FireEyeApiModule

Common FireEye code that will be appended to each FireEye integration when it is deployed.

Details

ID	`FireEyeApiModule`
Language	python
From Version	5.5.0
Docker Image	`demisto/python3:3.9.5.21272`
Tags	infra server

README

The FireEye API handles the API Key generation from the user/password authentication.

Manages the API Key and caches it for 10 minutes, to avoid 401 errors for consecutive API Key generation.
Holds the client command calls to the WSAPIs v2.0.0.
Includes a few generally used static function converters.

To use the common FireEye API logic, attach the from FireEyeApiModule import * # noqa: E402 line of code in the following location to import it. After you import the module, the FireEyeClient will be available for use.

def main():
    ...


from FireEyeApiModule import *  # noqa: E402

if __name__ in ('__main__', '__builtin__', 'builtins'):
    main()

For examples, see the FireEye Central Management integration.

Source

FireEyeApiModule.py FireEyeApiModule_test.py FireEyeApiModule.yml

Download History Raw

import pytest
from CommonServerPython import BaseClient, DemistoException
from FireEyeApiModule import FireEyeClient, alert_severity_to_dbot_score, to_fe_datetime_converter


def test_to_fe_datetime_converter():
    """Unit test
    Given
    - to_fe_datetime_converter command
    - time in a string
    When
    - running to_fe_datetime_converter
    Then
    - Validate that the FE time is as expected
    """
    # fe time will not change
    assert to_fe_datetime_converter("2021-05-14T01:08:04.000-02:00") == "2021-05-14T01:08:04.000-02:00"

    # "now"/ "1 day" / "3 months:" time will be without any timezone
    assert to_fe_datetime_converter("now")[23:] == "+00:00"
    assert to_fe_datetime_converter("3 months")[23:] == "+00:00"

    # now > 1 day
    assert to_fe_datetime_converter("now") > to_fe_datetime_converter("1 day")


@pytest.mark.parametrize("severity_str, dbot_score", [("minr", 1), ("majr", 2), ("crit", 3), ("kookoo", 0)])
def test_alert_severity_to_dbot_score(severity_str, dbot_score):
    """Unit test
    Given
    - alert_severity_to_dbot_score command
    - severity string
    When
    - running alert_severity_to_dbot_score
    Then
    - Validate that the dbot score is as expected
    """
    assert alert_severity_to_dbot_score(severity_str) == dbot_score


def test_exception_in__generate_token(mocker):
    """
    Check exception handling in _generate_token func
    Given:
        A FireEyeClient
    When:
        Generating new token
    Then:
        Ensure that Exceptions are caught and parsed correctly.

    """
    err = "Some error"
    mocker.patch.object(BaseClient, "_http_request", side_effect=DemistoException(err))
    with pytest.raises(DemistoException, match=f"Token request failed. message: {err}"):
        FireEyeClient(base_url="https://test.com", username="test_user", password="password", verify=False, proxy=False)