Migrate Connectors from Legacy `_monkeypatch` to Standardized Mocking

[PranavShukla7]

Description

While working with the connector tests, I noticed that a lot of them still depend on a _monkeypatch method defined inside the connector classes themselves to mock external services when MOCK_CONNECTIONS is enabled.

It does the job, but it feels a bit off having test-related logic sitting inside production code. Also, since this approach sometimes overrides global/module-level state, it can lead to subtle side effects, especially when the test suite grows or runs in parallel.

Another thing I noticed is that this pattern is different from what analyzers are already doing. They use a cleaner and more consistent approach with get_mocked_response(), which keeps things easier to follow.

On top of that, most of the mocked responses are currently hardcoded as Python dictionaries in the code, which makes them a bit harder to read, maintain, or reuse.

What feels problematic

• Test logic (_monkeypatch) living inside production connector classes
• Global state being modified during tests
• Different mocking styles between connectors and analyzers
• Mock data being hardcoded instead of reusable

Suggested direction

• Start phasing out _monkeypatch from connectors
• Align connectors with the same mocking pattern used by analyzers (e.g., get_mocked_response())
• Move mock responses into JSON files under the tests/ directory
• Refactor existing tests accordingly

Affected connectors (from what I saw)

• opencti.py
• yeti.py
• slack.py
• email_sender.py
• misp.py

Expected outcome

This should clean up the connector code by removing test-specific logic, make tests more predictable, and bring consistency across the project. It would also make it easier for someone new to understand how mocking is handled.

Additional context

Happy to help with this refactor if this direction makes sense. It seems like a good step toward improving overall test structure and maintainability.

[mlodic]

yep it makes sense

[gks281263]

Good catch @PranavShukla7, this direction makes sense.
One additional point: some connectors import mocking utilities directly from tests/ at module level (e.g. in yeti.py, misp.py, slack.py).
This introduces coupling between production and test code. If _monkeypatch is removed, it would be a good opportunity to eliminate these imports as well and keep mocking strictly in the test layer.
Also agree on doing this in phases — some connectors (like opencti.py) are more complex, so starting with simpler ones should keep reviews manageable.
Happy to help with some of the connectors if needed.

[PranavShukla7]

@mlodic ,I’ve been thinking through the refactor and wanted to quickly check if this approach makes sense before I start.

I’m planning to first introduce a common BaseConnectorTest, similar to what analyzers use, so we have a consistent place for something like get_mocked_response() and shared setup.

After that, I’ll migrate the connectors gradually...moving their mock data to JSON fixtures, updating the tests to use get_mocked_response(), and removing the _monkeypatch logic from the connector classes.

Once all connectors are updated, I’ll clean up the remaining _monkeypatch usage from the base plugin.
Let me know if this direction looks fine to you or if you’d prefer a different approach.

[PranavShukla7]

@gks281263 Yeah I had noticed those imports as well, so I’ll clean that up alongside removing _monkeypatch and keep all mocking strictly within the test layer.