|
2 | 2 | from datetime import timedelta |
3 | 3 |
|
4 | 4 | import pytest |
5 | | -from tests.integration import run_command |
6 | 5 |
|
7 | 6 |
|
8 | 7 | begin_date = datetime.utcnow() - timedelta(days=20) |
9 | 8 | end_date = datetime.utcnow() - timedelta(days=10) |
10 | 9 | begin_date_str = begin_date.strftime("%Y-%m-%d") |
11 | 10 | end_date_str = end_date.strftime("%Y-%m-%d") |
12 | 11 |
|
13 | | -ALERT_COMMAND = "code42 alerts search -b {} -e {}".format(begin_date_str, end_date_str) |
| 12 | +ALERT_SEARCH_COMMAND = "code42 alerts search -b {} -e {}".format( |
| 13 | + begin_date_str, end_date_str |
| 14 | +) |
14 | 15 | ADVANCED_QUERY = """{"groupClause":"AND", "groups":[{"filterClause":"AND", |
15 | 16 | "filters":[{"operator":"ON_OR_AFTER", "term":"eventTimestamp", "value":"2020-09-13T00:00:00.000Z"}, |
16 | 17 | {"operator":"ON_OR_BEFORE", "term":"eventTimestamp", "value":"2020-12-07T13:20:15.195Z"}]}], |
|
25 | 26 | @pytest.mark.parametrize( |
26 | 27 | "command", |
27 | 28 | [ |
28 | | - ALERT_COMMAND, |
29 | | - "{} --state OPEN".format(ALERT_COMMAND), |
30 | | - "{} --state RESOLVED".format(ALERT_COMMAND), |
31 | | - "{} --actor user@code42.com".format(ALERT_COMMAND), |
32 | | - "{} --rule-name 'File Upload Alert'".format(ALERT_COMMAND), |
33 | | - "{} --rule-id 962a6a1c-54f6-4477-90bd-a08cc74cbf71".format(ALERT_COMMAND), |
34 | | - "{} --rule-type FedEndpointExfiltration".format(ALERT_COMMAND), |
35 | | - "{} --description 'Alert on any file upload'".format(ALERT_COMMAND), |
36 | | - "{} --exclude-rule-type 'FedEndpointExfiltration'".format(ALERT_COMMAND), |
| 29 | + ALERT_SEARCH_COMMAND, |
| 30 | + "{} --state OPEN".format(ALERT_SEARCH_COMMAND), |
| 31 | + "{} --state RESOLVED".format(ALERT_SEARCH_COMMAND), |
| 32 | + "{} --actor user@code42.com".format(ALERT_SEARCH_COMMAND), |
| 33 | + "{} --rule-name 'File Upload Alert'".format(ALERT_SEARCH_COMMAND), |
| 34 | + "{} --rule-id 962a6a1c-54f6-4477-90bd-a08cc74cbf71".format( |
| 35 | + ALERT_SEARCH_COMMAND |
| 36 | + ), |
| 37 | + "{} --rule-type FedEndpointExfiltration".format(ALERT_SEARCH_COMMAND), |
| 38 | + "{} --description 'Alert on any file upload'".format(ALERT_SEARCH_COMMAND), |
| 39 | + "{} --exclude-rule-type 'FedEndpointExfiltration'".format(ALERT_SEARCH_COMMAND), |
37 | 40 | "{} --exclude-rule-id '962a6a1c-54f6-4477-90bd-a08cc74cbf71'".format( |
38 | | - ALERT_COMMAND |
| 41 | + ALERT_SEARCH_COMMAND |
39 | 42 | ), |
40 | | - "{} --exclude-rule-name 'File Upload Alert'".format(ALERT_COMMAND), |
41 | | - "{} --exclude-actor-contains 'user@code42.com'".format(ALERT_COMMAND), |
42 | | - "{} --exclude-actor 'user@code42.com'".format(ALERT_COMMAND), |
43 | | - "{} --actor-contains 'user@code42.com'".format(ALERT_COMMAND), |
| 43 | + "{} --exclude-rule-name 'File Upload Alert'".format(ALERT_SEARCH_COMMAND), |
| 44 | + "{} --exclude-actor-contains 'user@code42.com'".format(ALERT_SEARCH_COMMAND), |
| 45 | + "{} --exclude-actor 'user@code42.com'".format(ALERT_SEARCH_COMMAND), |
| 46 | + "{} --actor-contains 'user@code42.com'".format(ALERT_SEARCH_COMMAND), |
44 | 47 | ALERT_ADVANCED_QUERY_COMMAND, |
45 | 48 | ], |
46 | 49 | ) |
47 | | -def test_alert_command_returns_success_return_code(command): |
48 | | - return_code, response = run_command(command) |
| 50 | +def test_alert_command_returns_success_return_code(command, command_runner): |
| 51 | + return_code, response = command_runner(command) |
49 | 52 | assert return_code == 0 |
0 commit comments