CyrenThreatInDepthRelatedWidget

Details

ID	`CyrenThreatInDepthRelatedWidget`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	dynamic-indicator-section

README

Widget script to view a full set of information about the relationship information the Cyren Threat InDepth
feeds offer. For instance, you can see and navigate to a malicious SHA256 that was hosted by
a malicious URL.

The script can be used similar to the Feed Related Indicators.

This script uses the script CyrenThreatInDepthRenderRelated using the following (default) columns:

Indicator Type
Value (hyperlinked if possible)
Reputation
Relationship Type
Entity Category
Timestamp UTC

Script Data

Name	Description
Script Type	python3
Tags	dynamic-indicator-section
XSOAR Version	6.0.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Human Readable Output

Indicator Type	Value	Reputation	Relationship Type	Entity Category	Timestamp UTC
IP	172.217.6.65	None (0)	resolves to	malware	2021-01-07, 09:02:21
SHA-256	6ea626950a759c259a182b628f79816843af379af87dbbe13923bf72d6047770	Bad (3)	serves	malware	2021-01-07, 09:02:21

Source

CyrenThreatInDepthRelatedWidget.py CyrenThreatInDepthRelatedWidget_test.py CyrenThreatInDepthRelatedWidget.yml

Download History Raw

import demistomock as demisto
import pytest
from CommonServerPython import entryTypes

NORMAL = [
    {
        "Type": entryTypes["note"],
        "HumanReadable": "tha output!",
    }
]

ERROR = [
    {
        "Type": entryTypes["error"],
        "Contents": "",
    }
]


def executeCommand(result=NORMAL, error=False):
    def inner(command, args=None):
        if command == "CyrenThreatInDepthRenderRelated":
            if error:
                return ERROR
            return result
        return None

    return inner


def test_cyren_feed_relationship_normal(mocker):
    """
    Given: Normal arg input
    When: Running cyren_feed_relationship command.
    Then: The output is redirected from the inner script and default columns are used
    """
    from CyrenThreatInDepthRelatedWidget import cyren_feed_relationship

    mocker.patch.object(demisto, "executeCommand", side_effect=executeCommand())
    args = {"indicator": {"some": "value"}}
    result = cyren_feed_relationship(args)

    demisto.executeCommand.assert_any_call("CyrenThreatInDepthRenderRelated", {"indicator": '{"some": "value"}'})
    assert result.readable_output == "tha output!"


def test_cyren_feed_relationship_no_indicator(mocker):
    """
    Given: Empty args
    When: Running cyren_feed_relationship command.
    Then: An exception is raised
    """
    from CyrenThreatInDepthRelatedWidget import cyren_feed_relationship

    mocker.patch.object(demisto, "executeCommand", side_effect=executeCommand())
    with pytest.raises(ValueError):
        cyren_feed_relationship({})


def test_cyren_feed_relationship_error_response(mocker):
    """
    Given: An error in the inner script
    When: Running cyren_feed_relationship command.
    Then: An exception is raised
    """
    from CyrenThreatInDepthRelatedWidget import cyren_feed_relationship

    mocker.patch.object(demisto, "executeCommand", side_effect=executeCommand(error=True))
    args = {"indicator": {"some": "value"}}

    with pytest.raises(ValueError):
        cyren_feed_relationship(args)