From a5f92416506b620123cb0179bb5aaa63173de746 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 10 May 2022 10:31:16 -0700
Subject: [PATCH] Added Palo Alto TA in support of CRITICAL CVE 2022-1388
 Detection.

---
 bin/docker_detection_tester/modules/validate_args.py   | 10 +++++++++-
 .../test_config_github_actions.json                    |  7 ++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py
index ef4deded4f..7d870c4781 100644
--- a/bin/docker_detection_tester/modules/validate_args.py
+++ b/bin/docker_detection_tester/modules/validate_args.py
@@ -77,7 +77,15 @@ setup_schema = {
                     "app_version": None,
                     "local_path": None
                 },
+
+
                 #The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template
+
+                "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
+                    "app_number": 2757,
+                    "app_version": "7.1.0",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
+                },
                 "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
                     "app_number": 742,
                     "app_version": "8.4.0",
@@ -343,4 +351,4 @@ def validate(configuration: dict, skip_password_accessibility_check:bool=True) -
     except Exception as e:
         print("There was an error validation the configuration: [%s]" % (
             str(e)), file=sys.stderr)
-        return None, setup_schema
\ No newline at end of file
+        return None, setup_schema
diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json
index 48575e2df9..36fc631670 100644
--- a/bin/docker_detection_tester/test_config_github_actions.json
+++ b/bin/docker_detection_tester/test_config_github_actions.json
@@ -1,5 +1,10 @@
 {
   "apps": {
+      "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
+          "app_number": 2757,
+          "app_version": "7.1.0",
+          "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
+      },
       "ADD_ON_FOR_LINUX_SYSMON": {
           "app_number": 6176,
           "app_version": "1.0.4",
@@ -106,4 +111,4 @@
       "Hunting",
       "TTP"
   ]
-}
\ No newline at end of file
+}