OnionURLReputation

Details

ID	`OnionURLReputation`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	reputation

README

This script adds the reputation to Onion URL indicators. The script is automatically triggered when a Onion URL indicator is auto-extracted. For instance, if you run a Cortex XSOAR CLI on a valid Onion URL, the indicators are extracted automatically and this script is triggered for the extracted indicators.

Script Data

Name	Description
Script Type	python3
Tags	reputation
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
input	The indicators to which to add reputation.

Outputs

There are no outputs for this script.

Source

OnionURLReputation.py OnionURLReputation_test.py OnionURLReputation.yml

Download History Raw

import demistomock as demisto
from OnionURLReputation import main

# the onion urls used in the unittests are not a valid ones so they would not be caught as an Onion URL in XSOAR.
ARGS = {"input": "http://testforurls.onion/,http://testforurls2.onion/"}
EXPECTED_RESULTS = [
    {
        "Type": 1,
        "ContentsFormat": "json",
        "Contents": 2,
        "EntryContext": {
            "DBotScore": {"Indicator": "http://testforurls.onion/", "Type": "Onion URL", "Score": 2, "Vendor": "DBot"}
        },
    },
    {
        "Type": 1,
        "ContentsFormat": "json",
        "Contents": 2,
        "EntryContext": {
            "DBotScore": {"Indicator": "http://testforurls2.onion/", "Type": "Onion URL", "Score": 2, "Vendor": "DBot"}
        },
    },
]


def test_main(mocker):
    """Verifies that a reputation data is being set for a given onion url.
    Given
    - list of Onion URL's.
    When
    - When an Onion URL is being auto extracted.
    Then
    - Return the updated context for each URL.
    """
    mocker.patch.object(demisto, "args", return_value=ARGS)
    mocker.patch.object(demisto, "results")
    main()
    assert demisto.results.call_args[0][0] == EXPECTED_RESULTS