def test_try_poll_offense_events_with_retry__reset(mocker):
"""
Poll event with when reset is set
Given:
- Event fetch is to be polled via the qradar client
When:
- Reset trigger is waiting
Then:
- Stop fetch and return empty list
"""
client = QRadarClient("", {}, {"identifier": "*", "password": "******"})
offense_id = 450
query_status = "EXECUTE"
search_id = "1"
max_retries = 3
mocker.patch.object(QRadar_v2, "is_reset_triggered", return_value=True)
mocker.patch.object(
client,
"get_search",
side_effect=[ConnectionError, RAW_RESPONSES["qradar-get-search"]])
mocker.patch.object(
client,
"get_search_results",
return_value=RAW_RESPONSES["qradar-get-search-results"])
mocker.patch.object(demisto, "debug")
actual = try_poll_offense_events_with_retry(client, offense_id,
query_status, search_id,
max_retries)
assert actual == []
def test_try_poll_offense_events_with_retry__sad(mocker):
"""
Poll event with a failure
Given:
- Event fetch is to be polled via the qradar client
When:
- Search first returns ConnectionError
- Recovery is set to 0
Then:
- Stop fetch and return empty list
"""
client = QRadarClient("", {}, {"identifier": "*", "password": "******"})
offense_id = 450
query_status = "EXECUTE"
search_id = "1"
max_retries = 0
mocker.patch.object(QRadar_v2, "is_reset_triggered", return_value=False)
mocker.patch.object(
client,
"get_search",
side_effect=[ConnectionError, RAW_RESPONSES["qradar-get-search"]])
mocker.patch.object(demisto, "debug")
actual = try_poll_offense_events_with_retry(client, offense_id,
query_status, search_id,
max_retries)
assert actual == []
def test_try_poll_offense_events_with_retry__semi_happy(mocker):
"""
Poll event with a failure, recovery and success flow
Given:
- Event fetch is to be polled via the qradar client
When:
- Search first returns ConnectionError
- Search then returns search is COMPLETED
Then:
- Assert events are fetched correctly
"""
client = QRadarClient("", {}, {"identifier": "*", "password": "******"})
offense_id = 450
query_status = "EXECUTE"
search_id = "1"
max_retries = 3
expected = [{'MY Source IPs': '8.8.8.8'}]
mocker.patch.object(QRadar_v2, "is_reset_triggered", return_value=False)
mocker.patch.object(
client,
"get_search",
side_effect=[ConnectionError, RAW_RESPONSES["qradar-get-search"]])
mocker.patch.object(
client,
"get_search_results",
return_value=RAW_RESPONSES["qradar-get-search-results"])
mocker.patch.object(demisto, "debug")
actual = try_poll_offense_events_with_retry(client, offense_id,
query_status, search_id,
max_retries)
assert actual == expected