PcapConvert

Convert packet data to the standard pcap. Currently it only supports CDL(NGFW) pcap from which to convert.

Details

ID	`PcapConvert`
Language	python
From Version	6.2.0
Docker Image	`demisto/pcap-miner:1.0.0.10133006`
Tags	pcap Utility transformer

README

Convert packet data to the standard pcap. Currently it only supports CDL(NGFW) pcap from which to convert.

Script Data

Name	Description
Script Type	python3
Tags	pcap, Utility, transformer

Inputs

Argument Name	Description
value	The value to be converted from.
path	The context path to the pcap (e.g., PcapData.pcap). If you add a comma + a node name after the path, the output will be set to the node (e.g., PcapData.pcap,out).
pcap_type	The data type of the pcap data.
error_action	The action on error to parsing pcap. Possible values are abort (default), ignore, and keep.

Outputs

There are no outputs for this script.

Source

PcapConvert.py PcapConvert_test.py PcapConvert.yml

Download History Raw

import json

import demistomock as demisto


def test_main(mocker):
    """
    Given:
    - PCAP values are given with control parameters

    When:
    - Running PcapConvert

    Then:
    - Validate results output that returned to CortexSOAR
    """
    from PcapConvert import main

    with open("./test_data/test-1.json") as f:
        test_list = json.load(f)

    for t in test_list:
        mocker.patch.object(
            demisto,
            "args",
            return_value={
                "value": t["value"],
                "path": t.get("path"),
                "pcap_type": t.get("pcap_type"),
                "error_action": t.get("error_action"),
            },
        )
        mocker.patch.object(demisto, "results")
        main()
        assert demisto.results.call_count == 1
        results = demisto.results.call_args[0][0]
        assert json.dumps(results) == json.dumps(t["result"])