DamSensorDown

Pre processing script for Emails from Mcafee DAM, about sensor disconnected. Will ignore second notification, but will process first notification into incidents.

python · McAfee DAM

Details

ID	`DamSensorDown`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	preProcessing

README

Ignores second notifications, but will process first notification into incidents. This is a pre-processing script for Emails from Mcafee DAM, about sensor disconnected.

Script Data

Name	Description
Script Type	python
Tags	preProcessing

Dependencies

This script uses the following commands and scripts.

dam-get-latest-by-rule

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

DamSensorDown.py DamSensorDown_test.py DamSensorDown.yml

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def test_main(mocker):
    """
    Given:
        - The script args.
    When:
        - Running main function.
    Then:
        - Validating the outputs as expected.
    """
    from DamSensorDown import main

    value = "Sensor was disconnected at 12:00."
    body = "The issue is with sensor: <sensor-name>. the issue with host: <some-host>. ip: 1.1.1.1, done."
    mocker.patch.object(
        demisto,
        "incidents",
        return_value=[{"labels": [{"type": "Email/subject", "value": value}, {"type": "Email/text", "value": body}]}],
    )
    execute_command_res = [{"Type": 1, "Contents": {"success": "true"}}]
    execute_mock = mocker.patch.object(demisto, "executeCommand", return_value=execute_command_res)
    mocker.patch.object(demisto, "results")
    main()
    assert execute_mock.call_count == 1
    assert "1.1.1.1" in execute_mock.call_args[0][1]["addLabels"]