Branch was auto-updated.

.circleci/config.yml

@@ -432,7 +432,12 @@ jobs:
       - run:
           name: checkout repo
           command: |
-            if [ "${CIRCLE_BRANCH}" == "" ]; then
+            if [[ ! -z "${CIRCLE_PULL_REQUEST}" &&  ! -z "${CIRCLE_PR_NUMBER}" ]]; then
+                git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
+                cd security-content
+                git fetch origin pull/${CIRCLE_PR_NUMBER}/head:${CIRCLE_BRANCH}
+                git checkout ${CIRCLE_BRANCH}
+            elif [ "${CIRCLE_BRANCH}" == "" ]; then
                 git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
             else
                 git clone --branch ${CIRCLE_BRANCH} https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
@@ -454,7 +459,11 @@ jobs:
             virtualenv --python=/usr/bin/python3 --clear venv
             source venv/bin/activate
             pip install -q -r requirements.txt
-            python main.py -b ${CIRCLE_BRANCH}
+            if [[ ! -z "${CIRCLE_PULL_REQUEST}" &&  ! -z "${CIRCLE_PR_NUMBER}" ]]; then
+                python main.py -b ${CIRCLE_BRANCH} -pr ${CIRCLE_PR_NUMBER}
+            else
+                python main.py -b ${CIRCLE_BRANCH}
+            fi
 
 
 workflows:

automated_detection_testing/ci/detection_testing_batch/Dockerfile

@@ -5,6 +5,7 @@ RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata
 RUN apt-get install -y python3-dev git python-dev unzip python3-pip awscli
 RUN apt-get install -y python-gitdb
 RUN apt-get install -y wget unzip
+RUN apt-get install -y git
 
 ADD . /app
 

automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py

@@ -19,12 +19,17 @@ def main(args):
     parser = argparse.ArgumentParser(description="CI Detection Testing")
     parser.add_argument("-b", "--branch", required=True, help="security content branch")
     parser.add_argument("-u", "--uuid", required=True, help="uuid for detection test")
+    parser.add_argument("-pr", "--pr-number", required=False, help="Pull Request Number")
 
     args = parser.parse_args()
     branch = args.branch
     uuid_test = args.uuid
+    pr_number = args.pr_number
 
-    github_service = GithubService(branch)
+    if pr_number:
+        github_service = GithubService(branch, pr_number)
+    else:
+        github_service = GithubService(branch)
     test_files = github_service.get_changed_test_files()
     if len(test_files) == 0:
         print("No new detections to test.")

automated_detection_testing/ci/detection_testing_batch/modules/github_service.py

@@ -15,9 +15,11 @@ SECURITY_CONTENT_URL = "https://github.com/splunk/security_content"
 
 class GithubService:
 
-    def __init__(self, security_content_branch):
+    def __init__(self, security_content_branch, PR_number = None):
         self.security_content_branch = security_content_branch
         self.security_content_repo_obj = self.clone_project(SECURITY_CONTENT_URL, f"security_content", f"develop")
+        if PR_number:
+            os.system('cd security_content && git fetch origin refs/pull/' + PR_number + '/head:' + security_content_branch + ' && cd ..')
         self.security_content_repo_obj.git.checkout(security_content_branch)
 
     def clone_project(self, url, project, branch):

automated_detection_testing/ci/python_ci_code/main.py

@@ -10,9 +10,11 @@ def main(args):
 
     parser = argparse.ArgumentParser(description="Detection Testing Execution")
     parser.add_argument("-b", "--branch", required=True, help="security content branch")
+    parser.add_argument("-pr", "--pr-number", required=False, help="Pull Request Number")
 
     args = parser.parse_args()
     branch = args.branch
+    pr_number = args.pr_number
 
     # vars
     max_waiting_time = 7200
@@ -23,14 +25,26 @@ def main(args):
 
     # start aws batch job
     client = boto3.client("batch", region_name="eu-central-1")
-    response = client.submit_job(
-        jobName='detection_testing',
-        jobQueue='detection_testing_execution_queue',
-        jobDefinition='detection_testing_execution:2',
-        containerOverrides={
-            'command': ['-b', branch, '-u', uuid_test]
-        }
-    )
+
+    if pr_number:
+        response = client.submit_job(
+            jobName='detection_testing',
+            jobQueue='detection_testing_execution_queue',
+            jobDefinition='detection_testing_execution:2',
+            containerOverrides={
+                'command': ['-b', branch, '-u', uuid_test, '-pr', pr_number]
+            }
+        )
+    else:
+        response = client.submit_job(
+            jobName='detection_testing',
+            jobQueue='detection_testing_execution_queue',
+            jobDefinition='detection_testing_execution:2',
+            containerOverrides={
+                'command': ['-b', branch, '-u', uuid_test]
+            }
+        )
+
 
     while max_waiting_time > current_waiting_time:
 

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -50,3 +50,5 @@ tags:
   - Processes.process
   - Processes.dest
   security_domain: endpoint
+
+