def test_fetch_incidents(mocker):
"""Unit test
Given
- raw response of report results
When
- mock the demisto map object
- mock getting demisto indicators
Then
- validate the incidents values
"""
client_response = util_load_json('test_data/json_raw_response.json')
mapped_user = util_load_json('test_data/mapped_user.json')
mocker.patch.object(Client,
'get_full_report',
return_value=client_response)
mocker.patch('Workday_IAM.get_all_user_profiles',
return_value=("id", "mail"))
mocker.patch.object(demisto, 'mapObject', return_value=mapped_user)
client = Client(base_url="",
verify="verify",
headers={},
proxy=False,
ok_codes=(200, 204),
auth=None)
fetch_events = fetch_incidents(client, {}, "")
assert fetch_events == EVENT_RESULTS
def test_fetch_incidents_employee_id_change(requests_mock, mocker):
"""
Given
- A workday full report of employees.
When
- An employee id change is detected for the user [email protected].
Then
- Make sure the IAM - Update User event is returned as expected.
"""
from test_data.fetch_incidents_employee_id_change_mock_data import full_report, mapped_workday_user, \
employee_id_to_user_profile, email_to_user_profile, event_data
requests_mock.get('https://test.com', json=full_report)
mocker.patch('Workday_IAM.get_all_user_profiles',
return_value=(employee_id_to_user_profile,
email_to_user_profile))
mocker.patch.object(demisto, 'mapObject', return_value=mapped_workday_user)
client = Client(base_url="",
verify="verify",
headers={},
proxy=False,
ok_codes=(200, 204),
auth=None)
fetch_events = fetch_incidents(client, {}, "https://test.com", "%m/%d/%Y",
LAST_DAY_OF_WORK_FIELD, None, None)
assert fetch_events == event_data
def test_fetch_incidents_orphan_user(requests_mock, mocker):
"""
Given
- An empty workday report of employees.
When
- A user profile with email [email protected] exists on XSOAR.
Then
- Ensure an IAM - Terminate User event is returned for this user.
"""
from test_data.fetch_incidents_orphan_user_mock_data import full_report, email_to_user_profile, event_data
requests_mock.get('https://test.com', json=full_report)
mocker.patch('Workday_IAM.get_all_user_profiles', return_value=({}, {}, email_to_user_profile))
client = Client(base_url="", verify="verify", headers={}, proxy=False,
ok_codes=(200, 204), auth=None)
fetch_events = fetch_incidents(client, {}, "https://test.com", "%m/%d/%Y", LAST_DAY_OF_WORK_FIELD, None, None, 1)
assert fetch_events == event_data
def test_fetch_incidents_partial_name_match(requests_mock, mocker):
"""
Given
- A workday full report of employees.
When
- A new hire is detected with the same display name as an existing active user.
Then
- Ensure an "IAM - Sync user" event is detected with the partial name match details.
"""
from test_data.fetch_incidents_partial_name_match_mock_data import full_report, email_to_user_profile, \
employee_id_to_user_profile, display_name_to_user_profile, mapped_workday_user, event_data
requests_mock.get('https://test.com', json=full_report)
mocker.patch.object(demisto, 'mapObject', return_value=mapped_workday_user)
mocker.patch('Workday_IAM.get_all_user_profiles', return_value=(display_name_to_user_profile,
employee_id_to_user_profile,
email_to_user_profile))
mocker.patch('Workday_IAM.get_orphan_users', return_value=[]) # skip the orphan user detection
client = Client(base_url="", verify="verify", headers={}, proxy=False,
ok_codes=(200, 204), auth=None)
fetch_events = fetch_incidents(client, {}, "https://test.com", "%m/%d/%Y", LAST_DAY_OF_WORK_FIELD, None, None, 1)
assert fetch_events == event_data
def test_fetch_incidents_source_priority(requests_mock, mocker):
"""
Given
- A workday full report of employees.
When
- Workday IAM configured source priority is 2.
- A user profile with email [email protected] has a source priority 1.
Then
- Ensure the event for [email protected] is dropped.
"""
from test_data.fetch_incidents_source_priority_mock_data import full_report, email_to_user_profile, \
employee_id_to_user_profile, mapped_workday_user, event_data
requests_mock.get('https://test.com', json=full_report)
mocker.patch.object(demisto, 'mapObject', return_value=mapped_workday_user)
mocker.patch('Workday_IAM.get_all_user_profiles', return_value=({}, employee_id_to_user_profile,
email_to_user_profile))
client = Client(base_url="", verify="verify", headers={}, proxy=False,
ok_codes=(200, 204), auth=None)
fetch_events = fetch_incidents(client, {}, "https://test.com", "%m/%d/%Y", LAST_DAY_OF_WORK_FIELD, None, None,
source_priority=2)
assert fetch_events == event_data