IPv4Blacklist

Transformer that returns a filtered list of IPv4 addresses, based on whether they do not match a comma-separated list of IPv4 ranges. Useful for filtering out internal IP address space.

python · Filters And Transformers

Details

ID	`IPv4Blacklist`
Language	python
From Version	5.0.0
Docker Image	`demisto/netutils:1.0.0.11867191`
Tags	transformer entirelist

README

Transformer that returns a filtered list of IPv4 addresses, based on whether they do not match a comma-separated list of IPv4 ranges. Useful for filtering out internal IP address space.

Script Data

Name	Description
Script Type	python3
Tags	transformer, entirelist
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
value	Array or comma-separated list of IPv4 addresses to filter.
cidr_ranges	Array or comma-separated list of IPv4 ranges, in CIDR notation, against which to match the IPv4 addresses.

Outputs

There are no outputs for this script.

Source

IPv4Blacklist.py IPv4Blacklist_test.py IPv4Blacklist.yml

Download History Raw

import demistomock as demisto


def test_main(mocker):
    from IPv4Blacklist import main

    mocker.patch.object(
        demisto,
        "args",
        return_value={"value": "172.16.0.1,10.0.0.5,5.6.7.8,4.2.2.2", "cidr_ranges": "10.0.0.0/8,192.168.0.0/16,5.6.0.0/16"},
    )
    mocker.patch.object(demisto, "results")
    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0][0]
    assert len(results) == 2
    assert results[0] == "172.16.0.1"
    assert results[1] == "4.2.2.2"

    # use an array instead of CSV
    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "value": ["172.16.0.1", "10.0.0.5", "5.6.7.8", "4.2.2.2"],
            "cidr_ranges": ["10.0.0.0/8", "192.168.0.0/16", "5.6.0.0/16"],
        },
    )
    mocker.patch.object(demisto, "results")
    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0][0]
    assert len(results) == 2
    assert results[0] == "172.16.0.1"
    assert results[1] == "4.2.2.2"