MaliciousRatioReputation

import demistomock as demisto


def test_main_malicious_ratio_reputation(mocker):
    """
    Given:
        - The script args.
    When:
        - Running the main with valid indicator.
    Then:
        - Validating after calling the helper functions the results is as expected.
    """
    import MaliciousRatioReputation

    args = {"input": "value_a", "threshold": "-2"}
    mocker.patch.object(demisto, "args", return_value=args)
    mocker.patch.object(
        MaliciousRatioReputation, "get_indicator_from_value", return_value={"value": "value_a", "indicator_type": "IP"}
    )
    res_get_indicator_result = {
        "Type": 1,
        "EntryContext": {"DBotScore": {"Type": "ip", "Score": 2, "Vendor": "DBot-MaliciousRatio", "Indicator": "value_a"}},
        "Contents": 2,
        "ContentsFormat": "text",
        "HumanReadable": "Malicious ratio for value_a is -1.00",
        "ReadableContentsFormat": "markdown",
    }
    mocker.patch.object(MaliciousRatioReputation, "get_indicator_result", return_value=res_get_indicator_result)
    res_mock = mocker.patch.object(demisto, "results")
    MaliciousRatioReputation.main()
    assert res_mock.call_count == 1
    assert res_mock.call_args[0][0] == res_get_indicator_result


def test_get_indicator_result(mocker):
    """
    Given:
        - The script args and indicator with mr_score > given threshold.
    When:
        - Running the get_indicator_result function.
    Then:
        - Validating that the function returns entry to the context.
    """
    from MaliciousRatioReputation import get_indicator_result

    args = {"input": "8.8.8.8", "threshold": "-2"}
    mocker.patch.object(demisto, "args", return_value=args)
    indicator = {"value": "8.8.8.8", "indicator_type": "IP"}
    execute_command_res = [{"Contents": [{"maliciousRatio": -1}]}]
    execute_mock = mocker.patch.object(demisto, "executeCommand", return_value=execute_command_res)
    entry = get_indicator_result(indicator)
    assert execute_mock.call_count == 1
    assert len(entry["EntryContext"]) > 0


def test_get_indicator_result_with_smaller_mr_score(mocker):
    """
    Given:
        - The script args and indicator with mr_score < given threshold.
    When:
        - Running the get_indicator_result function.
    Then:
        - Validating that the function doesn't return entry.
    """
    from MaliciousRatioReputation import get_indicator_result

    mocker.patch.object(demisto, "args", return_value={"input": "8.8.8.8", "threshold": "0.3"})
    indicator = {"value": "8.8.8.8", "indicator_type": "IP"}
    execute_command_res = [{"Contents": [{"maliciousRatio": -1}]}]
    execute_mock = mocker.patch.object(demisto, "executeCommand", return_value=execute_command_res)
    assert get_indicator_result(indicator) is None
    assert execute_mock.call_count == 1


def test_get_indicator_from_value(mocker):
    """
    Given:
        - The function args.
    When:
        - Running the get_indicator_from_value function.
    Then:
        - Validating that the return value after calling to "findIndicators" command is as expected.
    """
    from MaliciousRatioReputation import get_indicator_from_value

    execute_command_res = [
        {
            "Contents": [{"id": "a", "investigationIDs": ["1", "2", "10"], "value": "value_a", "indicator_type": "File"}],
            "Type": "note",
        }
    ]
    execute_mock = mocker.patch.object(demisto, "executeCommand", return_value=execute_command_res)
    indicator = get_indicator_from_value("value_a")
    assert execute_mock.call_count == 1
    assert indicator == execute_command_res[0]["Contents"][0]