import hashlib from CommonServerPython import * from HashIncidentsFields import hash_incident, is_key_match_fields_to_hash, pattern_match default_args = { "fieldsToHash": "labels, activated, created, fake, owner, statuss, status, ,,,,11, activated, CustomFields.emailto", "contextKeys": "simpleValue, listValue", "outputFormat": "json", "addRandomSeed": "", } context1 = { "simpleValue": "simple", "listValue": [{"name": "test1"}, {"name": "test2"}], "dictListValue": {"test": ["1", "2"]}, "simpleListValue": ["1", "2", "3"], "dictListValue2": {"first": ["1", "2", "3"], "second": ["1"]}, "multipleDictsValue": {"test": {"first": {"word1": "1", "word2": "2"}, "second": ["word3", "word4"]}}, } incident1 = { "id": 1, "name": "This is incident1", "type": "Phishing", "severity": 0, "status": 1, "created": "2019-01-02", "closed": "0001-01-01T00:00:00Z", "labels": [{"type": "subject", "value": "This subject1"}, {"type": "unique", "value": "This subject1"}], "attachment": [{"name": "Test word1 word2"}], } context2 = context1 context3 = { "listValue": [{"name": "test1"}, {"name": "test3"}], "dictListValue": {"test": ["2", "1"]}, "simpleListValue": ["2", "1", "3"], "dictListValue2": {"first": ["1", "2", "3"]}, "multipleDictsValue": {"test": {"first": {"word1": "4", "word2": "2"}, "second": ["word3", "word4"]}}, } incident2 = { "id": 2, "name": "This is incident2", "type": "Phishing", "severity": 0, "status": 1, "created": "2019-01-01", "closed": "0001-01-01T00:00:00Z", "labels": [{"type": "subject", "value": "This subject2"}], "attachment": [{"name": "Test word1"}], } incident3 = { "id": 3, "name": "This is incident1", "type": "Phishing", "severity": 0, "status": 1, "created": "2019-01-01", "closed": "0001-01-01T00:00:00Z", "labels": [{"type": "subject", "value": "This subject1"}], "attachment": [{"name": "Test word1 word2"}], } def get_fields_to_hash(args): fields_to_hash = frozenset([x for x in argToList(args.get("fieldsToHash", "")) if x]) un_populate_fields = frozenset([x for x in argToList(args.get("unPopulateFields", "")) if x]) return fields_to_hash, un_populate_fields def dt_res(context, keys_to_search): keys_list = keys_to_search.split(".") context_key_value = None for key in keys_list: if context_key_value: if isinstance(context_key_value, list): list_value = [] for value in context_key_value: if isinstance(value, dict): if value.get(key): list_value.append(value[key]) else: list_value.append(value) context_key_value = list_value elif isinstance(context_key_value, dict): dict_list_value = [] for dict_key in context_key_value: if dict_key == key: if isinstance(context_key_value[dict_key], list): dict_list_value.append(sorted(context_key_value[dict_key])) else: dict_list_value.append(context_key_value[dict_key]) context_key_value = dict_list_value else: context = context_key_value else: context_key_value = context.get(key) return context_key_value def execute_command(command, args=None): if command == "GetIncidentsByQuery": entry = {} entry["Type"] = entryTypes["note"] entry["Contents"] = json.dumps([incident1, incident2, incident3]) return [entry] elif command == "getContext": if args["id"] == 1: return [{"Contents": {"context": context1}}] elif args["id"] == 2: return [{"Contents": {"context": context2}}] elif args["id"] == 3: return [{"Contents": {"context": context3}}] else: return [] else: return [] def test_length(mocker): args = dict(default_args) fields_to_hash, un_populate_fields = get_fields_to_hash(args) mocker.patch.object(demisto, "args", return_value=args) mocker.patch.object(demisto, "executeCommand", side_effect=execute_command) result = hash_incident(fields_to_hash, un_populate_fields) assert len(result["Contents"]) == 3 def test_hash(mocker): args = dict(default_args) fields_to_hash, un_populate_fields = get_fields_to_hash(args) mocker.patch.object(demisto, "args", return_value=args) mocker.patch.object(demisto, "executeCommand", side_effect=execute_command) result = hash_incident(fields_to_hash, un_populate_fields) assert result["Contents"][0]["name"] == incident1["name"] assert result["Contents"][0]["status"] == "1" assert result["Contents"][0]["created"] == hashlib.md5(str(incident1["created"]).encode("utf-8")).hexdigest() assert ( result["Contents"][0]["labels"][0]["type"] == hashlib.md5(str(incident1["labels"][0]["type"]).encode("utf-8")).hexdigest() ) assert list(result["Contents"][0]["labels"][0].keys()) == ["type", "value"] def test_context(mocker): args = dict(default_args) fields_to_hash, un_populate_fields = get_fields_to_hash(args) mocker.patch.object(demisto, "args", return_value=args) mocker.patch.object(demisto, "executeCommand", side_effect=execute_command) mocker.patch.object(demisto, "dt", side_effect=dt_res) result = hash_incident(fields_to_hash, un_populate_fields) assert result["Contents"][0]["context"]["simpleValue"] == "simple" assert result.get("Contents")[0].get("context").get("simpleListValue") is None def test_key_matching(): assert pattern_match("te*", "test") assert pattern_match("test", "test") assert not pattern_match("notmatch", "test") assert pattern_match("*tt*", "aaattaaa") assert is_key_match_fields_to_hash("thisIsMyTest", frozenset(["*My*"])) assert not is_key_match_fields_to_hash("thisIsMyTest2", frozenset(["*MM*"])) assert is_key_match_fields_to_hash("thisIsMyTest3", frozenset(["thisIsMyTest", "*MM*"])) assert not is_key_match_fields_to_hash("thisIsMyTest4", frozenset(["MyTest", "*MM*"])) assert is_key_match_fields_to_hash("thisIsMyTest", frozenset(["*MM*"])) # cached assert is_key_match_fields_to_hash("slaStatus", frozenset(["sla*"]))