PrismaCloudComputeParseComplianceAlert

Parse Compliance alert raw JSON data.

python · Prisma Cloud Compute by Palo Alto Networks

Details

IDPrismaCloudComputeParseComplianceAlert
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
TagsPrisma Cloud Compute

README

Parse Compliance alert raw JSON data

Script Data


Name Description
Script Type python3
Tags Prisma Cloud Compute
Cortex XSOAR Version 5.0.0

Used In


This script is used in the following playbooks and scripts.

  • Prisma Cloud Compute - Compliance Alert

Inputs


Argument Name Description
alert_raw_json The compliance alert raw JSON

Outputs


Path Description Type
PrismaCloudCompute.ComplianceAlert.compliance.description The compliance description String
PrismaCloudCompute.ComplianceAlert.compliance.id The compliance ID String
PrismaCloudCompute.ComplianceAlert.compliance.type The compliance type String
PrismaCloudCompute.ComplianceAlert.time Compliance alert creation time Date
PrismaCloudCompute.ComplianceAlert.type Entity type (host / image / container) String
import json

import pytest
from PrismaCloudComputeParseComplianceAlert import parse_compliance


def test_parse_compliance():
    valid_raw_json = json.dumps(
        {
            "_id": "testID",
            "compliance": [{"description": "testDescription", "id": "testID", "type": "testType"}],
            "kind": "compliance",
            "time": "1970-01-01T00:00:00.000Z",
            "type": "host",
        }
    )

    no_kind_raw_json = json.dumps({"_id": "testID", "time": "1970-01-01T00:00:00.000Z"})

    wrong_kind_raw_json = json.dumps({"_id": "testID", "time": "1970-01-01T00:00:00.000Z", "kind": "wrongKind"})

    tests = [
        {
            "input": valid_raw_json,
            "expectedException": False,
            "expectedResult": {
                "readable": r"""### Compliance Information
|time|type|
|---|---|
| 1970-01-01T00:00:00.000Z | host |
### Compliance
|description|id|type|
|---|---|---|
| testDescription | testID | testType |
""",
                "output": {"PrismaCloudCompute.ComplianceAlert": json.loads(valid_raw_json)},
                "raw": valid_raw_json,
            },
        },
        {
            "input": no_kind_raw_json,
            "expectedException": True,
        },
        {
            "input": wrong_kind_raw_json,
            "expectedException": True,
        },
    ]

    for test in tests:
        if test["expectedException"]:
            with pytest.raises(Exception) as ex:
                parse_compliance(test["input"])
            assert str(ex.value) == f"Input should be a raw JSON compliance alert, received: {test['input']}"
        else:
            assert parse_compliance(test["input"]) == (
                test["expectedResult"]["readable"],
                test["expectedResult"]["output"],
                test["expectedResult"]["raw"],
            )