QRadarGetOffenseCorrelations Deprecated

Deprecated. Use the QradarGetOffenseCorrlations_v2 Playbook instead. Return the QRadar offense correlations if exist in logs.

python · IBM QRadar

Details

ID	`QRadarGetOffenseCorrelations`
Language	python
From Version	5.0.0
Docker Image	`demisto/python:2.7.18.20958`
Tags	QRadar

Source

QRadarGetOffenseCorrelations.py QRadarGetOffenseCorrelations_test.py QRadarGetOffenseCorrelations.yml

Download History Raw

import pytest
import demistomock as demisto
from QRadarGetOffenseCorrelations import main


@pytest.mark.parametrize('bool_val', ["True"])
def test_get_query_cre_name_null_true(mocker, bool_val):
    def executeCommand(name, args=None):
        mock_dict = {
            'Contents.events': None,
            'Type': 'JSON'
        }
        return [mock_dict, "\"CRE NAME\" <> NULL" not in args["query_expression"]]

    mocker.patch.object(demisto, 'args', return_value={'is_cre_name_null': bool_val})
    mocker.patch.object(demisto, 'executeCommand', side_effect=executeCommand)
    mocker.patch.object(demisto, 'results')
    main()
    results = demisto.results.call_args[0]
    assert results[0][1]


@pytest.mark.parametrize('bool_val', ["False"])
def test_get_query_cre_name_null_false(mocker, bool_val):
    def executeCommand(name, args=None):
        mock_dict = {
            'Contents.events': None,
            'Type': 'JSON'
        }
        return [mock_dict, "\"CRE NAME\" <> NULL" not in args["query_expression"]]

    mocker.patch.object(demisto, 'args', return_value={'is_cre_name_null': bool_val})
    mocker.patch.object(demisto, 'executeCommand', side_effect=executeCommand)
    mocker.patch.object(demisto, 'results')
    main()
    results = demisto.results.call_args[0]
    assert not results[0][1]