From feb1c94d116cb520c8b2903555f445f8308c318f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 15 Nov 2022 11:11:08 -0800 Subject: [PATCH 1/2] add crowdstrike fdr to baseline --- bin/docker_detection_tester/modules/validate_args.py | 6 +++++- bin/docker_detection_tester/test_config_github_actions.json | 5 +++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index 051c2cc3ea..a9798b4385 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -74,7 +74,11 @@ setup_schema = { "default": { # The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template - + "Splunk Add-on for CrowdStrike FDR": { + "app_number": 5579, + "app_version": "1.2.0", + "http_path": "https://attack-range-appbinaries/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz" + }, "ADD_ON_FOR_LINUX_SYSMON": { "app_number": 6176, "app_version": "1.0.4", diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 2001714718..82b27b0964 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -1,5 +1,10 @@ { "apps": { + "Splunk Add-on for CrowdStrike FDR": { + "app_number": 5579, + "app_version": "1.2.0", + "http_path": "https://attack-range-appbinaries/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz" + }, "ADD_ON_FOR_LINUX_SYSMON": { "app_number": 6176, "app_version": "1.0.4", From 0117d03428f4422e9358021c6dd6977b3b361ac6 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 15 Nov 2022 11:15:49 -0800 Subject: [PATCH 2/2] fixing wrong URL --- bin/docker_detection_tester/modules/validate_args.py | 2 +- bin/docker_detection_tester/test_config_github_actions.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index a9798b4385..de10ed4d92 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -77,7 +77,7 @@ setup_schema = { "Splunk Add-on for CrowdStrike FDR": { "app_number": 5579, "app_version": "1.2.0", - "http_path": "https://attack-range-appbinaries/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz" + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz" }, "ADD_ON_FOR_LINUX_SYSMON": { "app_number": 6176, diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 82b27b0964..5980af4f03 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -3,7 +3,7 @@ "Splunk Add-on for CrowdStrike FDR": { "app_number": 5579, "app_version": "1.2.0", - "http_path": "https://attack-range-appbinaries/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz" + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz" }, "ADD_ON_FOR_LINUX_SYSMON": { "app_number": 6176,