ExpanseAggregateAttributionIP Deprecated

Deprecated. No available replacement. > Aggregate entries from multiple sources into AttributionIP.

python · Cortex Xpanse by Palo Alto Networks (Deprecated)

Details

ID	`ExpanseAggregateAttributionIP`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.10.13.83255`

README

Aggregate entries from multiple sources into AttributionIP

Script Data

Name	Description
Script Type	python3
Tags
Cortex XSOAR Version	6.0.0

Used In

This script is used in the following playbooks and scripts.

Expanse Attribution Subplaybook

Inputs

Argument Name	Description
input	Input list.
current	Current aggregation state.
source_ip_fields	Comma separated list of fields to treat as source IPs.
internal_ip_networks	Comma separated list of IPv4 Networks to be considered internal (default to RFC private networks).
sightings_fields	Comma separated list of field names to be considered sighting counts.

Outputs

Path	Description	Type
Expanse.AttributionIP.ip	IP address	string
Expanse.AttributionIP.private	Is the IP private?	boolean
Expanse.AttributionIP.sightings	Number of sessions seen on this device	number

Source

ExpanseAggregateAttributionIP.py ExpanseAggregateAttributionIP_test.py ExpanseAggregateAttributionIP.yml

Download History Raw

import demistomock as demisto  # noqa

import ExpanseAggregateAttributionIP


INPUT = [
    {"src": "1.1.1.1", "count": 2},
    {"src_ip": "8.8.8.8"},
    {"src": "8.8.8.8", "count": 10}
]

CURRENT = [
    {"ip": "1.1.1.1", "sightings": 1, "internal": False}
]

RESULT = [
    {"ip": "1.1.1.1", "sightings": 3, "internal": False},
    {"ip": "8.8.8.8", "sightings": 11, "internal": True}
]


def test_aggregate_command():
    """
    Given:
        - previous list aggregated IPs
        - new data source with IP/sightings information
        - merged aggregated data with new information
        - list of internal ip networks
    When
        - merging new sightings to existing aggregated data
    Then
        - data is merged
        - expected output is returned
    """
    result = ExpanseAggregateAttributionIP.aggregate_command({
        'input': INPUT,
        'current': CURRENT,
        'internal_ip_networks': "192.168.0.0/16,10.0.0.0/8,8.0.0.0/8"
    })

    assert result.outputs_prefix == "Expanse.AttributionIP"
    assert result.outputs_key_field == "ip"
    assert result.outputs == RESULT