def _fn_proofpoint_trap_delete_list_member_function(
self, event, *args, **kwargs):
"""Function: Delete the member of a list."""
try:
params = transform_kwargs(kwargs) if kwargs else {}
rp = ResultPayload(CONFIG_DATA_SECTION, **kwargs)
# Get the function parameters:
trap_list_id = kwargs.get("trap_list_id") # number
trap_member_id = kwargs.get("trap_member_id") # number
LOG.info("trap_list_id: %s", trap_list_id)
LOG.info("trap_member_id: %s", trap_member_id)
validate_fields(["trap_list_id", "trap_member_id"], kwargs)
pptr = PPTRClient(self.opts, self.options)
rtn = pptr.delete_list_member(**params)
results = rp.done(True, rtn)
# Produce a FunctionResult with the results
yield FunctionResult(results)
except Exception:
LOG.exception(
"Exception in Resilient Function for Proofpoint TRAP.")
yield FunctionError()
def _fn_proofpoint_trap_get_incident_details_function(
self, event, *args, **kwargs):
"""Function: Fetch Incident Details from Proofpoint TRAP"""
try:
params = transform_kwargs(kwargs) if kwargs else {}
rp = ResultPayload(CONFIG_DATA_SECTION, **kwargs)
# Get the function parameters:
trap_incident_id = kwargs.get("trap_incident_id") # number
LOG.info("trap_incident_id: %s", trap_incident_id)
validate_fields(["trap_incident_id"], kwargs)
pptr = PPTRClient(self.opts, self.options)
rtn = pptr.get_incident_details(**params)
if isinstance(rtn, dict) and "error" in rtn:
results = rtn
else:
results = rp.done(True, rtn)
results["data"] = rtn["data"]
results["href"] = rtn["href"]
# Produce a FunctionResult with the results
yield FunctionResult(results)
except Exception:
LOG.exception(
"Exception in Resilient Function for Proofpoint TRAP.")
yield FunctionError()
def _fn_proofpoint_trap_get_list_members_function(self, event, *args,
**kwargs):
"""Function: Retrieve all the members of a Threat Response list."""
try:
params = transform_kwargs(kwargs) if kwargs else {}
rp = ResultPayload(CONFIG_DATA_SECTION, **kwargs)
# Get the function parameters:
trap_list_id = kwargs.get("trap_list_id") # number
trap_member_id = kwargs.get("trap_member_id ") # number
trap_members_type = self.get_select_param(
kwargs.get(
"trap_members_type")) # select, values: "members.json"
LOG.info("trap_list_id: %s", trap_list_id)
LOG.info("trap_member_id: %s", trap_member_id)
LOG.info("trap_members_type: %s", trap_members_type)
validate_fields(["trap_list_id", "trap_members_type"], kwargs)
pptr = PPTRClient(self.opts, self.options)
rtn = pptr.get_list_members(**params)
results = rp.done(True, rtn)
# Produce a FunctionResult with the results
yield FunctionResult(results)
except Exception:
LOG.exception(
"Exception in Resilient Function for Proofpoint TRAP.")
yield FunctionError()
def test_delete_list_member(self, mock_get, trap_list_id, trap_member_id,
expected_results):
test_kwargs = {
"trap_list_id": trap_list_id,
"trap_member_id": trap_member_id
}
params = transform_kwargs(test_kwargs)
pptr = PPTRClient(None, get_config())
response = pptr.delete_list_member(**params)
assert (expected_results == response)
def test_add_list_member(self, mock_get, trap_list_id, trap_member,
trap_description, trap_expiration, trap_duration,
expected_results):
keys_host_1 = [
"created_at", "deleted", "description", "enabled", "expiration",
"host", "host_id", "id", "list_id", "updated_at"
]
keys_host_2 = [
"hash_reputation_id", "response_id", "reverse_user_id", "user_id"
]
expected_results = {
'created_at': '2017-01-11T03:47:15Z',
'deleted': False,
'description': 'Test Description',
'enabled': True,
'expiration': '2019-09-29T23:00:00Z',
'hash_reputation_id': None,
'host': {
'created_at': '2017-01-11T03:47:15Z',
'host': '192.168.1.2',
'id': 20,
'resolution_state': 4,
'ttl': 5,
'updated_at': '2019-09-25T14:07:46Z'
},
'host_id': 22,
'id': 8,
'list_id': 1,
'response_id': None,
'reverse_user_id': None,
'updated_at': '2019-09-25T14:07:46Z',
'user_id': None
}
test_kwargs = {
"trap_list_id": trap_list_id,
"trap_member": trap_member,
"trap_description": trap_description,
"trap_expiration": trap_expiration,
"trap_duration": trap_duration
}
params = transform_kwargs(test_kwargs)
pptr = PPTRClient(None, get_config())
response = pptr.add_list_member(**params)
assert_keys_in(response, *keys_host_1)
assert_keys_in(response, *keys_host_2)
assert_values(response, expected_results)
def test_get_incident_details(self, mock_get, trap_incident_id,
expected_result):
keys = ["data", "href"]
keys_data = [
"assignee", "created_at", "description", "hosts", "event_count",
"events", "score", "type"
]
test_kwargs = {"trap_incident_id": trap_incident_id}
params = transform_kwargs(test_kwargs)
pptr = PPTRClient(None, get_config())
response = pptr.get_incident_details(**params)
assert_keys_in(response, *keys)
assert expected_result == response["href"]
data = response["data"]
assert_keys_in(data, *keys_data)
def test_get_list_members(self, mock_get, trap_list_id, trap_members_type,
trap_member_id, expected_results):
keys_host_1 = [
"created_at", "deleted", "description", "enabled", "expiration",
"host", "host_id", "id", "list_id", "updated_at"
]
keys_host_2 = [
"hash_reputation_id", "response_id", "reverse_user_id", "user_id"
]
test_kwargs = {
"trap_list_id": trap_list_id,
"trap_members_type": trap_members_type,
"trap_member_id": trap_member_id
}
params = transform_kwargs(test_kwargs)
pptr = PPTRClient(None, get_config())
response = pptr.get_list_members(**params)
for host in response:
assert_keys_in(host, *keys_host_1)
assert_keys_in(host, *keys_host_2)
assert_value_not_none(host, *keys_host_1)