forked from jaegeral/PySight2MISP
-
Notifications
You must be signed in to change notification settings - Fork 0
/
test_pysight.py
150 lines (108 loc) · 6.21 KB
/
test_pysight.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
import unittest
import PySight_settings
from PySight import misp_process_isight_alert,data_search_report,test_isight_connection, misp_delete_events, \
isight_process_alert_content_element, get_misp_instance,data_search_indicators_since
class OnlineTestCases(unittest.TestCase):
def test_is_isight_working(self):
"""Is test api there aka connection test"""
self.assertTrue(test_isight_connection())
def test_get_isight_reports_last(self):
import time
since = int(time.time()) - 720 * 60 * 60
print (since)
return_value = data_search_indicators_since(private_key=PySight_settings.isight_priv_key,public_key=PySight_settings.isight_pub_key,since=since,url=PySight_settings.isight_url)
import json
print(json.dumps(return_value, sort_keys=True, indent=4))
self.assertIsNotNone(return_value)
def test_get_24hours_isight_report_and_push_misp(self):
import time
since = int(time.time()) - 720 * 60 * 60
print(since)
return_value = data_search_indicators_since(private_key=PySight_settings.isight_priv_key,
public_key=PySight_settings.isight_pub_key, since=since,
url=PySight_settings.isight_url)
import json
print(json.dumps(return_value, sort_keys=True, indent=4))
misp_process_isight_alert(return_value)
self.assertIsNotNone(return_value)
def test_is_misp_working(self):
localmisp = get_misp_instance()
self.assertIsNotNone(localmisp)
def test_get_specific_report2(self):
localmisp = get_misp_instance()
event = localmisp.get_event('2355')
for temp in event['Event']['Attribute']:
if temp['id'] == '34539':
attribute = temp
break
import json
print(json.dumps(event, sort_keys=True, indent=4))
print (event['Event']['Attribute'])
localmisp.add_tag(attribute, 'PAP:GREEN', attribute=True)
localmisp.add_tag(event, 'PAP:GREEN', attribute=False)
def test_get_specific_report(self):
localmisp = get_misp_instance()
result = data_search_report(url=PySight_settings.isight_url,private_key=PySight_settings.isight_priv_key,public_key=PySight_settings.isight_pub_key,a_reportid="16-00017916")
misp_process_isight_alert(result)
#result = data_search_indicators_last24_h(PySight_settings.isight_url, PySight_settings.isight_pub_key,
# PySight_settings.isight_priv_key)
class OfflineTestCases(unittest.TestCase):
def test_parse_example_indicator(self):
import json
json_data = json.load(open("test_data/example_indicator.json"))
PySight_settings.logger.debug(json.dumps(json_data['message'], sort_keys=True, indent=4))
#for i in json_data['message']:
returnvalue = isight_process_alert_content_element(json_data['message'])
#logger.debug("hols %s",json.dumps(i, sort_keys=True, indent=4))
#returnvalue = pySightReport(json_data['message'])
#logger.debug("Return valuer: %s",returnvalue)
#self.assertIsNot(returnvalue,None,"Message received and not none")
self.assertIsNot(returnvalue,False,"Message is false, something went wrong")
def test_parse_example_report(self):
import json
json_data = json.load(open("test_data/example_report.json"))
PySight_settings.logger.debug(json.dumps(json_data['message'], sort_keys=True, indent=4))
# for i in json_data['message']:
returnvalue = isight_process_alert_content_element(json_data['message'])
# logger.debug("hols %s",json.dumps(i, sort_keys=True, indent=4))
# returnvalue = pySightReport(json_data['message'])
# logger.debug("Return valuer: %s",returnvalue)
# self.assertIsNot(returnvalue,None,"Message received and not none")
self.assertIsNot(returnvalue, False, "Message is false, something went wrong")
def test_parse_example_report_from_struart(self):
import json
json_data = json.load(open("test_data/real/16-00014704.json"))
PySight_settings.logger.debug(json.dumps(json_data['report'], sort_keys=True, indent=4))
# for i in json_data['message']:
returnvalue = isight_process_alert_content_element(json_data['report'])
# logger.debug("hols %s",json.dumps(i, sort_keys=True, indent=4))
# returnvalue = pySightReport(json_data['message'])
# logger.debug("Return valuer: %s",returnvalue)
# self.assertIsNot(returnvalue,None,"Message received and not none")
self.assertIsNot(returnvalue, False, "Message is false, something went wrong")
def test_parse_example_indicator_c2(self):
import json
json_data = json.load(open("test_data/example_indicator_c2.json"))
#logger.debug(json.dumps(json_data['message'], sort_keys=True, indent=4))
# for i in json_data['message']:
returnvalue = isight_process_alert_content_element(json_data['message'])
# logger.debug("hols %s",json.dumps(i, sort_keys=True, indent=4))
# returnvalue = pySightReport(json_data['message'])
# logger.debug("Return valuer: %s",returnvalue)
# self.assertIsNot(returnvalue,None,"Message received and not none")
self.assertIsNot(returnvalue, False, "Message is false, something went wrong")
# Not a good test case
#def test_find_previous_events(self):
# self.assertIsNot(check_misp_all_result("16-00011458"),False)
# def test_is_error_catched_with_wrong_credentials(self):
# print("asd")
# def test_data_text_search_filter(self):
# self.assertIsNot(data_text_search_filter(isight_url, isight_pub_key, isight_priv_key), False)
def test_delete_misp_events(self):
localmisp = get_misp_instance()
self.assertFalse(misp_delete_events(1519,1519,localmisp))
self.assertTrue(misp_delete_events(1519,1519,localmisp))
#def test_search_ip(self):
# data_basic_search_ip(isight_url, isight_pub_key, isight_priv_key, '8.8.8.8')
# self.assertTrue(data_basic_search_ip(isight_url, isight_pub_key, isight_priv_key,'8.8.8.8'))
if __name__ == '__main__':