import BreachRx import pytest import requests_mock from BreachRx import ( BreachRxClient, create_incident_command, create_incident_mutation, get_actions_for_incident, get_incident_actions_command, get_incident_by_name, get_incident_command, get_incident_severities, get_incident_types, import_incident_command, ) from CommonServerPython import json def util_load_json(path): with open(path, encoding="utf-8") as f: return json.loads(f.read()) def introspection_matcher(request): return "IntrospectionQuery" in request.json().get("query") def create_incident_matcher(request): from graphql import print_ast return request.json().get("query") == print_ast(create_incident_mutation.document) def get_severities_matcher(request): from graphql import print_ast return request.json().get("query") == print_ast(get_incident_severities.document) def get_types_matcher(request): from graphql import print_ast return request.json().get("query") == print_ast(get_incident_types.document) def get_incident_matcher(request): from graphql import print_ast return request.json().get("query") == print_ast(get_incident_by_name.document) def get_actions_matcher(request): from graphql import print_ast return request.json().get("query") == print_ast(get_actions_for_incident.document) def set_up_mocker(m, found_incident=True): m.post(requests_mock.ANY, additional_matcher=create_incident_matcher, json=util_load_json("test_data/create_incident.json")) m.post( requests_mock.ANY, additional_matcher=get_severities_matcher, json=util_load_json("test_data/incident_severities.json") ) m.post(requests_mock.ANY, additional_matcher=get_types_matcher, json=util_load_json("test_data/incident_types.json")) if found_incident: m.post(requests_mock.ANY, additional_matcher=get_incident_matcher, json=util_load_json("test_data/get_incident.json")) else: m.post( requests_mock.ANY, additional_matcher=get_incident_matcher, json=util_load_json("test_data/get_incident_empty.json") ) m.post( requests_mock.ANY, additional_matcher=get_actions_matcher, json=util_load_json("test_data/get_actions_for_incident.json") ) return BreachRxClient("mock://base_url", "api_key", "secret_key", "org_name", False) def test_create_incident_command(): incident_name = "this is an incident" incident_description = "Here is a description." with requests_mock.Mocker() as m: client = set_up_mocker(m) results = create_incident_command(client, incident_name=incident_name, description=incident_description) create_incident_request = m.request_history[-1] assert incident_name == create_incident_request.json()["variables"]["name"] assert incident_description == create_incident_request.json()["variables"]["description"] assert results.outputs_prefix == "BreachRx.Incident" assert results.outputs_key_field == "id" assert results.outputs == { "description": "This is a description.", "id": 369, "identifier": "JULIETT000369", "name": "a random incident to create", "severity": {"name": "Unknown"}, "types": [{"type": {"name": "Other"}}], } def test_create_incident_command_no_description(): incident_name = "this is an incident" with requests_mock.Mocker() as m: client = set_up_mocker(m) results = create_incident_command(client, incident_name=incident_name) create_incident_request = m.request_history[-1] assert incident_name == create_incident_request.json()["variables"]["name"] assert ( create_incident_request.json()["variables"]["description"] == """An Incident copied from the Palo Alto Networks XSOAR platform.

XSOAR Incident Name: 1""" ) assert results.outputs_prefix == "BreachRx.Incident" assert results.outputs_key_field == "id" assert results.outputs == { "description": "This is a description.", "id": 369, "identifier": "JULIETT000369", "name": "a random incident to create", "severity": {"name": "Unknown"}, "types": [{"type": {"name": "Other"}}], } def test_create_incident_command_no_incident_name(): incident_description = "Here is a description." with requests_mock.Mocker() as m: client = set_up_mocker(m) results = create_incident_command(client, description=incident_description) create_incident_request = m.request_history[-1] assert create_incident_request.json()["variables"]["name"] == "1" assert incident_description == create_incident_request.json()["variables"]["description"] assert results.outputs_prefix == "BreachRx.Incident" assert results.outputs_key_field == "id" assert results.outputs == { "description": "This is a description.", "id": 369, "identifier": "JULIETT000369", "name": "a random incident to create", "severity": {"name": "Unknown"}, "types": [{"type": {"name": "Other"}}], } def test_get_incident_actions_command(mocker): incident = { "id": 339, "name": "4 My manually set XSOAR Incident name", "severity": {"name": "High"}, "types": [{"type": {"name": "Attempted Access"}}], "description": "An alternative description!", "identifier": "JULIETT000339", } with requests_mock.Mocker() as m: client = set_up_mocker(m) mocker.patch.object(BreachRx, "demisto") BreachRx.demisto.dt.return_value = incident results = get_incident_actions_command(client) get_actions_request = m.request_history[-1] assert get_actions_request.json()["variables"].get("incidentId") == incident["id"] assert results.outputs_prefix == "BreachRx.Incident" assert results.outputs_key_field == "id" assert results.outputs == [ { "description": "An alternative description!", "id": 339, "identifier": "JULIETT000339", "name": "4 My manually set XSOAR Incident name", "severity": {"name": "High"}, "types": [{"type": {"name": "Attempted Access"}}], "actions": [ { "description": "

abc

", "id": 1229, "name": "Another ggg", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": "", "id": 1230, "name": "conditions", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": "", "id": 1231, "name": "make another task", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": '

test indent

', "id": 1232, "name": "test4", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, ], } ] def test_get_incident_actions_command_no_incident_context(): with requests_mock.Mocker() as m: client = set_up_mocker(m) with pytest.raises(Exception) as error: get_incident_actions_command(client) assert str(error.value) == ( "Error: No BreachRx privacy Incident associated with this Incident, and no Incident search terms provided." ) def test_get_incident_actions_command_incident_name(mocker): incident_name = "Random Incident Name" with requests_mock.Mocker() as m: client = set_up_mocker(m) results = get_incident_actions_command(client, incident_name=incident_name) get_incident_request = m.request_history[-2] assert get_incident_request.json()["variables"].get("name") == incident_name get_actions_request = m.request_history[-1] assert get_actions_request.json()["variables"].get("incidentId") == 339 assert results.outputs_prefix == "BreachRx.Incident" assert results.outputs_key_field == "id" assert results.outputs == [ { "description": "An alternative description!", "id": 339, "identifier": "JULIETT000339", "name": "4 My manually set XSOAR Incident name", "severity": {"name": "High"}, "types": [{"type": {"name": "Attempted Access"}}], "actions": [ { "description": "

abc

", "id": 1229, "name": "Another ggg", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": "", "id": 1230, "name": "conditions", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": "", "id": 1231, "name": "make another task", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": '

test indent

', "id": 1232, "name": "test4", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, ], } ] def test_get_incident_actions_command_incident_identifier(): incident_identifier = "TEST0001" with requests_mock.Mocker() as m: client = set_up_mocker(m) results = get_incident_actions_command(client, incident_identifier=incident_identifier) get_incident_request = m.request_history[-2] assert get_incident_request.json()["variables"].get("identifier") == incident_identifier get_actions_request = m.request_history[-1] assert get_actions_request.json()["variables"].get("incidentId") == 339 assert results.outputs_prefix == "BreachRx.Incident" assert results.outputs_key_field == "id" assert results.outputs == [ { "description": "An alternative description!", "id": 339, "identifier": "JULIETT000339", "name": "4 My manually set XSOAR Incident name", "severity": {"name": "High"}, "types": [{"type": {"name": "Attempted Access"}}], "actions": [ { "description": "

abc

", "id": 1229, "name": "Another ggg", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": "", "id": 1230, "name": "conditions", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": "", "id": 1231, "name": "make another task", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": '

test indent

', "id": 1232, "name": "test4", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, ], } ] def test_get_incident_actions_command_multiple_incidents(mocker): incidents = [ { "id": 339, "name": "4 My manually set XSOAR Incident name", "severity": {"name": "High"}, "types": [{"type": {"name": "Attempted Access"}}], "description": "An alternative description!", "identifier": "JULIETT000339", }, { "id": 369, "name": "a random incident to create", "severity": {"name": "Unknown"}, "types": [{"type": {"name": "Other"}}], "description": "This is a description.", "identifier": "JULIETT000369", }, ] with requests_mock.Mocker() as m: client = set_up_mocker(m) mocker.patch.object(BreachRx, "demisto") BreachRx.demisto.dt.return_value = incidents results = get_incident_actions_command(client) get_actions_request = m.request_history[-2] assert get_actions_request.json()["variables"].get("incidentId") == incidents[0]["id"] get_actions_request = m.request_history[-1] assert get_actions_request.json()["variables"].get("incidentId") == incidents[1]["id"] assert results.outputs_prefix == "BreachRx.Incident" assert results.outputs_key_field == "id" assert results.outputs == [ { "description": "An alternative description!", "id": 339, "identifier": "JULIETT000339", "name": "4 My manually set XSOAR Incident name", "severity": {"name": "High"}, "types": [{"type": {"name": "Attempted Access"}}], "actions": [ { "description": "

abc

", "id": 1229, "name": "Another ggg", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": "", "id": 1230, "name": "conditions", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": "", "id": 1231, "name": "make another task", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": '

test indent

', "id": 1232, "name": "test4", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, ], }, { "id": 369, "name": "a random incident to create", "description": "This is a description.", "identifier": "JULIETT000369", "severity": {"name": "Unknown"}, "types": [{"type": {"name": "Other"}}], "actions": [ { "description": "

abc

", "id": 1229, "name": "Another ggg", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": "", "id": 1230, "name": "conditions", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": "", "id": 1231, "name": "make another task", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, { "description": '

test indent

', "id": 1232, "name": "test4", "phase": {"id": 1, "name": "Ready"}, "phase_name": "Ready", "user": None, }, ], }, ] def test_import_incident_command(): incident_name = "This is another example Incident" incident_identifier = "FOO00123" with requests_mock.Mocker() as m: client = set_up_mocker(m) results = import_incident_command(client, incident_name=incident_name, incident_identifier=incident_identifier) create_incident_request = m.request_history[-1] assert incident_name == create_incident_request.json()["variables"]["name"] assert incident_identifier == create_incident_request.json()["variables"]["identifier"] assert results.outputs_prefix == "BreachRx.Incident" assert results.outputs_key_field == "id" assert results.outputs == { "description": "An alternative description!", "id": 339, "identifier": "JULIETT000339", "name": "4 My manually set XSOAR Incident name", "severity": {"name": "High"}, "types": [{"type": {"name": "Attempted Access"}}], } def test_import_incident_command_no_incident(): incident_name = "This is another example Incident" incident_identifier = "FOO00123" with requests_mock.Mocker() as m: client = set_up_mocker(m, found_incident=False) with pytest.raises(Exception) as error: import_incident_command(client, incident_name=incident_name, incident_identifier=incident_identifier) create_incident_request = m.request_history[-1] assert incident_name == create_incident_request.json()["variables"]["name"] assert incident_identifier == create_incident_request.json()["variables"]["identifier"] assert str(error.value) == "Error: No BreachRx privacy Incident found using the search terms provided." def test_get_incident_command(): incident_name = "This is another example Incident" incident_identifier = "FOO00123" with requests_mock.Mocker() as m: client = set_up_mocker(m) results = get_incident_command(client, incident_name=incident_name, incident_identifier=incident_identifier) create_incident_request = m.request_history[-1] assert incident_name == create_incident_request.json()["variables"]["name"] assert incident_identifier == create_incident_request.json()["variables"]["identifier"] assert ( results.readable_output == 'Incident found with name="4 My manually set XSOAR Incident name" and identifier="JULIETT000339".' ) def test_get_incident_command_no_incident(): incident_name = "This is another example Incident" incident_identifier = "FOO00123" with requests_mock.Mocker() as m: client = set_up_mocker(m, found_incident=False) results = get_incident_command(client, incident_name=incident_name, incident_identifier=incident_identifier) create_incident_request = m.request_history[-1] assert incident_name == create_incident_request.json()["variables"]["name"] assert incident_identifier == create_incident_request.json()["variables"]["identifier"] assert results == "No Incident found with those search terms."