from unittest import mock
import demistomock as demisto
import pytest
from GenetecSecurityCenterEventCollector import Client, main
INCIDENT_NO_ONE = {
"Id": 1,
"Guid": 1,
"ModificationTimeStamp": "2024-02-21T23:21:33.96Z",
"Value": "1",
}
INCIDENT_NO_TWO = {
"Id": 2,
"Guid": 2,
"ModificationTimeStamp": "2024-02-22T23:21:33.96Z",
"Value": "2",
}
INCIDENT_NO_THREE = {
"Id": 3,
"Guid": 3,
"ModificationTimeStamp": "2024-02-23T23:21:33.96Z",
"Value": "3",
}
INCIDENT_NO_FOUR = {
"Id": 4,
"Guid": 4,
"ModificationTimeStamp": "2024-02-24T23:21:33.96Z",
"Value": "4",
}
def mock_http_response(
content=None,
):
mock_resp = mock.Mock()
mock_resp.content = content
return mock_resp
def get_client() -> Client:
return Client("www.test.com", "username", "password", False, False, "2", "app_id")
def test_test_module_success(mocker):
"""
Validate that in case of a successful response from the BaseClient's _http_request
The Client's http_request will return the response and test-module will return 'ok'.
"""
from GenetecSecurityCenterEventCollector import test_module
client = get_client()
mock_response = mock_http_response(content="""{"Rsp": {"Status": "OK", "Result": "Result"}}""")
mocker.patch.object(client, "_http_request", return_value=mock_response)
assert test_module(client=client) == "ok"
def test_test_module_failure(mocker):
"""
Validate that in case of an unsuccessful response from the BaseClient's _http_request.
The Client's http_request will raise an error with the result section as the message and test-module will fail as well..
"""
from GenetecSecurityCenterEventCollector import test_module
client = get_client()
mock_response = mock_http_response(content="""{"Rsp": {"Status": "Fail", "Result": "Failed the http request."}}""")
mocker.patch.object(client, "_http_request", return_value=mock_response)
try:
test_module(client=client)
except Exception as err:
assert "Failed the http request." in str(err)
@pytest.mark.parametrize(
"first_iteration_response, second_iteration_response, expected_events_len_first_call,"
"expected_events_len_second_call, expected_last_run_first_iteration, expected_last_run_second_iteration,"
"expected_events_first_call, expected_events_second_call",
[
(
[INCIDENT_NO_ONE, INCIDENT_NO_TWO.copy(), INCIDENT_NO_THREE, INCIDENT_NO_FOUR],
[INCIDENT_NO_TWO, INCIDENT_NO_THREE, INCIDENT_NO_FOUR],
2,
1,
{"audit_cache": [1, 2], "start_time": "2024-02-22T23:21:33"},
{"audit_cache": [3], "start_time": "2024-02-23T23:21:33"},
[
{
"Id": 1,
"Guid": 1,
"ModificationTimeStamp": "2024-02-21T23:21:33.96Z",
"_time": "2024-02-21T23:21:33.96Z",
"Value": {"AuditData": {"EId": "1"}},
},
{
"Id": 2,
"Guid": 2,
"ModificationTimeStamp": "2024-02-22T23:21:33.96Z",
"_time": "2024-02-22T23:21:33.96Z",
"Value": {"AuditData": {"EId": "2"}},
},
],
[
{
"Id": 3,
"Guid": 3,
"ModificationTimeStamp": "2024-02-23T23:21:33.96Z",
"_time": "2024-02-23T23:21:33.96Z",
"Value": {"AuditData": {"EId": "3"}},
}
],
)
],
)
def test_fetch_events_command(
mocker,
first_iteration_response,
second_iteration_response,
expected_events_len_first_call,
expected_events_len_second_call,
expected_last_run_first_iteration,
expected_last_run_second_iteration,
expected_events_first_call,
expected_events_second_call,
):
"""Testing two consecutive calls to the fetch events command.
The flow:
- General mocks & preparations.
- First call.
- Asserting first call results: The last_run object, the number of retrieved events, and the events content.
- Second call.
- Asserting second call results: The last_run object, the number of retrieved events, and the events content.
"""
mocker.patch.object(demisto, "getLastRun", return_value={})
mocker.patch.object(demisto, "command", return_value="fetch-events")
mocker.patch.object(demisto, "setLastRun")
mocker.patch.object(
demisto,
"params",
return_value={
"url": "http://test.com",
"credentials": {"identifier": "username", "password": "password"},
"app_id": "app_id",
"max_fetch": "2",
},
)
send_events_mock = mocker.patch("GenetecSecurityCenterEventCollector.send_events_to_xsiam")
mocker.patch("GenetecSecurityCenterEventCollector.Client.http_request", return_value=first_iteration_response)
main()
assert demisto.setLastRun.call_args[0][0] == expected_last_run_first_iteration
first_call_events = send_events_mock.call_args.kwargs["events"]
assert len(first_call_events) == expected_events_len_first_call
assert first_call_events == expected_events_first_call
mocker.patch("GenetecSecurityCenterEventCollector.Client.http_request", return_value=second_iteration_response)
main()
assert demisto.setLastRun.call_args[0][0] == expected_last_run_second_iteration
second_call_events = send_events_mock.call_args.kwargs["events"]
assert len(second_call_events) == expected_events_len_second_call
assert second_call_events == expected_events_second_call