From 26a2d80902b3ad89c1fd5f09a9d6bb2e232ef983 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 7 Feb 2022 13:20:22 +0100 Subject: [PATCH] switched back to test file format --- .../domain/entities/unit_test.py | 10 +--- .../domain/entities/unit_test_test.py | 15 ++++++ .../security_content_detection_builder.py | 2 +- ...al_dump_from_registry_via_reg_exe.test.yml | 22 +++++---- .../builder/test_data/test/example.test.yml | 46 ++++++++++--------- .../test_security_content_basic_builder.py | 6 +-- ...test_security_content_detection_builder.py | 2 +- .../builder/test_security_content_director.py | 8 ++-- 8 files changed, 62 insertions(+), 49 deletions(-) create mode 100644 bin/contentctl_project/contentctl_core/domain/entities/unit_test_test.py diff --git a/bin/contentctl_project/contentctl_core/domain/entities/unit_test.py b/bin/contentctl_project/contentctl_core/domain/entities/unit_test.py index f0edd29777..cca4154019 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/unit_test.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/unit_test.py @@ -3,15 +3,9 @@ from pydantic import BaseModel, validator, ValidationError from contentctl_core.domain.entities.security_content_object import SecurityContentObject -from contentctl_core.domain.entities.unit_test_attack_data import UnitTestAttackData -from contentctl_core.domain.entities.unit_test_baseline import UnitTestBaseline +from contentctl_core.domain.entities.unit_test_test import UnitTestTest class UnitTest(BaseModel, SecurityContentObject): name: str - file: str - pass_condition: str - earliest_time: str = None - latest_time: str = None - baselines: list[UnitTestBaseline] = None - attack_data: list[UnitTestAttackData] + tests: list[UnitTestTest] \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_core/domain/entities/unit_test_test.py b/bin/contentctl_project/contentctl_core/domain/entities/unit_test_test.py new file mode 100644 index 0000000000..e5a0cb05cf --- /dev/null +++ b/bin/contentctl_project/contentctl_core/domain/entities/unit_test_test.py @@ -0,0 +1,15 @@ + + +from pydantic import BaseModel + +from contentctl_core.domain.entities.unit_test_attack_data import UnitTestAttackData +from contentctl_core.domain.entities.unit_test_baseline import UnitTestBaseline + +class UnitTestTest(BaseModel): + name: str + file: str + pass_condition: str + earliest_time: str = None + latest_time: str = None + baselines: list[UnitTestBaseline] = None + attack_data: list[UnitTestAttackData] \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 4932db6c3a..867b3faf11 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -154,7 +154,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder): def addUnitTest(self, tests: list) -> None: for test in tests: - if test.name == self.security_content_obj.name: + if test.tests[0].name == self.security_content_obj.name: self.security_content_obj.test = test return diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/test/attempted_credential_dump_from_registry_via_reg_exe.test.yml b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/test/attempted_credential_dump_from_registry_via_reg_exe.test.yml index 2e6c47dceb..350f093598 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/test/attempted_credential_dump_from_registry_via_reg_exe.test.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/test/attempted_credential_dump_from_registry_via_reg_exe.test.yml @@ -1,10 +1,12 @@ -name: Attempted Credential Dump From Registry via Reg exe -file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml -pass_condition: '| stats count | where count > 0' -earliest_time: -24h -latest_time: now -attack_data: -- file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: xmlwineventlog +name: Attempted Credential Dump From Registry via Reg exe Unit Test +tests: +- name: Attempted Credential Dump From Registry via Reg exe + file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/test/example.test.yml b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/test/example.test.yml index aa716f64b5..fdf35b265e 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/test/example.test.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/test/example.test.yml @@ -1,22 +1,24 @@ -name: Cloud Compute Instance Created By Previously Unseen User -file: cloud/cloud_compute_instance_created_by_previously_unseen_user.yml -pass_condition: '| stats count | where count > 0' -earliest_time: -24h -latest_time: now -baselines: -- name: Previously Seen Cloud Compute Creations By User - Initial - file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -30d - latest_time: -1d -- name: Previously Seen Cloud Compute Creations By User - Update - file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -30d - latest_time: -1d -attack_data: -- file_name: cloudtrail_behavioural_detections.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json - sourcetype: aws:cloudtrail - source: aws_cloudtrail - update_timestamp: true +name: Cloud Compute Instance Created By Previously Unseen User Unit Test +tests: + - name: Cloud Compute Instance Created By Previously Unseen User + file: cloud/cloud_compute_instance_created_by_previously_unseen_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + baselines: + - name: Previously Seen Cloud Compute Creations By User - Initial + file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -30d + latest_time: -1d + - name: Previously Seen Cloud Compute Creations By User - Update + file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -30d + latest_time: -1d + attack_data: + - file_name: cloudtrail_behavioural_detections.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_basic_builder.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_basic_builder.py index edd67ef50e..d5ac033ae6 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_basic_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_basic_builder.py @@ -54,6 +54,6 @@ def test_read_test(): 'test_data/test/example.test.yml'), SecurityContentType.unit_tests) test = security_content_builder.getObject() - assert test.name == "Cloud Compute Instance Created By Previously Unseen User" - assert test.baselines[0].name == "Previously Seen Cloud Compute Creations By User - Initial" - assert test.attack_data[0].source == "aws_cloudtrail" \ No newline at end of file + assert test.name == "Cloud Compute Instance Created By Previously Unseen User Unit Test" + assert test.tests[0].baselines[0].name == "Previously Seen Cloud Compute Creations By User - Initial" + assert test.tests[0].attack_data[0].source == "aws_cloudtrail" \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py index 1e1c511bc8..19a9d189ac 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py @@ -152,4 +152,4 @@ def test_detection_enrich_unit_test(): security_content_builder.addUnitTest([test]) detection = security_content_builder.getObject() - assert detection.test.file == "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml" \ No newline at end of file + assert detection.test.tests[0].file == "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml" \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py index 3472fa764b..9fc5be782e 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py @@ -62,9 +62,9 @@ def test_construct_unit_tests(): 'test_data/test/example.test.yml')) test = unit_test_builder.getObject() - assert test.name == "Cloud Compute Instance Created By Previously Unseen User" - assert test.baselines[0].name == "Previously Seen Cloud Compute Creations By User - Initial" - assert test.attack_data[0].source == "aws_cloudtrail" + assert test.name == "Cloud Compute Instance Created By Previously Unseen User Unit Test" + assert test.tests[0].baselines[0].name == "Previously Seen Cloud Compute Creations By User - Initial" + assert test.tests[0].attack_data[0].source == "aws_cloudtrail" def test_construct_baselines(): @@ -156,7 +156,7 @@ def test_construct_detections(): assert detection.risk == valid_risk assert detection.playbooks[0].name == "Ransomware Investigate and Contain" assert detection.baselines[0].name == "Previously Seen Users In CloudTrail - Update" - assert detection.test.name == "Attempted Credential Dump From Registry via Reg exe" + assert detection.test.name == "Attempted Credential Dump From Registry via Reg exe Unit Test" def test_construct_stories():