def test_get_alerts_by_non_existent_type_should_return_empty_list(requests_mock, orca_client: OrcaClient) -> None: NON_EXISTENT_ALERT_TYPE = "non_existent_alert_type" mock_response = { "version": "0.1.0", "status": "success", "total_items": 0, "total_ungrouped_items": 0, "total_supported_items": 10000, "data": []} requests_mock.get(f"{ORCA_API_DNS_NAME}/alerts?type={NON_EXISTENT_ALERT_TYPE}", json=mock_response) res = orca_client.get_alerts_by_filter(alert_type=NON_EXISTENT_ALERT_TYPE) assert res == []
def test_get_alerts_by_type_malware_should_succeed(requests_mock, orca_client: OrcaClient) -> None: mock_response = { "version": "0.1.0", "status": "success", "total_items": 6, "total_ungrouped_items": 6, "total_supported_items": 10000, "data": [ { "type": "malware", "rule_id": "r1111ea1111", "type_string": "Malware", "type_key": "/test_eicar_file", "category": "Malware", "description": "Malware EICAR-Test-File found on asset", "details": "We have detected a file infected with EICAR-Test-File on the asset.", "recommendation": "Remediate the host and attend additional alerts on the host to close the infection path.", "alert_labels": [ "malware_found" ], "asset_category": "Storage", "cloud_provider_id": "111111111111", "cloud_provider": "aws", "cloud_account_id": "10b11111-1111-1111-91d5-11111de11111", "cloud_vendor_id": "111111111111", "account_name": "111111111111", "asset_unique_id": "storage_111111e11111_scan-me-s3-bucket-s8rrr", "asset_name": "scan-me-s3-bucket-s8rrr", "asset_type": "storage", "asset_type_string": "AWS S3 Bucket", "group_unique_id": "storage_111111e11111_scan-me-s3-bucket-s8rrr", "group_name": "scan-me-s3-bucket-s8rrr", "group_type": "storage", "group_type_string": "NonGroup", "group_val": "nongroup", "cluster_unique_id": "storage_111111e11111_scan-me-s3-bucket-s8rrr", "cluster_name": "scan-me-s3-bucket-s8rrr", "cluster_type": "storage", "level": 0, "asset_state": "enabled", "asset_labels": [ "internet_facing", "pii" ], "asset_vendor_id": "scan-me-s3-bucket-s8rrr", "asset_regions": [ "us-east-1" ], "asset_regions_names": [ "N. Virginia" ], "source": "test_eicar_file", "findings": { "malware": [ { "type": "malware", "labels": [ "malware_found" ], "virus_names": [ "EICAR-Test-File" ], "modification_time": "2020-04-26T14:26:11+00:00", "file": "/test_eicar_file", "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f", "sha1": "3395856ce81f2b7382dee72602f798b642f14140", "md5": "44d88612fea8a8f36de82e1278abb02f", "has_macro": False } ] }, "configuration": { "user_status": "closed", "jira_issue_link": "https://www.jira.com/myproject", "jira_issue": "TP-41" }, "state": { "alert_id": "orca-59", "status": "in_progress", "status_time": "2020-12-30T09:57:33+00:00", "created_at": "2020-11-08T12:58:52+00:00", "last_seen": "2020-12-30T10:35:46+00:00", "score": 1, "severity": "compromised", "low_since": None, "high_since": "2020-12-15T15:33:49+00:00", "in_verification": None }, "priv": { "key": "3ea22222274111114b011111bb311111", "score": 1, "orig_score": 1, "alert_id": "orca-59", "full_scan_time": "2020-12-30T10:35:46+00:00", "organization_id": "11111111-1111-1111-1111-c111881c1111", "organization_name": "Orca Security", "context": "data", "account_action_id_ctx": { "data": "11111111-1111-1111-1111-8a529a011111" }, "scan_id_ctx": { "data": "11111111-1111-1111-1111-8a529a011111_111111111111_bucket-111111e11111-us-east-1" }, "first_seen": "2020-11-08T13:03:37+00:00" }, "hdr": { "asset_category": "Storage", "organization_id": "11111111-1111-1111-1111-c111881c1111", "organization_name": "Orca Security", "cloud_provider": "aws", "cloud_provider_id": "111111111111", "cloud_account_id": "10b11111-1111-1111-91d5-11111de11111", "context": "data", "asset_unique_id": "storage_111111e11111_scan-me-s3-bucket-s8rrr", "asset_type": "storage", "asset_type_string": "AWS S3 Bucket", "asset_name": "scan-me-s3-bucket-s8rrr", "group_unique_id": "storage_111111e11111_scan-me-s3-bucket-s8rrr", "group_name": "scan-me-s3-bucket-s8rrr", "group_type": "storage", "group_type_string": "NonGroup", "cluster_unique_id": "storage_111111e11111_scan-me-s3-bucket-s8rrr", "cluster_type": "storage", "cluster_name": "scan-me-s3-bucket-s8rrr", "level": 0, "group_val": "nongroup", "asset_vendor_id": "scan-me-s3-bucket-s8rrr", "cloud_vendor_id": "111111111111", "asset_state": "enabled", "account_name": "111111111111", "asset_labels": [ "internet_facing" ] }, "insert_time": "2020-12-30T10:45:21+00:00" } ] } requests_mock.get(f"{ORCA_API_DNS_NAME}/alerts?type=malware", json=mock_response) res = orca_client.get_alerts_by_filter(alert_type="malware") assert res[0] == mock_response['data'][0]