context.

Details

ID	`ChronicleAssetIdentifierScript`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

Collect all asset identifiers - Hostname, IP address and MAC address in the context.

Script Data

Name	Description
Script Type	python3
Tags
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
artifact_identifiers	Hostname, IP address or MAC address that can identify the asset.

Outputs

Path	Description	Type
AssetIdentifiers	Collects all the asset identifier.	Unknown

Script Example

!ChronicleAssetIdentifierScript artifact_identifiers="{
        \"AccessedDomain\": \"dummy-accessed-domain.com\",
        \"FirstAccessedTime\": \"2018-10-03T02:59:56Z\",
        \"HostName\": \"dummy-host-name\",
        \"LastAccessedTime\": \"2020-07-02T20:42:30Z\"
    }"

Context Example

{
    "AssetIdentifiers": [
        "dummy-host-name"
    ]
}

Human Readable Output

{}

Source

ChronicleAssetIdentifierScript.py ChronicleAssetIdentifierScript_test.py ChronicleAssetIdentifierScript.yml

Download History Raw

import pytest

FIRST_ACCESSED_TIME = "2018-10-03T02:59:56Z"
LAST_ACCESSED_TIME = "2020-07-02T20:42:30Z"
ACCESSED_DOMAIN = "dummy-accessed-domain.com"


@pytest.mark.parametrize("input_key, output", [("key1", True), ("key4", False)])
def test_has_key(input_key, output):
    from ChronicleAssetIdentifierScript import has_key

    dummy_dict = {"key1": "value1", "key2": "value2"}

    expected_output = has_key(dummy_dict, key=input_key)

    assert output == expected_output


def test_get_entry_context_for_hostname():
    from ChronicleAssetIdentifierScript import get_entry_context

    dummy_identifiers = {
        "AccessedDomain": ACCESSED_DOMAIN,
        "FirstAccessedTime": FIRST_ACCESSED_TIME,
        "HostName": "dummy-host-name",
        "IpAddress": "dummy-ip-addres",
        "MacAddress": "dummy-mac-id",
        "LastAccessedTime": LAST_ACCESSED_TIME,
    }

    expected_ec = get_entry_context(dummy_identifiers)

    assert expected_ec == {"AssetIdentifiers": ["dummy-host-name"]}


def test_get_entry_context_for_ip_address():
    from ChronicleAssetIdentifierScript import get_entry_context

    dummy_identifiers = {
        "AccessedDomain": ACCESSED_DOMAIN,
        "FirstAccessedTime": FIRST_ACCESSED_TIME,
        "IpAddress": "dummy-ip-addres",
        "MacAddress": "dummy-mac-id",
        "LastAccessedTime": LAST_ACCESSED_TIME,
    }

    expected_ec = get_entry_context(dummy_identifiers)

    assert expected_ec == {"AssetIdentifiers": ["dummy-ip-addres"]}


def test_get_entry_context_for_mac_address():
    from ChronicleAssetIdentifierScript import get_entry_context

    dummy_identifiers = {
        "AccessedDomain": ACCESSED_DOMAIN,
        "FirstAccessedTime": FIRST_ACCESSED_TIME,
        "MacAddress": "dummy-mac-id",
        "LastAccessedTime": LAST_ACCESSED_TIME,
    }

    expected_ec = get_entry_context(dummy_identifiers)

    assert expected_ec == {"AssetIdentifiers": ["dummy-mac-id"]}