124 lines
3.4 KiB
Python
124 lines
3.4 KiB
Python
"""Tests for the ThreatActorEntity domain entity."""
|
|
|
|
import uuid
|
|
from types import SimpleNamespace
|
|
|
|
from app.domain.entities.threat_actor import (
|
|
ThreatActorEntity,
|
|
ThreatActorTechniqueRef,
|
|
)
|
|
|
|
|
|
def _make_ref(status: str = "not_evaluated") -> ThreatActorTechniqueRef:
|
|
return ThreatActorTechniqueRef(
|
|
technique_id=uuid.uuid4(),
|
|
mitre_id="T1059",
|
|
name="Command and Scripting Interpreter",
|
|
status=status,
|
|
)
|
|
|
|
|
|
def test_coverage_pct_all_covered():
|
|
actor = ThreatActorEntity(
|
|
name="APT29",
|
|
techniques=[_make_ref("validated"), _make_ref("partial")],
|
|
)
|
|
assert actor.coverage_pct == 100.0
|
|
|
|
|
|
def test_coverage_pct_partial():
|
|
actor = ThreatActorEntity(
|
|
name="APT28",
|
|
techniques=[_make_ref("validated"), _make_ref("not_evaluated")],
|
|
)
|
|
assert actor.coverage_pct == 50.0
|
|
|
|
|
|
def test_coverage_pct_none_covered():
|
|
actor = ThreatActorEntity(
|
|
name="Lazarus",
|
|
techniques=[_make_ref("not_evaluated"), _make_ref("in_progress")],
|
|
)
|
|
assert actor.coverage_pct == 0.0
|
|
|
|
|
|
def test_coverage_pct_no_techniques():
|
|
actor = ThreatActorEntity(name="Unknown")
|
|
assert actor.coverage_pct == 0.0
|
|
|
|
|
|
def test_covered_and_uncovered_techniques():
|
|
t1 = _make_ref("validated")
|
|
t2 = _make_ref("not_evaluated")
|
|
t3 = _make_ref("partial")
|
|
actor = ThreatActorEntity(name="Test", techniques=[t1, t2, t3])
|
|
assert len(actor.covered_techniques) == 2
|
|
assert len(actor.uncovered_techniques) == 1
|
|
|
|
|
|
def test_technique_count():
|
|
actor = ThreatActorEntity(
|
|
name="Test",
|
|
techniques=[_make_ref(), _make_ref(), _make_ref()],
|
|
)
|
|
assert actor.technique_count == 3
|
|
|
|
|
|
def test_from_orm_basic():
|
|
orm = SimpleNamespace(
|
|
id=uuid.uuid4(),
|
|
name="APT29",
|
|
mitre_id="G0016",
|
|
aliases=["Cozy Bear", "The Dukes"],
|
|
description="Russian APT group",
|
|
country="Russia",
|
|
target_sectors=["government"],
|
|
target_regions=["north-america"],
|
|
motivation="espionage",
|
|
sophistication="advanced",
|
|
first_seen="2008",
|
|
last_seen="2023",
|
|
is_active=True,
|
|
techniques=[],
|
|
)
|
|
entity = ThreatActorEntity.from_orm(orm)
|
|
assert entity.name == "APT29"
|
|
assert entity.mitre_id == "G0016"
|
|
assert entity.country == "Russia"
|
|
assert entity.aliases == ["Cozy Bear", "The Dukes"]
|
|
assert entity.technique_count == 0
|
|
|
|
|
|
def test_from_orm_with_techniques():
|
|
tech_orm = SimpleNamespace(
|
|
mitre_id="T1059",
|
|
name="Command and Scripting Interpreter",
|
|
status_global=SimpleNamespace(value="validated"),
|
|
)
|
|
tat_orm = SimpleNamespace(
|
|
technique_id=uuid.uuid4(),
|
|
technique=tech_orm,
|
|
usage_description="Uses PowerShell",
|
|
)
|
|
orm = SimpleNamespace(
|
|
id=uuid.uuid4(),
|
|
name="APT28",
|
|
mitre_id="G0007",
|
|
aliases=None,
|
|
description=None,
|
|
country=None,
|
|
target_sectors=None,
|
|
target_regions=None,
|
|
motivation=None,
|
|
sophistication=None,
|
|
first_seen=None,
|
|
last_seen=None,
|
|
is_active=None,
|
|
techniques=[tat_orm],
|
|
)
|
|
entity = ThreatActorEntity.from_orm(orm)
|
|
assert entity.technique_count == 1
|
|
assert entity.techniques[0].mitre_id == "T1059"
|
|
assert entity.techniques[0].status == "validated"
|
|
assert entity.is_active is True # defaults when None
|