diff --git a/bin/docker_detection_tester/detection_testing_execution.py b/bin/docker_detection_tester/detection_testing_execution.py index 990d6a8d66..2b58110445 100644 --- a/bin/docker_detection_tester/detection_testing_execution.py +++ b/bin/docker_detection_tester/detection_testing_execution.py @@ -118,7 +118,7 @@ def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tupl path_after_host = url_parse_obj[2].rstrip('/') #removes / at the end, if applicable base_name = path_after_host.rpartition('/')[-1] #just get the file name dest_path = os.path.join(target_directory, base_name) #write the whole path - utils.download_file_from_http(http_path, dest_path) + utils.download_file_from_http(http_path, dest_path, verbose_print=True) #we need to update the local path because this is used to copy it into the container later item['local_path'] = dest_path #Remove the HTTP Path, we will use the local_path instead diff --git a/bin/docker_detection_tester/modules/utils.py b/bin/docker_detection_tester/modules/utils.py index c818e44bc0..6671e16367 100644 --- a/bin/docker_detection_tester/modules/utils.py +++ b/bin/docker_detection_tester/modules/utils.py @@ -2,14 +2,22 @@ import os import requests -def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False, chunk_size=1024*1024)->None: +def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False, chunk_size:int=1024*1024, verbose_print:bool=False)->None: if os.path.exists(destination_file) and overwrite_file is False: print(f"[{destination_file}] already exists...using cached version") return - print(f"downloading to [{destination_file}]") - file_to_download = requests.get(url, stream=True) - if file_to_download.status_code != 200: - raise Exception(f"Error downloading the file {url}: Status Code {file_to_download.status_code}") - with open(destination_file, "wb") as output: - for piece in file_to_download.iter_content(chunk_size=chunk_size): - output.write(piece) \ No newline at end of file + if verbose_print: + print(f"downloading to [{destination_file}]...",end="") + try: + file_to_download = requests.get(url, stream=True) + if file_to_download.status_code != 200: + if verbose_print: + print("FAILED") + raise Exception(f"Error downloading the file {url}: Status Code {file_to_download.status_code}") + with open(destination_file, "wb") as output: + for piece in file_to_download.iter_content(chunk_size=chunk_size): + output.write(piece) + except Exception as e: + if verbose_print: + print("FAILED") + raise e \ No newline at end of file diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index 7d870c4781..6f6fde9ed1 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -52,13 +52,13 @@ setup_schema = { "additionalProperties": False, "properties": { "app_number": { - "type": ["integer","null"] + "type": ["integer", "null"] }, "app_version": { - "type": ["string","null"] + "type": ["string", "null"] }, "local_path": { - "type": ["string","null"] + "type": ["string", "null"] }, "http_path": { "type": ["string", "null"] @@ -66,71 +66,36 @@ setup_schema = { }, "anyOf": [ {"required": ["local_path"]}, - {"required": ["http_path"] }, - {"required": ["app_number", "app_version"] }, + {"required": ["http_path"]}, + {"required": ["app_number", "app_version"]}, ] } }, "default": { - ES_APP_NAME : { + ES_APP_NAME: { "app_number": 3449, "app_version": None, "local_path": None }, - #The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template + # The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template - "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { - "app_number": 2757, - "app_version": "7.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { - "app_number": 742, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" - }, "ADD_ON_FOR_LINUX_SYSMON": { "app_number": 6176, "app_version": "1.0.4", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" }, - "SPLUNK_ADD_ON_FOR_SYSMON": { - "app_number": 5709, - "app_version": "2.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" - }, - "SPLUNK_COMMON_INFORMATION_MODEL": { - "app_number": 1621, - "app_version": "5.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" + "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { + "app_number": 2757, + "app_version": "7.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" }, "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { "app_number": 2882, "app_version": "3.0.2", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" }, - "SPLUNK_MACHINE_LEARNING_TOOLKIT": { - "app_number": 2890, - "app_version": "5.3.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" - }, - "SPLUNK_APP_FOR_STREAM": { - "app_number": 1809, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { - "app_number": 5234, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { - "app_number": 5238, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" - }, "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { "app_number": 3719, "app_version": "1.3.2", @@ -138,25 +103,60 @@ setup_schema = { }, "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { "app_number": 4055, - "app_version": "2.2.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" + "app_version": "4.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz" }, - "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { - "app_number": 833, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" + "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { + "app_number": 742, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" }, "SPLUNK_ADD_ON_FOR_NGINX": { "app_number": 3258, "app_version": "3.1.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" }, + "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { + "app_number": 5238, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { + "app_number": 5234, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_SYSMON": { + "app_number": 5709, + "app_version": "3.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz" + }, + "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { + "app_number": 833, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz" + }, + "SPLUNK_APP_FOR_STREAM": { + "app_number": 1809, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz" + }, + "SPLUNK_COMMON_INFORMATION_MODEL": { + "app_number": 1621, + "app_version": "5.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" + }, + "SPLUNK_MACHINE_LEARNING_TOOLKIT": { + "app_number": 2890, + "app_version": "5.3.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" + }, "SPLUNK_TA_FOR_ZEEK": { "app_number": 5466, "app_version": "1.0.5", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - }, - + } + } }, @@ -227,9 +227,9 @@ setup_schema = { "type": "array", "items": { "type": "string", - "enum": ["endpoint", "cloud", "network","web","application", "experimental"] + "enum": ["endpoint", "cloud", "network", "web", "application", "experimental"] }, - "default": ["endpoint", "cloud", "network","web", "application"] + "default": ["endpoint", "cloud", "network", "web", "application"] }, "types": { @@ -252,7 +252,7 @@ def validate_file(file: io.TextIOWrapper) -> tuple[Union[dict, None], dict]: raise(e) -def check_dependencies(settings: dict, skip_password_accessibility_check:bool=True) -> bool: +def check_dependencies(settings: dict, skip_password_accessibility_check: bool = True) -> bool: # Check complex mode dependencies error_free = True @@ -268,20 +268,19 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr print("Error - mode was not 'selected' but detections_list was supplied.", file=sys.stderr) error_free = False - # Make sure that if we will be in an interactive mode, that either the user has provided the password or the password will be printed if skip_password_accessibility_check: pass elif (settings['interactive'] or not settings['no_interactive_failure']) and settings['show_splunk_app_password'] is False: print("\n\n******************************************************\n\n") if settings['splunk_app_password'] is not None: - print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\ - "and provided a password in the config file. We will NOT print this password to\n"\ - "stdout. Look in the config file for this password.",file=sys.stderr) + print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n" + "and provided a password in the config file. We will NOT print this password to\n" + "stdout. Look in the config file for this password.", file=sys.stderr) else: - print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\ - "and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"\ - "to True for you. Otherwise, interactive mode login would be impossible.",file=sys.stderr) + print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n" + "and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n" + "to True for you. Otherwise, interactive mode login would be impossible.", file=sys.stderr) settings['show_splunk_app_password'] = True print("\n\n******************************************************\n\n") @@ -289,7 +288,7 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr return error_free -def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]: +def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]: closeFile = False if output_file is None: import datetime @@ -305,7 +304,8 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, configuration['container_password'] = None configuration['show_splunk_app_password'] = True - validated_json, setup_schema = validate(configuration,skip_password_accessibility_check) + validated_json, setup_schema = validate( + configuration, skip_password_accessibility_check) if validated_json == None: print("Error in the new settings! No output file written") else: @@ -324,7 +324,7 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, return validated_json, setup_schema -def validate(configuration: dict, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]: +def validate(configuration: dict, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]: # v = jsonschema.Draft201909Validator(argument_schema) try: @@ -334,7 +334,8 @@ def validate(configuration: dict, skip_password_accessibility_check:bool=True) - if len(validation_errors) == 0: # check to make sure there were no complex errors - no_complex_errors = check_dependencies(validated_json,skip_password_accessibility_check) + no_complex_errors = check_dependencies( + validated_json, skip_password_accessibility_check) if no_complex_errors: return validated_json, setup_schema else: diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 36fc631670..5b664c4d4a 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -1,114 +1,114 @@ { - "apps": { - "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { - "app_number": 2757, - "app_version": "7.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" - }, - "ADD_ON_FOR_LINUX_SYSMON": { - "app_number": 6176, - "app_version": "1.0.4", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" - }, - "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { - "app_number": 2882, - "app_version": "3.0.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" - }, - "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { - "app_number": 3719, - "app_version": "1.3.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { - "app_number": 4055, - "app_version": "2.2.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { - "app_number": 742, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" - }, - "SPLUNK_ADD_ON_FOR_NGINX": { - "app_number": 3258, - "app_version": "3.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { - "app_number": 5238, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { - "app_number": 5234, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_SYSMON": { - "app_number": 5709, - "app_version": "2.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" - }, - "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { - "app_number": 833, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" - }, - "SPLUNK_APP_FOR_STREAM": { - "app_number": 1809, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" - }, - "SPLUNK_COMMON_INFORMATION_MODEL": { - "app_number": 1621, - "app_version": "5.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" - }, - "SPLUNK_ES_CONTENT_UPDATE": { - "app_number": 3449, - "app_version": null, - "local_path": null - }, - "SPLUNK_MACHINE_LEARNING_TOOLKIT": { - "app_number": 2890, - "app_version": "5.3.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" - }, - "SPLUNK_TA_FOR_ZEEK": { - "app_number": 5466, - "app_version": "1.0.5", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - } - }, - "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", - "commit_hash": null, - "container_tag": "latest", - "detections_list": null, - "folders": [ - "endpoint", - "cloud", - "network", - "web", - "application" - ], - "interactive": false, - "local_base_container_name": "splunk_test_%d", - "mock": false, - "mode": "changes", - "no_interactive_failure": true, - "num_containers": 10, - "persist_security_content": false, - "pr_number": null, - "reuse_image": true, - "show_splunk_app_password": false, - "splunk_app_password": null, - "splunk_container_apps_directory": "/opt/splunk/etc/apps", - "splunkbase_password": null, - "splunkbase_username": null, - "types": [ - "Anomaly", - "Hunting", - "TTP" - ] -} + "apps": { + "ADD_ON_FOR_LINUX_SYSMON": { + "app_number": 6176, + "app_version": "1.0.4", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" + }, + "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { + "app_number": 2757, + "app_version": "7.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" + }, + "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { + "app_number": 2882, + "app_version": "3.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" + }, + "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { + "app_number": 3719, + "app_version": "1.3.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { + "app_number": 4055, + "app_version": "4.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { + "app_number": 742, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" + }, + "SPLUNK_ADD_ON_FOR_NGINX": { + "app_number": 3258, + "app_version": "3.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { + "app_number": 5238, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { + "app_number": 5234, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_SYSMON": { + "app_number": 5709, + "app_version": "3.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz" + }, + "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { + "app_number": 833, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz" + }, + "SPLUNK_APP_FOR_STREAM": { + "app_number": 1809, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz" + }, + "SPLUNK_COMMON_INFORMATION_MODEL": { + "app_number": 1621, + "app_version": "5.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" + }, + "SPLUNK_ES_CONTENT_UPDATE": { + "app_number": 3449, + "app_version": null, + "local_path": null + }, + "SPLUNK_MACHINE_LEARNING_TOOLKIT": { + "app_number": 2890, + "app_version": "5.3.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" + }, + "SPLUNK_TA_FOR_ZEEK": { + "app_number": 5466, + "app_version": "1.0.5", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" + } + }, + "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", + "commit_hash": null, + "container_tag": "latest", + "detections_list": null, + "folders": [ + "endpoint", + "cloud", + "network", + "web", + "application" + ], + "interactive": false, + "local_base_container_name": "splunk_test_%d", + "mock": false, + "mode": "changes", + "no_interactive_failure": true, + "num_containers": 10, + "persist_security_content": false, + "pr_number": null, + "reuse_image": true, + "show_splunk_app_password": false, + "splunk_app_password": null, + "splunk_container_apps_directory": "/opt/splunk/etc/apps", + "splunkbase_password": null, + "splunkbase_username": null, + "types": [ + "Anomaly", + "Hunting", + "TTP" + ] +} \ No newline at end of file