ExpanseRefreshIssueAssets Deprecated

Deprecated. No available replacement. > Script to refresh tags and attribution reasons of assets inside Expanse Issue. The script should be used inside the Expanse Issue incident context.

python · Cortex Xpanse by Palo Alto Networks (Deprecated)

Details

IDExpanseRefreshIssueAssets
Languagepython
From Version6.0.0
Docker Imagedemisto/python3:3.10.13.87159

README

Script to refresh tags and attribution reasons of assets inside Expanse Issue. The script should be used inside the Expanse Issue incident context.

Script Data


Name Description
Script Type python3
Tags  
Cortex XSOAR Version 6.0.0

Inputs


There are no inputs for this script.

Outputs


There are no outputs for this script.

import demistomock as demisto  # noqa

import ExpanseRefreshIssueAssets


EXAMPLE_INCIDENT = {
    'CustomFields': {
        'expanseasset': [
            {'assettype': 'Certificate', 'assetkey': 'fakeMD5', 'id': 'id-old-certificate'},
            {'assettype': 'IpRange', 'assetkey': 'fakeIPRange', 'id': 'id-old-iprange'},
            {'assettype': 'Domain', 'assetkey': 'fakeDomain', 'id': 'id-old-domain'},
        ]
    }
}


REFRESH_RESULT = {'expanseasset': [{'assettype': 'Certificate',
                                    'assetkey': 'fakeMD5',
                                    'tags': 'tag-certificate',
                                    'id': 'id-certificate',
                                    'attributionReasons': 'fake-certificate-reason1\nfake-certificate-reason2'},
                                   {'assettype': 'IpRange',
                                    'assetkey': 'fakeIPRange',
                                    'tags': 'tag-iprange1\ntag-iprange2',
                                    'id': 'id-iprange',
                                    'attributionReasons': 'fake-iprange-reason'},
                                   {'assettype': 'Domain',
                                    'assetkey': 'fakeDomain',
                                    'tags': 'tag-domain',
                                    'id': 'id-domain',
                                    'attributionReasons': 'fake-domain-reason'},
                                   ]}


ASSET_CERTIFICATE = {
    'annotations': {
        'tags': [{'name': 'tag-certificate'}]
    },
    'attributionReasons': [{'reason': 'fake-certificate-reason1'}, {'reason': 'fake-certificate-reason2'}],
    'id': 'id-certificate'
}


ASSET_IPRANGE = {
    'annotations': {
        'tags': [{'name': 'tag-iprange1'}, {'name': 'tag-iprange2'}]
    },
    'attributionReasons': [{'reason': 'fake-iprange-reason'}],
    'id': 'id-iprange'
}


ASSET_DOMAIN = {
    'annotations': {
        'tags': [{'name': 'tag-domain'}]
    },
    'attributionReasons': [{'reason': 'fake-domain-reason'}],
    'id': 'id-domain'
}


def test_refresh_issue_assets_command(mocker):
    """
    Given:
        - current incident with iprange, domain and certificate assets
    When
        - Refreshing Expanse assets for an incident
    Then
        - commands are invoked to refresh asset data
        - incident is updated with the refreshed asset data
    """
    def executeCommand(name, args):
        if name == "expanse-get-domain" and args['domain'] == 'fakeDomain':
            return [{'Contents': ASSET_DOMAIN}]
        elif name == "expanse-get-iprange" and args['id'] == 'fakeIPRange':
            return [{'Contents': ASSET_IPRANGE}]
        elif name == "expanse-get-certificate" and args['md5_hash'] == 'fakeMD5':
            return [{'Contents': ASSET_CERTIFICATE}]
        elif name == "setIncident":
            return "OK"

        raise ValueError(f"Error: Unknown command or command/argument pair: {name} {args!r}")

    mocker.patch.object(demisto, 'incident', return_value=EXAMPLE_INCIDENT)
    ec_mock = mocker.patch.object(demisto, 'executeCommand', side_effect=executeCommand)

    result = ExpanseRefreshIssueAssets.refresh_issue_assets_command({})

    assert result.readable_output == "OK"
    assert len(ec_mock.call_args_list) == 4
    assert ec_mock.call_args_list[3][0][0] == "setIncident"
    assert ec_mock.call_args_list[3][0][1] == REFRESH_RESULT