mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
pyth0n1c
@@ -17,8 +17,6 @@ on:
|
||||
push:
|
||||
pull_request:
|
||||
types: [opened, reopened]
|
||||
schedule:
|
||||
- cron: "44 4 * * *"
|
||||
jobs:
|
||||
validate-tag-if-present:
|
||||
runs-on: ubuntu-latest
|
||||
@@ -298,290 +296,7 @@ jobs:
|
||||
|
||||
|
||||
|
||||
docker-detection-testing-setup:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [build-package]
|
||||
steps:
|
||||
- name: Get branch and PR required for detection testing main.py
|
||||
id: vars
|
||||
run: |
|
||||
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
|
||||
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
|
||||
#- name: Install requirements for installing slim during execution
|
||||
# run: |
|
||||
# sudo apt update -qq
|
||||
# #python2.7 needed for slim, for now
|
||||
# sudo apt install python2
|
||||
# sudo apt install virtualenv
|
||||
# curl https://bootstrap.pypa.io/pip/2.7/get-pip.py --output get-pip.py
|
||||
# sudo python2.7 get-pip.py
|
||||
|
||||
# Get the previously built ESCU
|
||||
- name: Get ESCU
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: content-latest
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/prior_config/apps
|
||||
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
||||
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
||||
|
||||
- name: Install Python Dependencies
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
python3 -m venv .venv
|
||||
source .venv/bin/activate
|
||||
python3 -m pip install wheel
|
||||
python3 -m pip install -r requirements.txt
|
||||
|
||||
- name: Run the CI
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
source .venv/bin/activate
|
||||
echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]"
|
||||
echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]"
|
||||
echo "steps.vars.outputs.branch : [${{ steps.vars.outputs.branch }}]"
|
||||
echo "github.event.pull_request.head.ref : [${{ github.event.pull_request.head.ref }}]"
|
||||
|
||||
ls -lahr prior_config
|
||||
|
||||
if [[ ${{ steps.vars.outputs.branch }} == develop ]]; then
|
||||
echo "Running a nightly test on all detections"
|
||||
python detection_testing_execution.py run --branch ${{ github.event.pull_request.head.ref }} --mode all --mock --config_file test_config_github_actions.json
|
||||
elif [[ ! -z "${{ github.event.pull_request.head.ref }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then
|
||||
echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
|
||||
python detection_testing_execution.py run --branch ${{ github.event.pull_request.head.ref }} --pr_number ${{ github.event.pull_request.number }} --mode changes --mock --config_file test_config_github_actions.json
|
||||
else
|
||||
echo "Push from branch [${{ steps.vars.outputs.branch }}]"
|
||||
python detection_testing_execution.py run --branch ${{ steps.vars.outputs.branch }} --mode changes --mock --config_file test_config_github_actions.json
|
||||
fi
|
||||
|
||||
mv *-test-run.json replicate_test.json
|
||||
- name: Upload Test Results Files
|
||||
uses: actions/upload-artifact@v2
|
||||
with:
|
||||
name: testing-results-config
|
||||
path: |
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/apps/DA-ESS-ContentUpdate-latest.tar.gz
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_0.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_1.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_2.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_3.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_4.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_5.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_6.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_7.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_8.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_9.json
|
||||
|
||||
- name: Upload File to Enable Replication of the Test at a Different Time or Place
|
||||
uses: actions/upload-artifact@v2
|
||||
with:
|
||||
name: replicate_test
|
||||
path: |
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/replicate_test.json
|
||||
|
||||
docker-detection-testing-execution:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [docker-detection-testing-setup]
|
||||
strategy:
|
||||
matrix:
|
||||
manifest_filename: ["config_tests_0.json",
|
||||
"config_tests_1.json",
|
||||
"config_tests_2.json",
|
||||
"config_tests_3.json",
|
||||
"config_tests_4.json",
|
||||
"config_tests_5.json",
|
||||
"config_tests_6.json",
|
||||
"config_tests_7.json",
|
||||
"config_tests_8.json",
|
||||
"config_tests_9.json"]
|
||||
steps:
|
||||
- name: Get branch and PR required for detection testing main.py
|
||||
id: vars
|
||||
run: |
|
||||
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
|
||||
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: testing-results-config
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/prior_config
|
||||
# - name: Install Docker
|
||||
# run: |
|
||||
# sudo apt update -qq
|
||||
|
||||
|
||||
# #python2.7 needed for slim, for now
|
||||
# sudo apt install python2
|
||||
# sudo apt install virtualenv
|
||||
# curl https://bootstrap.pypa.io/pip/2.7/get-pip.py --output get-pip.py
|
||||
# sudo python2.7 get-pip.py
|
||||
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
||||
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
||||
|
||||
- name: Install Python Dependencies
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
python3 -m venv .venv
|
||||
source .venv/bin/activate
|
||||
python3 -m pip install wheel
|
||||
python3 -m pip install -r requirements.txt
|
||||
|
||||
- name: Run the CI
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
source .venv/bin/activate
|
||||
|
||||
python3 detection_testing_execution.py run -c prior_config/${{ matrix.manifest_filename}} --splunkbase_username ${{ secrets.SPLUNKBASE_TESTING_USERNAME }} --splunkbase_password ${{ secrets.SPLUNKBASE_TESTING_KEY }}
|
||||
|
||||
|
||||
- name: Upload Test Results Files
|
||||
uses: actions/upload-artifact@v2
|
||||
with:
|
||||
name: ${{ matrix.manifest_filename}}.results
|
||||
path: |
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/success.csv
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/error.csv
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/failure.csv
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/combined.csv
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/success.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/error.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/failure.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/combined.json
|
||||
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/summary.json
|
||||
|
||||
docker-detection-testing-execution-merge-results:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [docker-detection-testing-setup, docker-detection-testing-execution]
|
||||
|
||||
steps:
|
||||
- name: Get branch and PR required for detection testing main.py
|
||||
id: vars
|
||||
run: |
|
||||
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
|
||||
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_0.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_0
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_1.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_1
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_2.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_2
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_3.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_3
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_4.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_4
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_5.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_5
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_6.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_6
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_7.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_7
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_8.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_8
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_9.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_9
|
||||
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
||||
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
||||
|
||||
- name: Install Python Dependencies
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
python3 -m venv .venv
|
||||
source .venv/bin/activate
|
||||
python3 -m pip install wheel
|
||||
python3 -m pip install -r requirements.txt
|
||||
|
||||
- name: Merge Detections into single File
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
source .venv/bin/activate
|
||||
python summarize_json.py --files results_*/summary.json --output_filename summary_test_results.json
|
||||
|
||||
|
||||
- name: Upload Summary Test Results JSON
|
||||
uses: actions/upload-artifact@v2
|
||||
if: always()
|
||||
with:
|
||||
name: SummaryTestResults
|
||||
path: |
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/summary_test_results.json
|
||||
|
||||
- name: Upload Failures Manifest on Failure
|
||||
uses: actions/upload-artifact@v2
|
||||
if: failure()
|
||||
with:
|
||||
name: DetectionFailureManifest
|
||||
path: |
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/detection_failure_manifest.json
|
||||
|
||||
|
||||
#Always clean these up, they make the output messy
|
||||
- name: Clean up intermediate Files
|
||||
uses: geekyeggo/delete-artifact@v1
|
||||
if: always()
|
||||
with:
|
||||
name: |
|
||||
config_tests_0.json.results
|
||||
config_tests_1.json.results
|
||||
config_tests_2.json.results
|
||||
config_tests_3.json.results
|
||||
config_tests_4.json.results
|
||||
config_tests_5.json.results
|
||||
config_tests_6.json.results
|
||||
config_tests_7.json.results
|
||||
config_tests_8.json.results
|
||||
config_tests_9.json.results
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -3,6 +3,8 @@ on:
|
||||
push:
|
||||
pull_request:
|
||||
types: [opened, reopened]
|
||||
schedule:
|
||||
- cron: "44 4 * * *"
|
||||
jobs:
|
||||
|
||||
validate-tag-if-present:
|
||||
@@ -37,71 +39,266 @@ jobs:
|
||||
run: |
|
||||
echo "yes it ran"
|
||||
|
||||
docker-detection-testing-setup:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [validate-tag-if-present, quit-for-dependabot]
|
||||
steps:
|
||||
- name: Get branch and PR required for detection testing main.py
|
||||
id: vars
|
||||
run: |
|
||||
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
|
||||
|
||||
detection-testing:
|
||||
runs-on: ubuntu-latest
|
||||
environment: Detection-Testing-Approval
|
||||
needs: [validate-tag-if-present, quit-for-dependabot]
|
||||
steps:
|
||||
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
|
||||
|
||||
#The following branch name only works (and is only used) for a push
|
||||
#to a branch. We used a different method for getting the source branch
|
||||
#from a PR
|
||||
- name: Get branch and PR required for detection testing main.py
|
||||
id: vars
|
||||
run: |
|
||||
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
|
||||
|
||||
- name: Install System Packages
|
||||
run: |
|
||||
sudo apt update -qq
|
||||
sudo apt install jq -qq
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
||||
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
||||
|
||||
|
||||
- name: Install Python Dependencies
|
||||
run: |
|
||||
#Get the virtualenv set up
|
||||
cd bin/automated_detection_testing/ci/python_ci_code
|
||||
rm -rf venv
|
||||
python3 -m venv --clear venv
|
||||
source venv/bin/activate
|
||||
python3 -m pip install --upgrade pip
|
||||
python3 -m pip install wheel
|
||||
python3 -m pip install -q -r requirements.txt
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
||||
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
||||
|
||||
- name: Install Python Dependencies
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
python3 -m venv .venv
|
||||
source .venv/bin/activate
|
||||
python3 -m pip install wheel
|
||||
python3 -m pip install -r requirements.txt
|
||||
|
||||
- name: Run the CI
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
source .venv/bin/activate
|
||||
echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]"
|
||||
echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]"
|
||||
echo "steps.vars.outputs.branch : [${{ steps.vars.outputs.branch }}]"
|
||||
echo "github.event.pull_request.head.ref : [${{ github.event.pull_request.head.ref }}]"
|
||||
|
||||
|
||||
|
||||
if [[ ${{ steps.vars.outputs.branch }} == develop ]]; then
|
||||
echo "Running a nightly test on all detections"
|
||||
python detection_testing_execution.py run --branch ${{ github.event.pull_request.head.ref }} --mode all --mock --config_file test_config_github_actions.json
|
||||
elif [[ ! -z "${{ github.event.pull_request.head.ref }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then
|
||||
echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
|
||||
python detection_testing_execution.py run --branch ${{ github.event.pull_request.head.ref }} --pr_number ${{ github.event.pull_request.number }} --mode changes --mock --config_file test_config_github_actions.json
|
||||
else
|
||||
echo "Push from branch [${{ steps.vars.outputs.branch }}]"
|
||||
python detection_testing_execution.py run --branch ${{ steps.vars.outputs.branch }} --mode changes --mock --config_file test_config_github_actions.json
|
||||
fi
|
||||
|
||||
mv *-test-run.json replicate_test.json
|
||||
- name: Upload Test Results Files
|
||||
uses: actions/upload-artifact@v2
|
||||
with:
|
||||
name: testing-results-config
|
||||
path: |
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/apps/DA-ESS-ContentUpdate-latest.tar.gz
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_0.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_1.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_2.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_3.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_4.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_5.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_6.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_7.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_8.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_9.json
|
||||
|
||||
- name: Upload File to Enable Replication of the Test at a Different Time or Place
|
||||
uses: actions/upload-artifact@v2
|
||||
with:
|
||||
name: replicate_test
|
||||
path: |
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/replicate_test.json
|
||||
|
||||
docker-detection-testing-execution:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [docker-detection-testing-setup]
|
||||
strategy:
|
||||
matrix:
|
||||
manifest_filename: ["config_tests_0.json",
|
||||
"config_tests_1.json",
|
||||
"config_tests_2.json",
|
||||
"config_tests_3.json",
|
||||
"config_tests_4.json",
|
||||
"config_tests_5.json",
|
||||
"config_tests_6.json",
|
||||
"config_tests_7.json",
|
||||
"config_tests_8.json",
|
||||
"config_tests_9.json"]
|
||||
steps:
|
||||
- name: Get branch and PR required for detection testing main.py
|
||||
id: vars
|
||||
run: |
|
||||
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
|
||||
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: testing-results-config
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/prior_config
|
||||
|
||||
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
||||
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
||||
|
||||
- name: Install Python Dependencies
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
python3 -m venv .venv
|
||||
source .venv/bin/activate
|
||||
python3 -m pip install wheel
|
||||
python3 -m pip install -r requirements.txt
|
||||
|
||||
- name: Run the CI
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
source .venv/bin/activate
|
||||
|
||||
python3 detection_testing_execution.py run -c prior_config/${{ matrix.manifest_filename}} --splunkbase_username ${{ secrets.SPLUNKBASE_TESTING_USERNAME }} --splunkbase_password ${{ secrets.SPLUNKBASE_TESTING_KEY }}
|
||||
|
||||
|
||||
- name: Upload Test Results Files
|
||||
uses: actions/upload-artifact@v2
|
||||
with:
|
||||
name: ${{ matrix.manifest_filename}}.results
|
||||
path: |
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/success.csv
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/error.csv
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/failure.csv
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/combined.csv
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/success.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/error.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/failure.json
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/combined.json
|
||||
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/test_results/summary.json
|
||||
|
||||
|
||||
#Set up credentials in the environment so that boto will be able to find them
|
||||
- uses: aws-actions/configure-aws-credentials@v1
|
||||
with:
|
||||
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
||||
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||||
#Right now the script is hard coded to EU because of the dev who originally wrote it...
|
||||
#probably change that arg to None and set here?
|
||||
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
|
||||
docker-detection-testing-execution-merge-results:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [docker-detection-testing-setup, docker-detection-testing-execution]
|
||||
|
||||
steps:
|
||||
- name: Get branch and PR required for detection testing main.py
|
||||
id: vars
|
||||
run: |
|
||||
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
|
||||
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_0.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_0
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_1.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_1
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_2.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_2
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_3.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_3
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_4.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_4
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_5.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_5
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_6.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_6
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_7.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_7
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_8.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_8
|
||||
- name: Download artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
name: config_tests_9.json.results
|
||||
path: bin/automated_detection_testing/ci/detection_testing_batch/results_9
|
||||
|
||||
- uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
||||
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
||||
|
||||
- name: Install Python Dependencies
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
python3 -m venv .venv
|
||||
source .venv/bin/activate
|
||||
python3 -m pip install wheel
|
||||
python3 -m pip install -r requirements.txt
|
||||
|
||||
- name: Merge Detections into single File
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/detection_testing_batch
|
||||
source .venv/bin/activate
|
||||
python summarize_json.py --files results_*/summary.json --output_filename summary_test_results.json
|
||||
|
||||
|
||||
- name: Upload Summary Test Results JSON
|
||||
uses: actions/upload-artifact@v2
|
||||
if: always()
|
||||
with:
|
||||
name: SummaryTestResults
|
||||
path: |
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/summary_test_results.json
|
||||
|
||||
- name: Upload Failures Manifest on Failure
|
||||
uses: actions/upload-artifact@v2
|
||||
if: failure()
|
||||
with:
|
||||
name: DetectionFailureManifest
|
||||
path: |
|
||||
bin/automated_detection_testing/ci/detection_testing_batch/detection_failure_manifest.json
|
||||
|
||||
|
||||
#Always clean these up, they make the output messy
|
||||
- name: Clean up intermediate Files
|
||||
uses: geekyeggo/delete-artifact@v1
|
||||
if: always()
|
||||
with:
|
||||
name: |
|
||||
config_tests_0.json.results
|
||||
config_tests_1.json.results
|
||||
config_tests_2.json.results
|
||||
config_tests_3.json.results
|
||||
config_tests_4.json.results
|
||||
config_tests_5.json.results
|
||||
config_tests_6.json.results
|
||||
config_tests_7.json.results
|
||||
config_tests_8.json.results
|
||||
config_tests_9.json.results
|
||||
|
||||
|
||||
|
||||
- name: Run Detection testing
|
||||
timeout-minutes: 120
|
||||
run: |
|
||||
cd bin/automated_detection_testing/ci/python_ci_code
|
||||
source venv/bin/activate
|
||||
|
||||
echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]"
|
||||
echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]"
|
||||
echo "steps.vars.outputs.branch : [${{ steps.vars.outputs.branch }}]"
|
||||
echo "github.event.pull_request.head.ref: [${{ github.event.pull_request.head.ref }}]"
|
||||
|
||||
if [[ ! -z "${{ github.event.pull_request.head.ref }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then
|
||||
echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
|
||||
python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}
|
||||
else
|
||||
echo "Push from branch [${{ steps.vars.outputs.branch }}]"
|
||||
python3 main.py -b ${{ steps.vars.outputs.branch }}
|
||||
fi
|
||||
|
||||
+1
-1
@@ -27,7 +27,7 @@ from docker.client import DockerClient
|
||||
from requests import get
|
||||
|
||||
import modules.new_arguments2
|
||||
from modules import (aws_service, container_manager, new_arguments2,
|
||||
from modules import (container_manager, new_arguments2,
|
||||
testing_service, validate_args)
|
||||
from modules.github_service import GithubService
|
||||
from modules.validate_args import validate, validate_and_write
|
||||
|
||||
@@ -1,96 +0,0 @@
|
||||
import boto3
|
||||
import uuid
|
||||
|
||||
|
||||
|
||||
def get_ar_information_from_dynamo_db(region, db_name):
|
||||
resource = boto3.resource('dynamodb', region_name=region)
|
||||
table = resource.Table(db_name)
|
||||
response = table.get_item(
|
||||
Key={
|
||||
'name': 'detection-testing-attack-range'
|
||||
}
|
||||
)
|
||||
if 'Item' in response:
|
||||
return response['Item']
|
||||
else:
|
||||
return {}
|
||||
|
||||
|
||||
def get_splunk_instance(region, key_name):
|
||||
client = boto3.client('ec2', region_name=region)
|
||||
response = client.describe_instances(
|
||||
Filters=[
|
||||
{
|
||||
'Name': "key-name",
|
||||
'Values': [key_name]
|
||||
}
|
||||
]
|
||||
)
|
||||
instances = []
|
||||
for reservation in response['Reservations']:
|
||||
for instance in reservation['Instances']:
|
||||
if instance['State']['Name']!='terminated':
|
||||
if len(instance['Tags']) > 0:
|
||||
tag = instance['Tags'][0]['Value']
|
||||
if key_name in tag:
|
||||
return instance
|
||||
|
||||
return {}
|
||||
|
||||
|
||||
def dynamo_db_nothing_to_test(region, uuid_test, time):
|
||||
uuid_var = str(uuid.uuid4())
|
||||
resource = boto3.resource('dynamodb', region_name=region)
|
||||
table = resource.Table("dt-results")
|
||||
response = table.put_item(Item= {
|
||||
'uuid': uuid_var,
|
||||
'uuid_test': uuid_test,
|
||||
'time': time,
|
||||
'status': 'nothing to test'
|
||||
})
|
||||
|
||||
|
||||
def add_detection_results_in_dynamo_db(region, uuid, uuid_test, detection, detection_path, time):
|
||||
resource = boto3.resource('dynamodb', region_name=region)
|
||||
table = resource.Table("dt-results")
|
||||
response = table.put_item(Item= {
|
||||
'uuid': uuid,
|
||||
'uuid_test': uuid_test,
|
||||
'detection': detection,
|
||||
'detection_path': detection_path,
|
||||
'time': time,
|
||||
'status': 'running'
|
||||
})
|
||||
|
||||
|
||||
def update_detection_results_in_dynamo_db(region, uuid, result):
|
||||
resource = boto3.resource('dynamodb', region_name=region)
|
||||
table = resource.Table("dt-results")
|
||||
response = table.update_item(
|
||||
Key={
|
||||
'uuid': uuid
|
||||
},
|
||||
UpdateExpression="set #ts=:s",
|
||||
ExpressionAttributeValues={
|
||||
':s': 'done'
|
||||
},
|
||||
ExpressionAttributeNames={
|
||||
"#ts": "status"
|
||||
},
|
||||
ReturnValues="UPDATED_NEW"
|
||||
)
|
||||
|
||||
response = table.update_item(
|
||||
Key={
|
||||
'uuid': uuid
|
||||
},
|
||||
UpdateExpression="set #ts=:s",
|
||||
ExpressionAttributeValues={
|
||||
':s': result
|
||||
},
|
||||
ExpressionAttributeNames={
|
||||
"#ts": "result"
|
||||
},
|
||||
ReturnValues="UPDATED_NEW"
|
||||
)
|
||||
+1
-37
@@ -81,7 +81,7 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa
|
||||
|
||||
|
||||
abs_folder_path = mkdtemp(prefix="DATA_", dir=attack_data_root_folder)
|
||||
#The ansible playbook wants the relative path, so we convert it as required
|
||||
#We want the relative path, so we convert it as required
|
||||
folder_name = relpath(abs_folder_path, os.getcwd())
|
||||
|
||||
|
||||
@@ -182,40 +182,4 @@ def load_file(file_path):
|
||||
return file
|
||||
|
||||
|
||||
# def update_ESCU_app(container_name, splunk_password):
|
||||
# print("Update ESCU App. This can take some time")
|
||||
|
||||
# ansible_vars = {}
|
||||
# ansible_vars['ansible_user'] = 'ansible_user'
|
||||
# ansible_vars['splunk_password'] = splunk_password
|
||||
# ansible_vars['security_content_path'] = 'security_content'
|
||||
|
||||
# cmdline = "--connection docker -i %s, -u %s" % (container_name, ansible_vars['ansible_user'])
|
||||
|
||||
# runner = ansible_runner.run(private_data_dir=os.path.join(os.path.dirname(__file__), '../'),
|
||||
# cmdline=cmdline,
|
||||
# roles_path=os.path.join(os.path.dirname(__file__), '../ansible/roles'),
|
||||
# playbook=os.path.join(os.path.dirname(__file__), '../ansible/update_escu.yml'),
|
||||
# extravars=ansible_vars)
|
||||
# print("Successfully updated the ESCU App!")
|
||||
|
||||
|
||||
# def replay_attack_dataset(container_name, splunk_password, folder_name, index, sourcetype, source, out):
|
||||
# ansible_vars = {}
|
||||
# ansible_vars['folder_name'] = folder_name
|
||||
# ansible_vars['ansible_user'] = 'ansible'
|
||||
|
||||
# ansible_vars['splunk_password'] = splunk_password
|
||||
# ansible_vars['out'] = out
|
||||
# ansible_vars['sourcetype'] = sourcetype
|
||||
# ansible_vars['source'] = source
|
||||
# ansible_vars['index'] = index
|
||||
|
||||
|
||||
# cmdline = "--connection docker -i %s, -u %s" % (container_name, ansible_vars['ansible_user'])
|
||||
|
||||
# runner = ansible_runner.run(private_data_dir=os.path.join(os.path.dirname(__file__), '../'),
|
||||
# cmdline=cmdline,
|
||||
# roles_path=os.path.join(os.path.dirname(__file__), '../ansible/roles'),
|
||||
# playbook=os.path.join(os.path.dirname(__file__), '../ansible/attack_replay.yml'),
|
||||
# extravars=ansible_vars)
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
ansible==4.2.0
|
||||
ansible-runner==1.4.4
|
||||
psutil==5.8.0
|
||||
attackcti==0.3.4.3
|
||||
boto3==1.11.0
|
||||
GitPython==3.1.14
|
||||
Jinja2==3.0.0
|
||||
PyYAML==5.4
|
||||
|
||||
Reference in New Issue
Block a user