mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Lots more changes to how we run. Now based off of the splunk/splunk container on docker hub as much as possible. We use ENV arguments to install required apps. Still only at 50% pass rate, so we need more troubleshooting to figure out why.
This commit is contained in:
pyth0n1c
+221
-129
@@ -11,16 +11,20 @@ import queue
|
||||
from modules.github_service import GithubService
|
||||
from modules import aws_service, testing_service
|
||||
import time
|
||||
|
||||
|
||||
import subprocess
|
||||
from datetime import datetime
|
||||
index_file_container_path = "/opt/splunk/etc/apps/search/"
|
||||
index_file_local_path = "indexes.conf.tar"
|
||||
|
||||
PASSWORD_LENGTH=20
|
||||
MAX_RECOMMENDED_CONTAINERS_BEFORE_WARNING=2
|
||||
DOCKER_HUB_CONTAINER_PATH="splunk/splunk:latest"
|
||||
BASE_CONTAINER_NAME="splunk"
|
||||
|
||||
DOCKER_COMMIT_NAME = "splunk_configured"
|
||||
RUNNER_BASE_NAME = "splunk_runner"
|
||||
|
||||
|
||||
#DOCKER_COMMIT_NAME = "splunk_configured"
|
||||
#RUNNER_BASE_NAME = "splunk_runner"
|
||||
|
||||
|
||||
BASE_CONTAINER_WEB_PORT=8000
|
||||
@@ -76,7 +80,7 @@ def stop_container(docker_client, container_name, force=True):
|
||||
|
||||
|
||||
def main(args):
|
||||
|
||||
start_time = datetime.now()
|
||||
parser = argparse.ArgumentParser(description="CI Detection Testing")
|
||||
parser.add_argument("-b", "--branch", type=str, required=True, help="security content branch")
|
||||
parser.add_argument("-u", "--uuid", type=str, required=True, help="uuid for detection test")
|
||||
@@ -101,8 +105,8 @@ def main(args):
|
||||
sys.exit(1)
|
||||
elif num_containers > MAX_RECOMMENDED_CONTAINERS_BEFORE_WARNING:
|
||||
print("You requested to run with [%d] containers which may use a very large amount of resources "
|
||||
"as they all run in parallel. The maximum suggested number of parallel. The maximum "
|
||||
"suggested number of containers is [%d]. We will do what you asked, but be warned!"%(num_containers, MAX_RECOMMENDED_CONTAINERS_BEFORE_WARNING))
|
||||
"as they all run in parallel. The maximum suggested number of parallel containers is "
|
||||
"[%d]. We will do what you asked, but be warned!"%(num_containers, MAX_RECOMMENDED_CONTAINERS_BEFORE_WARNING))
|
||||
|
||||
|
||||
if pr_number:
|
||||
@@ -114,7 +118,30 @@ def main(args):
|
||||
print("No new detections to test.")
|
||||
#aws_service.dynamo_db_nothing_to_test(REGION, uuid_test, str(int(time.time())))
|
||||
sys.exit(0)
|
||||
print("The files to test: %s", str(test_files))
|
||||
|
||||
#Go into the security content directory
|
||||
print("****GENERATE NEW CONTENT****")
|
||||
os.chdir("security_content")
|
||||
commands = ["python3 -m venv .venv", "source .venv/bin/activate", "python3 -m pip install -r requirements.txt", "python3 contentctl.py --path . --verbose generate --product ESCU --output dist/escu"]
|
||||
ret = subprocess.run("; ".join(commands), shell=True, capture_output=False)
|
||||
if ret.returncode != 0:
|
||||
print("Error generating new content. Exiting...")
|
||||
sys.exit(1)
|
||||
print("New content generated successfully")
|
||||
os.chdir("..")
|
||||
|
||||
client = docker.client.from_env()
|
||||
splunk_password = '123456qwertyQWERTY'
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#print("run it now!")
|
||||
|
||||
#time.sleep(180)
|
||||
#dt_ar = aws_service.get_ar_information_from_dynamo_db(REGION, DT_ATTACK_RANGE_STATE)
|
||||
#splunk_instance = aws_service.get_splunk_instance(REGION, dt_ar['ssh_key_name'])
|
||||
|
||||
@@ -129,170 +156,202 @@ def main(args):
|
||||
#splunk_password = secrets.token_urlsafe(PASSWORD_LENGTH)
|
||||
|
||||
#Only accessible on local host, it's okay to expose the password for debugging
|
||||
splunk_password = "123456qwerty!@#$%^QWERTY"
|
||||
#splunk_password = "123456qwerty!@#$%^QWERTY"
|
||||
#splunk_password = '123456qwerty%^QWERTY'
|
||||
splunk_container_manager_threads = []
|
||||
|
||||
|
||||
print("***Files to test: %d"%(len(test_files)))
|
||||
# print("***Files to test: %d"%(len(test_files)))
|
||||
test_file_queue = queue.Queue()
|
||||
for filename in test_files:
|
||||
test_file_queue.put(filename)
|
||||
print("***Test files enqueued")
|
||||
# print("***Test files enqueued")
|
||||
|
||||
print("Getting docker client")
|
||||
testing_service.test_detection_wrapper(None, None, splunk_password, None, test_file_queue.get(), 0%1, uuid_test)
|
||||
|
||||
# print("Getting docker client")
|
||||
client = docker.client.from_env()
|
||||
|
||||
# try:
|
||||
# print("Removing any existing containers called [%s]."%(BASE_CONTAINER_NAME))
|
||||
|
||||
try:
|
||||
print("Removing any existing containers called [%s]."%(BASE_CONTAINER_NAME))
|
||||
|
||||
c = client.containers.get(BASE_CONTAINER_NAME)
|
||||
except:
|
||||
print("Container [%s] did not exist. No need to remove it. It will; be created for you."%(BASE_CONTAINER_NAME))
|
||||
c = None
|
||||
# c = client.containers.get(BASE_CONTAINER_NAME)
|
||||
# except:
|
||||
# print("Container [%s] did not exist. No need to remove it. It will; be created for you."%(BASE_CONTAINER_NAME))
|
||||
# c = None
|
||||
|
||||
|
||||
if (c and reuse_containers):
|
||||
print("Found a container called [%s]. NOT removing it because you have specified --reuse_containers [%s]. "
|
||||
"However, we must stop the container. Stopping it now..."%(BASE_CONTAINER_NAME, reuse_containers))
|
||||
stop_container(client, BASE_CONTAINER_NAME)
|
||||
# if (c and reuse_containers):
|
||||
# print("Found a container called [%s]. NOT removing it because you have specified --reuse_containers [%s]. "
|
||||
# "However, we must stop the container. Stopping it now..."%(BASE_CONTAINER_NAME, reuse_containers))
|
||||
# stop_container(client, BASE_CONTAINER_NAME)
|
||||
|
||||
elif c:
|
||||
print("Found a container called [%s]. Removing it because you have specified --reuse_containers [%s]"%(BASE_CONTAINER_NAME, reuse_containers))
|
||||
remove_container(client, BASE_CONTAINER_NAME)
|
||||
# elif c:
|
||||
# print("Found a container called [%s]. Removing it because you have specified --reuse_containers [%s]"%(BASE_CONTAINER_NAME, reuse_containers))
|
||||
# remove_container(client, BASE_CONTAINER_NAME)
|
||||
|
||||
|
||||
|
||||
|
||||
download_image = False
|
||||
try:
|
||||
client.images.get(DOCKER_HUB_CONTAINER_PATH)
|
||||
if reuse_images:
|
||||
print("You already have an image named [%s]."%(DOCKER_HUB_CONTAINER_PATH))
|
||||
download_image = False
|
||||
else:
|
||||
print("You already have an image named [%s]., "
|
||||
"but have speicified --reuse_images %s"%(DOCKER_HUB_CONTAINER_PATH, reuse_images))
|
||||
download_image = True
|
||||
# download_image = False
|
||||
# try:
|
||||
# client.images.get(DOCKER_HUB_CONTAINER_PATH)
|
||||
# if reuse_images:
|
||||
# print("You already have an image named [%s]."%(DOCKER_HUB_CONTAINER_PATH))
|
||||
# download_image = False
|
||||
# else:
|
||||
# print("You already have an image named [%s]., "
|
||||
# "but have speicified --reuse_images %s"%(DOCKER_HUB_CONTAINER_PATH, reuse_images))
|
||||
# download_image = True
|
||||
|
||||
except:
|
||||
print("You did not have an image named [%s]."%(DOCKER_HUB_CONTAINER_PATH))
|
||||
download_image = True
|
||||
# except:
|
||||
# print("You did not have an image named [%s]."%(DOCKER_HUB_CONTAINER_PATH))
|
||||
# download_image = True
|
||||
|
||||
if download_image:
|
||||
try:
|
||||
print("Downloading image [%s]. Please note "
|
||||
"that this could take a long time depending on your "
|
||||
"connection. It's around 2GB."%(DOCKER_HUB_CONTAINER_PATH))
|
||||
client.images.pull(DOCKER_HUB_CONTAINER_PATH)
|
||||
print("Finished downloading the image [%s]"%(DOCKER_HUB_CONTAINER_PATH))
|
||||
except Exception as e:
|
||||
print("Unrecoverable error downloading image [%s]:[%s]"%(DOCKER_HUB_CONTAINER_PATH, str(e)))
|
||||
sys.exit(1)
|
||||
# if download_image:
|
||||
# try:
|
||||
# print("Downloading image [%s]. Please note "
|
||||
# "that this could take a long time depending on your "
|
||||
# "connection. It's around 2GB."%(DOCKER_HUB_CONTAINER_PATH))
|
||||
# client.images.pull(DOCKER_HUB_CONTAINER_PATH)
|
||||
# print("Finished downloading the image [%s]"%(DOCKER_HUB_CONTAINER_PATH))
|
||||
# except Exception as e:
|
||||
# print("Unrecoverable error downloading image [%s]:[%s]"%(DOCKER_HUB_CONTAINER_PATH, str(e)))
|
||||
# sys.exit(1)
|
||||
|
||||
|
||||
remove_tag = False
|
||||
try:
|
||||
image = client.images.get(DOCKER_COMMIT_NAME)
|
||||
print("Found an image called [%s]"%(DOCKER_COMMIT_NAME))
|
||||
if reuse_images == False:
|
||||
print("We will remove the image [%s] because you have specificed --reuse_images %s"%(DOCKER_COMMIT_NAME, reuse_images))
|
||||
remove_tag = True
|
||||
build_Tag = True
|
||||
else:
|
||||
print("We will use the preexisting image for [%s]"%(DOCKER_COMMIT_NAME))
|
||||
build_tag = False
|
||||
except:
|
||||
print("No image found named [%s]"%(DOCKER_COMMIT_NAME))
|
||||
build_tag = True
|
||||
# remove_tag = False
|
||||
# try:
|
||||
# image = client.images.get(DOCKER_COMMIT_NAME)
|
||||
# print("Found an image called [%s]"%(DOCKER_COMMIT_NAME))
|
||||
# if reuse_images == False:
|
||||
# print("We will remove the image [%s] because you have specificed --reuse_images %s"%(DOCKER_COMMIT_NAME, reuse_images))
|
||||
# remove_tag = True
|
||||
# build_Tag = True
|
||||
# else:
|
||||
# print("We will use the preexisting image for [%s]"%(DOCKER_COMMIT_NAME))
|
||||
# build_tag = False
|
||||
# except:
|
||||
# print("No image found named [%s]"%(DOCKER_COMMIT_NAME))
|
||||
# build_tag = True
|
||||
|
||||
|
||||
if remove_tag:
|
||||
try:
|
||||
#Stop it if it's running, remove associated volumes too
|
||||
client.images.remove(image=DOCKER_COMMIT_NAME, force=True)
|
||||
# if remove_tag:
|
||||
# try:
|
||||
# #Stop it if it's running, remove associated volumes too
|
||||
# client.images.remove(image=DOCKER_COMMIT_NAME, force=True)
|
||||
|
||||
except Exception as e:
|
||||
print("Unrecoverable error removing [%s]: [%s]"%(DOCKER_COMMIT_NAME, str(e)))
|
||||
sys.exit(1)
|
||||
# except Exception as e:
|
||||
# print("Unrecoverable error removing [%s]: [%s]"%(DOCKER_COMMIT_NAME, str(e)))
|
||||
# sys.exit(1)
|
||||
|
||||
|
||||
|
||||
|
||||
# for ind in range(num_containers):
|
||||
# ind = str(ind)
|
||||
# if not reuse_containers:
|
||||
# try:
|
||||
# print("Creating a new container called [%s]"%(BASE_CONTAINER_NAME+ind))
|
||||
|
||||
|
||||
if not reuse_containers:
|
||||
try:
|
||||
print("Creating a new container called [%s]"%(BASE_CONTAINER_NAME))
|
||||
# environment = {"SPLUNK_START_ARGS": "--accept-license",
|
||||
# "SPLUNK_PASSWORD" : splunk_password }
|
||||
# ports= {"8000/tcp": BASE_CONTAINER_WEB_PORT - 1 + int(ind) + 1,
|
||||
# "8089/tcp": BASE_CONTAINER_MANAGEMENT_PORT - 1 + int(ind) + 1
|
||||
# }
|
||||
# base_container = client.containers.create("splunk/splunk:latest", ports=ports, environment=environment, name=BASE_CONTAINER_NAME+ind, detach=True)
|
||||
# print("Running the new container called [%s]"%(BASE_CONTAINER_NAME+ind))
|
||||
# base_container.start()
|
||||
# print("Container is running [%s]"%(BASE_CONTAINER_NAME+ind))
|
||||
# print("Sleep for 60 seconds to allow the container to fully start up...")
|
||||
# wait_for_splunk_ready(max_seconds=60)
|
||||
# print("The container has fully started!")
|
||||
|
||||
# print("Do the ESCU installation on this container. That way we don't have to "
|
||||
# "do it on every container that we then spin up.")
|
||||
|
||||
# testing_service.prepare_detection_testing(BASE_CONTAINER_NAME+ind, splunk_password)
|
||||
# print("Waiting for a few seconds for the splunk app to come up.")
|
||||
# wait_for_splunk_ready(max_seconds=30)
|
||||
# print("Install the apps and enable accelerate")
|
||||
# wait_for_splunk_ready(max_seconds=180)
|
||||
# print("Stopping the running container [%s]"%(BASE_CONTAINER_NAME+ind))
|
||||
# base_container.stop()
|
||||
# #I am almost positive that I'm doing this wrong but it works for now...
|
||||
|
||||
# #print("Committing the configured container: [%s]--->[%s]"%(BASE_CONTAINER_NAME, DOCKER_COMMIT_NAME))
|
||||
# #base_container.commit(repository=DOCKER_COMMIT_NAME)
|
||||
|
||||
|
||||
environment = {"SPLUNK_START_ARGS": "--accept-license",
|
||||
"SPLUNK_PASSWORD" : splunk_password }
|
||||
ports= {"8000/tcp": BASE_CONTAINER_WEB_PORT - 1,
|
||||
"8089/tcp": BASE_CONTAINER_MANAGEMENT_PORT - 1
|
||||
}
|
||||
base_container = client.containers.create("splunk/splunk:latest", ports=ports, environment=environment, name=BASE_CONTAINER_NAME, detach=True)
|
||||
print("Running the new container called [%s]"%(BASE_CONTAINER_NAME))
|
||||
base_container.start()
|
||||
print("Container is running [%s]"%(BASE_CONTAINER_NAME))
|
||||
print("Sleep for 60 seconds to allow the container to fully start up...")
|
||||
wait_for_splunk_ready(max_seconds=60)
|
||||
print("The container has fully started!")
|
||||
|
||||
print("Do the ESCU installation on this container. That way we don't have to "
|
||||
"do it on every container that we then spin up.")
|
||||
|
||||
testing_service.prepare_detection_testing(BASE_CONTAINER_NAME, splunk_password)
|
||||
print("Waiting for a few seconds for the splunk app to come up.")
|
||||
wait_for_splunk_ready(max_seconds=30)
|
||||
|
||||
print("Stopping the running container [%s]"%(BASE_CONTAINER_NAME))
|
||||
base_container.stop()
|
||||
#I am almost positive that I'm doing this wrong but it works for now...
|
||||
|
||||
print("Committing the configured container: [%s]--->[%s]"%(BASE_CONTAINER_NAME, DOCKER_COMMIT_NAME))
|
||||
base_container.commit(repository=DOCKER_COMMIT_NAME)
|
||||
|
||||
|
||||
except Exception as e:
|
||||
print("There was an error getting the base container up and running. "
|
||||
"We cannot recover from this: [%s]\nGoodbye..."%(str(e)))
|
||||
sys.exit(1)
|
||||
# except Exception as e:
|
||||
# print("There was an error getting the base container up and running. "
|
||||
# "We cannot recover from this: [%s]\nGoodbye..."%(str(e)))
|
||||
# sys.exit(1)
|
||||
|
||||
|
||||
#The part below does not seem to be working as expected. Will need to look into it
|
||||
#When I create the new container, it fails to boot with
|
||||
# The CA file specified (/opt/splunk/etc/auth/cacert.pem) does not exist. Cannot continue.
|
||||
# SSL certificate generation failed.
|
||||
# # # #The part below does not seem to be working as expected. Will need to look into it
|
||||
# # # #When I create the new container, it fails to boot with
|
||||
# # # # The CA file specified (/opt/splunk/etc/auth/cacert.pem) does not exist. Cannot continue.
|
||||
# # # # SSL certificate generation failed.
|
||||
|
||||
|
||||
# MSG:
|
||||
# # # # MSG:
|
||||
|
||||
# non-zero return code
|
||||
# # # # non-zero return code
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
print("Make all the threads...")
|
||||
print("The number of detections we will test is [%d]"%(test_file_queue.qsize()))
|
||||
|
||||
results_queue = queue.Queue()
|
||||
success_names_queue = queue.Queue()
|
||||
failure_names_queue = queue.Queue()
|
||||
for container_index in range(num_containers):
|
||||
container_name = "%s_%d"%(RUNNER_BASE_NAME, container_index)
|
||||
container_name = "%s_%d"%(BASE_CONTAINER_NAME, container_index)
|
||||
|
||||
web_port = BASE_CONTAINER_WEB_PORT + container_index
|
||||
management_port = BASE_CONTAINER_MANAGEMENT_PORT + container_index
|
||||
print("Creating a new container called [%s]"%(container_name))
|
||||
|
||||
#docker run -p8089:8089 -p 8000:8000 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=123456qwertyQWERTY" -e "SPLUNK_APPS_URL=https://splunkbase.splunk.com/app/3435/release/3.3.4/download,https://splunkbase.splunk.com/app/5709/release/1.0.1/download,https://splunkbase.splunk.com/app/3449/release/3.29.0/download,https://splunkbase.splunk.com/app/1621/release/4.20.2/download" -e "SPLUNKBASE_USERNAME=ericmcginnistwo" -e "SPLUNKBASE_PASSWORD=splunkSecondAccount5@" -name splunktemplate splunk/splunk:latest
|
||||
environment = {"SPLUNK_START_ARGS": "--accept-license",
|
||||
"SPLUNK_PASSWORD" : splunk_password }
|
||||
"SPLUNK_PASSWORD" : splunk_password,
|
||||
"SPLUNK_APPS_URL" : "https://splunkbase.splunk.com/app/3435/release/3.3.4/download,https://splunkbase.splunk.com/app/5709/release/1.0.1/download,https://splunkbase.splunk.com/app/3449/release/3.29.0/download,https://splunkbase.splunk.com/app/1621/release/4.20.2/download",
|
||||
"SPLUNKBASE_USERNAME" : "emcginnistwo",
|
||||
"SPLUNKBASE_PASSWORD" : "splunkSecondAccount5@"
|
||||
}
|
||||
ports= {"8000/tcp": web_port,
|
||||
"8089/tcp": management_port
|
||||
}
|
||||
}
|
||||
|
||||
test_container = client.containers.create(DOCKER_COMMIT_NAME, ports=ports, environment=environment, name=container_name, detach=True, volumes_from=[BASE_CONTAINER_NAME])
|
||||
t = threading.Thread(target=splunk_container_manager, args=(test_file_queue, container_name, "127.0.0.1", splunk_password, management_port, uuid_test, results_queue))
|
||||
print("Creating CONTAINER: [%s]"%(container_name))
|
||||
base_container = client.containers.create(DOCKER_HUB_CONTAINER_PATH, ports=ports, environment=environment, name=container_name, detach=True)
|
||||
print("Created CONTAINER : [%s]"%(container_name))
|
||||
#print("Creating a new container called [%s]"%(container_name))
|
||||
#environment = {"SPLUNK_START_ARGS": "--accept-license",
|
||||
# "SPLUNK_PASSWORD" : splunk_password }
|
||||
#ports= {"8000/tcp": web_port,
|
||||
# "8089/tcp": management_port
|
||||
# }
|
||||
|
||||
#test_container = client.containers.create(DOCKER_COMMIT_NAME, ports=ports, environment=environment, name=container_name, detach=True, volumes_from=[BASE_CONTAINER_NAME])
|
||||
|
||||
t = threading.Thread(target=splunk_container_manager, args=(test_file_queue, container_name, "127.0.0.1", splunk_password, management_port, uuid_test, results_queue, success_names_queue, failure_names_queue))
|
||||
splunk_container_manager_threads.append(t)
|
||||
|
||||
#add the queue status thread - there can be some error in one of the test threads, so this
|
||||
#thread doesn't need to complete for the program to finish execution
|
||||
status_thread = threading.Thread(target=queue_status_thread, args=(test_file_queue.qsize(), test_file_queue, results_queue, success_names_queue, failure_names_queue), daemon=True)
|
||||
status_thread.start()
|
||||
print("Start all the threads...")
|
||||
for t in splunk_container_manager_threads:
|
||||
t.start()
|
||||
#we need to start containers slowly. Would be great it we could do all the setup and
|
||||
#app install once (with Dockerfile?)
|
||||
time.sleep(60)
|
||||
|
||||
#Try to join all the threads
|
||||
for t in splunk_container_manager_threads:
|
||||
@@ -305,38 +364,68 @@ def main(args):
|
||||
while True:
|
||||
|
||||
o = results_queue.get(block=False)
|
||||
print("Got from queue:")
|
||||
print(o)
|
||||
except queue.Empty:
|
||||
print("That's all the output!")
|
||||
|
||||
#now we are done!
|
||||
|
||||
stop_time = datetime.now()
|
||||
print("Total Execution Time: [%s]"%(stop_time-start_time))
|
||||
|
||||
|
||||
#detection testing service has already been prepared, no need to do it here!
|
||||
#testing_service.prepare_detection_testing(ssh_key_name, private_key, splunk_ip, splunk_password)
|
||||
|
||||
#testing_service.test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_files, uuid_test)
|
||||
|
||||
def queue_status_thread(total_tests_count, testing_queue, results_queue, success_names_queue, failure_names_queue):
|
||||
while True:
|
||||
print("***Progress Update:\n"\
|
||||
"\tTests to run : %d\n"\
|
||||
"\tTests currently running: %d\n"\
|
||||
"\tTests completed : %d\n"\
|
||||
"\t\tSuccess : %d\n"\
|
||||
"\t\tFailure : %d"%(testing_queue.qsize(), total_tests_count - testing_queue.qsize() - results_queue.qsize(), results_queue.qsize(), success_names_queue.qsize(), failure_names_queue.qsize()))
|
||||
if results_queue.qsize() == total_tests_count:
|
||||
return
|
||||
else:
|
||||
time.sleep(10)
|
||||
|
||||
def splunk_container_manager(testing_queue, container_name, splunk_ip, splunk_password, splunk_port, uuid_test, results_queue):
|
||||
def splunk_container_manager(testing_queue, container_name, splunk_ip, splunk_password, splunk_port, uuid_test, results_queue, success_names_queue, failure_names_queue):
|
||||
print("Starting the container [%s] after a sleep"%(container_name))
|
||||
#Is this going to be safe to use in different threads
|
||||
client = docker.client.from_env()
|
||||
|
||||
#start up the container from the base container
|
||||
#Assume that the base container has already been fully built with
|
||||
#escu etc
|
||||
#sleep for a little bit so that we don't all start at once...
|
||||
time.sleep(random.randrange(0,120))
|
||||
time.sleep(random.randrange(0,60))
|
||||
|
||||
container = client.containers.get(container_name)
|
||||
print("Starting the container [%s]"%(container_name))
|
||||
|
||||
#need to use the low level client to put a file onto a container
|
||||
apiclient = docker.APIClient()
|
||||
|
||||
container.start()
|
||||
wait_for_splunk_ready(max_seconds=60)
|
||||
successful_copy = False
|
||||
while not successful_copy:
|
||||
try:
|
||||
with open(index_file_local_path,"rb") as indexData:
|
||||
#splunk will restart a few times will installation of apps takes place so it will reload its indexes...
|
||||
time.sleep(10)
|
||||
apiclient.put_archive(container=container_name, path=index_file_container_path, data=indexData)
|
||||
successful_copy=True
|
||||
except Exception as e:
|
||||
print("Failed copy of index file to CONTAINER:[%s]...we will try again"%(container_name))
|
||||
successful_copy=False
|
||||
|
||||
|
||||
|
||||
wait_for_splunk_ready(max_seconds=120)
|
||||
|
||||
index=0
|
||||
print("Inspect your containers, you have 5 minutes!")
|
||||
wait_for_splunk_ready(max_seconds=60)
|
||||
try:
|
||||
while True:
|
||||
#Try to get something from the queue
|
||||
@@ -346,9 +435,12 @@ def splunk_container_manager(testing_queue, container_name, splunk_ip, splunk_pa
|
||||
#There is a detection to test
|
||||
print("Container [%s]--->[%s]"%(container_name, detection_to_test))
|
||||
try:
|
||||
pass
|
||||
#result = testing_service.test_detection_wrapper(container_name, splunk_ip, splunk_password, splunk_port, detection_to_test, index, uuid_test)
|
||||
#results_queue.put(result)
|
||||
result = testing_service.test_detection_wrapper(container_name, splunk_ip, splunk_password, splunk_port, detection_to_test, index%1, uuid_test)
|
||||
if result['detection_result']['error']:
|
||||
failure_names_queue.put(result['detection_result']['detection_name'])
|
||||
else:
|
||||
success_names_queue.put(result['detection_result']['detection_name'])
|
||||
results_queue.put(result)
|
||||
except Exception as e:
|
||||
print("Caught some exception in test detection: [%s]"%(str(e)))
|
||||
#just log the error itself for now so that we can continue
|
||||
@@ -360,7 +452,7 @@ def splunk_container_manager(testing_queue, container_name, splunk_ip, splunk_pa
|
||||
|
||||
print("Shutting down the container [%s]"%(container_name))
|
||||
container.stop()
|
||||
print("Finished shutting down the container [%s]"&(container_name))
|
||||
print("Finished shutting down the container [%s]"%(container_name))
|
||||
|
||||
if __name__ == "__main__":
|
||||
main(sys.argv[1:])
|
||||
Binary file not shown.
@@ -80,12 +80,15 @@ def test_detection_search(splunk_host, splunk_port, splunk_password, search, pas
|
||||
"dispatch.latest_time": "now"}
|
||||
|
||||
splunk_search = search + ' ' + pass_condition
|
||||
|
||||
print("SEARCH:")
|
||||
print(splunk_search)
|
||||
print("Sleep for 30 seconds")
|
||||
sleep(30)
|
||||
try:
|
||||
job = service.jobs.create(splunk_search, **kwargs)
|
||||
except Exception as e:
|
||||
print("Unable to execute detection: " + str(e))
|
||||
raise(Exception("NO EXECUTION EXCEPTION"))
|
||||
raise(Exception("***********NO EXECUTION EXCEPTION***********"))
|
||||
return 1, {}
|
||||
|
||||
test_results = dict()
|
||||
@@ -106,6 +109,8 @@ def test_detection_search(splunk_host, splunk_port, splunk_password, search, pas
|
||||
|
||||
|
||||
def delete_attack_data(splunk_host, splunk_password, splunk_port):
|
||||
#print("DO NOT DELETE ANYTHING!")
|
||||
#return None
|
||||
try:
|
||||
service = client.connect(
|
||||
host=splunk_host,
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
|
||||
import re
|
||||
import ansible_runner
|
||||
import yaml
|
||||
import uuid
|
||||
@@ -12,8 +12,10 @@ from modules import splunk_sdk
|
||||
|
||||
def prepare_detection_testing(splunk_ip, splunk_password):
|
||||
try:
|
||||
module = __import__('generate')
|
||||
results = module.main(REPO_PATH = 'security_content' , OUTPUT_PATH = 'security_content/dist/escu', PRODUCT = 'ESCU', VERBOSE = 'False' )
|
||||
pass
|
||||
#import security_content.bin.generate as module
|
||||
#module = __import__('security_content.bin.generate')
|
||||
#results = module.main(REPO_PATH = 'security_content' , OUTPUT_PATH = 'security_content/dist/escu', PRODUCT = 'ESCU', VERBOSE = 'False' )
|
||||
except Exception as e:
|
||||
print('Error: ' + str(e))
|
||||
|
||||
@@ -27,7 +29,7 @@ def test_detection_wrapper(container_name, splunk_ip, splunk_password, splunk_po
|
||||
|
||||
|
||||
# delete test data
|
||||
splunk_sdk.delete_attack_data(container_name, splunk_password, splunk_port)
|
||||
#splunk_sdk.delete_attack_data(splunk_ip, splunk_password, splunk_port)
|
||||
|
||||
|
||||
if result_test['detection_result']['error']:
|
||||
@@ -72,9 +74,9 @@ def test_detection(splunk_ip, splunk_port, container_name, splunk_password, test
|
||||
data_manipulation.manipulate_timestamp(folder_name + '/' + attack_data['file_name'], attack_data['sourcetype'], attack_data['source'])
|
||||
|
||||
replay_attack_dataset(container_name, splunk_password, folder_name, 'test' + str(test_index), attack_data['sourcetype'], attack_data['source'], attack_data['file_name'])
|
||||
|
||||
time.sleep(200)
|
||||
|
||||
print("START SLEEP AFTER REPLAY")
|
||||
time.sleep(30)
|
||||
print("DONE SLEEP AFTER REPLAY")
|
||||
result_test = {}
|
||||
test = test_file_obj['tests'][0]
|
||||
|
||||
@@ -117,6 +119,8 @@ def test_detection(splunk_ip, splunk_port, container_name, splunk_password, test
|
||||
|
||||
def load_file(file_path):
|
||||
try:
|
||||
print("Opening file path [%s]"%(file_path))
|
||||
sys.exit(0)
|
||||
with open(file_path, 'r', encoding="utf-8") as stream:
|
||||
try:
|
||||
file = list(yaml.safe_load_all(stream))[0]
|
||||
@@ -133,7 +137,7 @@ def update_ESCU_app(container_name, splunk_password):
|
||||
print("Update ESCU App. This can take some time")
|
||||
|
||||
ansible_vars = {}
|
||||
ansible_vars['ansible_user'] = 'ansible'
|
||||
ansible_vars['ansible_user'] = 'ansible_user'
|
||||
ansible_vars['splunk_password'] = splunk_password
|
||||
ansible_vars['security_content_path'] = 'security_content'
|
||||
|
||||
@@ -146,6 +150,121 @@ def update_ESCU_app(container_name, splunk_password):
|
||||
print("Successfully updated the ESCU App!")
|
||||
|
||||
|
||||
def configure_splunk_vm(container_name, splunk_password):
|
||||
ansible_vars = {}
|
||||
ansible_vars['splunk_password'] = splunk_password
|
||||
ansible_vars['ansible_user'] = 'ansible'
|
||||
|
||||
#BEGIN BLOCK VARS FROM ATTACK_RANGE_LOCAL.CONF
|
||||
splunk_url = "https://download.splunk.com/products/splunk/releases/8.0.2/linux/splunk-8.0.2-a7f645ddaf91-Linux-x86_64.tgz"
|
||||
# Specify the download URL of Splunk Enterprise
|
||||
|
||||
splunk_binary = "splunk-8.0.2-a7f645ddaf91-Linux-x86_64.tgz"
|
||||
# Specify the name of the Splunk Enterprise executable
|
||||
|
||||
s3_bucket_url = "https://attack-range-appbinaries.s3-us-west-2.amazonaws.com"
|
||||
# Specify the S3 bucket url from which you want to download the Splunk Apps
|
||||
|
||||
splunk_windows_ta = "splunk-add-on-for-microsoft-windows_800.tgz"
|
||||
# Specify the Splunk Windows TA
|
||||
|
||||
splunk_sysmon_ta = "splunk-add-on-for-microsoft-sysmon_1062.tgz"
|
||||
# Specify the Splunk Sysmon TA
|
||||
|
||||
splunk_cim_app = "splunk-common-information-model-cim_4180.tgz"
|
||||
# Specify the Splunk CIM App
|
||||
|
||||
splunk_escu_app = "DA-ESS-ContentUpdate-latest.tar.gz"
|
||||
# Specify the Splunk ESCU App
|
||||
|
||||
splunk_asx_app = "Splunk_ASX-latest.tar.gz"
|
||||
# Specify the Splunk ASX App
|
||||
|
||||
splunk_python_app = "python-for-scientific-computing-for-linux-64-bit_200.tgz"
|
||||
# Specify the Splunk python for scientific computing dependency that is needed by the MLTK app
|
||||
|
||||
splunk_mltk_app = "splunk-machine-learning-toolkit_510.tgz"
|
||||
# Specify the Splunk MLTK App
|
||||
|
||||
splunk_stream_app = "splunk-stream_720.tgz"
|
||||
# Specify the Splunk Stream App
|
||||
|
||||
splunk_security_essentials_app = "splunk-security-essentials_310.tgz"
|
||||
# Specify the Splunk SSE App
|
||||
|
||||
punchard_custom_visualization = "punchcard-custom-visualization_140.tgz"
|
||||
# Specify the Punchard Custom Visualization App
|
||||
|
||||
status_indicator_custom_visualization = "status-indicator-custom-visualization_140.tgz"
|
||||
# Specify the Status Indicator Custom Visualization App
|
||||
|
||||
splunk_attack_range_dashboard = "splunk_attack_range_reporting-1.0.5.tar.gz"
|
||||
# Specify the Attack Range Dashboard App
|
||||
|
||||
timeline_custom_visualization = "timeline-custom-visualization_140.tgz"
|
||||
# Specify the Timeline Custom Visualization App
|
||||
|
||||
splunk_aws_app = "splunk-add-on-for-amazon-web-services_500.tgz"
|
||||
# Specify the Splunk AWS App
|
||||
# Will be only installed when cloud_attack_range=1
|
||||
#END BLOCK VARS FROM ATTACK_RANGE_LOCAL.CONF
|
||||
|
||||
|
||||
|
||||
splunk_es_app = 'splunk-enterprise-security_640.spl'
|
||||
splunk_es_app_version = re.findall(r'\d+', splunk_es_app)[0]
|
||||
|
||||
#ansible_vars['ansible_python_interpreter'] = "/usr/bin/python3",
|
||||
ansible_vars['splunk_admin_password'] = splunk_password
|
||||
ansible_vars['splunk_url'] = splunk_url
|
||||
ansible_vars['splunk_binary'] = splunk_binary
|
||||
ansible_vars['s3_bucket_url'] = s3_bucket_url
|
||||
ansible_vars['splunk_escu_app'] = splunk_escu_app
|
||||
ansible_vars['splunk_asx_app'] = splunk_asx_app
|
||||
ansible_vars['splunk_windows_ta'] = splunk_windows_ta
|
||||
ansible_vars['splunk_cim_app'] = splunk_cim_app
|
||||
ansible_vars['splunk_sysmon_ta'] = splunk_sysmon_ta
|
||||
#ansible_vars['caldera_password'] = '{{ caldera_password }}'
|
||||
ansible_vars['splunk_mltk_app'] = splunk_mltk_app
|
||||
#ansible_vars['splunk_bots_dataset'] = '{{ splunk_bots_dataset }}'
|
||||
ansible_vars['splunk_stream_app'] = splunk_stream_app
|
||||
ansible_vars['splunk_python_app'] = splunk_python_app
|
||||
#ansible_vars['phantom_app'] = '{{ phantom_app }}'
|
||||
#ansible_vars['phantom_server'] = '{{ phantom_server }}'
|
||||
#ansible_vars['phantom_server_private_ip'] = '{{ phantom_server_private_ip }}'
|
||||
#ansible_vars['phantom_admin_password'] = '{{ phantom_admin_password }}'
|
||||
ansible_vars['splunk_security_essentials_app'] = splunk_security_essentials_app
|
||||
ansible_vars['punchard_custom_visualization'] = punchard_custom_visualization
|
||||
ansible_vars['status_indicator_custom_visualization'] = status_indicator_custom_visualization
|
||||
ansible_vars['splunk_attack_range_dashboard'] = splunk_attack_range_dashboard
|
||||
ansible_vars['timeline_custom_visualization'] = timeline_custom_visualization
|
||||
#ansible_vars['install_mission_control'] = install_mission_control
|
||||
#ansible_vars['mission_control_app'] = mission_control_app
|
||||
#ansible_vars['install_dsp'] = install_dsp
|
||||
#ansible_vars['dsp_client_cert_path'] = dsp_client_cert_path
|
||||
#ansible_vars['dsp_node'] = dsp_node
|
||||
ansible_vars['splunk_server_private_ip'] = "127.0.0.1"
|
||||
ansible_vars['cloud_attack_range'] = '0'
|
||||
|
||||
ansible_vars['install_es'] = '1'
|
||||
ansible_vars['install_mltk'] = '0'
|
||||
ansible_vars['install_mission_control'] = '0'
|
||||
ansible_vars['install_dsp'] = '0'
|
||||
|
||||
ansible_vars['splunk_es_app'] = splunk_es_app
|
||||
ansible_vars['splunk_es_app_version'] = splunk_es_app_version
|
||||
print(ansible_vars['splunk_es_app_version'])
|
||||
|
||||
|
||||
|
||||
|
||||
cmdline = "--connection docker -i %s, -u %s" % (container_name, ansible_vars['ansible_user'])
|
||||
runner = ansible_runner.run(private_data_dir=os.path.join(os.path.dirname(__file__), '../'),
|
||||
cmdline=cmdline,
|
||||
roles_path=os.path.join(os.path.dirname(__file__), '../ansible/roles'),
|
||||
playbook=os.path.join(os.path.dirname(__file__), '../ansible/splunk_server.yml'),
|
||||
extravars=ansible_vars)
|
||||
|
||||
def replay_attack_dataset(container_name, splunk_password, folder_name, index, sourcetype, source, out):
|
||||
ansible_vars = {}
|
||||
ansible_vars['folder_name'] = folder_name
|
||||
|
||||
Reference in New Issue
Block a user