ReadProcessesFileXDR
Return a process list from the XDRIR integration.
python · Malware Investigation and Response
Details
| ID | ReadProcessesFileXDR |
|---|---|
| Language | python |
| From Version | 6.2.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Tags | dynamic-section |
README
Return a process list from the XDRIR integration.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | dynamic-section |
Inputs
There are no inputs for this script.
Outputs
There are no outputs for this script.
Script Examples
Example command
### Context Example
```json
{}
Human Readable Output
| Name | CPU | Memory |
|---|---|---|
| System Idle Process | 50.0 | 8192 |
| System | 0.0 | 32768 |
| Registry | 0.0 | 21381120 |
| smss.exe | 0.0 | 409600 |
| svchost.exe | 0.0 | 612417536 |
| csrss.exe | 0.0 | 6385664 |
| sihost.exe | 0.0 | 13398016 |
| wininit.exe | 0.0 | 1675264 |
| winlogon.exe | 0.0 | 4898816 |
| services.exe | 0.0 | 7225344 |
| lsass.exe | 0.0 | 12431360 |
| fontdrvhost.exe | 0.0 | 2990080 |
import json import pytest @pytest.mark.parametrize("_return_value , res", [("test_data/process_list.json", "test_data/process_list.md")]) def test_entries_to_markdown(_return_value, res): """ Given: - _return_values a process list When: - running the automation Then: - parse the _return_value string entries and return them in a markdown format """ from ReadProcessesFileXDR import entries_to_markdown with open(_return_value) as process_list_from_xdr: # Reading from json file proces_list = json.load(process_list_from_xdr) entries_as_md = entries_to_markdown(proces_list) with open(res) as res_md: res_md = res_md.read() assert res_md == entries_as_md @pytest.mark.parametrize( "script_results , res", [ ("test_data/filter_script_results.json", "test_data/script_results.json"), ("test_data/filter_script_results_one_obj.json", "test_data/res_filter_script_results_one_obj.json"), ], ) def test_find_last_process_list_script(script_results, res): """ Given: - script_results When: - after running a script on the XDRIR integration Then: - choose the last script that is related to the process list. (contains the Name,CPU,Memory in the entry). """ from ReadProcessesFileXDR import find_last_process_list_script with open("test_data/script_results.json") as f: script_results = json.load(f) script_result = find_last_process_list_script(script_results) with open("test_data/filter_script_results.json") as res: filter_res = json.load(res) assert filter_res == script_result def test_entries_to_markdown_none(): """ Given: - _return_values a None process list When: - running the automation Then: - parse the _return_value string entries and return them in a markdown format """ from ReadProcessesFileXDR import entries_to_markdown entries_as_md = entries_to_markdown(None) assert entries_as_md == "" @pytest.mark.parametrize( "entry, res", [("Name: System Idle Process, CPU: 50.0, Memory: 8192", True), ("Name , CPU", False), ("", False)] ) def test_detect_process_field(entry, res): """ Given: - a _return_value record When: - calling find last process list Then - check that the first entry has all the required filds """ from ReadProcessesFileXDR import detect_process_field assert detect_process_field(entry) == res @pytest.mark.parametrize( "script_results, res", [ ( {"results": {"_return_value": ["Name: System Idle Process, CPU: 50.0, Memory: 8192"]}}, ["Name: System Idle Process, CPU: 50.0, Memory: 8192"], ), ( [{"results": [{"_return_value": ["Name: System Idle Process, CPU: 50.0, Memory: 8192"]}]}], ["Name: System Idle Process, CPU: 50.0, Memory: 8192"], ), ([{"results": [{"_return_value": ["Name: System Idle Process, CPU: 50.0, blabla: 8192"]}]}], None), (None, None), ], ) def test_find_last_process_list_script_(script_results, res): """ Given: - script_results with different structure. When: - after running a script on the XDRIR integration Then: - Check that the function knows how to parse all the cases and return the correct result """ from ReadProcessesFileXDR import find_last_process_list_script assert find_last_process_list_script(script_results) == res