GetDuplicatesMlv2 Deprecated

Deprecated. Use the "PhishingDedupPreprocessingRule" script instead. Find duplicate incidents candidates. Using machine learning techniques with pre-defined data (can also use data from the local environment), this script takes into consideration different features such as: labels comparison, email labels (relevant for phishing), incident time difference and shared indicators, which can be customized by the arguments. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Common Scripts

Details

ID	`GetDuplicatesMlv2`
Language	python
From Version	5.0.0
Docker Image	`demisto/machine-learning:1.0.0.22015`
Tags	dedup incidents ml duplicate

Source

GetDuplicatesMlv2.py GetDuplicatesMlv2_test.py GetDuplicatesMlv2.yml

Download History Raw

import demistomock as demisto
from GetDuplicatesMlv2 import main, Utils
from CommonServerPython import entryTypes


def test_main(mocker):
    def executeCommand(name, args=None):
        if name == 'findIndicators':
            return [
                {
                    'Type': entryTypes['note'],
                    'Contents': [{
                        "investigationIDs": ["1", "2"],
                        "value": "test@test.com",
                        "indicator_type": "Email",
                    }]
                }
            ]
        elif name == 'getIncidents':
            return demisto.exampleIncidents  # use original mock
        else:
            raise ValueError('Unimplemented command called: {}'.format(name))

    mocker.patch.object(demisto, 'args', return_value={
        "compareIndicators": "Email, IP, Domain, File SHA256, File MD5, URL",
        "compareEmailLabels": "Email/headers/From, Email/headers/Subject, Email/text, Email/html, Email/attachments",
        "UseLocalEnvDuplicatesInLastDays": "30"
    })
    mocker.patch.object(demisto, 'results')
    mocker.patch.object(demisto, 'executeCommand', side_effect=executeCommand)
    # validate our mocks are good
    assert 'URL' in demisto.args()['compareIndicators']
    main()
    assert demisto.results.call_count == 1
    # call_args is tuple (args list, kwargs). we only need the first one
    results = demisto.results.call_args[0][0]
    assert results.startswith('Did not find any')


def test_extract_domain_from_url(mocker):
    import requests

    class MySession(requests.Session):
        def merge_environment_settings(self, *args, **kwargs):
            config = super(MySession, self).merge_environment_settings(*args, **kwargs)
            config['verify'] = False
            return config

    mocker.patch('requests.Session', MySession)

    res = Utils.extract_domain_from_url("https://www.google.com")  # disable-secrets-detection
    assert res == 'google.com'
    res = Utils.extract_domain_from_url("https://www.google.co.il")  # disable-secrets-detection
    assert res == 'google.co.il'