# --------------------------------------------------------------------------
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License. See License.txt in the project root for
# license information.
#
# Code generated by Microsoft (R) AutoRest Code Generator.
# Changes may cause incorrect behavior and will be lost if the code is
# regenerated.
# --------------------------------------------------------------------------

import os
from azure.cli.testsdk import ScenarioTest
from .. import try_manual, raise_if, calc_coverage
from azure.cli.testsdk import ResourceGroupPreparer
from azure_devtools.scenario_tests import AllowLargeResponse


TEST_DIR = os.path.abspath(os.path.join(os.path.abspath(__file__), '..'))


@try_manual
class SecurityInsightsScenarioTest(ScenarioTest):

    @AllowLargeResponse()
    def setUp(self):
        super(SecurityInsightsScenarioTest, self).setUp()
        self.cmd('extension add -n log-analytics-solution')

    def tearDown(self):
        self.cmd('extension remove -n log-analytics-solution')
        super(SecurityInsightsScenarioTest, self).tearDown()

    @ResourceGroupPreparer(name_prefix='clitestsentinel_myRg'[:7], key='rg', parameter_name='rg', location='westus')
    @AllowLargeResponse()
    def test_sentinel(self, rg):
        workspace = self.create_random_name('clitestws-', 16)
        self.kwargs.update({
            'subscription_id': self.get_subscription_id(),
            'workspace': workspace,
            'rg': rg
        })

        self.cmd('monitor log-analytics workspace create -g {rg} -n {workspace} -l westus')

        self.cmd('monitor log-analytics solution create '
                 '--resource-group "{rg}" '
                 '--solution-type SecurityInsights '
                 '--workspace {workspace} ')

        # EXAMPLE: /AlertRules/put/Creates or updates a Fusion alert rule.
        self.cmd('sentinel alert-rule create '
                 '--fusion-alert-rule etag="3d00c3ca-0000-0100-0000-5d42d5010000" alert-rule-template-name="f71aba3d-28fb-4'
                 '50b-b192-4e76a83015c8" enabled=true '
                 '--resource-group "{rg}" '
                 '--rule-id "myFirstFusionRule" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('enabled', True),
                     self.check('kind', 'Fusion'),
                     self.check('name', 'myFirstFusionRule')
                 ])

        # EXAMPLE: /AlertRules/put/Creates or updates a MicrosoftSecurityIncidentCreation rule.
        self.cmd('sentinel alert-rule create '
                 '--microsoft-security-incident-creation-alert-rule etag="260097e0-0000-0d00-0000-5d6fa88f0000" '
                 'product-filter="Microsoft Cloud App Security" display-name="testing displayname" enabled=true '
                 '--resource-group "{rg}" '
                 '--rule-id "microsoftSecurityIncidentCreationRuleExample" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('enabled', True),
                     self.check('kind', 'MicrosoftSecurityIncidentCreation'),
                     self.check('name', 'microsoftSecurityIncidentCreationRuleExample'),
                     self.check('productFilter', 'Microsoft Cloud App Security'),
                     self.check('displayName', 'testing displayname')
                 ])

        # EXAMPLE: /AlertRules/get/Get a Fusion alert rule.
        self.cmd('sentinel alert-rule show '
                 '--resource-group "{rg}" '
                 '--rule-id "myFirstFusionRule" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('enabled', True),
                     self.check('kind', 'Fusion'),
                     self.check('name', 'myFirstFusionRule')
                 ])

        # EXAMPLE: /AlertRules/get/Get a MicrosoftSecurityIncidentCreation rule.
        self.cmd('sentinel alert-rule show '
                 '--resource-group "{rg}" '
                 '--rule-id "microsoftSecurityIncidentCreationRuleExample" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('enabled', True),
                     self.check('kind', 'MicrosoftSecurityIncidentCreation'),
                     self.check('name', 'microsoftSecurityIncidentCreationRuleExample'),
                     self.check('productFilter', 'Microsoft Cloud App Security'),
                     self.check('displayName', 'testing displayname')
                 ])

        # EXAMPLE: /AlertRules/get/Get all alert rules.
        self.cmd('sentinel alert-rule list '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('length(@)', 2)
                 ])

        self.cmd('sentinel alert-rule delete -y '
                 '--resource-group "{rg}" '
                 '--rule-id "myFirstFusionRule" '
                 '--workspace-name {workspace}')

        # EXAMPLE: /AlertRuleTemplates/get/Get alert rule template by Id.
        self.cmd('sentinel alert-rule-template show '
                 '--alert-rule-template-id "65360bb0-8986-4ade-a89d-af3cf44d28aa" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('kind', 'Scheduled'),
                     self.check('name', '65360bb0-8986-4ade-a89d-af3cf44d28aa')
                 ])

        # EXAMPLE: /AlertRuleTemplates/get/Get all alert rule templates.
        self.cmd('sentinel alert-rule-template list '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}')

        # EXAMPLE: /Bookmarks/put/Creates or updates a bookmark.
        self.cmd('sentinel bookmark create '
                 '--etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" '
                 '--created "2019-01-01T13:15:30Z" '
                 '--display-name "My bookmark" '
                 '--labels "Tag1" '
                 '--labels "Tag2" '
                 '--notes "Found a suspicious activity" '
                 '-q "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)" '
                 '--query-result "Security Event query result" '
                 '--updated "2019-01-01T13:15:30Z" '
                 '--bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('name', '73e01a99-5cd7-4139-a149-9f2736ff2ab5'),
                     self.check('query', 'SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)')
                 ])

        # EXAMPLE: /Bookmarks/get/Get a bookmark.
        self.cmd('sentinel bookmark show '
                 '--bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('name', '73e01a99-5cd7-4139-a149-9f2736ff2ab5'),
                     self.check('query', 'SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)')
                 ])

        # EXAMPLE: /Bookmarks/get/Get all bookmarks.
        self.cmd('sentinel bookmark list '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('length(@)', 1),
                     self.check('[0].name', '73e01a99-5cd7-4139-a149-9f2736ff2ab5'),
                     self.check('[0].query', 'SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)')
                 ])

        # EXAMPLE: /Bookmarks/delete/Delete a bookmark.
        self.cmd('sentinel bookmark delete -y '
                 '--bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}')

        # EXAMPLE: /Incidents/put/Creates or updates an incident.
        self.cmd('sentinel incident create '
                 '--etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" '
                 '--description "This is a demo incident" '
                 '--classification "FalsePositive" '
                 '--classification-comment "Not a malicious activity" '
                 '--classification-reason "IncorrectAlertLogic" '
                 '--first-activity-time-utc "2019-01-01T13:00:30Z" '
                 '--last-activity-time-utc "2019-01-01T13:05:30Z" '
                 '--owner object-id="2046feea-040d-4a46-9e2b-91c2941bfa70" '
                 '--severity "High" '
                 '--status "Closed" '
                 '--title "title" '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('classification', 'FalsePositive'),
                     self.check('classificationReason', 'IncorrectAlertLogic'),
                     self.check('classificationComment', 'Not a malicious activity'),
                     self.check('severity', 'High'),
                     self.check('title', 'title'),
                     self.check('status', 'Closed')
                 ])

        # EXAMPLE: /Incidents/get/Get an incident.
        self.cmd('sentinel incident show '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('classification', 'FalsePositive'),
                     self.check('classificationReason', 'IncorrectAlertLogic'),
                     self.check('classificationComment', 'Not a malicious activity'),
                     self.check('severity', 'High'),
                     self.check('title', 'title'),
                     self.check('status', 'Closed')
                 ])

        # EXAMPLE: /IncidentComments/put/Creates an incident comment.
        self.cmd('sentinel incident-comment create '
                 '--message "Some message" '
                 '--incident-comment-id "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014" '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('message', 'Some message'),
                     self.check('name', '4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014')
                 ])

        # EXAMPLE: /IncidentComments/get/Get all incident comments.
        self.cmd('sentinel incident-comment list '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('length(@)', 1),
                     self.check('[0].message', 'Some message'),
                     self.check('[0].name', '4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014')
                 ])

        # EXAMPLE: /IncidentComments/get/Get an incident comment.
        self.cmd('sentinel incident-comment show '
                 '--incident-comment-id "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014" '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('message', 'Some message'),
                     self.check('name', '4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014')
                 ])

        # EXAMPLE: /Incidents/delete/Delete an incident.
        self.cmd('sentinel incident delete -y '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}')

        calc_coverage(__file__)
        raise_if()

# --------------------------------------------------------------------------
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License. See License.txt in the project root for
# license information.
#
# Code generated by Microsoft (R) AutoRest Code Generator.
# Changes may cause incorrect behavior and will be lost if the code is
# regenerated.
# --------------------------------------------------------------------------

import os
from azure.cli.testsdk import ScenarioTest
from .. import try_manual, raise_if, calc_coverage
from azure.cli.testsdk import ResourceGroupPreparer
from azure_devtools.scenario_tests import AllowLargeResponse


TEST_DIR = os.path.abspath(os.path.join(os.path.abspath(__file__), '..'))


@try_manual
class SecurityInsightsScenarioTest(ScenarioTest):

    @AllowLargeResponse()
    def setUp(self):
        super(SecurityInsightsScenarioTest, self).setUp()
        self.cmd('extension add -n log-analytics-solution')

    def tearDown(self):
        self.cmd('extension remove -n log-analytics-solution')
        super(SecurityInsightsScenarioTest, self).tearDown()

    @ResourceGroupPreparer(name_prefix='clitestsentinel_myRg'[:7], key='rg', parameter_name='rg', location='westus')
    @AllowLargeResponse()
    def test_sentinel(self, rg):
        workspace = self.create_random_name('clitestws-', 16)
        self.kwargs.update({
            'subscription_id': self.get_subscription_id(),
            'workspace': workspace,
            'rg': rg
        })

        self.cmd('monitor log-analytics workspace create -g {rg} -n {workspace} -l westus')

        self.cmd('monitor log-analytics solution create '
                 '--resource-group "{rg}" '
                 '--solution-type SecurityInsights '
                 '--workspace {workspace} ')

        # EXAMPLE: /AlertRules/put/Creates or updates a Fusion alert rule.
        self.cmd('sentinel alert-rule create '
                 '--fusion-alert-rule etag="3d00c3ca-0000-0100-0000-5d42d5010000" alert-rule-template-name="f71aba3d-28fb-4'
                 '50b-b192-4e76a83015c8" enabled=true '
                 '--resource-group "{rg}" '
                 '--rule-id "myFirstFusionRule" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('enabled', True),
                     self.check('kind', 'Fusion'),
                     self.check('name', 'myFirstFusionRule')
                 ])

        # EXAMPLE: /AlertRules/put/Creates or updates a MicrosoftSecurityIncidentCreation rule.
        self.cmd('sentinel alert-rule create '
                 '--microsoft-security-incident-creation-alert-rule etag="260097e0-0000-0d00-0000-5d6fa88f0000" '
                 'product-filter="Microsoft Cloud App Security" display-name="testing displayname" enabled=true '
                 '--resource-group "{rg}" '
                 '--rule-id "microsoftSecurityIncidentCreationRuleExample" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('enabled', True),
                     self.check('kind', 'MicrosoftSecurityIncidentCreation'),
                     self.check('name', 'microsoftSecurityIncidentCreationRuleExample'),
                     self.check('productFilter', 'Microsoft Cloud App Security'),
                     self.check('displayName', 'testing displayname')
                 ])

        # EXAMPLE: /AlertRules/get/Get a Fusion alert rule.
        self.cmd('sentinel alert-rule show '
                 '--resource-group "{rg}" '
                 '--rule-id "myFirstFusionRule" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('enabled', True),
                     self.check('kind', 'Fusion'),
                     self.check('name', 'myFirstFusionRule')
                 ])

        # EXAMPLE: /AlertRules/get/Get a MicrosoftSecurityIncidentCreation rule.
        self.cmd('sentinel alert-rule show '
                 '--resource-group "{rg}" '
                 '--rule-id "microsoftSecurityIncidentCreationRuleExample" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('enabled', True),
                     self.check('kind', 'MicrosoftSecurityIncidentCreation'),
                     self.check('name', 'microsoftSecurityIncidentCreationRuleExample'),
                     self.check('productFilter', 'Microsoft Cloud App Security'),
                     self.check('displayName', 'testing displayname')
                 ])

        # EXAMPLE: /AlertRules/get/Get all alert rules.
        self.cmd('sentinel alert-rule list '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('length(@)', 2)
                 ])

        self.cmd('sentinel alert-rule delete -y '
                 '--resource-group "{rg}" '
                 '--rule-id "myFirstFusionRule" '
                 '--workspace-name {workspace}')

        # EXAMPLE: /AlertRuleTemplates/get/Get alert rule template by Id.
        self.cmd('sentinel alert-rule-template show '
                 '--alert-rule-template-id "65360bb0-8986-4ade-a89d-af3cf44d28aa" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('kind', 'Scheduled'),
                     self.check('name', '65360bb0-8986-4ade-a89d-af3cf44d28aa')
                 ])

        # EXAMPLE: /AlertRuleTemplates/get/Get all alert rule templates.
        self.cmd('sentinel alert-rule-template list '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}')

        # EXAMPLE: /Bookmarks/put/Creates or updates a bookmark.
        self.cmd('sentinel bookmark create '
                 '--etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" '
                 '--created "2019-01-01T13:15:30Z" '
                 '--display-name "My bookmark" '
                 '--labels "Tag1" '
                 '--labels "Tag2" '
                 '--notes "Found a suspicious activity" '
                 '-q "SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)" '
                 '--query-result "Security Event query result" '
                 '--updated "2019-01-01T13:15:30Z" '
                 '--bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('name', '73e01a99-5cd7-4139-a149-9f2736ff2ab5'),
                     self.check('query', 'SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)')
                 ])

        # EXAMPLE: /Bookmarks/get/Get a bookmark.
        self.cmd('sentinel bookmark show '
                 '--bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('name', '73e01a99-5cd7-4139-a149-9f2736ff2ab5'),
                     self.check('query', 'SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)')
                 ])

        # EXAMPLE: /Bookmarks/get/Get all bookmarks.
        self.cmd('sentinel bookmark list '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('length(@)', 1),
                     self.check('[0].name', '73e01a99-5cd7-4139-a149-9f2736ff2ab5'),
                     self.check('[0].query', 'SecurityEvent | where TimeGenerated > ago(1d) and TimeGenerated < ago(2d)')
                 ])

        # EXAMPLE: /Bookmarks/delete/Delete a bookmark.
        self.cmd('sentinel bookmark delete -y '
                 '--bookmark-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}')

        # EXAMPLE: /Incidents/put/Creates or updates an incident.
        self.cmd('sentinel incident create '
                 '--etag "\\"0300bf09-0000-0000-0000-5c37296e0000\\"" '
                 '--description "This is a demo incident" '
                 '--classification "FalsePositive" '
                 '--classification-comment "Not a malicious activity" '
                 '--classification-reason "IncorrectAlertLogic" '
                 '--first-activity-time-utc "2019-01-01T13:00:30Z" '
                 '--last-activity-time-utc "2019-01-01T13:05:30Z" '
                 '--owner object-id="2046feea-040d-4a46-9e2b-91c2941bfa70" '
                 '--severity "High" '
                 '--status "Closed" '
                 '--title "title" '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('classification', 'FalsePositive'),
                     self.check('classificationReason', 'IncorrectAlertLogic'),
                     self.check('classificationComment', 'Not a malicious activity'),
                     self.check('severity', 'High'),
                     self.check('title', 'title'),
                     self.check('status', 'Closed')
                 ])

        # EXAMPLE: /Incidents/get/Get an incident.
        self.cmd('sentinel incident show '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('classification', 'FalsePositive'),
                     self.check('classificationReason', 'IncorrectAlertLogic'),
                     self.check('classificationComment', 'Not a malicious activity'),
                     self.check('severity', 'High'),
                     self.check('title', 'title'),
                     self.check('status', 'Closed')
                 ])

        # EXAMPLE: /IncidentComments/put/Creates an incident comment.
        self.cmd('sentinel incident-comment create '
                 '--message "Some message" '
                 '--incident-comment-id "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014" '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('message', 'Some message'),
                     self.check('name', '4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014')
                 ])

        # EXAMPLE: /IncidentComments/get/Get all incident comments.
        self.cmd('sentinel incident-comment list '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('length(@)', 1),
                     self.check('[0].message', 'Some message'),
                     self.check('[0].name', '4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014')
                 ])

        # EXAMPLE: /IncidentComments/get/Get an incident comment.
        self.cmd('sentinel incident-comment show '
                 '--incident-comment-id "4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014" '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}',
                 checks=[
                     self.check('message', 'Some message'),
                     self.check('name', '4bb36b7b-26ff-4d1c-9cbe-0d8ab3da0014')
                 ])

        # EXAMPLE: /Incidents/delete/Delete an incident.
        self.cmd('sentinel incident delete -y '
                 '--incident-id "73e01a99-5cd7-4139-a149-9f2736ff2ab5" '
                 '--resource-group "{rg}" '
                 '--workspace-name {workspace}')

        calc_coverage(__file__)
        raise_if()

# -------------------------------------------------------------------------- # Copyright (c) Microsoft Corporation. All rights reserved. # Licensed under the MIT License. See License.txt in the project root for # license information. # # Code generated by Microsoft (R) AutoRest Code Generator. # Changes may cause incorrect behavior and will be lost if the code is # regenerated. # -------------------------------------------------------------------------- # EXAMPLE: /AlertRules/put/Creates or updates a Fusion alert rule. # EXAMPLE: /AlertRules/put/Creates or updates a MicrosoftSecurityIncidentCreation rule. # EXAMPLE: /AlertRules/get/Get a Fusion alert rule. # EXAMPLE: /AlertRules/get/Get a MicrosoftSecurityIncidentCreation rule. # EXAMPLE: /AlertRules/get/Get all alert rules. # EXAMPLE: /AlertRuleTemplates/get/Get alert rule template by Id. # EXAMPLE: /AlertRuleTemplates/get/Get all alert rule templates. # EXAMPLE: /Bookmarks/put/Creates or updates a bookmark. # EXAMPLE: /Bookmarks/get/Get a bookmark. # EXAMPLE: /Bookmarks/get/Get all bookmarks. # EXAMPLE: /Bookmarks/delete/Delete a bookmark. # EXAMPLE: /Incidents/put/Creates or updates an incident. # EXAMPLE: /Incidents/get/Get an incident. # EXAMPLE: /IncidentComments/put/Creates an incident comment. # EXAMPLE: /IncidentComments/get/Get all incident comments. # EXAMPLE: /IncidentComments/get/Get an incident comment. # EXAMPLE: /Incidents/delete/Delete an incident.