GetInstances

Returns integration instances configured in Cortex XSOAR. You can filter by instance status and/or brand name (vendor).

python · Common Scripts

Details

IDGetInstances
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10404775

README

Returns integration instances configured in Cortex XSOAR. You can filter by instance status and/or brand name (vendor).

Script Data

Name Description
Script Type python3
Tags  
Cortex XSOAR Version 5.0.0

Inputs

Argument Name Description
brand Brand name to filter instances by.
instance_status Instance status to filter instances by. Can be “active”, “disabled”, or “both”. Default is “active”.

Outputs

Path Description Type
Modules.name The instance name. string
Modules.category The instance category. string
Modules.defaultIgnored True if the instance avilable by default, otherwise false. string
Modules.state True if the instance is enabled, otherwise false. string
Modules.brand The instance brand. string

Script Example


## Context Example

```json
{
    "Modules": [
        {
            "brand": "EWS v2",
            "category": "Messaging",
            "defaultIgnored": "false",
            "name": "EWS v2_instance_1",
            "state": "active"
        },
        {
            "brand": "Elasticsearch v2",
            "category": "Database",
            "defaultIgnored": "false",
            "name": "Elasticsearch v2_instance_1",
            "state": "active"
        },
        {
            "brand": "Elasticsearch v2",
            "category": "Database",
            "defaultIgnored": "false",
            "name": "Elasticsearch v2_instance_2",
            "state": "disabled"
        },
        {
            "brand": "Rapid7 Nexpose",
            "category": "Vulnerability Management",
            "defaultIgnored": "false",
            "name": "Rapid7 Nexpose_instance_1",
            "state": "active"
        },
        {
            "brand": "activedir-login",
            "category": "Messaging",
            "defaultIgnored": "false",
            "name": "ad-login",
            "state": "active"
        },
        {
            "brand": "activedir",
            "category": "Data Enrichment & Threat Intelligence",
            "defaultIgnored": "false",
            "name": "ad-query",
            "state": "active"
        },
        {
            "brand": "d2",
            "category": "Endpoint",
            "defaultIgnored": "false",
            "name": "d2",
            "state": "active"
        },
        {
            "brand": "splunk",
            "category": "Analytics & SIEM",
            "defaultIgnored": "false",
            "name": "splunk",
            "state": "active"
        }
    ]
}

Human Readable Output

Results

brand category defaultIgnored name state
EWS v2 Messaging false EWS v2_instance_1 active
Elasticsearch v2 Database false Elasticsearch v2_instance_1 active
Elasticsearch v2 Database false Elasticsearch v2_instance_2 disabled
Rapid7 Nexpose Vulnerability Management false Rapid7 Nexpose_instance_1 active
activedir-login Messaging false ad-login active
activedir Data Enrichment & Threat Intelligence false ad-query active
d2 Endpoint false d2 active
splunk Analytics & SIEM false splunk active

Source

GetInstances.py GetInstances_test.py GetInstances.yml
Download History Raw 
import pytest
from GetInstances import *

ARGS_SYSTEM_FILTER = {"instance_status": "both"}
ARGS_BRAND_FILTER = {"brand": "EWS v2, splunk", "instance_status": "both"}
ARGS_IS_ENABLED_FILTER = {"instance_status": "active"}
ARGS_ALL_FILTERS = {"brand": "EWS v2, splunk", "instance_status": "active"}
PREPARED_ARGS_ALL_FILTERS = {
    "instance_status": ARGS_ALL_FILTERS["instance_status"],
    "filter_brand": [x.strip() for x in ARGS_ALL_FILTERS["brand"].split(",")],
}


def load_json_file(path):
    with open(path) as json_file:
        json_string = json_file.read()
    return json.loads(json_string)


data_test_prepare_args = [
    (ARGS_SYSTEM_FILTER, ARGS_SYSTEM_FILTER),
    (ARGS_IS_ENABLED_FILTER, ARGS_IS_ENABLED_FILTER),
    (ARGS_ALL_FILTERS, PREPARED_ARGS_ALL_FILTERS),
]


@pytest.mark.parametrize("input_args, expected_output", data_test_prepare_args)
def test_prepare_args(input_args, expected_output):
    output = prepare_args(input_args)
    assert output == expected_output


data_test_prepare_args_with_invalid_value = [{}, {"instance_status": "test"}]


@pytest.mark.parametrize("input_args", data_test_prepare_args_with_invalid_value)
def test_prepare_args_with_invalid_value(input_args):
    try:
        prepare_args(input_args)
    except ValueError as error:
        assert str(error) == "instance_status should be one of the following 'active', 'both', 'disabled'"


def test_without_any_filter():
    assert filter_config({"brand": "EWS v2"}, instance_status="both")
    assert not filter_config({"brand": "Scripts"}, instance_status="both")
    assert not filter_config({"brand": "Builtin"}, instance_status="both")
    assert not filter_config({"brand": "testmodule"}, instance_status="both")


def test_with_enabled_filter():
    assert filter_config({"state": "active"}, instance_status="active")
    assert not filter_config({"state": "disabled"}, instance_status="active")


data_test_filter_instances = [
    (ARGS_SYSTEM_FILTER, "system_filter"),
    (ARGS_BRAND_FILTER, "brand_filter"),
    (ARGS_IS_ENABLED_FILTER, "is_enabled_filter"),
    (ARGS_ALL_FILTERS, "all_filters"),
]


@pytest.mark.parametrize("filter_args, filter_type", data_test_filter_instances)
def test_filter_instances(filter_args, filter_type):
    modules = load_json_file("test_data/raw_modules.json")
    args = prepare_args(filter_args)
    output_instances = list(filter_instances(modules, **args))
    assert load_json_file(f"test_data/modules_with_{filter_type}.json") == output_instances