From 63f857481e8ee967cad0f2faf0f43b5b55659909 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 6 Jul 2021 13:18:10 +0200 Subject: [PATCH 1/3] bug fix detection testing --- .../detection_testing_execution.py | 27 +++++++++---------- .../modules/aws_service.py | 14 +++++++++- .../ci/python_ci_code/main.py | 4 +++ 3 files changed, 30 insertions(+), 15 deletions(-) diff --git a/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py b/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py index d9c5b5d7b5..9f21d3418b 100644 --- a/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py +++ b/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py @@ -2,6 +2,7 @@ import sys import argparse import shutil import os +import time from modules.github_service import GithubService from modules import aws_service, testing_service @@ -25,23 +26,21 @@ def main(args): github_service = GithubService(branch) test_files = github_service.get_changed_test_files() - for test_file in test_files: - print(test_file) + if len(test_files) == 0: + print("No new detections to test.") + aws_service.dynamo_db_nothing_to_test(REGION, uuid_test, str(int(time.time()))) + sys.exit(0) - # dt_ar = aws_service.get_ar_information_from_dynamo_db(REGION, DT_ATTACK_RANGE_STATE) - # splunk_instance = aws_service.get_splunk_instance(REGION, dt_ar['ssh_key_name']) + dt_ar = aws_service.get_ar_information_from_dynamo_db(REGION, DT_ATTACK_RANGE_STATE) + splunk_instance = aws_service.get_splunk_instance(REGION, dt_ar['ssh_key_name']) - # splunk_ip = splunk_instance['NetworkInterfaces'][0]['Association']['PublicIp'] - # splunk_password = dt_ar['password'] - # ssh_key_name = dt_ar['ssh_key_name'] - # private_key = dt_ar['private_key'] + splunk_ip = splunk_instance['NetworkInterfaces'][0]['Association']['PublicIp'] + splunk_password = dt_ar['password'] + ssh_key_name = dt_ar['ssh_key_name'] + private_key = dt_ar['private_key'] - # testing_service.prepare_detection_testing(ssh_key_name, private_key, splunk_ip, splunk_password) - # testing_service.test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_files, uuid_test) - - # Get Password, private_key and key_name from DynamoDB - # For loop - # Detection Test + testing_service.prepare_detection_testing(ssh_key_name, private_key, splunk_ip, splunk_password) + testing_service.test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_files, uuid_test) if __name__ == "__main__": diff --git a/automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py b/automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py index cc53c425f6..eaf2750597 100644 --- a/automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py +++ b/automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py @@ -1,5 +1,5 @@ import boto3 - +import uuid @@ -39,6 +39,18 @@ def get_splunk_instance(region, key_name): return {} +def dynamo_db_nothing_to_test(region, uuid_test, time): + uuid_var = str(uuid.uuid4()) + resource = boto3.resource('dynamodb', region_name=region) + table = resource.Table("dt-results") + response = table.put_item(Item= { + 'uuid': uuid_var, + 'uuid_test': uuid_test, + 'time': time, + 'status': 'nothing to test' + }) + + def add_detection_results_in_dynamo_db(region, uuid, uuid_test, detection, detection_path, time): resource = boto3.resource('dynamodb', region_name=region) table = resource.Table("dt-results") diff --git a/automated_detection_testing/ci/python_ci_code/main.py b/automated_detection_testing/ci/python_ci_code/main.py index 9026532c80..d69069e709 100644 --- a/automated_detection_testing/ci/python_ci_code/main.py +++ b/automated_detection_testing/ci/python_ci_code/main.py @@ -46,6 +46,10 @@ def main(args): test_done = True for item in response['Items']: + if item['status']['S'] == 'nothing to test': + print('No new or changed detections to test.') + sys.exit(0) + if item['status']['S'] == 'running': test_done = False From 4abeabf3154e1ca0d541f41a06cbf2ba55f83e49 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 6 Jul 2021 13:26:24 +0200 Subject: [PATCH 2/3] bug fix detection testing --- automated_detection_testing/ci/python_ci_code/main.py | 1 + 1 file changed, 1 insertion(+) diff --git a/automated_detection_testing/ci/python_ci_code/main.py b/automated_detection_testing/ci/python_ci_code/main.py index d69069e709..2cd876f469 100644 --- a/automated_detection_testing/ci/python_ci_code/main.py +++ b/automated_detection_testing/ci/python_ci_code/main.py @@ -44,6 +44,7 @@ def main(args): } ) + test_done = True for item in response['Items']: if item['status']['S'] == 'nothing to test': From cdcf271eae960b98fface9bf1aa26aa6e0ade909 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 6 Jul 2021 13:27:11 +0200 Subject: [PATCH 3/3] bug fix detection testing --- .../attempted_credential_dump_from_registry_via_reg_exe.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 6ef34eec85..d6f1b914d4 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -50,5 +50,3 @@ tags: - Processes.process - Processes.dest security_domain: endpoint - -