|
| 1 | +import pytest |
| 2 | +import json |
| 3 | + |
| 4 | +from integration import run_command |
| 5 | +from integration.util import cleanup_after_validation |
| 6 | + |
| 7 | +ALERT_COMMAND = "code42 alerts print -b 2020-05-18 -e 2020-05-20" |
| 8 | + |
| 9 | + |
| 10 | +def _parse_response(response): |
| 11 | + return [json.loads(line) for line in response if len(line)] |
| 12 | + |
| 13 | + |
| 14 | +def _validate_field_value(field, value, response): |
| 15 | + parsed_response = _parse_response(response) |
| 16 | + assert len(parsed_response) > 0 |
| 17 | + for record in parsed_response: |
| 18 | + assert record[field] == value |
| 19 | + |
| 20 | + |
| 21 | +@pytest.mark.parametrize( |
| 22 | + "command, field, value", |
| 23 | + [("{} --state OPEN".format(ALERT_COMMAND), "state", "OPEN"), |
| 24 | + ("{} --state RESOLVED".format(ALERT_COMMAND), "state", "RESOLVED"), |
| 25 | + ("{} --actor spatel@code42.com".format(ALERT_COMMAND), "actor", "spatel@code42.com"), |
| 26 | + ("{} --rule-name 'File Upload Alert'".format(ALERT_COMMAND), "name", "File Upload Alert"), |
| 27 | + ("{} --rule-id 962a6a1c-54f6-4477-90bd-a08cc74cbf71".format(ALERT_COMMAND), "ruleId", |
| 28 | + "962a6a1c-54f6-4477-90bd-a08cc74cbf71"), |
| 29 | + ("{} --rule-type FedEndpointExfiltration".format(ALERT_COMMAND), "type", |
| 30 | + "FED_ENDPOINT_EXFILTRATION"), |
| 31 | + ("{} --description 'Alert on any file upload'".format(ALERT_COMMAND), "description", |
| 32 | + "Alert on any file upload events"), |
| 33 | + ] |
| 34 | +) |
| 35 | +def test_alert_prints_to_stdout_and_filters_result_by_given_value(command, field, value): |
| 36 | + return_code, response = run_command(command) |
| 37 | + assert return_code is 0 |
| 38 | + _validate_field_value(field, value, response) |
| 39 | + |
| 40 | + |
| 41 | +def _validate_begin_date(response): |
| 42 | + parsed_response = _parse_response(response) |
| 43 | + assert len(parsed_response) > 0 |
| 44 | + for record in parsed_response: |
| 45 | + assert record["createdAt"].startswith("2020-05-18") |
| 46 | + |
| 47 | + |
| 48 | +@pytest.mark.parametrize("command, validate", [ |
| 49 | + (ALERT_COMMAND, _validate_begin_date), |
| 50 | +]) |
| 51 | +def test_alert_prints_to_stdout_and_filters_result_between_given_date(command, validate): |
| 52 | + return_code, response = run_command(command) |
| 53 | + assert return_code is 0 |
| 54 | + validate(response) |
| 55 | + |
| 56 | + |
| 57 | +def _validate_severity(response): |
| 58 | + record = json.loads(response) |
| 59 | + assert record["severity"] == "MEDIUM" |
| 60 | + |
| 61 | + |
| 62 | +@cleanup_after_validation("./integration/alerts") |
| 63 | +def test_alert_writes_to_file_and_filters_result_by_severity(): |
| 64 | + command = "code42 alerts write-to ./integration/alerts -b 2020-05-18 -e 2020-05-20 " \ |
| 65 | + "--severity MEDIUM" |
| 66 | + return_code, response = run_command(command) |
| 67 | + return _validate_severity |
0 commit comments