CrowdStrikeApiModule

Common CrowdStrike code that will be appended to each CrowdStrike integration when it is deployed to enable oauth2 authentication automatically.

python · ApiModules

Details

ID	`CrowdStrikeApiModule`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.8.6.12176`
Tags	infra server

README

The CrowdStrike API handles the oauth2 authentication process and API requests. When developing a CrowdStrike integration, import the API module to the integration and the authentication process will occur automatically.
To use the common CrowdStrike API logic, attach the from CrowdStrikeApiModule import * # noqa: E402 line of code in the following location to import it. After you import the module, the CrowdStrikeClient will be available for use.

def main():
    ...


from CrowdStrikeApiModule import *  # noqa: E402

if __name__ in ["builtins", "__main__"]:
    main()

For examples, see the CrowdStrike Falcon Intel v2 integration.

Source

CrowdStrikeApiModule.py CrowdStrikeApiModule_test.py CrowdStrikeApiModule.yml

Download History Raw

from datetime import datetime, timedelta

import demistomock as demisto
import pytest
from CrowdStrikeApiModule import CrowdStrikeClient
from test_data.context import MULTIPLE_ERRORS_RESULT
from test_data.http_responses import MULTI_ERRORS_HTTP_RESPONSE, NO_ERRORS_HTTP_RESPONSE


class ResMocker:
    def __init__(self, http_response):
        self.http_response = http_response
        self.status_code = 400
        self.reason = "error"
        self.ok = False

    def json(self):
        return self.http_response


@pytest.mark.parametrize(
    "http_response, output",
    [(MULTI_ERRORS_HTTP_RESPONSE, MULTIPLE_ERRORS_RESULT), (NO_ERRORS_HTTP_RESPONSE, "Error in API call [400] - error\n")],
)
def test_handle_errors(http_response, output, mocker):
    """Unit test
    Given
    - raw response of the http request
    When
    - 1. there are multiple errors in the http request
    - 2. there are no errors in the http request
    Then
    - 1. show the exception content
    - 2. show no errors
    """
    mocker.patch.object(CrowdStrikeClient, "_generate_token")
    params = {"insecure": False, "credentials": {"identifier": "user1", "password:": "12345"}, "proxy": False}
    client = CrowdStrikeClient(params)
    try:
        mocker.patch.object(client._session, "request", return_value=ResMocker(http_response))
        _, output, _ = client.check_quota_status()
    except Exception as e:
        assert str(e) == str(output)


@pytest.mark.parametrize(
    argnames="context, expected_call_count",
    argvalues=[
        ({}, 1),
        ({"generation_time": datetime.now().strftime("%Y-%m-%dT%H:%M:%S"), "auth_token": "test"}, 0),
        ({"generation_time": (datetime.now() - timedelta(minutes=30)).strftime("%Y-%m-%dT%H:%M:%S")}, 1),
    ],
)
def test_get_token(mocker, context, expected_call_count):
    """
    Given - varios token generation time
    When - try to get access token when init the client
    Then - validate that token was generated only of required (after 28 min)
    """
    mocker.patch.object(demisto, "getIntegrationContext", return_value=context)
    mocker.patch.object(CrowdStrikeClient, "_generate_token", return_value="test_token_generated")

    CrowdStrikeClient({})

    assert CrowdStrikeClient._generate_token.call_count == expected_call_count