import json import demistomock as demisto import requests_mock from freezegun import freeze_time DEMISTO_PARAMS = { "limit": 100, "credentials": { "identifier": "admin@your.domain", "password": "123456", }, } DATETIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ" AUTH_URL = "https://api.dropbox.com/oauth2/token" EVENTS_URL = "https://api.dropbox.com/2/team_log/get_events" def util_load_json(path): with open(path, encoding="utf-8") as f: return json.loads(f.read()) def mock_set_last_run(last_run): return last_run @freeze_time("2022-05-17T00:00:00Z") def test_fetch_incidents_few_incidents(mocker): """ Given - 6 events was created in Dropbox side in the last 7 days. When - fetch-events is running (with max_fetch set to 100). Then - Verify that all 6 events were created in XSIAM. - Verify last_run was set as expected. """ mocker.patch.object(demisto, "params", return_value=DEMISTO_PARAMS) mocker.patch.object(demisto, "args", return_value={"should_push_events": True}) mocker.patch.object(demisto, "getIntegrationContext", return_value={"refresh_token": "111111"}) mocker.patch("DropboxEventCollector.send_events_to_xsiam") last_run = mocker.patch.object(demisto, "setLastRun", side_effect=mock_set_last_run) or {} results = mocker.patch.object(demisto, "results") with requests_mock.Mocker() as m: m.post(AUTH_URL, json={"access_token": "222222"}) m.post(EVENTS_URL, json=util_load_json("test_data/events_1_.json")) m.post(f"{EVENTS_URL}/continue", json=util_load_json("test_data/events_2_.json")) from DropboxEventCollector import main main("dropbox-get-events", demisto.params() | demisto.args()) events = results.call_args[0][0]["Contents"] assert last_run.call_args[0][0].get("start_time") == "2022-05-16T11:48:29Z" assert len(events) == 6 @freeze_time("2022-05-17T00:00:00Z") def test_fetch_events_no_incidents(mocker): """ Given - No events was created in Dropbox side in the last 7 days. When - fetch-events is running. Then - Make sure no events was created in XSIAM. - Make sure last_run was set as expected. """ mocker.patch.object(demisto, "params", return_value=DEMISTO_PARAMS) mocker.patch.object(demisto, "args", return_value={"should_push_events": True}) mocker.patch.object(demisto, "getIntegrationContext", return_value={"refresh_token": "111111"}) mocker.patch("DropboxEventCollector.send_events_to_xsiam") last_run = mocker.patch.object(demisto, "setLastRun", side_effect=mock_set_last_run) results = mocker.patch.object(demisto, "results") with requests_mock.Mocker() as m: m.post(AUTH_URL, json={"access_token": "222222"}) m.post(EVENTS_URL, json={}) from DropboxEventCollector import main main("dropbox-get-events", demisto.params() | demisto.args()) events = results.call_args[0][0]["Contents"] assert not last_run.call_args assert not events @freeze_time("2022-05-17T00:00:00Z") def test_fetch_events_max_fetch_set_to_one(mocker): """ Given - 3 events was created in Jira side in the last 7 days. When - fetch-events is running (with max_fetch set to 1). Then - Verify that only 1 event were created in XSIAM. - Verify last_run was set as expected. """ params = DEMISTO_PARAMS.copy() params["limit"] = 1 mocker.patch.object(demisto, "params", return_value=params) mocker.patch.object(demisto, "args", return_value={"should_push_events": True}) mocker.patch.object(demisto, "getIntegrationContext", return_value={"refresh_token": "111111"}) mocker.patch("DropboxEventCollector.send_events_to_xsiam") last_run = mocker.patch.object(demisto, "setLastRun", side_effect=mock_set_last_run) results = mocker.patch.object(demisto, "results") with requests_mock.Mocker() as m: m.post(AUTH_URL, json={"access_token": "222222"}) m.post(EVENTS_URL, json=util_load_json("test_data/events_1_.json")) m.post(f"{EVENTS_URL}/continue", json=util_load_json("test_data/events_2_.json")) from DropboxEventCollector import main main("dropbox-get-events", demisto.params() | demisto.args()) events = results.call_args[0][0]["Contents"] assert last_run.call_args[0][0].get("start_time") == "2022-05-16T11:34:30Z" assert len(events) == 1 def test_time_field_added_to_events(mocker): """ Given: - Events are fetched from Dropbox with timestamp fields. When: - The dropbox-get-events command is executed with should_push_events enabled. Then: - Ensure each event has a _time field equal to its timestamp value. """ mocker.patch.object(demisto, "params", return_value=DEMISTO_PARAMS) mocker.patch.object(demisto, "args", return_value={"should_push_events": True}) mocker.patch.object(demisto, "getIntegrationContext", return_value={"refresh_token": "111111"}) send_events_mock = mocker.patch("DropboxEventCollector.send_events_to_xsiam") with requests_mock.Mocker() as m: m.post(AUTH_URL, json={"access_token": "222222"}) m.post(EVENTS_URL, json=util_load_json("test_data/events_1_.json")) m.post(f"{EVENTS_URL}/continue", json=util_load_json("test_data/events_2_.json")) from DropboxEventCollector import main main("dropbox-get-events", demisto.params() | demisto.args()) sent_events = send_events_mock.call_args[0][0] # Verify all events have _time field matching their timestamp for event in sent_events: assert event["_time"] == event["timestamp"]