def test_sanity_filter(self, requests_mock):
"""
Given:
- a custom filter.
When:
- Close requested alerts as false-positive.
Then:
- Command success.
"""
from MicrosoftCloudAppSecurity import close_false_positive_command
custom_filter = {
'filters': {
'id': {
'eq': [
'6060c4300be9cfd6182c934d',
'604f14400be9cfd6181b13fb',
],
},
},
}
args = {"custom_filter": json.dumps(custom_filter)}
requests_mock.post(
'https://demistodev.eu2.portal.cloudappsecurity.com/api/v1/alerts/close_false_positive/',
json=self.success_response)
res = close_false_positive_command(client_mocker, args)
assert res.raw_response == self.success_response
assert '2 alerts were closed as false-positive.' in res.readable_output
def test_failure_not_found(self, requests_mock):
"""
Given:
- list of alerts including invalid alert id.
When:
- Close requested alerts as false-positive.
Then:
- Command failure.
"""
from MicrosoftCloudAppSecurity import close_false_positive_command
alert_ids = '6060c4300be9cfd6182c934d,604f14400be9cfd6181b13fb,invalidAlert1,invalidAlert2'
args = {'alert_ids': alert_ids}
requests_mock.post('https://demistodev.eu2.portal.cloudappsecurity.com/api/v1/alerts/close_false_positive/',
json=self.failure_response)
with pytest.raises(DemistoException, match='Failed to close the following alerts:.*'):
close_false_positive_command(client_mocker, args)
def test_sanity_ids(self, requests_mock):
"""
Given:
- List of alerts.
When:
- Close requested alerts as false-positive.
Then:
- Command success.
"""
from MicrosoftCloudAppSecurity import close_false_positive_command
alert_ids = '6060c4300be9cfd6182c934d,604f14400be9cfd6181b13fb'
args = {'alert_ids': alert_ids}
requests_mock.post('https://demistodev.eu2.portal.cloudappsecurity.com/api/v1/alerts/close_false_positive/',
json=self.success_response)
res = close_false_positive_command(client_mocker, args)
assert res.raw_response == self.success_response
assert '2 alerts were closed as false-positive.' in res.readable_output