new: [test] test_deleted_attributes

tests/testlive_comprehensive_local.py

@@ -338,6 +338,41 @@ class TestComprehensive(unittest.TestCase):
 
         check_response(self.admin_misp_connector.set_server_setting('MISP.enableEventBlocklisting', 0))
 
+    def test_deleted_attributes(self):
+        # Create test event
+        event = create_simple_event()
+        event.add_attribute('text', "deleted", deleted=True)
+        event.add_attribute('text', "not-deleted")
+        event = self.user_misp_connector.add_event(event, pythonify=True)
+        check_response(event)
+
+        # Not deleted
+        fetched_event = self.user_misp_connector.get_event(event)
+        check_response(fetched_event)
+        self.assertEqual(len(fetched_event.attributes), 2, fetched_event)
+
+        # Not deleted
+        fetched_event = self.user_misp_connector.get_event(event, deleted=0)
+        check_response(fetched_event)
+        self.assertEqual(len(fetched_event.attributes), 2, fetched_event)
+
+        # Include deleted
+        fetched_event = self.user_misp_connector.get_event(event, deleted=1)
+        check_response(fetched_event)
+        self.assertEqual(len(fetched_event.attributes), 3, fetched_event)
+
+        # Deleted only
+        fetched_event = self.user_misp_connector.get_event(event, deleted=2)
+        check_response(fetched_event)
+        self.assertEqual(len(fetched_event.attributes), 1, fetched_event)
+
+        # Both
+        fetched_event = self.user_misp_connector.get_event(event, deleted=[0, 1])
+        check_response(fetched_event)
+        self.assertEqual(len(fetched_event.attributes), 3, fetched_event)
+
+        check_response(self.user_misp_connector.delete_event(event))
+
 
 if __name__ == '__main__':
     unittest.main()