IPv4Whitelist

Transformer that returns a filtered list of IPv4 addresses, based on whether they match a comma-separated list of IPv4 ranges. Useful for filtering in internal IP address space.

python · Filters And Transformers

Details

ID	`IPv4Whitelist`
Language	python
From Version	5.0.0
Docker Image	`demisto/netutils:1.0.0.11867191`
Tags	transformer entirelist

README

Transformer that returns a filtered list of IPv4 addresses, based on whether they match a comma-separated list of IPv4 ranges. Useful for filtering in internal IP address space.

Script Data

Name	Description
Script Type	python3
Tags	transformer, entirelist
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
value	Array or comma-separated list of IPv4 Addresses to filter.
cidr_ranges	Array or comma-separated list of IPv4 ranges, in CIDR notation, against which to match the IPv4 addresses.

Outputs

There are no outputs for this script.

Source

IPv4Whitelist.py IPv4Whitelist_test.py IPv4Whitelist.yml

Download History Raw

import demistomock as demisto


def test_main(mocker):
    from IPv4Whitelist import main

    mocker.patch.object(
        demisto,
        "args",
        return_value={"value": "172.16.0.1,10.0.0.5,5.6.7.8,4.2.2.2", "cidr_ranges": "10.0.0.0/8,192.168.0.0/16,5.6.0.0/16"},
    )
    mocker.patch.object(demisto, "results")
    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0][0]
    assert len(results) == 2
    assert results[0] == "10.0.0.5"
    assert results[1] == "5.6.7.8"

    # use an array instead of CSV
    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "value": ["172.16.0.1", "10.0.0.5", "5.6.7.8", "4.2.2.2"],
            "cidr_ranges": ["10.0.0.0/8", "192.168.0.0/16", "5.6.0.0/16"],
        },
    )
    mocker.patch.object(demisto, "results")
    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0][0]
    assert len(results) == 2
    assert results[0] == "10.0.0.5"
    assert results[1] == "5.6.7.8"