Skip to content
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions Packs/SilentPush/Integrations/SilentPush/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -685,15 +685,15 @@ This command fetch indicators of potential future attacks using a feed UUID.

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| feed_uuid | Unique ID for the feed. | Required |
| source_uuids | Unique ID for the feed. | Required |
| page_no | The page number to fetch results from. | Optional |
| page_size | The number of indicators to fetch per page. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| SilentPush.FutureAttackIndicators.feed_uuid | String | Unique identifier for the feed. |
| SilentPush.FutureAttackIndicators.source_uuids | String | Unique identifier for the feed. |
| SilentPush.FutureAttackIndicators.page_no | Number | Current page number for pagination. |
| SilentPush.FutureAttackIndicators.page_size | Number | Number of items to be retrieved per page. |
| SilentPush.FutureAttackIndicators.indicators.total_ioc | Number | Total number of Indicators of Compromise \(IOCs\) associated with the indicator. |
Expand Down Expand Up @@ -783,13 +783,13 @@ This command fetch indicators of potential future attacks using a feed UUID.

### **Command Example**
```bash
!silentpush-get-future-attack-indicators feed_uuid="99da9b6a-146b-4a4d-9929-5fd5c6e2c257"
!silentpush-get-future-attack-indicators source_uuids="99da9b6a-146b-4a4d-9929-5fd5c6e2c257"
```

### **Context Example**
```json
{
"feed_uuid": "99da9b6a-146b-4a4d-9929-5fd5c6e2c257",
"source_uuids": "99da9b6a-146b-4a4d-9929-5fd5c6e2c257",
"future_attack_indicators": {
"total_source_score": 100,
"total_ioc": 100,
Expand Down
22 changes: 11 additions & 11 deletions Packs/SilentPush/Integrations/SilentPush/SilentPush.py
Original file line number Diff line number Diff line change
Expand Up @@ -234,7 +234,7 @@
InputArgument(name="region", description="Region to scan the URL in."),
]
FUTURE_ATTACK_INDICATOR_INPUTS = [
InputArgument(name="feed_uuid", description="Unique ID for the feed.", required=True),
InputArgument(name="source_uuids", description="Unique ID for the feed.", required=True),
InputArgument(name="page_no", description="The page number to fetch results from."),
InputArgument(name="page_size", description="The number of indicators to fetch per page."),
]
Expand Down Expand Up @@ -1263,7 +1263,7 @@
),
]
FUTURE_ATTACK_INDICATOR_OUTPUTS = [
OutputArgument(name="feed_uuid", output_type=str, description="Unique identifier for the feed."),
OutputArgument(name="source_uuids", output_type=str, description="Unique identifier for the feed."),
OutputArgument(name="page_no", output_type=int, description="Current page number for pagination."),
OutputArgument(name="page_size", output_type=int, description="Number of items to be retrieved per page."),
OutputArgument(
Expand Down Expand Up @@ -2227,19 +2227,19 @@ def live_url_scan(

return self._http_request(method="GET", url_suffix=url_suffix, params=params)

def get_future_attack_indicators(self, feed_uuid: str, page_no: int = 1, page_size: int = 10000) -> dict[str, Any]:
def get_future_attack_indicators(self, source_uuids: str, page_no: int = 1, page_size: int = 10000) -> dict[str, Any]:
"""
Retrieve indicators of future attack feed from SilentPush.

Args:
feed_uuid (str): Feed unique identifier to fetch records for.
source_uuids (str): Feed unique identifier to fetch records for.
page_no (int, optional): Page number for pagination. Defaults to 1.
page_size (int, optional): Number of records per page. Defaults to 10000.

Returns:
Dict[str, Any]: Response containing future attack indicators.
"""
params = {"feed_uuids": feed_uuid, "page": page_no, "size": page_size}
params = {"source_uuids": source_uuids, "page": page_no, "size": page_size}

query_string = urlencode(params)
url = self._base_url.replace("/api/v1/merge-api", "") + f"/api/v2/iocs/threat-ranking/?{query_string}"
Expand Down Expand Up @@ -3588,22 +3588,22 @@ def get_future_attack_indicators_command(client: Client, args: dict[str, Any]) -

Args:
client (Client): SilentPush API client instance.
args (dict): Command arguments, should include 'feed_uuid' and may include 'page_no', and 'page_size'.
args (dict): Command arguments, should include 'source_uuids' and may include 'page_no', and 'page_size'.

Returns:
CommandResults: Results for XSOAR containing future attack indicators or error message.

Raises:
ValueError: If required parameters are missing.
"""
feed_uuid = args.get("feed_uuid")
source_uuids = args.get("source_uuids")
page_no = int(args.get("page_no", 1))
page_size = int(args.get("page_size", 10000))

if not feed_uuid:
raise ValueError("feed_uuid is a required parameter")
if not source_uuids:
raise ValueError("source_uuids is a required parameter")

raw_response = client.get_future_attack_indicators(feed_uuid, page_no, page_size)
raw_response = client.get_future_attack_indicators(source_uuids, page_no, page_size)

# Handle list or dict gracefully
if isinstance(raw_response, list):
Expand All @@ -3614,7 +3614,7 @@ def get_future_attack_indicators_command(client: Client, args: dict[str, Any]) -
return CommandResults(
readable_output=tableToMarkdown("SilentPush Future Attack Indicators", indicators),
outputs_prefix="SilentPush.FutureAttackIndicators",
outputs_key_field="feed_uuid", # replace with appropriate key like "uuid" if needed
outputs_key_field="source_uuids", # replace with appropriate key like "uuid" if needed
outputs=indicators,
raw_response=raw_response,
)
Expand Down
8 changes: 4 additions & 4 deletions Packs/SilentPush/Integrations/SilentPush/SilentPush_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -395,7 +395,7 @@

def test_get_future_attack_indicators_command_success(mock_client, mocker):
# Mock arguments
args = {"feed_uuid": "test-feed-uuid", "page_no": "1", "page_size": "10"}
args = {"source_uuids": "test-source-uuids", "page_no": "1", "page_size": "10"}

# Mock response from client
mock_response = [
Expand All @@ -413,7 +413,7 @@
# Assertions
assert isinstance(result, CommandResults)
assert result.outputs_prefix == "SilentPush.FutureAttackIndicators"
assert result.outputs_key_field == "feed_uuid"
assert result.outputs_key_field == "source_uuids"
assert result.outputs == mock_response
assert result.readable_output == "Mocked Markdown Table"

Expand All @@ -423,13 +423,13 @@
args = {}

# Call the function and expect ValueError
with pytest.raises(ValueError, match="feed_uuid is a required parameter"):
with pytest.raises(ValueError, match="source_uuids is a required parameter"):
get_future_attack_indicators_command(mock_client, args)


def test_get_future_attack_indicators_command_no_data(mock_client, mocker):
# Mock arguments
args = {"feed_uuid": "test-feed-uuid", "page_no": "1", "page_size": "10"}
args = {"source_uuids": "test-source-uuids", "page_no": "1", "page_size": "10"}

# Mock response from client
mock_response = []
Expand All @@ -441,7 +441,7 @@
# Assertions
assert isinstance(result, CommandResults)
assert result.outputs_prefix == "SilentPush.FutureAttackIndicators"
assert result.outputs_key_field == "feed_uuid"

Check failure on line 444 in Packs/SilentPush/Integrations/SilentPush/SilentPush_test.py

View workflow job for this annotation

GitHub Actions / pre-commit / pre-commit

test_get_future_attack_indicators_command_no_data AssertionError: assert 'source_uuids' == 'feed_uuid' - feed_uuid + source_uuids
assert result.outputs == []
assert result.readable_output.strip() == "### SilentPush Future Attack Indicators\n**No entries.**"

Expand Down
Loading