QUESTION

In a detection test, is it possible to mock the response of a helper function that is not directly called in my detection code?

ANSWER

No, it is not possible to mock the response of a helper function that is not called directly in your detection code. Only functions that are referenced in your rule or policy directly may be mocked in a test.