ExpanseAggregateAttributionUser Deprecated

Deprecated. No available replacement. > Aggregate entries from multiple sources into AttributionUser.

python · Cortex Xpanse by Palo Alto Networks (Deprecated)

Details

ID	`ExpanseAggregateAttributionUser`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.10.13.83255`

README

Aggregate entries from multiple sources into AttributionUser

Script Data

Name	Description
Script Type	python3
Tags
Cortex XSOAR Version	6.0.0

Used In

This script is used in the following playbooks and scripts.

Expanse Attribution Subplaybook

Inputs

Argument Name	Description
input	Input list.
current	Current aggregation state.
username_fields	Comma separated list of fields to treat as serial number.
sightings_fields	Comma separated list of field names to be considered sighting counts.

Outputs

Path	Description	Type
Expanse.AttributionUser.username	Username of the user	string
Expanse.AttributionUser.domain	Domain of the user	string
Expanse.AttributionUser.groups	List of groups the user is member of	Unknown
Expanse.AttributionUser.display-name	Display Name	string
Expanse.AttributionUser.description	Description of the user	string
Expanse.AttributionUser.sightings	Number of sessions seen on this device	number

Source

ExpanseAggregateAttributionUser.py ExpanseAggregateAttributionUser_test.py ExpanseAggregateAttributionUser.yml

Download History Raw

import demistomock as demisto  # noqa

import ExpanseAggregateAttributionUser


INPUT = [
    {"user": "lmori", "count": 10},
    {"srcuser": "fvigo"},
    {"source_user": "DEVREL\\lmori"},
]

CURRENT = [
    {"username": "fvigo", "sightings": 1, "groups": [], "description": None, "domain": ""}
]

RESULT = [
    {"username": "fvigo", "sightings": 2, "groups": [], "description": None, "domain": ""},
    {"username": "lmori", "sightings": 10, "groups": [], "description": None, "domain": ""},
    {"username": "lmori", "sightings": 1, "groups": [], "description": None, "domain": "DEVREL"},
]


def test_aggregate_command():
    """
    Given:
        - previous list aggregated users
        - new data source with users/sightings information
        - merged aggregated data with new information
        - list of internal ip networks
    When
        - merging new sightings to existing aggregated data
    Then
        - data is merged
        - expected output is returned
    """
    result = ExpanseAggregateAttributionUser.aggregate_command({
        'input': INPUT,
        'current': CURRENT
    })

    assert result.outputs_prefix == "Expanse.AttributionUser"
    assert result.outputs_key_field == ["username", "domain"]
    assert result.outputs == RESULT