Fixes to tests and policies and 0.9.1 version and dependencies bump (#…

…221)

* Fixes to tests and IOAs and 0.9.1 version and dependencies bump

* Linter fix

* Fix failing CustomIOA unit test (#223)

---------

Co-authored-by: Atte Niemi <4998544+hur@users.noreply.github.com>

.github/workflows/code-quality.yml

@@ -32,7 +32,11 @@ jobs:
     - name: Install dependencies
       run: poetry install
 
+    - name: Run unit tests
+      run: poetry run py.test tests/unit_tests
+
     - name: Lint package source with flake8
+      if: success() || failure()
       run: |
         poetry run flake8 caracara/ --show-source --statistics
         poetry run flake8 examples/ --show-source --statistics

caracara/common/policy_wrapper.py

@@ -363,7 +363,7 @@ def _load_data_dict(self, data_dict: Dict = None):
             self.groups.append(GroupAssignment(data_dict=group_dict))
 
         # Load all groups of settings
-        settings_groups: List[Dict] = data_dict.get(self.settings_key_name)
+        settings_groups: List[Dict] = data_dict.get(self.settings_key_name, [])
         for settings_group_dict in settings_groups:
             self.settings_groups.append(PolicySettingGroup(data_dict=settings_group_dict))
 
@@ -409,7 +409,7 @@ def flat_dump(self) -> Dict:
             "description": self.description,
             "name": self.name,
             "platform_name": self.platform_name,
-            "settings": settings,
+            self.settings_key_name: settings,
         }
         if self.policy_id:
             data["id"] = self.policy_id

caracara/modules/custom_ioa/custom_ioa.py

@@ -204,7 +204,6 @@ def _update_create_delete_rules(self, group: IoaRuleGroup, comment: str) -> IoaR
                 raw_rule,
                 rule_type=self._get_rule_types_cached()[raw_rule["ruletype_id"]],
             )
-            new_rule.rulegroup_id = group.id_
             new_rules.append(new_rule)
             new_group.version += 1
 

caracara/modules/custom_ioa/rules.py

@@ -122,7 +122,6 @@ def from_data_dict(data_dict: dict, rule_type_map: Dict[str, RuleType]) -> IoaRu
             # The following line might raise an index error if there's a rule type on this rule that
             # we don't know about. I don't catch this since I don't think it's likely to happen.
             rule_type = rule_type_map[raw_rule["ruletype_id"]]
-            raw_rule["rulegroup_id"] = rule_group.id_  # API doesn't populate this field, so we do
             rule = CustomIoaRule.from_data_dict(data_dict=raw_rule, rule_type=rule_type)
             rule_group.rules.append(rule)
 
@@ -330,6 +329,7 @@ class CustomIoaRule:
     modified_on: datetime
     version_ids: List[str]
     pattern_id: str
+    rulegroup_id: str
 
     def __init__(
         self,
@@ -385,6 +385,7 @@ def __init__(
         self.modified_on = None
         self.version_ids = None
         self.pattern_id = None
+        self.rulegroup_id = None
 
     def __repr__(self):
         """Return an unambiguous string representation of the CustomIoaRule and its properties.
@@ -441,6 +442,7 @@ def from_data_dict(data_dict: dict, rule_type: RuleType) -> CustomIoaRule:
         rule.version_ids = data_dict["version_ids"]
         rule.pattern_id = data_dict["pattern_id"]
         rule.comment = data_dict["comment"]
+        rule.rulegroup_id = data_dict["rulegroup_id"]
 
         rule.fields = {}
         for field_value in data_dict["field_values"]:
@@ -622,6 +624,7 @@ def dump(self) -> dict:
             "action_label": self.action_label,
             "ruletype_id": self.rule_type.id_,
             "ruletype_name": self.rule_type.name,
+            "rulegroup_id": self.rulegroup_id,
             "field_values": list(self.fields.values()),
             "enabled": self.enabled,
             "deleted": self.deleted,

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "caracara"
-version = "0.9.0"
+version = "0.9.1"
 description = "The CrowdStrike Falcon Developer Toolkit"
 authors = [ "CrowdStrike <falconpy@crowdstrike.com>" ]
 readme = "README.md"

tests/unit_tests/test_custom_ioas.py

@@ -103,6 +103,7 @@ def mock_create_rule(body, comment=None):
             "pattern_severity": body["pattern_severity"],
             "disposition_id": body["disposition_id"],
             "action_label": rule_type.disposition_map[body["disposition_id"]],
+            "rulegroup_id": "test_group_01",
             "ruletype_id": body["ruletype_id"],
             "ruletype_name": rule_type.name,
             "field_values": body["field_values"],
@@ -332,6 +333,7 @@ def test_describe_rule_groups_with_rules(
                     "action_label": list(simple_rule_type.disposition_map.values())[0],
                     "ruletype_id": simple_rule_type.id_,
                     "ruletype_name": simple_rule_type.name,
+                    "rulegroup_id": "test_group_01",
                     "field_values": [],
                     "enabled": True,
                     "deleted": False,
@@ -373,7 +375,6 @@ def mock_query_rule_groups_full(offset, limit, filter):
 
     # Call caracara
     groups = client.custom_ioas.describe_rule_groups(filters="test_filter")
-
     assert len(mock_groups) == len(groups)
     for mock_group in mock_groups:
         assert mock_group["id"] in groups.keys()
@@ -508,6 +509,7 @@ def test_update_rule_groups_with_rule_changes(
                 "action_label": list(simple_rule_type.disposition_map.values())[0],
                 "ruletype_id": simple_rule_type.id_,
                 "ruletype_name": simple_rule_type.name,
+                "rulegroup_id": "test_group_01",
                 "field_values": [],
                 "enabled": True,
                 "deleted": False,
@@ -532,6 +534,7 @@ def test_update_rule_groups_with_rule_changes(
                 "action_label": list(simple_rule_type.disposition_map.values())[0],
                 "ruletype_id": simple_rule_type.id_,
                 "ruletype_name": simple_rule_type.name,
+                "rulegroup_id": "test_group_01",
                 "field_values": [],
                 "enabled": True,
                 "deleted": False,
@@ -617,6 +620,7 @@ def mock_create_rule(body):
             "action_label": list(simple_rule_type.disposition_map.values())[0],
             "ruletype_id": body["ruletype_id"],
             "ruletype_name": simple_rule_type.name,
+            "rulegroup_id": "test_group_01",
             "field_values": body["field_values"],
             "enabled": False,
             "deleted": False,
@@ -735,6 +739,7 @@ def test_update_rule_group_with_new_rules(
                 "action_label": list(simple_rule_type.disposition_map.values())[0],
                 "ruletype_id": simple_rule_type.id_,
                 "ruletype_name": simple_rule_type.name,
+                "rulegroup_id": "test_group_01",
                 "field_values": [],
                 "enabled": True,
                 "deleted": False,
@@ -759,6 +764,7 @@ def test_update_rule_group_with_new_rules(
                 "action_label": list(simple_rule_type.disposition_map.values())[0],
                 "ruletype_id": simple_rule_type.id_,
                 "ruletype_name": simple_rule_type.name,
+                "rulegroup_id": "test_group_01",
                 "field_values": [],
                 "enabled": True,
                 "deleted": False,
@@ -808,6 +814,7 @@ def mock_create_rule(body):
             "action_label": list(simple_rule_type.disposition_map.values())[0],
             "ruletype_id": body["ruletype_id"],
             "ruletype_name": simple_rule_type.name,
+            "rulegroup_id": "test_group_01",
             "field_values": body["field_values"],
             "enabled": False,
             "deleted": False,