device-security-alert-post-processing

Resolves the alert in the Device Security portal via the API. Designed to run as a post-processing script.

python · Device Security by Palo Alto Networks

Details

ID	`device-security-alert-post-processing`
Language	python
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	device security post-processing

README

Resolves the alert in the Device Security portal via the API. Designed to run as a post-processing script.

Script Data

Name	Description
Script Type	python3
Tags	device security, post-processing
Cortex XSOAR Version	6.10.0

Inputs

Argument Name	Description
close_reason	The reason the alert was closed (either ‘Resolved’ or ‘No Action Needed’).

Outputs

There are no outputs for this script.

Source

device_security_alert_post_processing.py device_security_alert_post_processing_test.py device_security_alert_post_processing.yml device_security_alert_post_processing_description.md

Download History Raw

import demistomock as demisto
import device_security_alert_post_processing
from device_security_alert_post_processing import device_security_resolve_alert

_INCIDENT = {"id": 28862, "labels": [{"type": "id", "value": "5ed08587fe03d30d000016e8"}]}


def test_device_security_resolve_alert(monkeypatch, mocker):
    """
    Scenario: resolving alert in post processing after closing the XSOAR incident

    Given
    - An alert incident

    When
    - Resolving an alert in Device Security Portal

    Then
    - Ensure the correct parameters to the device-security-resolve-alert command
    """
    monkeypatch.setattr(device_security_alert_post_processing, "_get_incident", lambda: _INCIDENT)
    execute_mocker = mocker.patch.object(demisto, "executeCommand")
    expected_command = "device-security-resolve-alert"
    expected_args = {
        "id": "5ed08587fe03d30d000016e8",
        "reason": "Resolved by XSOAR incident 28862",
        "reason_type": "No Action Needed",
    }
    device_security_resolve_alert()
    execute_mocker.assert_called_with(expected_command, expected_args)