diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index c6ed4e4db5..f08b0d3859 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -17,8 +17,6 @@ on: push: pull_request: types: [opened, reopened] - schedule: - - cron: "44 4 * * *" jobs: validate-tag-if-present: runs-on: ubuntu-latest @@ -298,290 +296,7 @@ jobs: - docker-detection-testing-setup: - runs-on: ubuntu-latest - needs: [build-package] - steps: - - name: Get branch and PR required for detection testing main.py - id: vars - run: | - echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" - - - name: Checkout Repo - uses: actions/checkout@v2 - - #- name: Install requirements for installing slim during execution - # run: | - # sudo apt update -qq - # #python2.7 needed for slim, for now - # sudo apt install python2 - # sudo apt install virtualenv - # curl https://bootstrap.pypa.io/pip/2.7/get-pip.py --output get-pip.py - # sudo python2.7 get-pip.py - - # Get the previously built ESCU - - name: Get ESCU - uses: actions/download-artifact@v2 - with: - name: content-latest - path: bin/automated_detection_testing/ci/detection_testing_batch/prior_config/apps - - - uses: actions/setup-python@v2 - with: - python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy - architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified - - - name: Install Python Dependencies - run: | - cd bin/automated_detection_testing/ci/detection_testing_batch - python3 -m venv .venv - source .venv/bin/activate - python3 -m pip install wheel - python3 -m pip install -r requirements.txt - - - name: Run the CI - run: | - cd bin/automated_detection_testing/ci/detection_testing_batch - source .venv/bin/activate - echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]" - echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]" - echo "steps.vars.outputs.branch : [${{ steps.vars.outputs.branch }}]" - echo "github.event.pull_request.head.ref : [${{ github.event.pull_request.head.ref }}]" - - ls -lahr prior_config - - if [[ ${{ steps.vars.outputs.branch }} == develop ]]; then - echo "Running a nightly test on all detections" - python detection_testing_execution.py run --branch ${{ github.event.pull_request.head.ref }} --mode all --mock --config_file test_config_github_actions.json - elif [[ ! -z "${{ github.event.pull_request.head.ref }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then - echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]" - python detection_testing_execution.py run --branch ${{ github.event.pull_request.head.ref }} --pr_number ${{ github.event.pull_request.number }} --mode changes --mock --config_file test_config_github_actions.json - else - echo "Push from branch [${{ steps.vars.outputs.branch }}]" - python detection_testing_execution.py run --branch ${{ steps.vars.outputs.branch }} --mode changes --mock --config_file test_config_github_actions.json - fi - - mv *-test-run.json replicate_test.json - - name: Upload Test Results Files - uses: actions/upload-artifact@v2 - with: - name: testing-results-config - path: | - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/apps/DA-ESS-ContentUpdate-latest.tar.gz - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_0.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_1.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_2.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_3.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_4.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_5.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_6.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_7.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_8.json - bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_9.json - - - name: Upload File to Enable Replication of the Test at a Different Time or Place - uses: actions/upload-artifact@v2 - with: - name: replicate_test - path: | - bin/automated_detection_testing/ci/detection_testing_batch/replicate_test.json - - docker-detection-testing-execution: - runs-on: ubuntu-latest - needs: [docker-detection-testing-setup] - strategy: - matrix: - manifest_filename: ["config_tests_0.json", - "config_tests_1.json", - "config_tests_2.json", - "config_tests_3.json", - "config_tests_4.json", - "config_tests_5.json", - "config_tests_6.json", - "config_tests_7.json", - "config_tests_8.json", - "config_tests_9.json"] - steps: - - name: Get branch and PR required for detection testing main.py - id: vars - run: | - echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" - - - name: Checkout Repo - uses: actions/checkout@v2 - - - name: Download artifacts - uses: actions/download-artifact@v2 - with: - name: testing-results-config - path: bin/automated_detection_testing/ci/detection_testing_batch/prior_config - # - name: Install Docker - # run: | - # sudo apt update -qq - - - # #python2.7 needed for slim, for now - # sudo apt install python2 - # sudo apt install virtualenv - # curl https://bootstrap.pypa.io/pip/2.7/get-pip.py --output get-pip.py - # sudo python2.7 get-pip.py - - - uses: actions/setup-python@v2 - with: - python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy - architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified - - - name: Install Python Dependencies - run: | - cd bin/automated_detection_testing/ci/detection_testing_batch - python3 -m venv .venv - source .venv/bin/activate - python3 -m pip install wheel - python3 -m pip install -r requirements.txt - - - name: Run the CI - run: | - cd bin/automated_detection_testing/ci/detection_testing_batch - source .venv/bin/activate - - python3 detection_testing_execution.py run -c prior_config/${{ matrix.manifest_filename}} --splunkbase_username ${{ secrets.SPLUNKBASE_TESTING_USERNAME }} --splunkbase_password ${{ secrets.SPLUNKBASE_TESTING_KEY }} - - - - name: Upload Test Results Files - uses: actions/upload-artifact@v2 - with: - name: ${{ matrix.manifest_filename}}.results - path: | - bin/automated_detection_testing/ci/detection_testing_batch/test_results/success.csv - bin/automated_detection_testing/ci/detection_testing_batch/test_results/error.csv - bin/automated_detection_testing/ci/detection_testing_batch/test_results/failure.csv - bin/automated_detection_testing/ci/detection_testing_batch/test_results/combined.csv - bin/automated_detection_testing/ci/detection_testing_batch/test_results/success.json - bin/automated_detection_testing/ci/detection_testing_batch/test_results/error.json - bin/automated_detection_testing/ci/detection_testing_batch/test_results/failure.json - bin/automated_detection_testing/ci/detection_testing_batch/test_results/combined.json - - bin/automated_detection_testing/ci/detection_testing_batch/test_results/summary.json - - docker-detection-testing-execution-merge-results: - runs-on: ubuntu-latest - needs: [docker-detection-testing-setup, docker-detection-testing-execution] - - steps: - - name: Get branch and PR required for detection testing main.py - id: vars - run: | - echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" - - - name: Checkout Repo - uses: actions/checkout@v2 - - - name: Download artifacts - uses: actions/download-artifact@v2 - with: - name: config_tests_0.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_0 - - name: Download artifacts - uses: actions/download-artifact@v2 - with: - name: config_tests_1.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_1 - - name: Download artifacts - uses: actions/download-artifact@v2 - with: - name: config_tests_2.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_2 - - name: Download artifacts - uses: actions/download-artifact@v2 - with: - name: config_tests_3.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_3 - - name: Download artifacts - uses: actions/download-artifact@v2 - with: - name: config_tests_4.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_4 - - name: Download artifacts - uses: actions/download-artifact@v2 - with: - name: config_tests_5.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_5 - - name: Download artifacts - uses: actions/download-artifact@v2 - with: - name: config_tests_6.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_6 - - name: Download artifacts - uses: actions/download-artifact@v2 - with: - name: config_tests_7.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_7 - - name: Download artifacts - uses: actions/download-artifact@v2 - with: - name: config_tests_8.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_8 - - name: Download artifacts - uses: actions/download-artifact@v2 - with: - name: config_tests_9.json.results - path: bin/automated_detection_testing/ci/detection_testing_batch/results_9 - - - uses: actions/setup-python@v2 - with: - python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy - architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified - - - name: Install Python Dependencies - run: | - cd bin/automated_detection_testing/ci/detection_testing_batch - python3 -m venv .venv - source .venv/bin/activate - python3 -m pip install wheel - python3 -m pip install -r requirements.txt - - - name: Merge Detections into single File - run: | - cd bin/automated_detection_testing/ci/detection_testing_batch - source .venv/bin/activate - python summarize_json.py --files results_*/summary.json --output_filename summary_test_results.json - - - - name: Upload Summary Test Results JSON - uses: actions/upload-artifact@v2 - if: always() - with: - name: SummaryTestResults - path: | - bin/automated_detection_testing/ci/detection_testing_batch/summary_test_results.json - - - name: Upload Failures Manifest on Failure - uses: actions/upload-artifact@v2 - if: failure() - with: - name: DetectionFailureManifest - path: | - bin/automated_detection_testing/ci/detection_testing_batch/detection_failure_manifest.json - - - #Always clean these up, they make the output messy - - name: Clean up intermediate Files - uses: geekyeggo/delete-artifact@v1 - if: always() - with: - name: | - config_tests_0.json.results - config_tests_1.json.results - config_tests_2.json.results - config_tests_3.json.results - config_tests_4.json.results - config_tests_5.json.results - config_tests_6.json.results - config_tests_7.json.results - config_tests_8.json.results - config_tests_9.json.results - - + diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index 82d471d5f6..094ac48098 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -3,6 +3,8 @@ on: push: pull_request: types: [opened, reopened] + schedule: + - cron: "44 4 * * *" jobs: validate-tag-if-present: @@ -37,71 +39,266 @@ jobs: run: | echo "yes it ran" + docker-detection-testing-setup: + runs-on: ubuntu-latest + needs: [validate-tag-if-present, quit-for-dependabot] + steps: + - name: Get branch and PR required for detection testing main.py + id: vars + run: | + echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" - detection-testing: - runs-on: ubuntu-latest - environment: Detection-Testing-Approval - needs: [validate-tag-if-present, quit-for-dependabot] - steps: - - - name: Checkout Repo - uses: actions/checkout@v2 - - - #The following branch name only works (and is only used) for a push - #to a branch. We used a different method for getting the source branch - #from a PR - - name: Get branch and PR required for detection testing main.py - id: vars - run: | - echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" - - - name: Install System Packages - run: | - sudo apt update -qq - sudo apt install jq -qq + - name: Checkout Repo + uses: actions/checkout@v2 - - uses: actions/setup-python@v2 - with: - python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy - architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + - - name: Install Python Dependencies - run: | - #Get the virtualenv set up - cd bin/automated_detection_testing/ci/python_ci_code - rm -rf venv - python3 -m venv --clear venv - source venv/bin/activate - python3 -m pip install --upgrade pip - python3 -m pip install wheel - python3 -m pip install -q -r requirements.txt + - uses: actions/setup-python@v2 + with: + python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + - name: Install Python Dependencies + run: | + cd bin/automated_detection_testing/ci/detection_testing_batch + python3 -m venv .venv + source .venv/bin/activate + python3 -m pip install wheel + python3 -m pip install -r requirements.txt + + - name: Run the CI + run: | + cd bin/automated_detection_testing/ci/detection_testing_batch + source .venv/bin/activate + echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]" + echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]" + echo "steps.vars.outputs.branch : [${{ steps.vars.outputs.branch }}]" + echo "github.event.pull_request.head.ref : [${{ github.event.pull_request.head.ref }}]" + + + + if [[ ${{ steps.vars.outputs.branch }} == develop ]]; then + echo "Running a nightly test on all detections" + python detection_testing_execution.py run --branch ${{ github.event.pull_request.head.ref }} --mode all --mock --config_file test_config_github_actions.json + elif [[ ! -z "${{ github.event.pull_request.head.ref }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then + echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]" + python detection_testing_execution.py run --branch ${{ github.event.pull_request.head.ref }} --pr_number ${{ github.event.pull_request.number }} --mode changes --mock --config_file test_config_github_actions.json + else + echo "Push from branch [${{ steps.vars.outputs.branch }}]" + python detection_testing_execution.py run --branch ${{ steps.vars.outputs.branch }} --mode changes --mock --config_file test_config_github_actions.json + fi + + mv *-test-run.json replicate_test.json + - name: Upload Test Results Files + uses: actions/upload-artifact@v2 + with: + name: testing-results-config + path: | + bin/automated_detection_testing/ci/detection_testing_batch/prior_config/apps/DA-ESS-ContentUpdate-latest.tar.gz + bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_0.json + bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_1.json + bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_2.json + bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_3.json + bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_4.json + bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_5.json + bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_6.json + bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_7.json + bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_8.json + bin/automated_detection_testing/ci/detection_testing_batch/prior_config/config_tests_9.json + + - name: Upload File to Enable Replication of the Test at a Different Time or Place + uses: actions/upload-artifact@v2 + with: + name: replicate_test + path: | + bin/automated_detection_testing/ci/detection_testing_batch/replicate_test.json + + docker-detection-testing-execution: + runs-on: ubuntu-latest + needs: [docker-detection-testing-setup] + strategy: + matrix: + manifest_filename: ["config_tests_0.json", + "config_tests_1.json", + "config_tests_2.json", + "config_tests_3.json", + "config_tests_4.json", + "config_tests_5.json", + "config_tests_6.json", + "config_tests_7.json", + "config_tests_8.json", + "config_tests_9.json"] + steps: + - name: Get branch and PR required for detection testing main.py + id: vars + run: | + echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" + + - name: Checkout Repo + uses: actions/checkout@v2 + + - name: Download artifacts + uses: actions/download-artifact@v2 + with: + name: testing-results-config + path: bin/automated_detection_testing/ci/detection_testing_batch/prior_config + + + - uses: actions/setup-python@v2 + with: + python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + - name: Install Python Dependencies + run: | + cd bin/automated_detection_testing/ci/detection_testing_batch + python3 -m venv .venv + source .venv/bin/activate + python3 -m pip install wheel + python3 -m pip install -r requirements.txt + + - name: Run the CI + run: | + cd bin/automated_detection_testing/ci/detection_testing_batch + source .venv/bin/activate + + python3 detection_testing_execution.py run -c prior_config/${{ matrix.manifest_filename}} --splunkbase_username ${{ secrets.SPLUNKBASE_TESTING_USERNAME }} --splunkbase_password ${{ secrets.SPLUNKBASE_TESTING_KEY }} + + + - name: Upload Test Results Files + uses: actions/upload-artifact@v2 + with: + name: ${{ matrix.manifest_filename}}.results + path: | + bin/automated_detection_testing/ci/detection_testing_batch/test_results/success.csv + bin/automated_detection_testing/ci/detection_testing_batch/test_results/error.csv + bin/automated_detection_testing/ci/detection_testing_batch/test_results/failure.csv + bin/automated_detection_testing/ci/detection_testing_batch/test_results/combined.csv + bin/automated_detection_testing/ci/detection_testing_batch/test_results/success.json + bin/automated_detection_testing/ci/detection_testing_batch/test_results/error.json + bin/automated_detection_testing/ci/detection_testing_batch/test_results/failure.json + bin/automated_detection_testing/ci/detection_testing_batch/test_results/combined.json + + bin/automated_detection_testing/ci/detection_testing_batch/test_results/summary.json - - #Set up credentials in the environment so that boto will be able to find them - - uses: aws-actions/configure-aws-credentials@v1 - with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - #Right now the script is hard coded to EU because of the dev who originally wrote it... - #probably change that arg to None and set here? - aws-region: us-west-1 #assume we will always use this, could make this an environment variable... + docker-detection-testing-execution-merge-results: + runs-on: ubuntu-latest + needs: [docker-detection-testing-setup, docker-detection-testing-execution] + + steps: + - name: Get branch and PR required for detection testing main.py + id: vars + run: | + echo "::set-output name=branch::${GITHUB_REF#refs/heads/}" + + - name: Checkout Repo + uses: actions/checkout@v2 + + - name: Download artifacts + uses: actions/download-artifact@v2 + with: + name: config_tests_0.json.results + path: bin/automated_detection_testing/ci/detection_testing_batch/results_0 + - name: Download artifacts + uses: actions/download-artifact@v2 + with: + name: config_tests_1.json.results + path: bin/automated_detection_testing/ci/detection_testing_batch/results_1 + - name: Download artifacts + uses: actions/download-artifact@v2 + with: + name: config_tests_2.json.results + path: bin/automated_detection_testing/ci/detection_testing_batch/results_2 + - name: Download artifacts + uses: actions/download-artifact@v2 + with: + name: config_tests_3.json.results + path: bin/automated_detection_testing/ci/detection_testing_batch/results_3 + - name: Download artifacts + uses: actions/download-artifact@v2 + with: + name: config_tests_4.json.results + path: bin/automated_detection_testing/ci/detection_testing_batch/results_4 + - name: Download artifacts + uses: actions/download-artifact@v2 + with: + name: config_tests_5.json.results + path: bin/automated_detection_testing/ci/detection_testing_batch/results_5 + - name: Download artifacts + uses: actions/download-artifact@v2 + with: + name: config_tests_6.json.results + path: bin/automated_detection_testing/ci/detection_testing_batch/results_6 + - name: Download artifacts + uses: actions/download-artifact@v2 + with: + name: config_tests_7.json.results + path: bin/automated_detection_testing/ci/detection_testing_batch/results_7 + - name: Download artifacts + uses: actions/download-artifact@v2 + with: + name: config_tests_8.json.results + path: bin/automated_detection_testing/ci/detection_testing_batch/results_8 + - name: Download artifacts + uses: actions/download-artifact@v2 + with: + name: config_tests_9.json.results + path: bin/automated_detection_testing/ci/detection_testing_batch/results_9 + + - uses: actions/setup-python@v2 + with: + python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + - name: Install Python Dependencies + run: | + cd bin/automated_detection_testing/ci/detection_testing_batch + python3 -m venv .venv + source .venv/bin/activate + python3 -m pip install wheel + python3 -m pip install -r requirements.txt + + - name: Merge Detections into single File + run: | + cd bin/automated_detection_testing/ci/detection_testing_batch + source .venv/bin/activate + python summarize_json.py --files results_*/summary.json --output_filename summary_test_results.json + + + - name: Upload Summary Test Results JSON + uses: actions/upload-artifact@v2 + if: always() + with: + name: SummaryTestResults + path: | + bin/automated_detection_testing/ci/detection_testing_batch/summary_test_results.json + + - name: Upload Failures Manifest on Failure + uses: actions/upload-artifact@v2 + if: failure() + with: + name: DetectionFailureManifest + path: | + bin/automated_detection_testing/ci/detection_testing_batch/detection_failure_manifest.json + + + #Always clean these up, they make the output messy + - name: Clean up intermediate Files + uses: geekyeggo/delete-artifact@v1 + if: always() + with: + name: | + config_tests_0.json.results + config_tests_1.json.results + config_tests_2.json.results + config_tests_3.json.results + config_tests_4.json.results + config_tests_5.json.results + config_tests_6.json.results + config_tests_7.json.results + config_tests_8.json.results + config_tests_9.json.results + + - - name: Run Detection testing - timeout-minutes: 120 - run: | - cd bin/automated_detection_testing/ci/python_ci_code - source venv/bin/activate - - echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]" - echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]" - echo "steps.vars.outputs.branch : [${{ steps.vars.outputs.branch }}]" - echo "github.event.pull_request.head.ref: [${{ github.event.pull_request.head.ref }}]" - if [[ ! -z "${{ github.event.pull_request.head.ref }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then - echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]" - python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }} - else - echo "Push from branch [${{ steps.vars.outputs.branch }}]" - python3 main.py -b ${{ steps.vars.outputs.branch }} - fi diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py b/bin/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py index e88cce0acd..ae4ae4ef2b 100644 --- a/bin/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py +++ b/bin/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py @@ -27,7 +27,7 @@ from docker.client import DockerClient from requests import get import modules.new_arguments2 -from modules import (aws_service, container_manager, new_arguments2, +from modules import (container_manager, new_arguments2, testing_service, validate_args) from modules.github_service import GithubService from modules.validate_args import validate, validate_and_write diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py b/bin/automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py deleted file mode 100644 index eaf2750597..0000000000 --- a/bin/automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py +++ /dev/null @@ -1,96 +0,0 @@ -import boto3 -import uuid - - - -def get_ar_information_from_dynamo_db(region, db_name): - resource = boto3.resource('dynamodb', region_name=region) - table = resource.Table(db_name) - response = table.get_item( - Key={ - 'name': 'detection-testing-attack-range' - } - ) - if 'Item' in response: - return response['Item'] - else: - return {} - - -def get_splunk_instance(region, key_name): - client = boto3.client('ec2', region_name=region) - response = client.describe_instances( - Filters=[ - { - 'Name': "key-name", - 'Values': [key_name] - } - ] - ) - instances = [] - for reservation in response['Reservations']: - for instance in reservation['Instances']: - if instance['State']['Name']!='terminated': - if len(instance['Tags']) > 0: - tag = instance['Tags'][0]['Value'] - if key_name in tag: - return instance - - return {} - - -def dynamo_db_nothing_to_test(region, uuid_test, time): - uuid_var = str(uuid.uuid4()) - resource = boto3.resource('dynamodb', region_name=region) - table = resource.Table("dt-results") - response = table.put_item(Item= { - 'uuid': uuid_var, - 'uuid_test': uuid_test, - 'time': time, - 'status': 'nothing to test' - }) - - -def add_detection_results_in_dynamo_db(region, uuid, uuid_test, detection, detection_path, time): - resource = boto3.resource('dynamodb', region_name=region) - table = resource.Table("dt-results") - response = table.put_item(Item= { - 'uuid': uuid, - 'uuid_test': uuid_test, - 'detection': detection, - 'detection_path': detection_path, - 'time': time, - 'status': 'running' - }) - - -def update_detection_results_in_dynamo_db(region, uuid, result): - resource = boto3.resource('dynamodb', region_name=region) - table = resource.Table("dt-results") - response = table.update_item( - Key={ - 'uuid': uuid - }, - UpdateExpression="set #ts=:s", - ExpressionAttributeValues={ - ':s': 'done' - }, - ExpressionAttributeNames={ - "#ts": "status" - }, - ReturnValues="UPDATED_NEW" - ) - - response = table.update_item( - Key={ - 'uuid': uuid - }, - UpdateExpression="set #ts=:s", - ExpressionAttributeValues={ - ':s': result - }, - ExpressionAttributeNames={ - "#ts": "result" - }, - ReturnValues="UPDATED_NEW" - ) \ No newline at end of file diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py b/bin/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py index 036ef3d2b2..50119f22f5 100644 --- a/bin/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py +++ b/bin/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py @@ -81,7 +81,7 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa abs_folder_path = mkdtemp(prefix="DATA_", dir=attack_data_root_folder) - #The ansible playbook wants the relative path, so we convert it as required + #We want the relative path, so we convert it as required folder_name = relpath(abs_folder_path, os.getcwd()) @@ -182,40 +182,4 @@ def load_file(file_path): return file -# def update_ESCU_app(container_name, splunk_password): -# print("Update ESCU App. This can take some time") -# ansible_vars = {} -# ansible_vars['ansible_user'] = 'ansible_user' -# ansible_vars['splunk_password'] = splunk_password -# ansible_vars['security_content_path'] = 'security_content' - -# cmdline = "--connection docker -i %s, -u %s" % (container_name, ansible_vars['ansible_user']) - -# runner = ansible_runner.run(private_data_dir=os.path.join(os.path.dirname(__file__), '../'), -# cmdline=cmdline, -# roles_path=os.path.join(os.path.dirname(__file__), '../ansible/roles'), -# playbook=os.path.join(os.path.dirname(__file__), '../ansible/update_escu.yml'), -# extravars=ansible_vars) -# print("Successfully updated the ESCU App!") - - -# def replay_attack_dataset(container_name, splunk_password, folder_name, index, sourcetype, source, out): -# ansible_vars = {} -# ansible_vars['folder_name'] = folder_name -# ansible_vars['ansible_user'] = 'ansible' - -# ansible_vars['splunk_password'] = splunk_password -# ansible_vars['out'] = out -# ansible_vars['sourcetype'] = sourcetype -# ansible_vars['source'] = source -# ansible_vars['index'] = index - - -# cmdline = "--connection docker -i %s, -u %s" % (container_name, ansible_vars['ansible_user']) - -# runner = ansible_runner.run(private_data_dir=os.path.join(os.path.dirname(__file__), '../'), -# cmdline=cmdline, -# roles_path=os.path.join(os.path.dirname(__file__), '../ansible/roles'), -# playbook=os.path.join(os.path.dirname(__file__), '../ansible/attack_replay.yml'), -# extravars=ansible_vars) diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/requirements.txt b/bin/automated_detection_testing/ci/detection_testing_batch/requirements.txt index d8419b7d63..6986ae3ee8 100644 --- a/bin/automated_detection_testing/ci/detection_testing_batch/requirements.txt +++ b/bin/automated_detection_testing/ci/detection_testing_batch/requirements.txt @@ -1,7 +1,5 @@ -ansible==4.2.0 -ansible-runner==1.4.4 +psutil==5.8.0 attackcti==0.3.4.3 -boto3==1.11.0 GitPython==3.1.14 Jinja2==3.0.0 PyYAML==5.4