import json from pathlib import Path from InvestigationSummaryToTable import Result, findings_to_command_results, get_findings TEST_DATA_DIR = Path(__file__).parent / "test_data" def _load_test_file(file_name: str): return json.loads((TEST_DATA_DIR / file_name).read_text()) def _dump_test_file(file_name: str, content: dict): (TEST_DATA_DIR / file_name).write_text(json.dumps(content)) def test_empty_context(): context = {} findings = get_findings(context) result = findings_to_command_results(findings) assert not result.outputs assert ( result.readable_output == "### Waiting on entries\n" "When `InvestigationSummaryParse` is finished, its results will appear here." ) def test_context(): findings = get_findings( { "EvidenceOfCommandAndControl": {"Result": "Suspicious", "Tactic": "Command and Control"}, "EvidenceOfPrivilegeEscalation": [ {"should be ignored": "should be ignored"}, {"Result": "Not Detected", "Tactic": "Privilege Escalation"}, ], } ) assert len(findings) == 2 assert findings[0].result == Result.SUSPICIOUS assert findings[0].tactic == "Command and Control" assert findings[0].context_name == "EvidenceOfCommandAndControl" assert findings[1].result == Result.NOT_DETECTED assert findings[1].tactic == "Privilege Escalation" assert findings[1].context_name == "EvidenceOfPrivilegeEscalation" assert findings_to_command_results(findings).to_context() == _load_test_file("expected_context.json")