ReadProcessesFileXDR

Return a process list from the XDRIR integration.

python · Malware Investigation and Response

Details

IDReadProcessesFileXDR
Languagepython
From Version6.2.0
Docker Imagedemisto/python3:3.12.13.10404775
Tagsdynamic-section

README

Return a process list from the XDRIR integration.

Script Data


Name Description
Script Type python3
Tags dynamic-section

Inputs


There are no inputs for this script.

Outputs


There are no outputs for this script.

Script Examples

Example command


### Context Example

```json
{}

Human Readable Output

Name CPU Memory
System Idle Process 50.0 8192
System 0.0 32768
Registry 0.0 21381120
smss.exe 0.0 409600
svchost.exe 0.0 612417536
csrss.exe 0.0 6385664
sihost.exe 0.0 13398016
wininit.exe 0.0 1675264
winlogon.exe 0.0 4898816
services.exe 0.0 7225344
lsass.exe 0.0 12431360
fontdrvhost.exe 0.0 2990080
import json

import pytest


@pytest.mark.parametrize("_return_value , res", [("test_data/process_list.json", "test_data/process_list.md")])
def test_entries_to_markdown(_return_value, res):
    """
    Given:
        - _return_values a process list
    When:
        - running the automation
    Then:
        - parse the _return_value string entries and return them in a markdown format
    """
    from ReadProcessesFileXDR import entries_to_markdown

    with open(_return_value) as process_list_from_xdr:
        # Reading from json file
        proces_list = json.load(process_list_from_xdr)
    entries_as_md = entries_to_markdown(proces_list)
    with open(res) as res_md:
        res_md = res_md.read()
    assert res_md == entries_as_md


@pytest.mark.parametrize(
    "script_results , res",
    [
        ("test_data/filter_script_results.json", "test_data/script_results.json"),
        ("test_data/filter_script_results_one_obj.json", "test_data/res_filter_script_results_one_obj.json"),
    ],
)
def test_find_last_process_list_script(script_results, res):
    """
    Given:
        - script_results
    When:
        - after running a script on the XDRIR integration
    Then:
        - choose the last script that is related to the process list.
        (contains the Name,CPU,Memory in the entry).
    """
    from ReadProcessesFileXDR import find_last_process_list_script

    with open("test_data/script_results.json") as f:
        script_results = json.load(f)
    script_result = find_last_process_list_script(script_results)
    with open("test_data/filter_script_results.json") as res:
        filter_res = json.load(res)
    assert filter_res == script_result


def test_entries_to_markdown_none():
    """
    Given:
        - _return_values a None process list
    When:
        - running the automation
    Then:
        - parse the _return_value string entries and return them in a markdown format
    """
    from ReadProcessesFileXDR import entries_to_markdown

    entries_as_md = entries_to_markdown(None)
    assert entries_as_md == ""


@pytest.mark.parametrize(
    "entry, res", [("Name: System Idle Process, CPU: 50.0, Memory: 8192", True), ("Name , CPU", False), ("", False)]
)
def test_detect_process_field(entry, res):
    """
    Given:
        - a _return_value record
    When:
        - calling find last process list
    Then
        - check that the first entry has all the required filds
    """
    from ReadProcessesFileXDR import detect_process_field

    assert detect_process_field(entry) == res


@pytest.mark.parametrize(
    "script_results, res",
    [
        (
            {"results": {"_return_value": ["Name: System Idle Process, CPU: 50.0, Memory: 8192"]}},
            ["Name: System Idle Process, CPU: 50.0, Memory: 8192"],
        ),
        (
            [{"results": [{"_return_value": ["Name: System Idle Process, CPU: 50.0, Memory: 8192"]}]}],
            ["Name: System Idle Process, CPU: 50.0, Memory: 8192"],
        ),
        ([{"results": [{"_return_value": ["Name: System Idle Process, CPU: 50.0, blabla: 8192"]}]}], None),
        (None, None),
    ],
)
def test_find_last_process_list_script_(script_results, res):
    """
    Given:
        - script_results with different structure.
    When:
        - after running a script on the XDRIR integration
    Then:
        - Check that the function knows how to parse all the cases and return the correct result
    """
    from ReadProcessesFileXDR import find_last_process_list_script

    assert find_last_process_list_script(script_results) == res