mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
cleaned up some functions
This commit is contained in:
divious1
+77
-63
@@ -153,60 +153,47 @@ class DetectCommand(GeneratingCommand):
|
||||
self.collection_results['executed_by'] = self.story_results['executed_by']
|
||||
collection.data.insert(json.dumps(self.collection_results))
|
||||
|
||||
def generate(self):
|
||||
|
||||
# connect to splunk and start execution
|
||||
port = splunk.getDefault('port')
|
||||
service = splunklib.client.connect(token=self._metadata.searchinfo.session_key, port=port, owner="nobody")
|
||||
self.logger.info("detect.pytime - starting run story")
|
||||
|
||||
# get story name
|
||||
self.story_results['story'] = self.story
|
||||
|
||||
# get username
|
||||
def _get_username(self, service):
|
||||
search = '| rest /services/authentication/current-context/context | fields + username'
|
||||
results = service.jobs.oneshot(search)
|
||||
username_results = splunklib.results.ResultsReader(results)
|
||||
username = next(iter(username_results))['username']
|
||||
self.story_results['executed_by'] = username
|
||||
|
||||
# get time window
|
||||
if hasattr(self.search_results_info, 'search_et') and hasattr(self.search_results_info, 'search_lt'):
|
||||
earliest_time = self.search_results_info.search_et
|
||||
latest_time = self.search_results_info.search_lt
|
||||
|
||||
# get saved_searches
|
||||
savedsearches = service.saved_searches
|
||||
def _process_job_results(self,job_reults):
|
||||
# if there are results lets process them
|
||||
if job['resultCount'] > "0":
|
||||
# place to store results and entity results
|
||||
detection_results = []
|
||||
|
||||
# create collection if it does not exists otherwise wipe it
|
||||
collection_name = "story_results_test"
|
||||
if self.COLLECTION_NAME in service.kvstore:
|
||||
service.kvstore.delete(self.COLLECTION_NAME)
|
||||
service.kvstore.create(self.COLLECTION_NAME)
|
||||
entities = []
|
||||
entity_results = dict()
|
||||
|
||||
collection = service.kvstore[self.COLLECTION_NAME]
|
||||
support_search_name = ["No Support or Baseline search in this Analytic Story"]
|
||||
# process results
|
||||
for result in job_results:
|
||||
# add store detection results
|
||||
detection_results.append(dict(result))
|
||||
|
||||
# get all savedsearches content
|
||||
for savedsearch in savedsearches:
|
||||
content = savedsearch.content
|
||||
|
||||
# lets process entity results now
|
||||
entity = self._process_entities(result, search, entity_results)
|
||||
|
||||
# check we are on the right story
|
||||
if 'action.escu.analytic_story' in content and self.story in content['action.escu.analytic_story']:
|
||||
entities.append(entity)
|
||||
|
||||
# if it has a support search grab it otherwise replace its value with a message
|
||||
# THIS CAN BE REMOVED AFTER BASELINE MODULE IS CONSTRUCTED
|
||||
if content['action.escu.search_type'] == 'support':
|
||||
support_searches_to_run = self._support_searches(content)
|
||||
support_search_name = self._run_support(support_searches_to_run, service, earliest_time,
|
||||
latest_time)
|
||||
|
||||
# if it has detection searches grab it
|
||||
if content['action.escu.search_type'] == 'detection':
|
||||
detection_searches_to_run = self._detection_searches(content)
|
||||
# self.logger.info("detect.py - PROCESSED ENTITY {0} | SEARCH: {1}".format(entity, search['search_name']))
|
||||
|
||||
# lets create a array to store our detections in
|
||||
detection = {}
|
||||
detection['detection_result_count'] = job['resultCount']
|
||||
detection['detection_search_name'] = search['search_name']
|
||||
detection['mappings'] = search['mappings']
|
||||
detection['detection_results'] = detection_results
|
||||
detection['support_search_name'] = support_search_name
|
||||
detection['entities'] = entities
|
||||
self.story_results['detections'].append(detection)
|
||||
|
||||
def _run_detections(self, detection_searches_to_run, service):
|
||||
# create an array to store our detections in
|
||||
self.story_results['detections'] = []
|
||||
|
||||
# run detection searches
|
||||
@@ -237,36 +224,63 @@ class DetectCommand(GeneratingCommand):
|
||||
# process raw results with reader
|
||||
job_results = splunklib.results.ResultsReader(job.results())
|
||||
|
||||
# if there are results lets process them
|
||||
if job['resultCount'] > "0":
|
||||
# place to store results and entity results
|
||||
detection_results = []
|
||||
# process job results into detection objects extract the necessary keys
|
||||
self._process_job_results(job_results)
|
||||
|
||||
entities = []
|
||||
entity_results = dict()
|
||||
|
||||
# process results
|
||||
for result in job_results:
|
||||
# add store detection results
|
||||
detection_results.append(dict(result))
|
||||
def generate(self):
|
||||
|
||||
# lets process entity results now
|
||||
entity = self._process_entities(result, search, entity_results)
|
||||
# connect to splunk and start execution
|
||||
port = splunk.getDefault('port')
|
||||
service = splunklib.client.connect(token=self._metadata.searchinfo.session_key, port=port, owner="nobody")
|
||||
self.logger.info("detect.pytime - starting run story")
|
||||
|
||||
entities.append(entity)
|
||||
# get story name
|
||||
self.story_results['story'] = self.story
|
||||
|
||||
#self.logger.info("detect.py - PROCESSED ENTITY {0} | SEARCH: {1}".format(entity, search['search_name']))
|
||||
# get username
|
||||
self._get_username(service)
|
||||
|
||||
detection = {}
|
||||
detection['detection_result_count'] = job['resultCount']
|
||||
detection['detection_search_name'] = search['search_name']
|
||||
detection['mappings'] = search['mappings']
|
||||
detection['detection_results'] = detection_results
|
||||
detection['support_search_name'] = support_search_name
|
||||
detection['entities'] = entities
|
||||
self.story_results['detections'].append(detection)
|
||||
# get time window
|
||||
if hasattr(self.search_results_info, 'search_et') and hasattr(self.search_results_info, 'search_lt'):
|
||||
earliest_time = self.search_results_info.search_et
|
||||
latest_time = self.search_results_info.search_lt
|
||||
|
||||
# lets store our collections
|
||||
# get saved_searches
|
||||
savedsearches = service.saved_searches
|
||||
|
||||
# create collection if it does not exists otherwise wipe it
|
||||
if self.COLLECTION_NAME in service.kvstore:
|
||||
service.kvstore.delete(self.COLLECTION_NAME)
|
||||
service.kvstore.create(self.COLLECTION_NAME)
|
||||
|
||||
collection = service.kvstore[self.COLLECTION_NAME]
|
||||
|
||||
# if there are no support searches lets pre-set a value
|
||||
support_search_name = ["No Support or Baseline search in this Analytic Story"]
|
||||
|
||||
# get all savedsearches content
|
||||
for savedsearch in savedsearches:
|
||||
content = savedsearch.content
|
||||
|
||||
# check we are on the right story
|
||||
if 'action.escu.analytic_story' in content and self.story in content['action.escu.analytic_story']:
|
||||
|
||||
# if it has a support search grab it otherwise replace its value with a message
|
||||
# THIS CAN BE REMOVED AFTER BASELINE MODULE IS CONSTRUCTED
|
||||
if content['action.escu.search_type'] == 'support':
|
||||
support_searches_to_run = self._support_searches(content)
|
||||
support_search_name = self._run_support(support_searches_to_run, service, earliest_time,
|
||||
latest_time)
|
||||
|
||||
# if it has detection searches grab it
|
||||
if content['action.escu.search_type'] == 'detection':
|
||||
detection_searches_to_run = self._detection_searches(content)
|
||||
|
||||
# now lets run all the detection searches and process their results into story_results['detections']
|
||||
self._run_detections(detection_searches_to_run, service)
|
||||
|
||||
# lets store our collections
|
||||
self._store_collections(collection)
|
||||
|
||||
yield {
|
||||
|
||||
Reference in New Issue
Block a user