diff --git a/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py b/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py index d9c5b5d7b5..9f21d3418b 100644 --- a/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py +++ b/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py @@ -2,6 +2,7 @@ import sys import argparse import shutil import os +import time from modules.github_service import GithubService from modules import aws_service, testing_service @@ -25,23 +26,21 @@ def main(args): github_service = GithubService(branch) test_files = github_service.get_changed_test_files() - for test_file in test_files: - print(test_file) + if len(test_files) == 0: + print("No new detections to test.") + aws_service.dynamo_db_nothing_to_test(REGION, uuid_test, str(int(time.time()))) + sys.exit(0) - # dt_ar = aws_service.get_ar_information_from_dynamo_db(REGION, DT_ATTACK_RANGE_STATE) - # splunk_instance = aws_service.get_splunk_instance(REGION, dt_ar['ssh_key_name']) + dt_ar = aws_service.get_ar_information_from_dynamo_db(REGION, DT_ATTACK_RANGE_STATE) + splunk_instance = aws_service.get_splunk_instance(REGION, dt_ar['ssh_key_name']) - # splunk_ip = splunk_instance['NetworkInterfaces'][0]['Association']['PublicIp'] - # splunk_password = dt_ar['password'] - # ssh_key_name = dt_ar['ssh_key_name'] - # private_key = dt_ar['private_key'] + splunk_ip = splunk_instance['NetworkInterfaces'][0]['Association']['PublicIp'] + splunk_password = dt_ar['password'] + ssh_key_name = dt_ar['ssh_key_name'] + private_key = dt_ar['private_key'] - # testing_service.prepare_detection_testing(ssh_key_name, private_key, splunk_ip, splunk_password) - # testing_service.test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_files, uuid_test) - - # Get Password, private_key and key_name from DynamoDB - # For loop - # Detection Test + testing_service.prepare_detection_testing(ssh_key_name, private_key, splunk_ip, splunk_password) + testing_service.test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_files, uuid_test) if __name__ == "__main__": diff --git a/automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py b/automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py index cc53c425f6..eaf2750597 100644 --- a/automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py +++ b/automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py @@ -1,5 +1,5 @@ import boto3 - +import uuid @@ -39,6 +39,18 @@ def get_splunk_instance(region, key_name): return {} +def dynamo_db_nothing_to_test(region, uuid_test, time): + uuid_var = str(uuid.uuid4()) + resource = boto3.resource('dynamodb', region_name=region) + table = resource.Table("dt-results") + response = table.put_item(Item= { + 'uuid': uuid_var, + 'uuid_test': uuid_test, + 'time': time, + 'status': 'nothing to test' + }) + + def add_detection_results_in_dynamo_db(region, uuid, uuid_test, detection, detection_path, time): resource = boto3.resource('dynamodb', region_name=region) table = resource.Table("dt-results") diff --git a/automated_detection_testing/ci/python_ci_code/main.py b/automated_detection_testing/ci/python_ci_code/main.py index 9026532c80..2cd876f469 100644 --- a/automated_detection_testing/ci/python_ci_code/main.py +++ b/automated_detection_testing/ci/python_ci_code/main.py @@ -44,8 +44,13 @@ def main(args): } ) + test_done = True for item in response['Items']: + if item['status']['S'] == 'nothing to test': + print('No new or changed detections to test.') + sys.exit(0) + if item['status']['S'] == 'running': test_done = False diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 6ef34eec85..d6f1b914d4 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -50,5 +50,3 @@ tags: - Processes.process - Processes.dest security_domain: endpoint - -