Merge branch 'develop' of github.com:splunk/security-content into tf23

README.md

@@ -4,6 +4,8 @@
         <img src="https://img.shields.io/github/v/release/splunk/security_content" /></a>
     <a href="https://circleci.com/gh/splunk/security_content/tree/develop">
         <img src="https://img.shields.io/circleci/build/github/splunk/security_content?token=67ad1fa7779c57d7e5bcfc42bd617baf607ec269" /></a>
+    <a href="https://github.com/splunk/security_content">
+        <img src="https://security-content.s3-us-west-2.amazonaws.com/reporting/detection_count.svg" /></a>
     <a href="https://github.com/splunk/security_content">
         <img src="https://security-content.s3-us-west-2.amazonaws.com/reporting/detection_coverage.svg" /></a>
     <a href="https://github.com/splunk/security_content">

automated_detection_testing/requirements.txt

@@ -1,5 +1,5 @@
 ansible==2.10.7
-ansible-runner==1.4.6
+ansible-runner==1.4.7
 apipkg==1.5
 aspy.yaml==1.3.0
 atomicwrites==1.4.0

bin/jinja2_templates/detection_count.j2

@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="105" height="20">
+<linearGradient id="a" x2="0" y2="100%">
+  <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+  <stop offset="2" stop-opacity=".1"/>
+</linearGradient>
+
+<rect rx="3" width="65" height="20" fill="#555"/> <!-- Comment -->
+<rect rx="3" x="65" width="40" height="20" fill="#4c1"/>
+
+<path fill="#4c1" d="M63 0h4v20h-4z"/>
+
+<rect rx="3" width="105" height="20" fill="url(#a)"/>
+<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
+    <text x="30" y="14">detections</text>
+    <text x="83" y="14">{{ detection_count }}</text>
+</g>
+</svg>

bin/jinja2_templates/detection_coverage.j2

@@ -12,7 +12,6 @@
 
 <rect rx="3" width="100" height="20" fill="url(#a)"/>
 <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
-    <text x="30" y="15" fill="#010101" fill-opacity=".3">coverage</text>
     <text x="30" y="14">coverage</text>
     <text x="80" y="14">{{ detection_coverage }}</text>
 </g>

bin/reporting.py

@@ -40,6 +40,11 @@ def main(args):
     detections.extend(load_objects("detections/network/*.yml", REPO_PATH))
     detections.extend(load_objects("detections/web/*.yml", REPO_PATH))
 
+    detections_all = detections.copy()
+    detections_all.extend(load_objects("detections/deprecated/*.yml", REPO_PATH))
+    detections_all.extend(load_objects("detections/experimental/*/*.yml", REPO_PATH))
+    count_detections_all = len(detections_all)
+
     tests = load_objects("tests/*/*.yml", REPO_PATH)
 
     counter_tests=0
@@ -56,12 +61,18 @@ def main(args):
     TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates')
     OUTPUT_PATH = os.path.join(os.path.dirname(__file__), 'reporting')
     j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), trim_blocks=True)
-    template = j2_env.get_template('svg_badge.j2')
+    template = j2_env.get_template('detection_coverage.j2')
     output_path = path.join(OUTPUT_PATH, 'detection_coverage.svg')
     output = template.render(detection_coverage=detection_coverage)
     with open(output_path, 'w', encoding="utf-8") as f:
         f.write(output)
 
+    template = j2_env.get_template('detection_count.j2')
+    output_path = path.join(OUTPUT_PATH, 'detection_count.svg')
+    output = template.render(detection_count=count_detections_all)
+    with open(output_path, 'w', encoding="utf-8") as f:
+        f.write(output)
+
 
 if __name__ == "__main__":
     main(sys.argv[1:])

bin/reporting/detection_count.svg

@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="105" height="20">
+<linearGradient id="a" x2="0" y2="100%">
+  <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+  <stop offset="2" stop-opacity=".1"/>
+</linearGradient>
+
+<rect rx="3" width="65" height="20" fill="#555"/> <!-- Comment -->
+<rect rx="3" x="65" width="40" height="20" fill="#4c1"/>
+
+<path fill="#4c1" d="M63 0h4v20h-4z"/>
+
+<rect rx="3" width="105" height="20" fill="url(#a)"/>
+<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
+    <text x="30" y="14">detections</text>
+    <text x="83" y="14">357</text>
+</g>
+</svg>

bin/reporting/detection_coverage.svg

@@ -12,8 +12,7 @@
 
 <rect rx="3" width="100" height="20" fill="url(#a)"/>
 <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
-    <text x="30" y="15" fill="#010101" fill-opacity=".3">coverage</text>
     <text x="30" y="14">coverage</text>
-    <text x="80" y="14">82%</text>
+    <text x="80" y="14">83%</text>
 </g>
 </svg>

detections/application/okta_user_logins_from_multiple_cities.yml

@@ -5,7 +5,7 @@ date: '2020-07-21'
 author: Rico Valdez, Splunk
 type: batch
 datamodel: []
-description: This search detects logins from the same user from different states in
+description: This search detects logins from the same user from different cities in
   a 24 hour period.
 search: '`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null
   | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city)

lookups/rare_process_allow_list_default.csv

@@ -1,4 +1,4 @@
-process,whitelist
+process,allow_list
 splunk-regmon.exe,true
 winword.exe,true
 excel.exe,true

lookups/rare_process_allow_list_local.csv

@@ -1 +1 @@
-process,whitelist
+process,allow_list