From 7d0ddc452cff0810f2fa035697e6aa74c0eaeada Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 2 Oct 2019 18:25:55 -0400 Subject: [PATCH] cleaned up some functions --- package/bin/detect.py | 140 +++++++++++++++++++++++------------------- 1 file changed, 77 insertions(+), 63 deletions(-) diff --git a/package/bin/detect.py b/package/bin/detect.py index ab3a9bb5d5..454e13bb7c 100644 --- a/package/bin/detect.py +++ b/package/bin/detect.py @@ -153,60 +153,47 @@ class DetectCommand(GeneratingCommand): self.collection_results['executed_by'] = self.story_results['executed_by'] collection.data.insert(json.dumps(self.collection_results)) - def generate(self): - # connect to splunk and start execution - port = splunk.getDefault('port') - service = splunklib.client.connect(token=self._metadata.searchinfo.session_key, port=port, owner="nobody") - self.logger.info("detect.pytime - starting run story") - - # get story name - self.story_results['story'] = self.story - - # get username + def _get_username(self, service): search = '| rest /services/authentication/current-context/context | fields + username' results = service.jobs.oneshot(search) username_results = splunklib.results.ResultsReader(results) username = next(iter(username_results))['username'] self.story_results['executed_by'] = username - # get time window - if hasattr(self.search_results_info, 'search_et') and hasattr(self.search_results_info, 'search_lt'): - earliest_time = self.search_results_info.search_et - latest_time = self.search_results_info.search_lt - # get saved_searches - savedsearches = service.saved_searches + def _process_job_results(self,job_reults): + # if there are results lets process them + if job['resultCount'] > "0": + # place to store results and entity results + detection_results = [] - # create collection if it does not exists otherwise wipe it - collection_name = "story_results_test" - if self.COLLECTION_NAME in service.kvstore: - service.kvstore.delete(self.COLLECTION_NAME) - service.kvstore.create(self.COLLECTION_NAME) + entities = [] + entity_results = dict() - collection = service.kvstore[self.COLLECTION_NAME] - support_search_name = ["No Support or Baseline search in this Analytic Story"] + # process results + for result in job_results: + # add store detection results + detection_results.append(dict(result)) - # get all savedsearches content - for savedsearch in savedsearches: - content = savedsearch.content - + # lets process entity results now + entity = self._process_entities(result, search, entity_results) - # check we are on the right story - if 'action.escu.analytic_story' in content and self.story in content['action.escu.analytic_story']: + entities.append(entity) - # if it has a support search grab it otherwise replace its value with a message - # THIS CAN BE REMOVED AFTER BASELINE MODULE IS CONSTRUCTED - if content['action.escu.search_type'] == 'support': - support_searches_to_run = self._support_searches(content) - support_search_name = self._run_support(support_searches_to_run, service, earliest_time, - latest_time) - - # if it has detection searches grab it - if content['action.escu.search_type'] == 'detection': - detection_searches_to_run = self._detection_searches(content) + # self.logger.info("detect.py - PROCESSED ENTITY {0} | SEARCH: {1}".format(entity, search['search_name'])) - # lets create a array to store our detections in + detection = {} + detection['detection_result_count'] = job['resultCount'] + detection['detection_search_name'] = search['search_name'] + detection['mappings'] = search['mappings'] + detection['detection_results'] = detection_results + detection['support_search_name'] = support_search_name + detection['entities'] = entities + self.story_results['detections'].append(detection) + + def _run_detections(self, detection_searches_to_run, service): + # create an array to store our detections in self.story_results['detections'] = [] # run detection searches @@ -237,36 +224,63 @@ class DetectCommand(GeneratingCommand): # process raw results with reader job_results = splunklib.results.ResultsReader(job.results()) - # if there are results lets process them - if job['resultCount'] > "0": - # place to store results and entity results - detection_results = [] + # process job results into detection objects extract the necessary keys + self._process_job_results(job_results) - entities = [] - entity_results = dict() - # process results - for result in job_results: - # add store detection results - detection_results.append(dict(result)) + def generate(self): - # lets process entity results now - entity = self._process_entities(result, search, entity_results) + # connect to splunk and start execution + port = splunk.getDefault('port') + service = splunklib.client.connect(token=self._metadata.searchinfo.session_key, port=port, owner="nobody") + self.logger.info("detect.pytime - starting run story") - entities.append(entity) + # get story name + self.story_results['story'] = self.story - #self.logger.info("detect.py - PROCESSED ENTITY {0} | SEARCH: {1}".format(entity, search['search_name'])) + # get username + self._get_username(service) - detection = {} - detection['detection_result_count'] = job['resultCount'] - detection['detection_search_name'] = search['search_name'] - detection['mappings'] = search['mappings'] - detection['detection_results'] = detection_results - detection['support_search_name'] = support_search_name - detection['entities'] = entities - self.story_results['detections'].append(detection) + # get time window + if hasattr(self.search_results_info, 'search_et') and hasattr(self.search_results_info, 'search_lt'): + earliest_time = self.search_results_info.search_et + latest_time = self.search_results_info.search_lt - # lets store our collections + # get saved_searches + savedsearches = service.saved_searches + + # create collection if it does not exists otherwise wipe it + if self.COLLECTION_NAME in service.kvstore: + service.kvstore.delete(self.COLLECTION_NAME) + service.kvstore.create(self.COLLECTION_NAME) + + collection = service.kvstore[self.COLLECTION_NAME] + + # if there are no support searches lets pre-set a value + support_search_name = ["No Support or Baseline search in this Analytic Story"] + + # get all savedsearches content + for savedsearch in savedsearches: + content = savedsearch.content + + # check we are on the right story + if 'action.escu.analytic_story' in content and self.story in content['action.escu.analytic_story']: + + # if it has a support search grab it otherwise replace its value with a message + # THIS CAN BE REMOVED AFTER BASELINE MODULE IS CONSTRUCTED + if content['action.escu.search_type'] == 'support': + support_searches_to_run = self._support_searches(content) + support_search_name = self._run_support(support_searches_to_run, service, earliest_time, + latest_time) + + # if it has detection searches grab it + if content['action.escu.search_type'] == 'detection': + detection_searches_to_run = self._detection_searches(content) + + # now lets run all the detection searches and process their results into story_results['detections'] + self._run_detections(detection_searches_to_run, service) + + # lets store our collections self._store_collections(collection) yield {