ZTAPBuildTimeline Deprecated

Deprecated. Comment ingestion simplified and audit log ingestion removed. No available replacement. Adds unmarked log/comment notes as evidence in the timeline.

python · Zero Trust Analytics Platform

Details

ID	`ZTAPBuildTimeline`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.9.7.24076`
Tags	ztap

README

Adds unmarked log/comment notes as evidence in the timeline.

Script Data

Name	Description
Script Type	python3
Tags	ztap
Cortex XSOAR Version	6.0.0

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

ZTAPBuildTimeline.py ZTAPBuildTimeline_test.py ZTAPBuildTimeline.yml

Download History Raw

import json
import io
import demistomock as demisto


def util_load_json(path):
    with io.open(path, mode="r", encoding="utf-8") as f:
        return json.loads(f.read())


def test_build_timeline(mocker):
    from ZTAPBuildTimeline import build_timeline

    def executeCommand(name, args=None):
        if name == "markAsEvidence":
            return [{"Contents": "done"}]
        else:
            raise ValueError("Unimplemented command called: {name}")

    mocker.patch.object(demisto, "executeCommand", side_effect=executeCommand)

    entries = util_load_json("test_data/entries.json")
    output = build_timeline(entries)

    mock_markdown_result = util_load_json("test_data/output.json")
    assert output == mock_markdown_result