PrismaCloudComputeParseVulnerabilityAlert

Parse Vulnerability alert raw JSON data.

python · Prisma Cloud Compute by Palo Alto Networks

Details

IDPrismaCloudComputeParseVulnerabilityAlert
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
TagsPrisma Cloud Compute

README

Parse Vulnerability alert raw JSON data

Script Data


Name Description
Script Type python3
Tags Prisma Cloud Compute
Cortex XSOAR Version 5.0.0

Used In


This script is used in the following playbooks and scripts.

  • Prisma Cloud Compute - Vulnerability Alert

Inputs


Argument Name Description
alert_raw_json The vulneribility alert raw JSON data

Outputs


Path Description Type
PrismaCloudCompute.VulnerabilityAlert.time Vulnerability discovery time Date
PrismaCloudCompute.VulnerabilityAlert.imageName Impacted image name String
PrismaCloudCompute.VulnerabilityAlert.distroName Full name of the image distribution String
PrismaCloudCompute.VulnerabilityAlert.vulnerabilities.cve CVE ID of the vulnerability String
PrismaCloudCompute.VulnerabilityAlert.vulnerabilities.severity The Severity of the vulnerability String
PrismaCloudCompute.VulnerabilityAlert.vulnerabilities.link The CVE vendor link String
PrismaCloudCompute.VulnerabilityAlert.vulnerabilities.status The CVE vendor status String
PrismaCloudCompute.VulnerabilityAlert.vulnerabilities.packages Package names String
PrismaCloudCompute.VulnerabilityAlert.vulnerabilities.packageVersion The version of the package that caused the vulnerability String
PrismaCloudCompute.VulnerabilityAlert.vulnerabilities.sourcePackage The name of the source package if such package exist, for os packages, source package is the package used to build the binary String
import json

import pytest
from PrismaCloudComputeParseVulnerabilityAlert import parse_vulnerability


def test_parse_vulnerability():
    valid_raw_json = json.dumps(
        {
            "_id": "testID",
            "time": "1970-01-01T00:00:00.000Z",
            "kind": "vulnerability",
            "imageName": "testImage",
            "distroName": "testDestribution",
            "labels": {},
            "vulnerabilities": [
                {
                    "cve": "testCVE",
                    "severity": "testSeverity",
                    "link": "testLink",
                    "status": "testStatus",
                    "packages": "testPackage",
                    "packageVersion": "1.0.0",
                    "sourcePackage": "testSourcePackage",
                },
            ],
        }
    )

    no_kind_raw_json = json.dumps({"_id": "testID", "time": "1970-01-01T00:00:00.000Z"})

    wrong_kind_raw_json = json.dumps({"_id": "testID", "time": "1970-01-01T00:00:00.000Z", "kind": "wrongKind"})

    tests = [
        {
            "input": valid_raw_json,
            "expectedException": False,
            "expectedResult": {
                "readable": r"""### Vulnerability Information
|distroName|imageName|labels|time|
|---|---|---|---|
| testDestribution | testImage |  | 1970-01-01T00:00:00.000Z |
### Vulnerabilities
|cve|link|packageVersion|packages|severity|sourcePackage|status|
|---|---|---|---|---|---|---|
| testCVE | testLink | 1.0.0 | testPackage | testSeverity | testSourcePackage | testStatus |
""",
                "output": {"PrismaCloudCompute.VulnerabilityAlert": json.loads(valid_raw_json)},
                "raw": valid_raw_json,
            },
        },
        {
            "input": no_kind_raw_json,
            "expectedException": True,
        },
        {
            "input": wrong_kind_raw_json,
            "expectedException": True,
        },
    ]

    for test in tests:
        if test["expectedException"]:
            with pytest.raises(Exception) as ex:
                parse_vulnerability(test["input"])
            assert str(ex.value) == f"Input should be a raw JSON vulnerability alert, received: {test['input']}"
        else:
            assert parse_vulnerability(test["input"]) == (
                test["expectedResult"]["readable"],
                test["expectedResult"]["output"],
                test["expectedResult"]["raw"],
            )