def test_query_vmwarealert_invalid_group_ids():
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
with pytest.raises(ApiError):
api.select(VMwareAlert).set_group_ids(["Bogus"])
def test_query_device_download(monkeypatch):
_was_called = False
def _run_download(url, query_params, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/devices/_search/download"
assert query_params == {
"status": "ALL",
"ad_group_id": "14,25",
"policy_id": "8675309",
"target_priority": "HIGH",
"query_string": "foobar",
"sort_field": "name",
"sort_order": "DESC"
}
_was_called = True
return "123456789,123456789,123456789"
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, RAW_GET=_run_download)
rc = api.select(Device).where("foobar").set_ad_group_ids([14, 25]).set_policy_ids([8675309]) \
.set_status(["ALL"]).set_target_priorities(["HIGH"]).sort_by("name", "DESC").download()
assert _was_called
assert rc == "123456789,123456789,123456789"
def test_load_workflow(monkeypatch):
_was_called = False
def _get_workflow(url, parms=None, default=None):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/workflow/status/497ABX"
_was_called = True
return {
"errors": [],
"failed_ids": [],
"id": "497ABX",
"num_hits": 0,
"num_success": 0,
"status": "QUEUED",
"workflow": {
"state": "DISMISSED",
"remediation": "Fixed",
"comment": "Yessir",
"changed_by": "Robocop",
"last_update_time": "2019-10-31T16:03:13.951Z"
}
}
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, GET=_get_workflow)
workflow = api.select(WorkflowStatus, "497ABX")
assert _was_called
assert workflow.id_ == "497ABX"
def test_device_update_sensor_version(monkeypatch):
_was_called = False
def _call_update_sensor_version(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {
"action_type": "UPDATE_SENSOR_VERSION",
"device_id": [6023],
"options": {
"sensor_version": {
"RHEL": "2.3.4.5"
}
}
}
_was_called = True
return StubResponse(None, 204)
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_call_update_sensor_version)
api.device_update_sensor_version([6023], {"RHEL": "2.3.4.5"})
assert _was_called
def test_alerts_bulk_dismiss_vmware(monkeypatch):
_was_called = False
def _do_dismiss(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/alerts/vmware/workflow/_criteria"
assert body == {
"query": "Blort",
"state": "DISMISSED",
"remediation_state": "Fixed",
"comment": "Yessir",
"criteria": {
"device_name": ["HAL9000"]
}
}
_was_called = True
return StubResponse({"request_id": "497ABX"})
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_do_dismiss)
q = api.select(VMwareAlert).where("Blort").set_device_names(["HAL9000"])
reqid = q.dismiss("Fixed", "Yessir")
assert _was_called
assert reqid == "497ABX"
def test_query_device_do_quarantine(monkeypatch):
_was_called = False
def _quarantine(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {
"action_type": "QUARANTINE",
"search": {
"query": "foobar",
"criteria": {},
"exclusions": {}
},
"options": {
"toggle": "ON"
}
}
_was_called = True
return StubResponse(None, 204)
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_quarantine)
api.select(Device).where("foobar").quarantine(True)
assert _was_called
def test_query_device_do_update_policy(monkeypatch):
_was_called = False
def _update_policy(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {
"action_type": "UPDATE_POLICY",
"search": {
"query": "foobar",
"criteria": {},
"exclusions": {}
},
"options": {
"policy_id": 8675309
}
}
_was_called = True
return StubResponse(None, 204)
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_update_policy)
api.select(Device).where("foobar").update_policy(8675309)
assert _was_called
def test_query_device_do_update_sensor_version(monkeypatch):
_was_called = False
def _update_sensor_version(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {
"action_type": "UPDATE_SENSOR_VERSION",
"search": {
"query": "foobar",
"criteria": {},
"exclusions": {}
},
"options": {
"sensor_version": {
"RHEL": "2.3.4.5"
}
}
}
_was_called = True
return StubResponse(None, 204)
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_update_sensor_version)
api.select(Device).where("foobar").update_sensor_version(
{"RHEL": "2.3.4.5"})
assert _was_called
def test_query_device_invalid_sort_direction():
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
with pytest.raises(ApiError):
api.select(Device).sort_by("policy_name", "BOGUS")
def test_query_device_invalid_criteria_values():
tests = [{
"method": "set_ad_group_ids",
"arg": ["Bogus"]
}, {
"method": "set_policy_ids",
"arg": ["Bogus"]
}, {
"method": "set_os",
"arg": ["COMMODORE_64"]
}, {
"method": "set_status",
"arg": ["Bogus"]
}, {
"method": "set_target_priorities",
"arg": ["Bogus"]
}, {
"method": "set_exclude_sensor_versions",
"arg": [12703]
}]
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
query = api.select(Device)
for t in tests:
meth = getattr(query, t["method"], None)
with pytest.raises(ApiError):
meth(t["arg"])
def test_query_watchlistalert_facets(monkeypatch):
_was_called = False
def _run_facet_query(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/alerts/watchlist/_facet"
assert body == {
"query": "Blort",
"criteria": {
"workflow": ["OPEN"]
},
"terms": {
"rows": 0,
"fields": ["REPUTATION", "STATUS"]
}
}
_was_called = True
return StubResponse({
"results": [{
"field": {},
"values": [{
"id": "reputation",
"name": "reputationX",
"total": 4
}]
}, {
"field": {},
"values": [{
"id": "status",
"name": "statusX",
"total": 9
}]
}]
})
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_run_facet_query)
query = api.select(WatchlistAlert).where("Blort").set_workflows(["OPEN"])
f = query.facets(["REPUTATION", "STATUS"])
assert _was_called
assert f == [{
"field": {},
"values": [{
"id": "reputation",
"name": "reputationX",
"total": 4
}]
}, {
"field": {},
"values": [{
"id": "status",
"name": "statusX",
"total": 9
}]
}]
def test_Device_update_policy(monkeypatch):
_was_called = False
def _get_device(url, parms=None, default=None):
assert url == "/appservices/v6/orgs/Z100/devices/6023"
return {"id": 6023}
def _update_policy(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {
"action_type": "UPDATE_POLICY",
"device_id": [6023],
"options": {
"policy_id": 8675309
}
}
_was_called = True
return StubResponse(None, 204)
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, GET=_get_device, POST=_update_policy)
dev = Device(api, 6023, {"id": 6023})
dev.update_policy(8675309)
assert _was_called
def test_Device_lr_session(monkeypatch):
def _get_session(url, parms=None, default=None):
assert url == "/appservices/v6/orgs/Z100/devices/6023"
return {"id": 6023}
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
sked = StubScheduler(6023)
api._lr_scheduler = sked
patch_cbapi(monkeypatch, api, GET=_get_session)
dev = Device(api, 6023, {"id": 6023})
sess = dev.lr_session()
assert sess["itworks"]
assert sked.was_called
def test_Device_bypass(monkeypatch):
_was_called = False
def _get_device(url, parms=None, default=None):
assert url == "/appservices/v6/orgs/Z100/devices/6023"
return {"id": 6023}
def _bypass(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {
"action_type": "BYPASS",
"device_id": [6023],
"options": {
"toggle": "OFF"
}
}
_was_called = True
return StubResponse(None, 204)
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, GET=_get_device, POST=_bypass)
dev = Device(api, 6023, {"id": 6023})
dev.bypass(False)
assert _was_called
def test_device_uninstall_sensor(monkeypatch):
_was_called = False
def _call_uninstall_sensor(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "UNINSTALL_SENSOR", "device_id": [6023]}
_was_called = True
return StubResponse(None, 204)
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_call_uninstall_sensor)
api.device_uninstall_sensor([6023])
assert _was_called
def test_query_device_invalid_last_contact_time_combinations():
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
with pytest.raises(ApiError):
api.select(Device).set_last_contact_time()
with pytest.raises(ApiError):
api.select(Device).set_last_contact_time(start="2019-09-30T12:34:56",
end="2019-10-01T12:00:12",
range="-3w")
with pytest.raises(ApiError):
api.select(Device).set_last_contact_time(start="2019-09-30T12:34:56",
range="-3w")
with pytest.raises(ApiError):
api.select(Device).set_last_contact_time(end="2019-10-01T12:00:12",
range="-3w")
def test_query_device_with_all_bells_and_whistles(monkeypatch):
_was_called = False
def _run_query(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/devices/_search"
assert body == {
"query": "foobar",
"criteria": {
"ad_group_id": [14, 25],
"os": ["LINUX"],
"policy_id": [8675309],
"status": ["ALL"],
"target_priority": ["HIGH"]
},
"exclusions": {
"sensor_version": ["0.1"]
},
"sort": [{
"field": "name",
"order": "DESC"
}]
}
_was_called = True
return StubResponse({
"results": [{
"id": 6023,
"organization_name": "thistestworks"
}],
"num_found":
1
})
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_run_query)
query = api.select(Device).where("foobar").set_ad_group_ids([14, 25]).set_os(["LINUX"]) \
.set_policy_ids([8675309]).set_status(["ALL"]).set_target_priorities(["HIGH"]) \
.set_exclude_sensor_versions(["0.1"]).sort_by("name", "DESC")
d = query.one()
assert _was_called
assert d.id == 6023
assert d.organization_name == "thistestworks"
def test_get_device(monkeypatch):
_was_called = False
def _get_device(url):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/devices/6023"
_was_called = True
return {"device_id": 6023, "organization_name": "thistestworks"}
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, GET=_get_device)
rc = api.select(Device, 6023)
assert _was_called
assert isinstance(rc, Device)
assert rc.device_id == 6023
assert rc.organization_name == "thistestworks"
def test_WorkflowStatus(monkeypatch):
_times_called = 0
def _get_workflow(url, parms=None, default=None):
nonlocal _times_called
assert url == "/appservices/v6/orgs/Z100/workflow/status/W00K13"
if _times_called >= 0 and _times_called <= 3:
_stat = "QUEUED"
elif _times_called >= 4 and _times_called <= 6:
_stat = "IN_PROGRESS"
elif _times_called >= 7 and _times_called <= 9:
_stat = "FINISHED"
else:
pytest.fail("_get_workflow called too many times")
_times_called = _times_called + 1
return {
"errors": [],
"failed_ids": [],
"id": "W00K13",
"num_hits": 0,
"num_success": 0,
"status": _stat,
"workflow": {
"state": "DISMISSED",
"remediation": "Fixed",
"comment": "Yessir",
"changed_by": "Robocop",
"last_update_time": "2019-10-31T16:03:13.951Z"
}
}
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, GET=_get_workflow)
wfstat = WorkflowStatus(api, "W00K13")
assert wfstat.workflow_.changed_by == "Robocop"
assert wfstat.workflow_.state == "DISMISSED"
assert wfstat.workflow_.remediation == "Fixed"
assert wfstat.workflow_.comment == "Yessir"
assert wfstat.workflow_.last_update_time == "2019-10-31T16:03:13.951Z"
assert _times_called == 1
assert wfstat.queued
assert not wfstat.in_progress
assert not wfstat.finished
assert _times_called == 4
assert not wfstat.queued
assert wfstat.in_progress
assert not wfstat.finished
assert _times_called == 7
assert not wfstat.queued
assert not wfstat.in_progress
assert wfstat.finished
assert _times_called == 10
def test_query_basealert_with_create_time_as_start_end(monkeypatch):
_was_called = False
def _run_query(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/alerts/_search"
assert body == {
"query": "Blort",
"criteria": {
"create_time": {
"start": "2019-09-30T12:34:56",
"end": "2019-10-01T12:00:12"
}
}
}
_was_called = True
return StubResponse({
"results": [{
"id": "S0L0",
"org_key": "Z100",
"threat_id": "B0RG",
"workflow": {
"state": "OPEN"
}
}],
"num_found":
1
})
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_run_query)
query = api.select(BaseAlert).where("Blort").set_create_time(
start="2019-09-30T12:34:56", end="2019-10-01T12:00:12")
a = query.one()
assert _was_called
assert a.id == "S0L0"
assert a.org_key == "Z100"
assert a.threat_id == "B0RG"
assert a.workflow_.state == "OPEN"
def test_query_cbanalyticsalert_invalid_criteria_values():
tests = [{
"method": "set_blocked_threat_categories",
"arg": ["MINOR"]
}, {
"method": "set_device_locations",
"arg": ["NARNIA"]
}, {
"method": "set_kill_chain_statuses",
"arg": ["SPAWN_COPIES"]
}, {
"method": "set_not_blocked_threat_categories",
"arg": ["MINOR"]
}, {
"method": "set_policy_applied",
"arg": ["MAYBE"]
}, {
"method": "set_reason_code",
"arg": [55]
}, {
"method": "set_run_states",
"arg": ["MIGHT_HAVE"]
}, {
"method": "set_sensor_actions",
"arg": ["FLIP_A_COIN"]
}, {
"method": "set_threat_cause_vectors",
"arg": ["NETWORK"]
}]
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
query = api.select(CBAnalyticsAlert)
for t in tests:
meth = getattr(query, t["method"], None)
with pytest.raises(ApiError):
meth(t["arg"])
def test_device_bypass(monkeypatch):
_was_called = False
def _call_bypass(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {
"action_type": "BYPASS",
"device_id": [6023],
"options": {
"toggle": "OFF"
}
}
_was_called = True
return StubResponse(None, 204)
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_call_bypass)
api.device_bypass([6023], False)
assert _was_called
def test_alerts_bulk_undismiss_threat(monkeypatch):
_was_called = False
def _do_update(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/threat/workflow/_criteria"
assert body == {
"threat_id": ["B0RG", "F3R3NG1"],
"state": "OPEN",
"remediation_state": "Fixed",
"comment": "NoSir"
}
_was_called = True
return StubResponse({"request_id": "497ABX"})
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_do_update)
reqid = api.bulk_threat_update(["B0RG", "F3R3NG1"], "Fixed", "NoSir")
assert _was_called
assert reqid == "497ABX"
def test_query_watchlistalert_invalid_criteria_values():
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
with pytest.raises(ApiError):
api.select(WatchlistAlert).set_watchlist_ids([888])
with pytest.raises(ApiError):
api.select(WatchlistAlert).set_watchlist_names([69])
def test_query_device_with_last_contact_time_as_start_end(monkeypatch):
_was_called = False
def _run_query(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/devices/_search"
assert body == {
"query": "foobar",
"criteria": {
"last_contact_time": {
"start": "2019-09-30T12:34:56",
"end": "2019-10-01T12:00:12"
}
},
"exclusions": {}
}
_was_called = True
return StubResponse({
"results": [{
"id": 6023,
"organization_name": "thistestworks"
}],
"num_found":
1
})
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_run_query)
query = api.select(Device).where("foobar") \
.set_last_contact_time(start="2019-09-30T12:34:56", end="2019-10-01T12:00:12")
d = query.one()
assert _was_called
assert d.id == 6023
assert d.organization_name == "thistestworks"
def test_query_device_do_uninstall_sensor(monkeypatch):
_was_called = False
def _uninstall_sensor(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {
"action_type": "UNINSTALL_SENSOR",
"search": {
"query": "foobar",
"criteria": {},
"exclusions": {}
}
}
_was_called = True
return StubResponse(None, 204)
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_uninstall_sensor)
api.select(Device).where("foobar").uninstall_sensor()
assert _was_called
def test_Device_delete_sensor(monkeypatch):
_was_called = False
def _get_device(url, parms=None, default=None):
assert url == "/appservices/v6/orgs/Z100/devices/6023"
return {"id": 6023}
def _delete_sensor(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "DELETE_SENSOR", "device_id": [6023]}
_was_called = True
return StubResponse(None, 204)
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, GET=_get_device, POST=_delete_sensor)
dev = Device(api, 6023, {"id": 6023})
dev.delete_sensor()
assert _was_called
def test_BaseAlert_undismiss_threat(monkeypatch):
_was_called = False
def _do_update(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/threat/B0RG/workflow"
assert body == {
"state": "OPEN",
"remediation_state": "Fixed",
"comment": "NoSir"
}
_was_called = True
return StubResponse({
"state": "OPEN",
"remediation": "Fixed",
"comment": "NoSir",
"changed_by": "Robocop",
"last_update_time": "2019-10-31T16:03:13.951Z"
})
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_do_update)
alert = BaseAlert(api, "ESD14U2C", {
"id": "ESD14U2C",
"threat_id": "B0RG",
"workflow": {
"state": "OPEN"
}
})
wf = alert.update_threat("Fixed", "NoSir")
assert _was_called
assert wf.changed_by == "Robocop"
assert wf.state == "OPEN"
assert wf.remediation == "Fixed"
assert wf.comment == "NoSir"
assert wf.last_update_time == "2019-10-31T16:03:13.951Z"
def test_BaseAlert_dismiss(monkeypatch):
_was_called = False
def _do_dismiss(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/alerts/ESD14U2C/workflow"
assert body == {
"state": "DISMISSED",
"remediation_state": "Fixed",
"comment": "Yessir"
}
_was_called = True
return StubResponse({
"state": "DISMISSED",
"remediation": "Fixed",
"comment": "Yessir",
"changed_by": "Robocop",
"last_update_time": "2019-10-31T16:03:13.951Z"
})
api = CbPSCBaseAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbapi(monkeypatch, api, POST=_do_dismiss)
alert = BaseAlert(api, "ESD14U2C", {
"id": "ESD14U2C",
"workflow": {
"state": "OPEN"
}
})
alert.dismiss("Fixed", "Yessir")
assert _was_called
assert alert.workflow_.changed_by == "Robocop"
assert alert.workflow_.state == "DISMISSED"
assert alert.workflow_.remediation == "Fixed"
assert alert.workflow_.comment == "Yessir"
assert alert.workflow_.last_update_time == "2019-10-31T16:03:13.951Z"
def search_for_usb_devices(cb: CbPSCBaseAPI, query):
# XXX - This doesn't look implemented in TH?
uri = f"/device_control/v3/orgs/{cb.credentials.org_key}/devices/_search"
data = {"query": query}
return cb.post_object(uri, data).json()