CofenseTriageReportDownload

Download all reports associated with the email address.

Details

ID	`CofenseTriageReportDownload`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	enhancement

README

Download all reports associated with the email address.

Script Data

Name	Description
Script Type	python3
Tags	enhancement
Version	6.0.0

Dependencies

This script uses the following commands and scripts.

cofense-report-list
cofense-report-download

Inputs

Argument Name	Description
email	From address for which to download the report.

Outputs

There are no outputs for this script.

Script Example

!CofenseTriageReportDownloadScript email=dummy@xyz.com

Context Example

{
    "File": [
        {
            "EntryID": "1234@4696afd6-8bfb-4487-89b3-a9aaaddfe5ee",
            "Extension": "eml",
            "Info": "eml",
            "MD5": "bdb1234321a1ffb216d08e8159924f7f",
            "Name": "Report ID - 88.eml",
            "SHA1": "12a3456a627619f1d84c2385f73f31a38a3433c3",
            "SHA256": "1ca12345f004115c7df1ebeda1e34a76e8f460abd1eb507aa8bf47e1345345da",
            "SHA512": "4d6f4abc1f1a9f5cda9e21fdd174d83c92ab372c5b4b98411ad17105a65a5cd568bb4abf02ce4beb708c655a5c48f4d3fda9e2a4587f6eddde0683d504b169ab",
            "SSDeep": "123:Rro28+wIah4VuBoeSdYKQ3Xf1UXtoDLwKkZkR6klyqX9z6w6G:Zo1+xGRoeSn6Lwx+RhlyueG",
            "Size": 45514,
            "Type": "ASCII text, with CRLF line terminators"
        },
        {
            "EntryID": "1234@4696afd6-8bfb-4487-89b3-a9aaaddfe5ee",
            "Extension": "eml",
            "Info": "eml",
            "MD5": "123456f995bad5f8ffbca6f3336e0f74",
            "Name": "Report ID - 253.eml",
            "SHA1": "7d12345c4ac51998dfdb465fde3188f11d62f930",
            "SHA256": "0f52e1234ccf44f118c13e000683f4b0355232f72c72a7bd306ff875667f8735",
            "SHA512": "0a4c123ab97a6852bdea86605041e48c176059e830c3642f388ae99251f3c90947c24e3f5ec9a8dde86ed17ccb60b549640b899aae4b29ef77727e97d87ca464",
            "SSDeep": "123:b254wJVFXVW2P/B/5mwwjekJYv3XDe4PYAuRAQt/M:bO/tw3GXJx96E",
            "Size": 15771,
            "Type": "ASCII text, with CRLF line terminators"
        }
    ]
}

Source

CofenseTriageReportDownload.py CofenseTriageReportDownload_test.py CofenseTriageReportDownload.yml

Download History Raw

import json
from unittest.mock import patch


@patch("demistomock.executeCommand")
def test_get_report_list_when_valid_response_is_returned(mock_execute_command):
    """
    Test get_report_list when command execution is successfull.
    """
    from CofenseTriageReportDownload import get_report_list

    with open("test_data/report_list_response.json") as data:
        mock_response = json.load(data)

    mock_execute_command.return_value = mock_response
    args = {"email": ""}
    response = get_report_list(args)

    assert response == mock_response


@patch("demistomock.executeCommand")
def test_download_reports_when_valid_response_is_returned(mock_execute_command):
    """
    Test download_reports when command execution is successfull.
    """
    from CofenseTriageReportDownload import download_reports

    with open("test_data/report_download_response.json") as data:
        mock_response = json.load(data)

    with open("test_data/report_list_response.json") as data:
        reports = json.load(data)

    mock_execute_command.return_value = mock_response
    response = download_reports(reports)

    assert response == mock_response