kitos
c234fd64c2
Mirrors the existing Atomic/Caldera/Elastic/Sigma/LOLBAS import pattern — D3FEND mapping import was the one source silently skipping the review_required flag, so leads never got prompted to review techniques that only gained new D3FEND coverage.
43 lines
1.5 KiB
Python
43 lines
1.5 KiB
Python
"""Tests for D3FEND mapping import — review_required trigger parity.
|
|
|
|
Every other import source (Atomic Red Team, Caldera, Elastic, Sigma, LOLBAS)
|
|
flags a technique with review_required=True when it gains new content, so a
|
|
lead knows to look at it. D3FEND mapping import was missing this — this test
|
|
locks in the fix.
|
|
"""
|
|
|
|
from app.models.defensive_technique import DefensiveTechnique
|
|
from app.models.technique import Technique
|
|
from app.services.d3fend_import_service import import_d3fend_mappings
|
|
|
|
|
|
def test_import_d3fend_mappings_sets_review_required(db):
|
|
technique = Technique(mitre_id="T1590", name="Gather Victim Network Information", review_required=False)
|
|
db.add(technique)
|
|
db.add(DefensiveTechnique(d3fend_id="D3-NTA", name="Network Traffic Analysis"))
|
|
db.commit()
|
|
|
|
result = import_d3fend_mappings(db)
|
|
|
|
assert result["created"] >= 1
|
|
db.refresh(technique)
|
|
assert technique.review_required is True
|
|
|
|
|
|
def test_import_d3fend_mappings_skips_existing_without_reflagging(db):
|
|
technique = Technique(mitre_id="T1590", name="Gather Victim Network Information", review_required=False)
|
|
db.add(technique)
|
|
db.add(DefensiveTechnique(d3fend_id="D3-NTA", name="Network Traffic Analysis"))
|
|
db.commit()
|
|
|
|
import_d3fend_mappings(db)
|
|
db.refresh(technique)
|
|
technique.review_required = False
|
|
db.commit()
|
|
|
|
result = import_d3fend_mappings(db)
|
|
|
|
assert result["created"] == 0
|
|
db.refresh(technique)
|
|
assert technique.review_required is False
|