def test_load_workflow(monkeypatch):
"""Test loading a workflow status."""
_was_called = False
def _get_workflow(url, parms=None, default=None):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/workflow/status/497ABX"
_was_called = True
return {
"errors": [],
"failed_ids": [],
"id": "497ABX",
"num_hits": 0,
"num_success": 0,
"status": "QUEUED",
"workflow": {
"state": "DISMISSED",
"remediation": "Fixed",
"comment": "Yessir",
"changed_by": "Robocop",
"last_update_time": "2019-10-31T16:03:13.951Z"
}
}
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, GET=_get_workflow)
workflow = api.select(WorkflowStatus, "497ABX")
assert _was_called
assert workflow.id_ == "497ABX"
def test_query_watchlistalert_facets(monkeypatch):
"""Test a watchlist alert facet query."""
_was_called = False
def _run_facet_query(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/alerts/watchlist/_facet"
assert body == {
"query": "Blort",
"criteria": {
"workflow": ["OPEN"]
},
"terms": {
"rows": 0,
"fields": ["REPUTATION", "STATUS"]
},
"rows": 100
}
_was_called = True
return StubResponse({
"results": [{
"field": {},
"values": [{
"id": "reputation",
"name": "reputationX",
"total": 4
}]
}, {
"field": {},
"values": [{
"id": "status",
"name": "statusX",
"total": 9
}]
}]
})
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, POST=_run_facet_query)
query = api.select(WatchlistAlert).where("Blort").set_workflows(["OPEN"])
f = query.facets(["REPUTATION", "STATUS"])
assert _was_called
assert f == [{
"field": {},
"values": [{
"id": "reputation",
"name": "reputationX",
"total": 4
}]
}, {
"field": {},
"values": [{
"id": "status",
"name": "statusX",
"total": 9
}]
}]
def test_run_delete_failed(monkeypatch):
"""Test a failure in the attempt to delete a query."""
_was_called = False
def _execute_delete(url):
nonlocal _was_called
assert url == "/livequery/v1/orgs/Z100/runs/abcdefg"
_was_called = True
return StubResponse(None, 403)
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, DELETE=_execute_delete)
run = Run(
api, "abcdefg", {
"org_key": "Z100",
"name": "FoobieBletch",
"id": "abcdefg",
"status": "ACTIVE"
})
rc = run.delete()
assert _was_called
assert not rc
assert not run._is_deleted
def test_Device_update_policy(monkeypatch):
"""Test the call to update policy for a device."""
_was_called = False
def _get_device(url, parms=None, default=None):
assert url == "/appservices/v6/orgs/Z100/devices/6023"
return {"id": 6023}
def _update_policy(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {
"action_type": "UPDATE_POLICY",
"device_id": [6023],
"options": {
"policy_id": 8675309
}
}
_was_called = True
return StubResponse(None, 204)
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, GET=_get_device, POST=_update_policy)
dev = Device(api, 6023, {"id": 6023})
dev.update_policy(8675309)
assert _was_called
def test_Device_bypass(monkeypatch):
"""Test the call to set the bypass status for a device."""
_was_called = False
def _get_device(url, parms=None, default=None):
assert url == "/appservices/v6/orgs/Z100/devices/6023"
return {"id": 6023}
def _bypass(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {
"action_type": "BYPASS",
"device_id": [6023],
"options": {
"toggle": "OFF"
}
}
_was_called = True
return StubResponse(None, 204)
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, GET=_get_device, POST=_bypass)
dev = Device(api, 6023, {"id": 6023})
dev.bypass(False)
assert _was_called
def test_Device_update_sensor_version(monkeypatch):
"""Test the call to update the sensor version for a device."""
_was_called = False
def _get_device(url, parms=None, default=None):
assert url == "/appservices/v6/orgs/Z100/devices/6023"
return {"id": 6023}
def _update_sensor_version(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {
"action_type": "UPDATE_SENSOR_VERSION",
"device_id": [6023],
"options": {
"sensor_version": {
"RHEL": "2.3.4.5"
}
}
}
_was_called = True
return StubResponse(None, 204)
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch,
api,
GET=_get_device,
POST=_update_sensor_version)
dev = Device(api, 6023, {"id": 6023})
dev.update_sensor_version({"RHEL": "2.3.4.5"})
assert _was_called
def test_audit_remediation_history_with_everything(monkeypatch):
"""Test a query of run history with all possible options."""
_was_called = False
def _run_query(url, body, **kwargs):
nonlocal _was_called
assert url == "/livequery/v1/orgs/Z100/runs/_search"
assert body == {"query": "xyzzy", "sort": [{"field": "id", "order": "ASC"}], "start": 0}
_was_called = True
return StubResponse({"org_key": "Z100", "num_found": 3,
"results": [{"org_key": "Z100", "name": "FoobieBletch", "id": "abcdefg"},
{"org_key": "Z100", "name": "Aoxomoxoa", "id": "cdefghi"},
{"org_key": "Z100", "name": "Read_Me", "id": "efghijk"}]})
api = CBCloudAPI(url="https://example.com", token="ABCD/1234", org_key="Z100", ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, POST=_run_query)
query = api.audit_remediation_history("xyzzy").sort_by("id")
assert isinstance(query, RunHistoryQuery)
count = 0
for item in query.all():
assert item.org_key == "Z100"
if item.id == "abcdefg":
assert item.name == "FoobieBletch"
elif item.id == "cdefghi":
assert item.name == "Aoxomoxoa"
elif item.id == "efghijk":
assert item.name == "Read_Me"
else:
pytest.fail("Unknown item ID: %s" % item.id)
count = count + 1
assert _was_called
assert count == 3
def test_Device_uninstall_sensor(monkeypatch):
"""Test the call to uninstall the sensor for a device."""
_was_called = False
def _get_device(url, parms=None, default=None):
assert url == "/appservices/v6/orgs/Z100/devices/6023"
return {"id": 6023}
def _uninstall_sensor(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "UNINSTALL_SENSOR", "device_id": [6023]}
_was_called = True
return StubResponse(None, 204)
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch,
api,
GET=_get_device,
POST=_uninstall_sensor)
dev = Device(api, 6023, {"id": 6023})
dev.uninstall_sensor()
assert _was_called
def test_run_refresh(monkeypatch):
"""Test refreshing a query view."""
_was_called = False
def _get_run(url, parms=None, default=None):
nonlocal _was_called
assert url == "/livequery/v1/orgs/Z100/runs/abcdefg"
_was_called = True
return {
"org_key": "Z100",
"name": "FoobieBletch",
"id": "abcdefg",
"status": "COMPLETE"
}
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, GET=_get_run)
run = Run(
api, "abcdefg", {
"org_key": "Z100",
"name": "FoobieBletch",
"id": "abcdefg",
"status": "ACTIVE"
})
rc = run.refresh()
assert _was_called
assert rc
assert run.org_key == "Z100"
assert run.name == "FoobieBletch"
assert run.id == "abcdefg"
assert run.status == "COMPLETE"
def test_run_stop_failed(monkeypatch):
"""Test the failure to stop a running query."""
_was_called = False
def _execute_stop(url, body, **kwargs):
nonlocal _was_called
assert url == "/livequery/v1/orgs/Z100/runs/abcdefg/status"
assert body == {"status": "CANCELLED"}
_was_called = True
return StubResponse(
{"error_message": "The query is not presently running."}, 409)
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, PUT=_execute_stop)
run = Run(
api, "abcdefg", {
"org_key": "Z100",
"name": "FoobieBletch",
"id": "abcdefg",
"status": "CANCELLED"
})
rc = run.stop()
assert _was_called
assert not rc
def test_run_stop(monkeypatch):
"""Test stopping a running query."""
_was_called = False
def _execute_stop(url, body, **kwargs):
nonlocal _was_called
assert url == "/livequery/v1/orgs/Z100/runs/abcdefg/status"
assert body == {"status": "CANCELLED"}
_was_called = True
return StubResponse({
"org_key": "Z100",
"name": "FoobieBletch",
"id": "abcdefg",
"status": "CANCELLED"
})
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, PUT=_execute_stop)
run = Run(
api, "abcdefg", {
"org_key": "Z100",
"name": "FoobieBletch",
"id": "abcdefg",
"status": "ACTIVE"
})
rc = run.stop()
assert _was_called
assert rc
assert run.org_key == "Z100"
assert run.name == "FoobieBletch"
assert run.id == "abcdefg"
assert run.status == "CANCELLED"
def test_query_device_with_all_bells_and_whistles(monkeypatch):
"""Test a device query with all options set."""
_was_called = False
def _run_query(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/devices/_search"
assert body == {"query": "foobar",
"criteria": {"ad_group_id": [14, 25], "os": ["LINUX"], "policy_id": [8675309],
"status": ["ALL"], "target_priority": ["HIGH"], "deployment_type": ["ENDPOINT"]},
"exclusions": {"sensor_version": ["0.1"]},
"sort": [{"field": "name", "order": "DESC"}]}
_was_called = True
return StubResponse({"results": [{"id": 6023, "organization_name": "thistestworks"}],
"num_found": 1})
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, POST=_run_query)
query = api.select(Device).where("foobar").set_ad_group_ids([14, 25]).set_os(["LINUX"]) \
.set_policy_ids([8675309]).set_status(["ALL"]).set_target_priorities(["HIGH"]) \
.set_exclude_sensor_versions(["0.1"]).sort_by("name", "DESC").set_deployment_type(["ENDPOINT"])
d = query.one()
assert _was_called
assert d.id == 6023
assert d.organization_name == "thistestworks"
def test_alerts_bulk_dismiss_vmware(monkeypatch):
"""Test dismissing a batch of VMware alerts."""
_was_called = False
def _do_dismiss(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/alerts/cbanalytics/workflow/_criteria"
assert body == {
"query": "Blort",
"state": "DISMISSED",
"remediation_state": "Fixed",
"comment": "Yessir",
"criteria": {
"device_name": ["HAL9000"]
}
}
_was_called = True
return StubResponse({"request_id": "497ABX"})
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, POST=_do_dismiss)
q = api.select(CBAnalyticsAlert).where("Blort").set_device_names(
["HAL9000"])
reqid = q.dismiss("Fixed", "Yessir")
assert _was_called
assert reqid == "497ABX"
def test_WorkflowStatus(monkeypatch):
"""Test retrieval of the workflow status."""
_times_called = 0
def _get_workflow(url, parms=None, default=None):
nonlocal _times_called
assert url == "/appservices/v6/orgs/Z100/workflow/status/W00K13"
if _times_called >= 0 and _times_called <= 3:
_stat = "QUEUED"
elif _times_called >= 4 and _times_called <= 6:
_stat = "IN_PROGRESS"
elif _times_called >= 7 and _times_called <= 9:
_stat = "FINISHED"
else:
pytest.fail("_get_workflow called too many times")
_times_called = _times_called + 1
return {
"errors": [],
"failed_ids": [],
"id": "W00K13",
"num_hits": 0,
"num_success": 0,
"status": _stat,
"workflow": {
"state": "DISMISSED",
"remediation": "Fixed",
"comment": "Yessir",
"changed_by": "Robocop",
"last_update_time": "2019-10-31T16:03:13.951Z"
}
}
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, GET=_get_workflow)
wfstat = WorkflowStatus(api, "W00K13")
assert wfstat.workflow_.changed_by == "Robocop"
assert wfstat.workflow_.state == "DISMISSED"
assert wfstat.workflow_.remediation == "Fixed"
assert wfstat.workflow_.comment == "Yessir"
assert wfstat.workflow_.last_update_time == "2019-10-31T16:03:13.951Z"
assert _times_called == 1
assert wfstat.queued
assert not wfstat.in_progress
assert not wfstat.finished
assert _times_called == 4
assert not wfstat.queued
assert wfstat.in_progress
assert not wfstat.finished
assert _times_called == 7
assert not wfstat.queued
assert not wfstat.in_progress
assert wfstat.finished
assert _times_called == 10
def test_simple_query(monkeypatch):
"""Test SimpleQuery methods using a FeedQuery for API calls"""
_was_called = False
def _get_results(url, **kwargs):
nonlocal _was_called
assert url == "/threathunter/feedmgr/v2/orgs/WNEX/feeds"
_was_called = True
return {
"results": [{
"name": "My Feed",
"owner": "WNEX",
"provider_url": "https://exampleprovider.com",
"summary": "this is the summary",
"category": "this is the category",
"source_label": None,
"access": "public",
"id": "my_feed_id"
}]
}
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="WNEX",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, GET=_get_results)
feed = api.select(Feed).where(include_public=True)
assert isinstance(feed, SimpleQuery)
assert isinstance(feed, FeedQuery)
results = feed.results
assert isinstance(results, list)
assert isinstance(results[0], Feed)
assert results[0].id == "my_feed_id"
assert results[0].name == "My Feed"
assert _was_called
simpleQuery = SimpleQuery(Feed, api)
assert simpleQuery._doc_class == Feed
assert str(
simpleQuery._urlobject) == "/threathunter/feedmgr/v2/orgs/{}/feeds"
assert isinstance(simpleQuery, SimpleQuery)
assert simpleQuery._cb == api
assert simpleQuery._results == []
assert simpleQuery._query == {}
clonedSimple = simpleQuery._clone()
assert clonedSimple._cb == simpleQuery._cb
assert clonedSimple._results == simpleQuery._results
assert clonedSimple._query == simpleQuery._query
def test_Device_lr_session(monkeypatch):
"""Test the call to set up a Live Response session for a device."""
def _get_session(url, parms=None, default=None):
assert url == "/appservices/v6/orgs/Z100/devices/6023"
return {"id": 6023}
api = CBCloudAPI(url="https://example.com", token="ABCD/1234", org_key="Z100", ssl_verify=True)
sked = StubScheduler(6023)
api._lr_scheduler = sked
patch_cbc_sdk_api(monkeypatch, api, GET=_get_session)
dev = Device(api, 6023, {"id": 6023})
sess = dev.lr_session()
assert sess["itworks"]
assert sked.was_called
def test_device_background_scan(monkeypatch):
"""Test setting the background scan status of a device."""
_was_called = False
def _call_background_scan(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "BACKGROUND_SCAN", "device_id": [6023], "options": {"toggle": "ON"}}
_was_called = True
return StubResponse(None, 204)
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, POST=_call_background_scan)
api.device_background_scan([6023], True)
assert _was_called
def test_device_uninstall_sensor(monkeypatch):
"""Test uninstalling the sensor for a device."""
_was_called = False
def _call_uninstall_sensor(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "UNINSTALL_SENSOR", "device_id": [6023]}
_was_called = True
return StubResponse(None, 204)
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, POST=_call_uninstall_sensor)
api.device_uninstall_sensor([6023])
assert _was_called
def test_device_bypass(monkeypatch):
"""Test setting the bypass status of a device."""
_was_called = False
def _call_bypass(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "BYPASS", "device_id": [6023], "options": {"toggle": "OFF"}}
_was_called = True
return StubResponse(None, 204)
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, POST=_call_bypass)
api.device_bypass([6023], False)
assert _was_called
def test_device_update_policy(monkeypatch):
"""Test updating the policy of a device."""
_was_called = False
def _call_update_policy(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "UPDATE_POLICY", "device_id": [6023], "options": {"policy_id": 8675309}}
_was_called = True
return StubResponse(None, 204)
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, POST=_call_update_policy)
api.device_update_policy([6023], 8675309)
assert _was_called
def test_query_device_do_quarantine(monkeypatch):
"""Test setting the quarantine status on devices matched by a query."""
_was_called = False
def _quarantine(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "QUARANTINE",
"search": {"query": "foobar", "criteria": {}, "exclusions": {}}, "options": {"toggle": "ON"}}
_was_called = True
return StubResponse(None, 204)
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, POST=_quarantine)
api.select(Device).where("foobar").quarantine(True)
assert _was_called
def test_query_device_do_uninstall_sensor(monkeypatch):
"""Test uninstalling the sensor on devices matched by a query."""
_was_called = False
def _uninstall_sensor(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "UNINSTALL_SENSOR",
"search": {"query": "foobar", "criteria": {}, "exclusions": {}}}
_was_called = True
return StubResponse(None, 204)
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, POST=_uninstall_sensor)
api.select(Device).where("foobar").uninstall_sensor()
assert _was_called
def test_device_update_sensor_version(monkeypatch):
"""Test updating the sensor version of a device."""
_was_called = False
def _call_update_sensor_version(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "UPDATE_SENSOR_VERSION", "device_id": [6023],
"options": {"sensor_version": {"RHEL": "2.3.4.5"}}}
_was_called = True
return StubResponse(None, 204)
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, POST=_call_update_sensor_version)
api.device_update_sensor_version([6023], {"RHEL": "2.3.4.5"})
assert _was_called
def test_query_device_do_update_policy(monkeypatch):
"""Test updating the policy on devices matched by a query."""
_was_called = False
def _update_policy(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "UPDATE_POLICY",
"search": {"query": "foobar", "criteria": {}, "exclusions": {}},
"options": {"policy_id": 8675309}}
_was_called = True
return StubResponse(None, 204)
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, POST=_update_policy)
api.select(Device).where("foobar").update_policy(8675309)
assert _was_called
def test_simple_get(monkeypatch):
"""Test a simple "get" of a run status object."""
_was_called = False
def _get_run(url, parms=None, default=None):
nonlocal _was_called
assert url == "/livequery/v1/orgs/Z100/runs/abcdefg"
_was_called = True
return {"org_key": "Z100", "name": "FoobieBletch", "id": "abcdefg"}
api = CBCloudAPI(url="https://example.com", token="ABCD/1234", org_key="Z100", ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, GET=_get_run)
run = api.select(Run, "abcdefg")
assert _was_called
assert run.org_key == "Z100"
assert run.name == "FoobieBletch"
assert run.id == "abcdefg"
def test_query_device_do_update_sensor_version(monkeypatch):
"""Test updating the sensor version on devices matched by a query."""
_was_called = False
def _update_sensor_version(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/device_actions"
assert body == {"action_type": "UPDATE_SENSOR_VERSION",
"search": {"query": "foobar", "criteria": {}, "exclusions": {}},
"options": {"sensor_version": {"RHEL": "2.3.4.5"}}}
_was_called = True
return StubResponse(None, 204)
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, POST=_update_sensor_version)
api.select(Device).where("foobar").update_sensor_version({"RHEL": "2.3.4.5"})
assert _was_called
def test_get_device(monkeypatch):
"""Test simple retrieval of a Device object by ID."""
_was_called = False
def _get_device(url):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/devices/6023"
_was_called = True
return {"device_id": 6023, "organization_name": "thistestworks"}
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, GET=_get_device)
rc = api.select(Device, 6023)
assert _was_called
assert isinstance(rc, Device)
assert rc.device_id == 6023
assert rc.organization_name == "thistestworks"
def test_query_basealert_with_time_range(monkeypatch):
"""Test an alert query with the last_update_time specified as a range."""
_was_called = False
_timestamp = datetime.now()
def _run_query(url, body, **kwargs):
nonlocal _was_called
nonlocal _timestamp
assert url == "/appservices/v6/orgs/Z100/alerts/_search"
assert body == {
"query": "Blort",
"criteria": {
"last_update_time": {
"start": _timestamp.isoformat(),
"end": _timestamp.isoformat()
}
},
"rows": 100
}
_was_called = True
return StubResponse({
"results": [{
"id": "S0L0",
"org_key": "Z100",
"threat_id": "B0RG",
"workflow": {
"state": "OPEN"
}
}],
"num_found":
1
})
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, POST=_run_query)
query = api.select(BaseAlert).where("Blort").set_time_range(
"last_update_time", start=_timestamp, end=_timestamp)
a = query.one()
assert _was_called
assert a.id == "S0L0"
assert a.org_key == "Z100"
assert a.threat_id == "B0RG"
assert a.workflow_.state == "OPEN"
def test_query_basealert_with_create_time_as_start_end(monkeypatch):
"""Test an alert query with the creation time specified as a start and end time."""
_was_called = False
def _run_query(url, body, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/alerts/_search"
assert body == {
"query": "Blort",
"rows": 100,
"criteria": {
"create_time": {
"start": "2019-09-30T12:34:56",
"end": "2019-10-01T12:00:12"
}
}
}
_was_called = True
return StubResponse({
"results": [{
"id": "S0L0",
"org_key": "Z100",
"threat_id": "B0RG",
"workflow": {
"state": "OPEN"
}
}],
"num_found":
1
})
api = CBCloudAPI(url="https://example.com",
token="ABCD/1234",
org_key="Z100",
ssl_verify=True)
patch_cbc_sdk_api(monkeypatch, api, POST=_run_query)
query = api.select(BaseAlert).where("Blort").set_create_time(
start="2019-09-30T12:34:56", end="2019-10-01T12:00:12")
a = query.one()
assert _was_called
assert a.id == "S0L0"
assert a.org_key == "Z100"
assert a.threat_id == "B0RG"
assert a.workflow_.state == "OPEN"
def test_query_device_download(monkeypatch):
"""Test downloading the results of a device query as CSV."""
_was_called = False
def _run_download(url, query_params, **kwargs):
nonlocal _was_called
assert url == "/appservices/v6/orgs/Z100/devices/_search/download"
assert query_params == {"status": "ALL", "ad_group_id": "14,25", "policy_id": "8675309",
"target_priority": "HIGH", "query_string": "foobar", "sort_field": "name",
"sort_order": "DESC"}
_was_called = True
return "123456789,123456789,123456789"
api = call_cbcloud_api()
patch_cbc_sdk_api(monkeypatch, api, RAW_GET=_run_download)
rc = api.select(Device).where("foobar").set_ad_group_ids([14, 25]).set_policy_ids([8675309]) \
.set_status(["ALL"]).set_target_priorities(["HIGH"]).sort_by("name", "DESC").download()
assert _was_called
assert rc == "123456789,123456789,123456789"