FPSetRule

Adds (or updates existing) rule in Forcepoint Triton. Preserves order of rules and modifies policy in-place if a rule exists with the exact type and value.

python · Forcepoint Web Security

Details

ID	`FPSetRule`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	forcepoint triton

README

Adds (or updates an existing) rule in Forcepoint Triton. Preserves orders of rules and modifies policy in-place if a rule exists with the exact type and value.

Script Data

Name	Description
Script Type	python
Tags	forcepoint, triton

Dependencies

This script uses the following commands and scripts.

Inputs

Argument Name	Description
policy	The policy/action assigned to the rule. Can be, “allow” or “deny” only.
type	The Triton rule type. Can be, “dest_domain”, “dest_ip”, “dest_host” or “url_regex”.
value	The value to match for this rule. Can be, “domain”, “regex”, etc… depending on the type.
remoteaccessname	If the Forcepoint Triton instance is configured as a RemoteAccess integration instance ‐ insert its name here. Replaces argument “tritonsystem”.
tritonsystem	The system name of the linux host on which Forcepoint Triton is installed. Only use this if it is not working with Triton as a RemoteAccess integration instance ‐ if so, use the “remoteaccessname” argument instead.

Outputs

There are no outputs for this script.

Source

FPSetRule.py FPSetRule_test.py FPSetRule.yml

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def test_set_rule_error_policy(mocker):
    """
    Given:
        - The script args.
    When:
        - Running seste_rule function.
    Then:
        - Validating the outputs as expected.
    """
    from FPSetRule import set_rule

    results_mock = mocker.patch.object(demisto, "results")
    set_rule("wrong_policy", "dest_domain")
    assert 'Policy argument must be "allow" or "deny". Invalid value: wrong_policy' in results_mock.call_args[0][0]["Contents"]


def test_set_rule_error_type(mocker):
    """
    Given:
        - The script args.
    When:
        - Running seste_rule function.
    Then:
        - Validating the outputs as expected.
    """
    from FPSetRule import set_rule

    results_mock = mocker.patch.object(demisto, "results")
    set_rule("allow", "wrong_type")
    assert (
        'Type argument must be "dest_domain", "dest_ip", "dest_host" or "url_regex". Invalid value: wrong_type'
        in results_mock.call_args[0][0]["Contents"]
    )


def test_set_rule(mocker):
    """
    Given:
        - The script args.
    When:
        - Running set_rule function.
    Then:
        - Validating the outputs as expected.
    """
    from FPSetRule import set_rule

    mocker.patch.object(demisto, "args", return_value={"tritonsystem": "tritonsystem", "value": "system"})
    execute_command_res = [{"Type": 1, "Contents": {"success": "true"}}]
    execute_mock = mocker.patch.object(demisto, "executeCommand", return_value=execute_command_res)
    results_mock = mocker.patch.object(demisto, "results")
    set_rule("allow", "dest_domain")
    assert execute_mock.call_count == 1
    assert "Command executed successfully." in results_mock.call_args[0][0]