import json from unittest.mock import patch import demistomock import pytest from LogsignSiem import * from test_data.sample_data import ( ARGS_Q, CHECK_ARG_MOCK_DATA, DATE_FORMAT, MOCK_INC, MOCK_INCIDENTS, PARAMS, RESULT_COLUMNS_HR, RESULT_COUNT_HR, ) TEST_URL = "https://example.com" def get_client(url: str = TEST_URL, api_key: str = "apikey", verify: bool = False, proxy: bool = False): return Client(url=url, api_key=api_key, verify=verify, proxy=proxy) def test_check_args(): mock_data = CHECK_ARG_MOCK_DATA assert check_arg("test_int", mock_data) == 15 assert check_arg("test_str", mock_data) == "logsign" assert check_arg("test_list", mock_data) == [1, 2, 3] assert check_arg("test_dict", mock_data) == {"str": "unix"} with pytest.raises(ValueError): check_arg("unknown", mock_data) def test_client_general_exc(): client = get_client(url="Logsign") with pytest.raises(Exception): client._http_request("GET", "/url_suffix", params={"args": 1}) def test_client_type_error(): client = get_client(url="Logsign") with pytest.raises(TypeError): client._http_request() def test_get_generic_data(): mock_data = {"incidents": [1, 2, 3]} result = get_generic_data(data=mock_data, key="incidents", output_prefix="Logsign.Incidents") assert result.outputs_prefix == "Logsign.Incidents" assert result.outputs == mock_data assert result.raw_response == json.dumps(mock_data) def test_get_query_command(requests_mock): mock_args = {"query": "*", "grouped_column": "Source.IP", "criteria": "value", "time_frame": "1 day"} mock_q_result = {"success": True, "columns": ["8.8.8.8", "8.8.4.4"]} requests_mock.get( f"{TEST_URL}/get_columns?api_key=apikey&query=*&grouped_column=Source.IP&criteria=value&time_frame=1%20day", json=mock_q_result, ) client = get_client() response = get_query_command(client=client, url_suffix="get_columns", args=mock_args) assert response.raw_response == json.dumps(mock_q_result) assert response.outputs_prefix == "LogsignSiem.Columns" assert json.loads(response.raw_response)["columns"] == mock_q_result["columns"] def test_api_check_command(requests_mock): mock_resp = {"result": "ok"} requests_mock.get(f"{TEST_URL}/test_api?api_key=apikey", json=mock_resp) client = get_client() response = api_check_command(client) assert response == mock_resp["result"] def test_api_check_command_fail(requests_mock): mock_resp = "Authorization Error: Make sure Logsign Discovery API Key is correctly set" requests_mock.get(f"{TEST_URL}/test_api?api_key=apikey", exc=mock_resp) client = get_client() with pytest.raises(ValueError): api_check_command(client) def test_get_query_command_count(requests_mock): mock_args = {"query": "*", "grouped_column": "Source.IP", "criteria": "value", "time_frame": "1 day"} mock_q_result = {"success": True, "count": 783327} requests_mock.get( f"{TEST_URL}/get_count?api_key=apikey&query=*&grouped_column=Source.IP&criteria=value&time_frame=1%20day", json=mock_q_result, ) client = get_client() response = get_query_command(client=client, url_suffix="get_count", args=mock_args) assert response.raw_response == json.dumps(mock_q_result) assert response.outputs_prefix == "LogsignSiem.Count" assert json.loads(response.raw_response)["count"] == mock_q_result["count"] def test_main_success(mocker): """ When main function called test function should call. """ import LogsignSiem mocker.patch.object(demisto, "params", return_value=PARAMS) mocker.patch.object(demisto, "command", return_value="test-module") mocker.patch.object(LogsignSiem, "api_check_command", return_value="ok") LogsignSiem.main() assert LogsignSiem.api_check_command.called @patch("LogsignSiem.return_error") def test_main_failure(mock_return_error, mocker): """ When main function get some exception then valid message should be print. """ import LogsignSiem mocker.patch.object(demisto, "error") mocker.patch.object(demisto, "params", return_value=PARAMS) mocker.patch.object(demisto, "command", return_value="test-module") mocker.patch.object(LogsignSiem, "api_check_command", side_effect=Exception) LogsignSiem.main() mock_return_error.assert_called_once_with("Error: ") def test_get_columns_q_cmd(mocker): """ When main function called test function should call. """ import LogsignSiem mocker.patch.object(demisto, "args", return_value=ARGS_Q) mocker.patch.object(demisto, "command", return_value="logsign-get-columns-query") mocker.patch.object(LogsignSiem, "get_query_command", return_value=RESULT_COLUMNS_HR) LogsignSiem.main() assert LogsignSiem.get_query_command.called def test_get_count_q_cmd(mocker): """ When main function called test function should call. """ import LogsignSiem mocker.patch.object(demisto, "args", return_value=ARGS_Q) mocker.patch.object(demisto, "command", return_value="logsign-get-count-query") mocker.patch.object(LogsignSiem, "get_query_command", return_value=RESULT_COUNT_HR) LogsignSiem.main() assert LogsignSiem.get_query_command.called def test_get_incidents(requests_mock): last_run = "2021-05-03T13:00:00Z" requests_mock.get(f"{TEST_URL}/get_incidents?api_key=apikey&last_run={last_run}", json=MOCK_INCIDENTS) client = get_client() response = client.get_incidents("GET", datetime.strptime(last_run, DATE_FORMAT), "") assert response == MOCK_INCIDENTS def test_fetch_incidents(requests_mock): last_run = "2021-04-21T00:00:00Z" next_run = {"last_fetch": "2021-04-21T01:00:00Z"} requests_mock.get(f"{TEST_URL}/get_incidents?api_key=apikey&last_run={last_run}", json=MOCK_INC) client = get_client() resp = client.get_incidents("GET", datetime.strptime(last_run, DATE_FORMAT), "") demistomock.setLastRun({"last_fetch": last_run}) assert len(resp["incidents"]) == 2 assert resp["incidents"] == MOCK_INC["incidents"] assert next_run["last_fetch"] == resp["last_fetch"]