ACTIIndicatorQuery_test.py

import requests_mock
from ACTIIndicatorQuery import IDEFENSE_URL_TEMPLATE, Client, domain_command, url_command, ip_command, uuid_command, _calculate_dbot_score, getThreatReport_command, fix_markdown, addBaseUrlToPartialPaths, convert_inline_image_to_encoded, fundamental_uuid_command                         # noqa: E501
from CommonServerPython import DemistoException, DBotScoreReliability
from test_data.response_constants import URL_RES_JSON, URL_INTEL_JSON, IP_RES_JSON, IP_INTEL_JSON, DOMAIN_RES_JSON, \
    DOMAIN_INTEL_JSON, UUID_RES_JSON, RES_JSON_IA, RES_JSON_IR, expected_output_ia, expected_output_ir, MALWARE_FAMILY_RES_JSON, \
    expected_output_malware_family, RAW_MALWARE_FAMILY_RES_JSON
import demistomock as demisto
import pytest

API_URL = "https://test.com"

DBOT_KEY = 'DBotScore(val.Indicator && val.Indicator == obj.Indicator && ' \
           'val.Vendor == obj.Vendor && val.Type == obj.Type)'

INTEGRATION_NAME = 'iDefense'

ENDPOINTS = {
    'threatindicator': '/rest/threatindicator',
    'document': '/rest/document',
    'fundamental': '/rest/fundamental'
}


@pytest.fixture(autouse=True)
def handle_calling_context(mocker):
    mocker.patch.object(demisto, 'callingContext', {'context': {'IntegrationBrand': INTEGRATION_NAME}})


def test_ip_command():
    """
    Given:
        - an IP

    When:
        - running ip command and validate whether the ip is malicious

    Then:
        - return command results containing indicator, dbotscore and associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/ip?key.values=0.0.0.0'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.values=0.0.0.0&type.values=intelligence_alert&type.values=intelligence_report&links.display_text.match_all=true'                     # noqa: E501
    fund_url = 'https://test.com/rest/fundamental/v0/malware_family?key.values=Hive'
    status_code = 200
    json_data = IP_RES_JSON
    intel_json_data = IP_INTEL_JSON
    malware_json_data = RAW_MALWARE_FAMILY_RES_JSON

    expected_output = {
        'IP': [{'Address': '0.0.0.0'}],
        'DBOTSCORE': [{'Indicator': '0.0.0.0', 'Type': 'ip', 'Vendor': 'iDefense', 'Score': 2,
                       'Reliability': 'B - Usually reliable'}]}

    ip_to_check = {'ip': '0.0.0.0'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=status_code, json=intel_json_data)
        m.get(fund_url, status_code=status_code, json=malware_json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = ip_command(client, ip_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)

        context_result = results[0].to_context()
        output = results[0].to_context().get('EntryContext', {})

        assert output.get('IP(val.Address && val.Address == obj.Address)', []) == expected_output.get('IP')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert _is_intelligence_data_present_in_command_result(context_result, intel_json_data) is True


def test_ip_command_when_api_key_not_authorised_for_document_search():
    """
    Given:
        - a ip and api key not authorized for doc search

    When:
        - running ip command and validate whether the ip is malicious

    Then:
        - return command results containing indicator, dbotscore and NO associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/ip?key.values=0.0.0.0'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.values=0.0.0.0&type.values=intelligence_alert&type.values=intelligence_report&links.display_text.match_all=true'                                                        # noqa: E501
    fund_url = 'https://test.com/rest/fundamental/v0/malware_family?key.values=Hive'
    status_code = 200
    error_status_code = 403
    json_data = IP_RES_JSON
    malware_family_data = RAW_MALWARE_FAMILY_RES_JSON
    doc_search_exception_response = {'timestamp': '2021-11-12T09:09:27.983Z', 'status': 403,
                                     'error': 'Forbidden', 'message': 'Forbidden', 'path': '/rest/document/v0'}

    expected_output = {
        'IP': [{'Address': '0.0.0.0'}],
        'DBOTSCORE': [{'Indicator': '0.0.0.0', 'Type': 'ip', 'Vendor': 'iDefense', 'Score': 2,
                       'Reliability': 'B - Usually reliable'}]}

    ip_to_check = {'ip': '0.0.0.0'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=error_status_code, json=doc_search_exception_response)
        m.get(fund_url, status_code=status_code, json=malware_family_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = ip_command(client, ip_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)

        context_result = results[0].to_context()
        content = context_result['HumanReadable']
        output = context_result.get('EntryContext', {})

        assert output.get('IP(val.Address && val.Address == obj.Address)', []) == expected_output.get('IP')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert 'Intelligence Alerts' not in content
        assert 'Intelligence Reports' not in content


def test_domain_command():
    """
    Given:
        - a domain

    When:
        - running domain command and validate whether the domain is malicious

    Then:
        - return command results containing indicator, dbotscore and associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/domain?key.values=mydomain.com'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.values=mydomain.com&type.values=intelligence_alert&type.values=intelligence_report&links.display_text.match_all=true'                                            # noqa: E501

    status_code = 200
    json_data = DOMAIN_RES_JSON
    intel_json_data = DOMAIN_INTEL_JSON
    expected_output = {
        'domain': [{'Name': 'mydomain.com'}],
        'DBOTSCORE': [{'Indicator': 'mydomain.com', 'Type': 'domain', 'Vendor': 'iDefense', 'Score': 2, 'Reliability': 'B - Usually reliable'}]                                                      # noqa: E501
    }

    domain_to_check = {'domain': 'mydomain.com'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=status_code, json=intel_json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = domain_command(client, domain_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)

        context_result = results[0].to_context()

        output = results[0].to_context().get('EntryContext', {})

        assert output.get('Domain(val.Name && val.Name == obj.Name)', []) == expected_output.get('domain')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert _is_intelligence_data_present_in_command_result(context_result, intel_json_data) is True


def test_domain_command_when_api_key_not_authorized_for_document_search():
    """
    Given:
        - a domain and api key not authorized for doc search

    When:
        - running domain command and validate whether the domain is malicious

    Then:
        - return command results containing indicator, dbotscore and NO associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/domain?key.values=mydomain.com'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.values=mydomain.com&type.values=intelligence_alert&type.values=intelligence_report&links.display_text.match_all=true'                                                                                # noqa: E501

    status_code = 200
    error_status_code = 403
    json_data = DOMAIN_RES_JSON
    doc_search_exception_response = {'timestamp': '2021-11-12T09:09:27.983Z', 'status': 403,
                                     'error': 'Forbidden', 'message': 'Forbidden', 'path': '/rest/document/v0'}

    expected_output = {
        'domain': [{'Name': 'mydomain.com'}],
        'DBOTSCORE': [{'Indicator': 'mydomain.com', 'Type': 'domain', 'Vendor': 'iDefense', 'Score': 2, 'Reliability': 'B - Usually reliable'}]                                                                                         # noqa: E501
    }

    domain_to_check = {'domain': 'mydomain.com'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=error_status_code, json=doc_search_exception_response)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = domain_command(client, domain_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)

        context_result = results[0].to_context()
        content = context_result['HumanReadable']
        output = context_result.get('EntryContext', {})

        assert output.get('Domain(val.Name && val.Name == obj.Name)', []) == expected_output.get('domain')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert 'Intelligence Alerts' not in content
        assert 'Intelligence Reports' not in content


def _is_intelligence_data_present_in_command_result(context_result, test_intel_json_data) -> bool:
    """
        Function to verify whether context result includes intelligence alert and report information

        Args:
            context_result from demisto command
            test_intel_json_data mock response data used for document search api

        Returns:
            True if intelligence alert and report are present else False
    """

    test_data = test_intel_json_data.get('results')
    alerts, reports = {}, {}

    for result in test_data:
        if result['type'] == 'intelligence_alert':
            alerts[result['title']] = IDEFENSE_URL_TEMPLATE.format(result['type'], result['uuid'])
        if result['type'] == 'intelligence_report':
            reports[result['title']] = IDEFENSE_URL_TEMPLATE.format(result['type'], result['uuid'])

    content = context_result['HumanReadable']

    for title, url in alerts.items():
        if url not in content[content.find(title):content.find('|', content.find(title))]:
            return False

    return all(url in content[content.find(title):content.find("|", content.find(title))] for title, url in reports.items())


def test_uuid_command():
    """
    Given:
        - a domain uuid

    When:
        - running uuid command and validate whether the domain is malicious

    Then:
        - return command results containing indicator, dbotscore and associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/461b5ba2-d4fe-4b5c-ac68-35b6636c6edf'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.values=mydomain.com&type.values=intelligence_alert&type.values=intelligence_report&links.display_text.match_all=true'                                                           # noqa: E501
    malware_family_url = 'https://test.com/rest/fundamental/v0/malware_family?key.values=Hive'
    status_code = 200
    json_data = UUID_RES_JSON
    intel_json_data = DOMAIN_INTEL_JSON
    malware_json_data = RAW_MALWARE_FAMILY_RES_JSON
    expected_output = {
        'domain': [{'Name': 'mydomain.com'}],
        'DBOTSCORE': [{'Indicator': 'mydomain.com', 'Type': 'domain', 'Vendor': 'iDefense', 'Score': 2, 'Reliability': 'B - Usually reliable'}]                                                                  # noqa: E501
    }

    uuid_to_check = {'uuid': '461b5ba2-d4fe-4b5c-ac68-35b6636c6edf'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=status_code, json=intel_json_data)
        m.get(malware_family_url, status_code=status_code, json=malware_json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = uuid_command(client, uuid_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)

        context_result = results.to_context()

        output = results.to_context().get('EntryContext', {})

        assert output.get('Domain(val.Name && val.Name == obj.Name)', []) == expected_output.get('domain')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert _is_intelligence_data_present_in_command_result(context_result, intel_json_data) is True


def test_uuid_command_when_api_key_not_authorized_for_document_search():
    """
    Given:
        - a domain uuid and api key not authorized for doc search

    When:
        - running uuid command and validate whether the domain is malicious

    Then:
        - return command results containing indicator, dbotscore and NO associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/461b5ba2-d4fe-4b5c-ac68-35b6636c6edf'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.values=mydomain.com&type.values=intelligence_alert&type.values=intelligence_report&links.display_text.match_all=true'                                                                                                  # noqa: E501
    malware_family_url = 'https://test.com/rest/fundamental/v0/malware_family?key.values=Hive'
    status_code = 200
    error_status_code = 403
    json_data = UUID_RES_JSON
    malware_json_data = RAW_MALWARE_FAMILY_RES_JSON
    doc_search_exception_response = {'timestamp': '2021-11-12T09:09:27.983Z', 'status': 403,
                                     'error': 'Forbidden', 'message': 'Forbidden', 'path': '/rest/document/v0'}

    expected_output = {
        'domain': [{'Name': 'mydomain.com'}],
        'DBOTSCORE': [{'Indicator': 'mydomain.com', 'Type': 'domain', 'Vendor': 'iDefense', 'Score': 2, 'Reliability': 'B - Usually reliable'}]                                                                                   # noqa: E501
    }

    uuid_to_check = {'uuid': '461b5ba2-d4fe-4b5c-ac68-35b6636c6edf'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=error_status_code, json=doc_search_exception_response)
        m.get(malware_family_url, status_code=status_code, json=malware_json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = uuid_command(client, uuid_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)

        context_result = results.to_context()
        content = context_result['HumanReadable']
        output = context_result.get('EntryContext', {})

        assert output.get('Domain(val.Name && val.Name == obj.Name)', []) == expected_output.get('domain')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert 'Intelligence Alerts' not in content
        assert 'Intelligence Reports' not in content


def test_ip_not_found():
    """
    Given:
        - an IP

    When:
        - running ip command and validate whether the ip is malicious

    Then:
        - return command results with context indicate that no results were found

    """

    url = 'https://test.com/rest/threatindicator/v0/ip?key.values=1.1.1.1'
    status_code = 200
    json_data = {'total_size': 0, 'page': 1, 'page_size': 25, 'more': False}
    expected_output = "No results were found for ip 1.1.1.1"

    ip_to_check = {'ip': '1.1.1.1'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = ip_command(client, ip_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)
        output = results[0].to_context().get('HumanReadable')
        assert expected_output in output


def test_url_not_found():
    """
    Given:
        - an URL

    When:
        - running url command and validate whether the url is malicious

    Then:
        - return command results with context indicate that no results were found

    """

    url = 'https://test.com/rest/threatindicator/v0/url?key.values=http://www.malware.com/path'
    status_code = 200
    json_data = {'total_size': 0, 'page': 1, 'page_size': 25, 'more': False}
    expected_output = "No results were found for url http://www.malware.com/path"

    url_to_check = {'url': 'http://www.malware.com/path'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = url_command(client, url_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)
        output = results[0].to_context().get('HumanReadable')
        assert expected_output in output


def test_domain_not_found():
    """
    Given:
        - an Domain

    When:
        - running domain command and validate whether the domain is malicious

    Then:
        - return command results with context indicate that no results were found

    """

    url = 'https://test.com/rest/threatindicator/v0/domain?key.values=mydomain.com'
    status_code = 200
    json_data = {'total_size': 0, 'page': 1, 'page_size': 25, 'more': False}
    expected_output = "No results were found for Domain mydomain.com"

    domain_to_check = {'domain': 'mydomain.com'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = domain_command(client, domain_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)
        output = results[0].to_context().get('HumanReadable')
        assert expected_output in output


def test_wrong_ip():
    """
    Given:
        - an IP

    When:
        - running ip command validate at first to check if the given ip is a valid ip

    Then:
        - raise error before calling http request that indicates that the given argument is not valid

    """

    ip_to_check = {'ip': '1'}
    client = Client(API_URL, 'api_token', True, False)
    doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
    fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
    try:
        ip_command(client, ip_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)
    except DemistoException as err:
        assert "Received wrong IP value" in str(err)


def test_wrong_connection():
    """
    Given:
        - an api token

    When:
        - checking api access

    Then:
        - raise error if there is no access because of wrong api token

    """

    from ACTIIndicatorQuery import test_module
    with requests_mock.Mocker() as m:
        mock_address = 'https://test.com/rest/threatindicator/v0/'
        m.get(mock_address, status_code=401, json={})
        client = Client('bad_api_key', 'wrong_token', True, False)
        try:
            test_module(client)
        except DemistoException as err:
            assert 'Error in API call - check the input parameters' in str(err)


def test_url_command():
    """
    Given:
        - url

    When:
        - running url command and validate whether the url is malicious

    Then:
        - return command results containing indicator, dbotscore and associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/url?key.values=http://www.malware.com/path'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.values=http://www.malware.com/path&type.values=intelligence_alert&type.values=intelligence_report&links.display_text.match_all=true'                                                             # noqa: E501
    status_code = 200
    json_data = URL_RES_JSON
    intel_json_data = URL_INTEL_JSON

    expected_output = {
        'URL': [{'Data': 'http://www.malware.com/path'}],
        'DBOTSCORE': [{'Indicator': 'http://www.malware.com/path', 'Type': 'url', 'Vendor': 'iDefense',
                       'Score': 2, 'Reliability': 'B - Usually reliable'}]}

    url_to_check = {'url': 'http://www.malware.com/path'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=status_code, json=intel_json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = url_command(client, url_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)

        context_result = results[0].to_context()

        output = results[0].to_context().get('EntryContext', {})
        assert output.get('URL(val.Data && val.Data == obj.Data)', []) == expected_output.get('URL')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert _is_intelligence_data_present_in_command_result(context_result, intel_json_data) is True


def test_url_command_when_api_key_not_authorized_for_document_search():
    """
    Given:
        - a url and api key not authorized for doc search

    When:
        - running url command and validate whether the url is malicious

    Then:
        - return command results containing indicator, dbotscore and NO associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/url?key.values=http://www.malware.com/path'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.values=http://www.malware.com/path&type.values=intelligence_alert&type.values=intelligence_report&links.display_text.match_all=true'                                                                                             # noqa: E501
    status_code = 200
    error_status_code = 403
    json_data = URL_RES_JSON
    doc_search_exception_response = {'timestamp': '2021-11-12T09:09:27.983Z', 'status': 403,
                                     'error': 'Forbidden', 'message': 'Forbidden', 'path': '/rest/document/v0'}

    expected_output = {
        'URL': [{'Data': 'http://www.malware.com/path'}],
        'DBOTSCORE': [{'Indicator': 'http://www.malware.com/path', 'Type': 'url', 'Vendor': 'iDefense',
                       'Score': 2, 'Reliability': 'B - Usually reliable'}]}

    url_to_check = {'url': 'http://www.malware.com/path'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=error_status_code, json=doc_search_exception_response)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        fundamental_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = url_command(client, url_to_check, DBotScoreReliability.B, doc_search_client, fundamental_client)

        context_result = results[0].to_context()
        content = context_result['HumanReadable']
        output = context_result.get('EntryContext', {})

        assert output.get('URL(val.Data && val.Data == obj.Data)', []) == expected_output.get('URL')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert 'Intelligence Alerts' not in content
        assert 'Intelligence Reports' not in content


def test_calculate_dbot_score():
    """
    Given:
        - number represents severity

    When:
        - api call with indicator returns response that includes them severity score

    Then:
        - returns dbotscore according to internal conversion

    """
    assert _calculate_dbot_score(0) == 0
    assert _calculate_dbot_score(1) == 1
    assert _calculate_dbot_score(2) == 1
    assert _calculate_dbot_score(3) == 2
    assert _calculate_dbot_score(4) == 2
    assert _calculate_dbot_score(5) == 3
    assert _calculate_dbot_score(6) == 3
    assert _calculate_dbot_score(7) == 3


def test_fix_markdown():
    text_to_update = "##Key Findings and Judgements\n\n* The sophisticated [cyber espionage operation](/#/node/intelligence"\
        "_alert/view/a655306d-bd95-426d-8c93-ebeef57406e4) was selective; it used supply-chain attack techniques,"\
        " mainly a malicious update of a widely used product from IT monitoring firm SolarWinds,"\
        " but its final target list appears to number only in the hundreds. Known targets include public-"\
        " and private-sector entities, mostly in the US, including IT vendors, US government entities, and think"\
        " tanks (#/node/intelligence_alert/view/a655306d-bd95-426d-8c93-ebeef57406e4)."
    expected_output = "## Key Findings and Judgements\n\n* The sophisticated [cyber espionage operation](/#/node/"\
        "intelligence_alert/view/a655306d-bd95-426d-8c93-ebeef57406e4) was selective; it used supply-chain attack "\
        "techniques, mainly a malicious update of a widely used product from IT monitoring firm SolarWinds, but its"\
        " final target list appears to number only in the hundreds. Known targets include public- and private-sector "\
        "entities, mostly in the US, including IT vendors, US government entities, and think tanks (#/node/"\
        "intelligence_alert/view/a655306d-bd95-426d-8c93-ebeef57406e4)."
    output = fix_markdown(text_to_update)
    assert expected_output == output


def _test_getThreatReport_ia_command():
    """
    Given:
        - an URL

    When:
        - running ThreatReport command and fetch IA/IR

    Then:
        - return command results containing UUID, dbotscore

    """
    url = 'https://test.com/rest/document/v0/a487dfdc-08b4-4909-82ea-2d934c27d901'
    status_code = 200
    json_res = RES_JSON_IA

    expected_output = expected_output_ia

    uuid_to_check = {'uuid': 'a487dfdc-08b4-4909-82ea-2d934c27d901'}

    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_res)
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = getThreatReport_command(doc_search_client, uuid_to_check, DBotScoreReliability.B)
        output = results.to_context().get('EntryContext', {})
        assert output.get('IAIR(val.value && val.value == obj.value)', []) == expected_output.get('IA')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBot')


def _test_getThreatReport_ir_command():
    """
    Given:
        - an URL

    When:
        - running ThreatReport command and fetch IA/IR

    Then:
        - return command results containing UUID, dbotscore

    """
    url = 'https://test.com/rest/document/v0/bdc9d16f-6040-4894-8544-9c98986a41fd'
    status_code = 200
    json_res = RES_JSON_IR

    expected_output = expected_output_ir

    uuid_to_check = {'uuid': 'bdc9d16f-6040-4894-8544-9c98986a41fd'}

    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_res)
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = getThreatReport_command(doc_search_client, uuid_to_check, DBotScoreReliability.B)
        output = results.to_context().get('EntryContext', {})
        assert output.get('IAIR(val.value && val.value == obj.value)', []) == expected_output.get('IR')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBot')


def test_getThreatReport_not_found():
    url = 'https://test.com/rest/document/v0/a487dfdc-08b4-49a09-82ea-2d934c27d901'
    status_code = 200
    json_res = None

    expected_output = 'No report was found for UUID: a487dfdc-08b4-49a09-82ea-2d934c27d901 !!'

    uuid_to_check = {'uuid': 'a487dfdc-08b4-49a09-82ea-2d934c27d901'}

    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_res)
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = getThreatReport_command(doc_search_client, uuid_to_check, DBotScoreReliability.B)
        output = results.to_context().get('HumanReadable')
        assert expected_output in output


def test_addBaseUrlToPartialPaths():
    IA_link_in_content = " BELUGASTURGEON activity, including a [2020 campaign against the Cypriot"\
        " government](#/node/intelligence_alert/view/6cc805d7-cb77-443d-afea-d052916fa602)"
    image_link_in_content = "as China has.\n\n ![Arctic Map](/rest/files/download/0f/6c"\
        "/6f/91de9ef8d8d38345dc270f8915d9faa496a00b5babe2bff231dd195cd0/ArcticMapUWNews28288859157_5f54b9c446_c.jpg)"
    IA_link_expected_output = " BELUGASTURGEON activity, including a [2020 campaign against the Cypriot"\
        " government](https://intelgraph.idefense.com/#/node/intelligence_alert/view/6cc805d7-cb77-443d-afea-d052916fa602)"
    image_link_expected_output = "as China has.\n\n ![Arctic Map](https://intelgraph.idefense.com/rest/files/download/0f/6c"\
        "/6f/91de9ef8d8d38345dc270f8915d9faa496a00b5babe2bff231dd195cd0/ArcticMapUWNews28288859157_5f54b9c446_c.jpg)"
    ialink_output = addBaseUrlToPartialPaths(IA_link_in_content)
    imagelink_output = addBaseUrlToPartialPaths(image_link_in_content)

    assert ialink_output == IA_link_expected_output
    assert imagelink_output == image_link_expected_output


def test_convert_inline_image_to_encoded():
    md_text = "China has.\n\n ![Arctic Map](https://test.com/rest/files/download/0f/6c/6f/"\
        "91de9ef8d8d38345dc270f8915d9faa496a00b5babe2bff231dd195cd0/ArcticMapUWNews28288859157_5f54b9c446_c.jpg)"
    url = "https://test.com/rest/files/download/0f/6c/6f/91de9ef8d8d38345dc270f8915d9faa496a00b5ba"\
        "be2bff231dd195cd0/ArcticMapUWNews28288859157_5f54b9c446_c.jpg"
    status_code = 200
    expected_res = "China has.\n\n ![Arctic Map](data:image/jpg;base64,eyJjb250ZW50IjogIkNoaW"\
        "5hIGhhcy5cblxuICFbQXJjdGljIE1hcF0oZGF0YTppbWFnZS9qcGc7YmFzZTY0LCkifQ==)"
    raw_res = {
        'content': 'China has.\n\n ![Arctic Map](data:image/jpg;base64,)'
    }
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=raw_res)
        res = convert_inline_image_to_encoded(md_text)
        assert res == expected_res


def test_fundamental_uuid_command():
    url = 'https://test.com/rest/fundamental/v0/c1b3216e-8b2e-4a9f-b0a9-2e184b7182f7'

    status_code = 200
    json_data = MALWARE_FAMILY_RES_JSON
    expected_output = expected_output_malware_family

    uuid_to_check = {'uuid': 'c1b3216e-8b2e-4a9f-b0a9-2e184b7182f7'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['fundamental'])
        results = fundamental_uuid_command(client, uuid_to_check, DBotScoreReliability.B)

        output = results.to_context().get('EntryContext', {})

        assert output.get('ACTI_MalwareFamily(val.value && val.value == obj.value)', []) == expected_output.get('malware_family')
        assert output.get(DBOT_KEY, []) == expected_output.get('dbot')