import demistomock as demisto # noqa import ExpanseEnrichAttribution CURRENT_IP = [ {"ip": "1.1.1.1", "attr1": "value1"}, {"ip": "8.8.8.8", "attr1": "value2"}, ] ENRICH_IP = [ {"ipaddress": "1.1.1.1", "provider": "Cloudflare", "ignored": "ignored-right"}, {"ipaddress": "8.8.8.4", "provider": "Google"} ] RESULT_IP = [ {"ip": "1.1.1.1", "attr1": "value1", "provider": "Cloudflare"}, {"ip": "8.8.8.8", "attr1": "value2"}, ] CURRENT_DEVICE = [ {"serial": "serialA", "attr1": "value1"}, {"serial": "serialB", "attr1": "value2"}, ] ENRICH_DEVICE = [ {"deviceSerial": "serialA", "location": "unknown", "owner": "lmori"}, {"deviceSerial": "serialC", "location": "unknown"} ] RESULT_DEVICE = [ {"serial": "serialA", "attr1": "value1", "location": "unknown"}, {"serial": "serialB", "attr1": "value2"}, ] CURRENT_USER = [ {"username": "fvigo", "attr1": "value1"}, {"username": "lmori", "attr1": "value2"}, ] ENRICH_USER = [ {"user": "fvigo", "team": "DevRel", "manager": "unknown"}, {"user": "ibojer", "team": "DevRel"} ] RESULT_USER = [ {"username": "fvigo", "attr1": "value1", "manager": "unknown"}, {"username": "lmori", "attr1": "value2"}, ] def test_enrich_command(): """ Given: - nonenriched lists of: ips, users, devices sightings - enrichment information for ips, users, devices When - enriching lists of ips, users, devices Then - data is enriched - enriched output is returned """ ip_result = ExpanseEnrichAttribution.enrich_command({ 'type': 'IP', 'current': CURRENT_IP, 'enrich': ENRICH_IP, 'enrich_key': 'ipaddress', 'enrich_fields': 'provider' }) assert ip_result.outputs == RESULT_IP assert ip_result.outputs_key_field == "ip" assert ip_result.outputs_prefix == "Expanse.AttributionIP" device_result = ExpanseEnrichAttribution.enrich_command({ 'type': 'Device', 'current': CURRENT_DEVICE, 'enrich': ENRICH_DEVICE, 'enrich_key': 'deviceSerial', 'enrich_fields': 'location' }) assert device_result.outputs == RESULT_DEVICE assert device_result.outputs_key_field == "serial" assert device_result.outputs_prefix == "Expanse.AttributionDevice" user_result = ExpanseEnrichAttribution.enrich_command({ 'type': 'User', 'current': CURRENT_USER, 'enrich': ENRICH_USER, 'enrich_key': 'user', 'enrich_fields': 'manager' }) assert user_result.outputs == RESULT_USER assert user_result.outputs_key_field == "username" assert user_result.outputs_prefix == "Expanse.AttributionUser"