def _add_tenant_id_if_missing(self, query):
query_dict = json.loads(str(query))
tenant_id = query_dict.get(u"tenantId", None)
if tenant_id is None:
query_dict[u"tenantId"] = self._user_context.get_current_tenant_id()
return json.dumps(query_dict)
else:
return str(query)
def test_compare_filter_group_with_equivalent_multiple_args_in_different_order_returns_true(
):
group1 = create_is_in_filter_group("term", ["value1", "value2", "value3"])
group2 = create_is_in_filter_group("term", ["value3", "value1", "value2"])
assert group1 == group2
assert str(group1) == group2
assert tuple(group1) == group2
assert list(group1) == group2
assert group1 == str(group2)
assert group1 == tuple(group2)
assert group1 == list(group2)
def test_filter_group_when_changed_filter_clause_has_correct_json_representation(
):
group = create_is_in_filter_group("term", ["value1", "value2", "value3"])
assert (str(group) == '{"filterClause":"OR", "filters"'
':[{"operator":"IS", "term":"term", "value":"value1"},'
'{"operator":"IS", "term":"term", "value":"value2"},'
'{"operator":"IS", "term":"term", "value":"value3"}]}')
group.filter_clause = "AND"
assert (str(group) == '{"filterClause":"AND", "filters"'
':[{"operator":"IS", "term":"term", "value":"value1"},'
'{"operator":"IS", "term":"term", "value":"value2"},'
'{"operator":"IS", "term":"term", "value":"value3"}]}')
def test_create_not_eq_filter_group_returns_obj_with_correct_json_representation(
):
filter_group = create_not_eq_filter_group("noteqterm", "noteqvalue")
assert (
str(filter_group) == '{"filterClause":"AND",'
' "filters":[{"operator":"IS_NOT", "term":"noteqterm", "value":"noteqvalue"}]}'
)
def test_filter_group_with_duplicate_filters_or_specified_str_gives_correct_json_representation(
query_filter, ):
json_single_filter_group = JSON_FILTER_GROUP_BASE.format(
"OR", JSON_QUERY_FILTER)
assert (str(
create_filter_group([query_filter, query_filter, query_filter],
"OR")) == json_single_filter_group)
def __init__(self, exception):
error_message = (
u"An error occurred while requesting "
u"server environment information, caused by {}".format(
str(exception)))
super(Py42SessionInitializationError,
self).__init__(exception, error_message)
def test_create_is_in_filter_group_returns_obj_with_correct_json_representation():
filter_group = create_is_in_filter_group("isinterm", ["isinvalue1", "isinvalue2"])
assert (
str(filter_group) == '{"filterClause":"OR",'
' "filters":[{"operator":"IS", "term":"isinterm", "value":"isinvalue1"},'
'{"operator":"IS", "term":"isinterm", "value":"isinvalue2"}]}'
)
def test_alert_query_str_with_many_filters_or_specified_gives_correct_json_representation(
event_filter_group_list, ):
alert_query = AlertQuery(_TENANT_ID,
event_filter_group_list,
group_clause="OR")
json_query_str = build_query_json("OR", event_filter_group_list)
assert str(alert_query) == json_query_str
def test_create_exists_filter_returns_filter_group_with_correct_json_representation():
term = "test_eq_term"
_group = create_exists_filter_group(term)
assert (
str(_group) == '{"filterClause":"AND", "filters":[{"operator":"EXISTS", '
'"term":"test_eq_term", "value":null}]}'
)
def test_multi_vlaue_device_signed_in_username_gives_correct_json_representation(
filter_criteria, test_filter
):
usernames = ["username1", "username2", "username3"]
_filter = filter_criteria(usernames)
expected = test_filter.format("operatingSystemUser", *usernames)
assert str(_filter) == expected
def test_file_event_query_str_with_page_size_gives_correct_json_representation(
event_filter_group):
file_event_query = FileEventQuery(event_filter_group)
file_event_query.page_size = 500
json_query_str = JSON_QUERY_BASE.format("AND", event_filter_group, 1, 500,
"asc", "eventId")
assert str(file_event_query) == json_query_str
def test_create_in_range_filter_group_returns_obj_with_correct_json_representation():
filter_group = create_in_range_filter_group("rangeterm", "beforevalue", "aftervalue")
assert (
str(filter_group) == '{"filterClause":"AND",'
' "filters":[{"operator":"ON_OR_AFTER", "term":"rangeterm", "value":"beforevalue"},'
'{"operator":"ON_OR_BEFORE", "term":"rangeterm", "value":"aftervalue"}]}'
)
def test_file_event_query_str_with_sort_direction_gives_correct_json_representation(
event_filter_group, ):
file_event_query = FileEventQuery(event_filter_group)
file_event_query.sort_direction = "desc"
json_query_str = JSON_QUERY_BASE.format("AND", event_filter_group, 1,
10000, "desc", "eventId")
assert str(file_event_query) == json_query_str
def __eq__(self, other):
if isinstance(other, (QueryFilter, tuple, list)):
return tuple(self) == tuple(other)
elif isinstance(other, string_type):
return str(self) == other
else:
return False
def test_device_username_eq_unicode_str_gives_correct_json_representation():
unicode_username = u"您已经发现了秘密信息"
_filter = DeviceUsername.eq(unicode_username)
expected = IS.format(
u"deviceUserName",
u"\u60a8\u5df2\u7ecf\u53d1\u73b0\u4e86\u79d8\u5bc6\u4fe1\u606f")
assert str(_filter) == expected
def test_alert_query_str_with_single_filter_and_specified_gives_correct_json_representation(
event_filter_group, ):
alert_query = AlertQuery(_TENANT_ID,
event_filter_group,
group_clause="AND")
json_query_str = build_query_json("AND", event_filter_group)
assert str(alert_query) == json_query_str
def test_filter_group_when_does_not_contain_expected_query_filter_returns_false(
filter_class, ):
group = create_is_in_filter_group("term", ["value1", "value2", "value3"])
assert filter_class not in group
assert str(filter_class) not in group
assert tuple(filter_class) not in group
assert list(filter_class) not in group
def test_filter_group_contains_expected_query_filter_returns_true(
filter_class):
group = create_is_in_filter_group("term", ["value1", "value2", "value3"])
assert filter_class in group
assert str(filter_class) in group
assert tuple(filter_class) in group
assert list(filter_class) in group
def test_alert_query_str_with_sort_key_gives_correct_json_representation(
event_filter_group):
alert_query = AlertQuery(_TENANT_ID, event_filter_group)
alert_query.sort_key = "some_field_to_sort_by"
json_query_str = JSON_QUERY_BASE.format(_TENANT_ID, "AND",
event_filter_group, 0, 10000,
"desc", "some_field_to_sort_by")
assert str(alert_query) == json_query_str
def test_alert_query_str_with_sort_direction_gives_correct_json_representation(
event_filter_group, ):
alert_query = AlertQuery(_TENANT_ID, event_filter_group)
alert_query.sort_direction = "asc"
json_query_str = JSON_QUERY_BASE.format(_TENANT_ID, "AND",
event_filter_group, 0, 10000,
"asc", "CreatedAt")
assert str(alert_query) == json_query_str
def test_filter_group_with_multiple_filters_or_specified_str_gives_correct_json_representation(
query_filter_list, ):
filters_string = ",".join(
[json_query_filter_with_suffix(suffix) for suffix in range(3)])
json_multi_filter_group = JSON_FILTER_GROUP_BASE.format(
"OR", filters_string)
assert str(create_filter_group(query_filter_list,
"OR")) == json_multi_filter_group
def test_create_on_or_before_filter_group_returns_obj_with_correct_json_representation(
):
filter_group = create_on_or_before_filter_group("onorbeforeterm",
"onorbeforevalue")
assert (
str(filter_group) == '{"filterClause":"AND",'
' "filters":[{"operator":"ON_OR_BEFORE", "term":"onorbeforeterm", "value":"onorbeforevalue"}]}'
)
def test_create_contains_filter_group_returns_filter_group_with_correct_json_representation():
term = "test_eq_term"
value_list = ["item1", "item2"]
_group = create_contains_filter_group(term, value_list)
assert (
str(_group) == '{"filterClause":"AND", "filters":[{"operator":"CONTAINS", '
'"term":"test_eq_term", "value":"[\'item1\', \'item2\']"}]}'
)
def test_file_event_query_str_with_sort_key_gives_correct_json_representation(
event_filter_group):
file_event_query = FileEventQuery(event_filter_group)
file_event_query.sort_key = "some_field_to_sort_by"
json_query_str = JSON_QUERY_BASE.format("AND", event_filter_group, 1,
10000, "asc",
"some_field_to_sort_by")
assert str(file_event_query) == json_query_str
def test_alert_query_str_with_page_num_gives_correct_json_representation(
event_filter_group):
alert_query = AlertQuery(_TENANT_ID, event_filter_group)
alert_query.page_number = 5
json_query_str = JSON_QUERY_BASE.format(_TENANT_ID, "AND",
event_filter_group, 5, 10000,
"desc", "CreatedAt")
assert str(alert_query) == json_query_str
def test_date_observed_in_range_str_gives_correct_json_representation():
test_before_time = time()
test_after_time = time(
) + 30 # make sure timestamps are actually different
formatted_before = format_timestamp(test_before_time)
formatted_after = format_timestamp(test_after_time)
_filter = DateObserved.in_range(test_before_time, test_after_time)
expected = IN_RANGE.format("CreatedAt", formatted_before, formatted_after)
assert str(_filter) == expected
def get_all_rules_by_name(
self, rule_name, sort_key=_CREATED_AT, sort_direction=u"DESC"
):
return get_all_pages(
self.get_rules_page,
self._RULE_METADATA,
groups=[json.loads(str(create_eq_filter_group(u"Name", rule_name)))],
sort_key=sort_key,
sort_direction=sort_direction,
)
def __eq__(self, other):
if isinstance(other, FilterGroup):
return (self.filter_clause == other.filter_clause
and self._filter_set == other._filter_set)
elif isinstance(other, (tuple, list)):
return tuple(self) == tuple(other)
elif isinstance(other, string_type):
return str(self) == other
else:
return False
def _print_request(self, method, url, params=None, data=None):
if debug.will_print_for(debug.INFO):
print(u"{0}{1}".format(str(method).ljust(8), url))
if debug.will_print_for(debug.TRACE):
if self.headers:
_print_dict(self.headers, u" headers")
if debug.will_print_for(debug.DEBUG):
if params:
_print_dict(params, u" params")
if data:
_print_dict(data, u" data")
def test_date_observed_on_same_day_str_gives_correct_json_representation():
test_time = time()
test_date = datetime.utcfromtimestamp(test_time)
start_time = datetime(test_date.year, test_date.month, test_date.day, 0, 0,
0)
end_time = datetime(test_date.year, test_date.month, test_date.day, 23, 59,
59)
formatted_before = format_datetime(start_time)
formatted_after = format_datetime(end_time)
_filter = DateObserved.on_same_day(test_time)
expected = IN_RANGE.format("CreatedAt", formatted_before, formatted_after)
assert str(_filter) == expected
