ExpanseEnrichAttribution Deprecated

Deprecated. No available replacement. > This script can be used to enrich context generated by ExpanseAggregateAttribution* scripts with additional details

python · Cortex Xpanse by Palo Alto Networks (Deprecated)

Details

IDExpanseEnrichAttribution
Languagepython
From Version6.0.0
Docker Imagedemisto/python3:3.10.13.87159

README

This script can be used to enrich context generated by ExpanseAggregateAttribution* scripts with additional details

Script Data


Name Description
Script Type python3
Tags  
Cortex XSOAR Version 6.0.0

Used In


This script is used in the following playbooks and scripts.

  • Expanse Attribution Subplaybook

Inputs


Argument Name Description
enrich List of entries to extract additional data from.
enrich_key Primary key in the enrichment entries to match against primary key in the attribution data structure.
current Current attribution data structure.
type What attribution structure to enrich.
enrich_fields comma separated list of fields to take enrichment details from.

Outputs


Path Description Type
Expanse.AttributionIP.ip IP address string
Expanse.AttributionIP.private Is the IP private? boolean
Expanse.AttributionIP.sightings Number of sessions seen on this device number
Expanse.AttributionDevice.serial Serial Number of the device string
Expanse.AttributionDevice.vsys VSYS of the device string
Expanse.AttributionDevice.device-group Device Group inside Panorama string
Expanse.AttributionDevice.exposing_service Is the device exposing the asset? boolean
Expanse.AttributionDevice.sightings Number of sessions seen on this device number
Expanse.AttributionUser.username Username of the user string
Expanse.AttributionUser.domain Domain of the user string
Expanse.AttributionUser.groups List of groups the user is member of Unknown
Expanse.AttributionUser.display-name Display Name string
Expanse.AttributionUser.description Description of the user string
Expanse.AttributionUser.sightings Number of sessions seen on this device number
import demistomock as demisto  # noqa

import ExpanseEnrichAttribution


CURRENT_IP = [
    {"ip": "1.1.1.1", "attr1": "value1"},
    {"ip": "8.8.8.8", "attr1": "value2"},
]

ENRICH_IP = [
    {"ipaddress": "1.1.1.1", "provider": "Cloudflare", "ignored": "ignored-right"},
    {"ipaddress": "8.8.8.4", "provider": "Google"}
]

RESULT_IP = [
    {"ip": "1.1.1.1", "attr1": "value1", "provider": "Cloudflare"},
    {"ip": "8.8.8.8", "attr1": "value2"},
]


CURRENT_DEVICE = [
    {"serial": "serialA", "attr1": "value1"},
    {"serial": "serialB", "attr1": "value2"},
]

ENRICH_DEVICE = [
    {"deviceSerial": "serialA", "location": "unknown", "owner": "lmori"},
    {"deviceSerial": "serialC", "location": "unknown"}
]

RESULT_DEVICE = [
    {"serial": "serialA", "attr1": "value1", "location": "unknown"},
    {"serial": "serialB", "attr1": "value2"},
]


CURRENT_USER = [
    {"username": "fvigo", "attr1": "value1"},
    {"username": "lmori", "attr1": "value2"},
]

ENRICH_USER = [
    {"user": "fvigo", "team": "DevRel", "manager": "unknown"},
    {"user": "ibojer", "team": "DevRel"}
]

RESULT_USER = [
    {"username": "fvigo", "attr1": "value1", "manager": "unknown"},
    {"username": "lmori", "attr1": "value2"},
]


def test_enrich_command():
    """
    Given:
        - nonenriched lists of: ips, users, devices sightings
        - enrichment information for ips, users, devices
    When
        - enriching lists of ips, users, devices
    Then
        - data is enriched
        - enriched output is returned
    """
    ip_result = ExpanseEnrichAttribution.enrich_command({
        'type': 'IP',
        'current': CURRENT_IP,
        'enrich': ENRICH_IP,
        'enrich_key': 'ipaddress',
        'enrich_fields': 'provider'
    })
    assert ip_result.outputs == RESULT_IP
    assert ip_result.outputs_key_field == "ip"
    assert ip_result.outputs_prefix == "Expanse.AttributionIP"

    device_result = ExpanseEnrichAttribution.enrich_command({
        'type': 'Device',
        'current': CURRENT_DEVICE,
        'enrich': ENRICH_DEVICE,
        'enrich_key': 'deviceSerial',
        'enrich_fields': 'location'
    })
    assert device_result.outputs == RESULT_DEVICE
    assert device_result.outputs_key_field == "serial"
    assert device_result.outputs_prefix == "Expanse.AttributionDevice"

    user_result = ExpanseEnrichAttribution.enrich_command({
        'type': 'User',
        'current': CURRENT_USER,
        'enrich': ENRICH_USER,
        'enrich_key': 'user',
        'enrich_fields': 'manager'
    })
    assert user_result.outputs == RESULT_USER
    assert user_result.outputs_key_field == "username"
    assert user_result.outputs_prefix == "Expanse.AttributionUser"