VectraRUXGetIncidents

Details

ID	`VectraRUXGetIncidents`
Language	python
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

Get the incidents with the type Vectra RUX Events Detection.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	6.10.0

Inputs

Argument Name	Description
page	Provide the page number. A single page has a maximum of 50 incidents.
incident_type	The XSOAR incident type to search for inactive detections. Default is ‘Vectra RUX Events Detection’.

Outputs

Path	Description	Type
VectraRUXGetIncidents.id	Incident ID.	String
VectraRUXGetIncidents.name	Incident name.	String
VectraRUXGetIncidents.CustomFields.vectraruxdetectionid	Vectra RUX detection ID linked to this incident.	String

Source

VectraRUXGetIncidents.py VectraRUXGetIncidents_test.py VectraRUXGetIncidents.yml

Download History Raw

import pytest
from VectraRUXGetIncidents import check_if_found_incident


# ==================== Tests for check_if_found_incident ====================


class TestCheckIfFoundIncident:
    def test_incident_found_returns_true(self):
        res = [{"Contents": {"data": [{"id": "1", "name": "Test Incident"}]}}]
        assert check_if_found_incident(res) is True

    def test_incident_not_found_data_is_none_returns_false(self):
        res = [{"Contents": {"data": None}}]
        assert check_if_found_incident(res) is False

    def test_raises_exception_when_data_key_missing(self):
        res = [{"Contents": {"error": "something went wrong"}}]
        with pytest.raises(Exception):
            check_if_found_incident(res)

    def test_raises_exception_when_res_is_empty_list(self):
        res: list = []
        with pytest.raises(Exception):
            check_if_found_incident(res)

    def test_raises_exception_when_contents_is_not_dict(self):
        res = [{"Contents": "some string"}]
        with pytest.raises(Exception):
            check_if_found_incident(res)

    def test_raises_exception_when_res_is_not_list(self):
        res = "invalid response"
        with pytest.raises(Exception):
            check_if_found_incident(res)  # type: ignore

    def test_raises_exception_with_correct_message_when_contents_has_error(self):
        error_contents = {"message": "Unauthorized"}
        res = [{"Contents": error_contents}]
        with pytest.raises(Exception, match="Unauthorized"):
            check_if_found_incident(res)

    def test_raises_exception_when_res_is_none(self):
        with pytest.raises(Exception):
            check_if_found_incident(None)  # type: ignore