def _run_query(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/devices/_search" assert body == { "query": "foobar", "criteria": { "ad_group_id": [14, 25], "os": ["LINUX"], "policy_id": [8675309], "status": ["ALL"], "target_priority": ["HIGH"] }, "exclusions": { "sensor_version": ["0.1"] }, "sort": [{ "field": "name", "order": "DESC" }] } _was_called = True return StubResponse({ "results": [{ "id": 6023, "organization_name": "thistestworks" }], "num_found": 1 })
def _execute_stop(url, body, **kwargs): nonlocal _was_called assert url == "/livequery/v1/orgs/Z100/runs/abcdefg/status" assert body == {"status": "CANCELLED"} _was_called = True return StubResponse( {"error_message": "The query is not presently running."}, 409)
def _run_query(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/alerts/_search" assert body == { "query": "Blort", "criteria": { "create_time": { "start": "2019-09-30T12:34:56", "end": "2019-10-01T12:00:12" } } } _was_called = True return StubResponse({ "results": [{ "id": "S0L0", "org_key": "Z100", "threat_id": "B0RG", "workflow": { "state": "OPEN" } }], "num_found": 1 })
def _run_facet_query(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/alerts/watchlist/_facet" assert body == { "query": "Blort", "criteria": { "workflow": ["OPEN"] }, "terms": { "rows": 0, "fields": ["REPUTATION", "STATUS"] } } _was_called = True return StubResponse({ "results": [{ "field": {}, "values": [{ "id": "reputation", "name": "reputationX", "total": 4 }] }, { "field": {}, "values": [{ "id": "status", "name": "statusX", "total": 9 }] }] })
def _execute_delete(url): nonlocal _was_called assert url == "/livequery/v1/orgs/Z100/runs/abcdefg" if _was_called: pytest.fail("_execute_delete should not be called twice!") _was_called = True return StubResponse(None)
def _run_facet_query(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/alerts/_facet" assert body["query"] == "Blort" t = body["criteria"] assert t["workflow"] == ["OPEN"] t = body["terms"] assert t["rows"] == 0 assert t["fields"] == ["REPUTATION", "STATUS"] _was_called = True return StubResponse({ "results": [{ "field": {}, "values": [{ "id": "reputation", "name": "reputationX", "total": 4 }] }, { "field": {}, "values": [{ "id": "status", "name": "statusX", "total": 9 }] }] })
def _run_query(url, body, **kwargs): nonlocal _was_called assert url == "/livequery/v1/orgs/Z100/runs" assert body == {"sql": "select * from whatever;", "name": "AmyWasHere", "notify_on_finish": True, "device_filter": {"device_ids": [1, 2, 3], "device_types": ["Alpha", "Bravo", "Charlie"], "policy_ids": [16, 27, 38]}} _was_called = True return StubResponse({"org_key": "Z100", "name": "FoobieBletch", "id": "abcdefg"})
def _run_query(url, body, **kwargs): nonlocal _was_called assert url == "/livequery/v1/orgs/Z100/runs/_search" assert body == {"query": "xyzzy", "sort": [{"field": "id", "order": "ASC"}], "start": 0} _was_called = True return StubResponse({"org_key": "Z100", "num_found": 3, "results": [{"org_key": "Z100", "name": "FoobieBletch", "id": "abcdefg"}, {"org_key": "Z100", "name": "Aoxomoxoa", "id": "cdefghi"}, {"org_key": "Z100", "name": "Read_Me", "id": "efghijk"}]})
def _run_query(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/alerts/cbanalytics/_search" assert body == { "query": "Blort", "criteria": { "category": ["SERIOUS", "CRITICAL"], "device_id": [6023], "device_name": ["HAL"], "device_os": ["LINUX"], "device_os_version": ["0.1.2"], "device_username": ["JRN"], "group_results": True, "id": ["S0L0"], "legacy_alert_id": ["S0L0_1"], "minimum_severity": 6, "policy_id": [8675309], "policy_name": ["Strict"], "process_name": ["IEXPLORE.EXE"], "process_sha256": ["0123456789ABCDEF0123456789ABCDEF"], "reputation": ["SUSPECT_MALWARE"], "tag": ["Frood"], "target_value": ["HIGH"], "threat_id": ["B0RG"], "type": ["WATCHLIST"], "workflow": ["OPEN"], "blocked_threat_category": ["RISKY_PROGRAM"], "device_location": ["ONSITE"], "kill_chain_status": ["EXECUTE_GOAL"], "not_blocked_threat_category": ["NEW_MALWARE"], "policy_applied": ["APPLIED"], "reason_code": ["ATTACK_VECTOR"], "run_state": ["RAN"], "sensor_action": ["DENY"], "threat_cause_vector": ["WEB"] }, "sort": [{ "field": "name", "order": "DESC" }] } _was_called = True return StubResponse({ "results": [{ "id": "S0L0", "org_key": "Z100", "threat_id": "B0RG", "workflow": { "state": "OPEN" } }], "num_found": 1 })
def _execute_stop(url, body, **kwargs): nonlocal _was_called assert url == "/livequery/v1/orgs/Z100/runs/abcdefg/status" assert body == {"status": "CANCELLED"} _was_called = True return StubResponse({ "org_key": "Z100", "name": "FoobieBletch", "id": "abcdefg", "status": "CANCELLED" })
def _do_update(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/threat/workflow/_criteria" assert body == { "threat_id": ["B0RG", "F3R3NG1"], "state": "OPEN", "remediation_state": "Fixed", "comment": "NoSir" } _was_called = True return StubResponse({"request_id": "497ABX"})
def _bypass(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/device_actions" assert body == { "action_type": "BYPASS", "device_id": [6023], "options": { "toggle": "OFF" } } _was_called = True return StubResponse(None, 204)
def _update_policy(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/device_actions" assert body == { "action_type": "UPDATE_POLICY", "device_id": [6023], "options": { "policy_id": 8675309 } } _was_called = True return StubResponse(None, 204)
def _quarantine(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/device_actions" assert body == { "action_type": "QUARANTINE", "device_id": [6023], "options": { "toggle": "ON" } } _was_called = True return StubResponse(None, 204)
def _background_scan(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/device_actions" assert body == { "action_type": "BACKGROUND_SCAN", "device_id": [6023], "options": { "toggle": "ON" } } _was_called = True return StubResponse(None, 204)
def _run_facets(url, body, **kwargs): nonlocal _was_called assert url == "/livequery/v1/orgs/Z100/runs/abcdefg/results/device_summaries/_facet" assert body == { "query": "xyzzy", "criteria": { "device_name": ["AxCx", "A7X"] }, "terms": { "fields": ["alpha", "bravo", "charlie"] } } _was_called = True return StubResponse({ "terms": [{ "field": "alpha", "values": [{ "total": 1, "id": "alpha1", "name": "alpha1" }, { "total": 2, "id": "alpha2", "name": "alpha2" }] }, { "field": "bravo", "values": [{ "total": 1, "id": "bravo1", "name": "bravo1" }, { "total": 2, "id": "bravo2", "name": "bravo2" }] }, { "field": "charlie", "values": [{ "total": 1, "id": "charlie1", "name": "charlie1" }, { "total": 2, "id": "charlie2", "name": "charlie2" }] }] })
def _uninstall_sensor(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/device_actions" assert body == { "action_type": "UNINSTALL_SENSOR", "search": { "query": "foobar", "criteria": {}, "exclusions": {} } } _was_called = True return StubResponse(None, 204)
def _update_sensor_version(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/device_actions" assert body == { "action_type": "UPDATE_SENSOR_VERSION", "device_id": [6023], "options": { "sensor_version": { "RHEL": "2.3.4.5" } } } _was_called = True return StubResponse(None, 204)
def _do_dismiss(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/alerts/vmware/workflow/_criteria" assert body == { "query": "Blort", "state": "DISMISSED", "remediation_state": "Fixed", "comment": "Yessir", "criteria": { "device_name": ["HAL9000"] } } _was_called = True return StubResponse({"request_id": "497ABX"})
def _run_summaries(url, body, **kwargs): nonlocal _was_called assert url == "/livequery/v1/orgs/Z100/runs/abcdefg/results/device_summaries/_search" assert body == { "query": "foo", "criteria": { "device_name": ["AxCx", "A7X"] }, "sort": [{ "field": "device_name", "order": "ASC" }], "start": 0 } _was_called = True return StubResponse({ "org_key": "Z100", "num_found": 2, "results": [{ "id": "ghijklm", "total_results": 2, "device_id": 314159, "metrics": [{ "key": "aaa", "value": 0.0 }, { "key": "bbb", "value": 0.0 }] }, { "id": "mnopqrs", "total_results": 3, "device_id": 271828, "metrics": [{ "key": "aaa", "value": 0.0 }, { "key": "bbb", "value": 0.0 }] }] })
def _background_scan(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/device_actions" assert body == { "action_type": "BACKGROUND_SCAN", "search": { "query": "foobar", "criteria": {}, "exclusions": {} }, "options": { "toggle": "ON" } } _was_called = True return StubResponse(None, 204)
def _quarantine(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/device_actions" assert body == { "action_type": "QUARANTINE", "search": { "query": "foobar", "criteria": {}, "exclusions": {} }, "options": { "toggle": "ON" } } _was_called = True return StubResponse(None, 204)
def _update_policy(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/device_actions" assert body == { "action_type": "UPDATE_POLICY", "search": { "query": "foobar", "criteria": {}, "exclusions": {} }, "options": { "policy_id": 8675309 } } _was_called = True return StubResponse(None, 204)
def _do_update(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/threat/B0RG/workflow" assert body == { "state": "OPEN", "remediation_state": "Fixed", "comment": "NoSir" } _was_called = True return StubResponse({ "state": "OPEN", "remediation": "Fixed", "comment": "NoSir", "changed_by": "Robocop", "last_update_time": "2019-10-31T16:03:13.951Z" })
def _do_dismiss(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/alerts/ESD14U2C/workflow" assert body == { "state": "DISMISSED", "remediation_state": "Fixed", "comment": "Yessir" } _was_called = True return StubResponse({ "state": "DISMISSED", "remediation": "Fixed", "comment": "Yessir", "changed_by": "Robocop", "last_update_time": "2019-10-31T16:03:13.951Z" })
def _run_query(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/alerts/watchlist/_search" assert body == { "query": "Blort", "criteria": { "category": ["SERIOUS", "CRITICAL"], "device_id": [6023], "device_name": ["HAL"], "device_os": ["LINUX"], "device_os_version": ["0.1.2"], "device_username": ["JRN"], "group_results": True, "id": ["S0L0"], "legacy_alert_id": ["S0L0_1"], "minimum_severity": 6, "policy_id": [8675309], "policy_name": ["Strict"], "process_name": ["IEXPLORE.EXE"], "process_sha256": ["0123456789ABCDEF0123456789ABCDEF"], "reputation": ["SUSPECT_MALWARE"], "tag": ["Frood"], "target_value": ["HIGH"], "threat_id": ["B0RG"], "type": ["WATCHLIST"], "workflow": ["OPEN"], "watchlist_id": ["100"], "watchlist_name": ["Gandalf"] }, "sort": [{ "field": "name", "order": "DESC" }] } _was_called = True return StubResponse({ "results": [{ "id": "S0L0", "org_key": "Z100", "threat_id": "B0RG", "workflow": { "state": "OPEN" } }], "num_found": 1 })
def _update_sensor_version(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/device_actions" assert body == { "action_type": "UPDATE_SENSOR_VERSION", "search": { "query": "foobar", "criteria": {}, "exclusions": {} }, "options": { "sensor_version": { "RHEL": "2.3.4.5" } } } _was_called = True return StubResponse(None, 204)
def _run_query(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/devices/_search" assert body == { "query": "foobar", "criteria": { "last_contact_time": { "range": "-3w" } }, "exclusions": {} } _was_called = True return StubResponse({ "results": [{ "id": 6023, "organization_name": "thistestworks" }], "num_found": 1 })
def _run_query(url, body, **kwargs): nonlocal _was_called assert url == "/livequery/v1/orgs/Z100/runs" assert body == {"sql": "select * from whatever;", "device_filter": {}} _was_called = True return StubResponse({"org_key": "Z100", "name": "FoobieBletch", "id": "abcdefg"})
def _uninstall_sensor(url, body, **kwargs): nonlocal _was_called assert url == "/appservices/v6/orgs/Z100/device_actions" assert body == {"action_type": "UNINSTALL_SENSOR", "device_id": [6023]} _was_called = True return StubResponse(None, 204)