HuntingFromIndicatorLayout

This automation creates an incident from the indicator layouts Malware, Campaign and Intrusion set, with the following parameters: - Name: Threat Hunting Session - <Indicator Value> - Type: Proactive Threat Hunting - sdoname: <Indicator Value>.

python · Proactive Threat Hunting

Details

IDHuntingFromIndicatorLayout
Languagepython
From Version6.9.0
Docker Imagedemisto/python3:3.12.13.10116658
Tagsindicator-action-button
from unittest.mock import patch

import pytest
from CommonServerPython import DemistoException  # noqa: F401
from HuntingFromIndicatorLayout import hunting_from_indicator_layout, main


@pytest.fixture
def mock_executeCommand():
    with patch("demistomock.executeCommand") as mock:
        yield mock


@pytest.mark.parametrize(
    "sdo_value, expected_result", [("indicator", "Proactive Threat Hunting Incident Created: Threat Hunting Session - indicator")]
)
def test_hunting_from_indicator_layout_success(mock_executeCommand, sdo_value, expected_result):
    """
    Given:
        The 'mock_executeCommand' function is properly patched to mock 'demistomock.executeCommand'.
    When:
        The 'hunting_from_indicator_layout' function is called with the sdo_value parameter set to "indicator".
    Then:
        The result of 'hunting_from_indicator_layout' compared to the 'expected_results'.
    """
    mock_executeCommand.return_value = [{"Type": 1, "Contents": "Incident created successfully"}]

    result = hunting_from_indicator_layout(sdo_value)

    assert result.readable_output == expected_result


def test_hunting_from_indicator_layout_failure(mock_executeCommand):
    """
    Given:
        The mock_executeCommand function is properly patched to mock demistomock.executeCommand.
    When:
        The hunting_from_indicator_layout function is called with the sdo_value parameter set to "non_existent_indicator",
            and the mocked executeCommand is configured to raise a DemistoException
    Then:
        he test is expected to raise a DemistoException with the specified message.
    """
    mock_executeCommand.side_effect = DemistoException("The automation was not executed from indicator layout")

    with pytest.raises(DemistoException):
        hunting_from_indicator_layout("non_existent_indicator")


def test_main_indicator_not_in_args():
    """
    Given:
        No additional setup is required.
    When:
        The main function is called.
    Then:
        The test is expected to raise a DemistoException with the message "The automation was not
            executed from indicator layout".
    """
    with pytest.raises(DemistoException, match="The automation was not executed from indicator layout"):
        main()


if __name__ == "__main__":
    pytest.main()