iot-security-vuln-post-processing

IoT vulnerability post processing script to resolve the vulnerability incident in IoT security portal using API

Details

ID	`iot-security-vuln-post-processing`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	iot post-processing

README

An IoT vulnerability post processing script to resolve the vulnerability incident in IoT security portal using the API.

Script Data

Name	Description
Script Type	python3
Tags	iot, post-processing
Cortex XSOAR Version	5.5.0

This script is executing the ‘iot-security-resolve-vuln’ command to resolve a vulnerability in the Palo Alto Networks IoT security portal during post-processing.

Inputs

There are no inputs for this script.

Outputs

There are no outputs for this script.

Source

iot_vuln_post_processing.py iot_vuln_post_processing_test.py iot_vuln_post_processing.yml iot_vuln_post_processing_description.md

Download History Raw

import demistomock as demisto
import iot_vuln_post_processing
from iot_vuln_post_processing import iot_resolve_vuln

_INCIDENT = {
    "id": 28862,
    "labels": [{"type": "zb_ticketid", "value": "vuln-99124066"}, {"type": "vulnerability_name", "value": "SMB v1 Usage"}],
}


def test_iot_resolve_alert(monkeypatch, mocker):
    """
    Scenario: resolving vulnerability in post processing after closing the XSOAR incident

    Given
    - A vulnerability incident

    When
    - Resolving a vulnerability in IoT Security Portal

    Then
    - Ensure the correct parameters to the iot-security-resolve-vuln command
    """
    monkeypatch.setattr(iot_vuln_post_processing, "_get_incident", lambda: _INCIDENT)
    execute_mocker = mocker.patch.object(demisto, "executeCommand")
    expected_command = "iot-security-resolve-vuln"
    expected_args = {"id": "vuln-99124066", "full_name": "SMB v1 Usage", "reason": "resolved by XSOAR incident 28862"}
    iot_resolve_vuln()
    execute_mocker.assert_called_with(expected_command, expected_args)