MicrosoftAtpEndpoint

A polling wrapper script; retrieves machines that have communicated with Microsoft Defender for Endpoint cloud. At least one of the following arguments is required: IP, hostname, or ID. Otherwise, an error appears.

python · Microsoft Defender for Endpoint

Details

ID	`MicrosoftAtpEndpoint`
Language	python
From Version	6.1.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	Utilities

Source

MicrosoftAtpEndpoint.py MicrosoftAtpEndpoint_test.py MicrosoftAtpEndpoint.yml

Download History Raw

from pytest_mock import MockerFixture


def test_main(mocker: MockerFixture):
    """
    Given:
        Command args.
    When:
        Calling `main`.
    Assert:
        Ensure `execute_polling_command` is called once with the correct command name and args.
    """
    from MicrosoftAtpEndpoint import main, INTEGRATION_NAME

    args = {"ip": "0.0.0.0"}
    mocker.patch("MicrosoftAtpEndpoint.demisto.args", return_value=args)
    mock_execute_polling_command = mocker.patch("MicrosoftAtpEndpoint.execute_polling_command", return_value=[])

    main()

    assert mock_execute_polling_command.call_count == 1
    assert mock_execute_polling_command.call_args[0] == ("endpoint", args)
    assert mock_execute_polling_command.call_args.kwargs["using_brand"] == INTEGRATION_NAME