RSA_GetRawLog

Use this script to get RAW log.

Details

ID	`RSA_GetRawLog`
Language	python
From Version	6.9.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	field-change-triggered

README

Use this script to get RAW log.
Each RSA NetWitness log contains the eventsource meta that contains an IP address that can be requested using RSA NetWitness Packets and Logs.
This log is after set in the field rsarawlogslist.

Script Data

Name	Description
Script Type	python3
Tags	field-change-triggered

Dependencies

This script uses the following commands and scripts.

netwitness-query
RSA NetWitness Packets and Logs
netwitness-packets

Used In

This script is used in the following playbooks and scripts.

rsaalerts

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Script Examples

Example command


### Context Example

```json
 {
    "RSA Alerts": [
        {
            "created": "2023-07-03T11:04:16.408Z",
            "detail": null,
            "events": [
                {
                    "destination": {},
                    "eventSource": "1.1.1.1:56005",
                    "eventSourceId": "12123434",
                    "source": {}
                }
            ],
            "id": "123456789",
            "riskScore": "50",
            "source": "NetWitness Investigate",
            "title": "Incident name",
            "type": "Log",
        },
    ]
}

Source

RSAGetRawLog.py RSAGetRawLog_test.py RSAGetRawLog.yml

Download History Raw

import demistomock as demisto  # noqa: F401
import pytest
import RSAGetRawLog
from RSAGetRawLog import create_id_set, get_metas_log, get_raw_log, is_json, main, merge_dict


def test_is_json():
    assert is_json('{"test": "test"}') == {"test": "test"}


def test_merge_dict():
    assert merge_dict({"a": "a"}, {"b": "b"}) == {"a": "a", "b": "b"}


def test_create_id_set():
    assert create_id_set([{"id": 1}, {"id": 2}, {"id": 3}]) == [1, 2, 3]


def test_get_raw_log(mocker):
    mocker.patch.object(RSAGetRawLog, "isCommandAvailable", return_value=True)
    mocker.patch.object(demisto, "executeCommand", return_value=[{"Contents": {"logs": ["log1", "log2"]}}])

    assert get_raw_log("0", "1.2.3.4", "1234") == ["log1", "log2"]


def test_get_metas_log(mocker):
    mocker.patch.object(RSAGetRawLog, "isCommandAvailable", return_value=True)
    mocker.patch.object(
        demisto, "executeCommand", return_value=[{"Contents": {}, "EntryContext": {"NetWitness.Events": "Test Value"}}]
    )

    assert get_metas_log("0", "1.2.3.4", "1234") == "Test Value"


@pytest.mark.parametrize(
    "alerts_incident, expected_results",
    [
        (
            {"CustomFields": {"rsaalerts": [], "rsarawlogslist": [], "rsametasevents": []}},
            "No alert/event was found in this incident.",
        ),
        (
            {
                "CustomFields": {
                    "rsaalerts": [{"id": 1}, {"id": 2}, {"id": 3}],
                    "rsarawlogslist": [{"id": 1}, {"id": 2}, {"id": 3}],
                    "rsametasevents": [],
                }
            },
            "Nothing has changed !",
        ),
        (
            {
                "CustomFields": {
                    "rsaalerts": [
                        {
                            "id": 1,
                            "title": "title",
                            "created": "2023-08-29T11:46:22.529Z",
                            "events": [{"eventSource": "1.2.3.4:56005", "eventSourceId": "157970808811"}],
                        }
                    ],
                    "rsarawlogslist": [{"id": 2}, {"id": 3}],
                    "rsametasevents": [],
                }
            },
            "1 raw log inserts !",
        ),
    ],
)
def test_main(mocker, alerts_incident, expected_results):
    mocker_result = mocker.patch.object(demisto, "results")
    mocker.patch.object(RSAGetRawLog, "get_raw_log", return_value=[{"log": "value"}])
    mocker.patch.object(RSAGetRawLog, "get_metas_log", return_value=[{"metas": "value"}])
    mocker.patch("RSAGetRawLog.demisto.incident", return_value=alerts_incident)

    main()
    result_content = mocker_result.call_args.args[0].get("HumanReadable")
    assert result_content == expected_results