diff --git a/README.md b/README.md index d207e71a1d..473442f261 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,8 @@ + + diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 937cfc1345..4eea099786 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -1,5 +1,5 @@ ansible==2.10.7 -ansible-runner==1.4.6 +ansible-runner==1.4.7 apipkg==1.5 aspy.yaml==1.3.0 atomicwrites==1.4.0 diff --git a/bin/jinja2_templates/detection_count.j2 b/bin/jinja2_templates/detection_count.j2 new file mode 100644 index 0000000000..993e7ce876 --- /dev/null +++ b/bin/jinja2_templates/detection_count.j2 @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + detections + {{ detection_count }} + + diff --git a/bin/jinja2_templates/svg_badge.j2 b/bin/jinja2_templates/detection_coverage.j2 similarity index 90% rename from bin/jinja2_templates/svg_badge.j2 rename to bin/jinja2_templates/detection_coverage.j2 index b598da6aac..2c8362be37 100644 --- a/bin/jinja2_templates/svg_badge.j2 +++ b/bin/jinja2_templates/detection_coverage.j2 @@ -12,7 +12,6 @@ - coverage coverage {{ detection_coverage }} diff --git a/bin/reporting.py b/bin/reporting.py index ced2479ed1..06d2646f92 100644 --- a/bin/reporting.py +++ b/bin/reporting.py @@ -40,6 +40,11 @@ def main(args): detections.extend(load_objects("detections/network/*.yml", REPO_PATH)) detections.extend(load_objects("detections/web/*.yml", REPO_PATH)) + detections_all = detections.copy() + detections_all.extend(load_objects("detections/deprecated/*.yml", REPO_PATH)) + detections_all.extend(load_objects("detections/experimental/*/*.yml", REPO_PATH)) + count_detections_all = len(detections_all) + tests = load_objects("tests/*/*.yml", REPO_PATH) counter_tests=0 @@ -56,12 +61,18 @@ def main(args): TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates') OUTPUT_PATH = os.path.join(os.path.dirname(__file__), 'reporting') j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), trim_blocks=True) - template = j2_env.get_template('svg_badge.j2') + template = j2_env.get_template('detection_coverage.j2') output_path = path.join(OUTPUT_PATH, 'detection_coverage.svg') output = template.render(detection_coverage=detection_coverage) with open(output_path, 'w', encoding="utf-8") as f: f.write(output) + template = j2_env.get_template('detection_count.j2') + output_path = path.join(OUTPUT_PATH, 'detection_count.svg') + output = template.render(detection_count=count_detections_all) + with open(output_path, 'w', encoding="utf-8") as f: + f.write(output) + if __name__ == "__main__": main(sys.argv[1:]) diff --git a/bin/reporting/detection_count.svg b/bin/reporting/detection_count.svg new file mode 100644 index 0000000000..aad718c430 --- /dev/null +++ b/bin/reporting/detection_count.svg @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + detections + 357 + + \ No newline at end of file diff --git a/bin/reporting/detection_coverage.svg b/bin/reporting/detection_coverage.svg index ae73966523..d04a62141a 100644 --- a/bin/reporting/detection_coverage.svg +++ b/bin/reporting/detection_coverage.svg @@ -12,8 +12,7 @@ - coverage coverage - 82% + 83% \ No newline at end of file diff --git a/detections/application/okta_user_logins_from_multiple_cities.yml b/detections/application/okta_user_logins_from_multiple_cities.yml index 80a5e47e0b..35dba10164 100644 --- a/detections/application/okta_user_logins_from_multiple_cities.yml +++ b/detections/application/okta_user_logins_from_multiple_cities.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Rico Valdez, Splunk type: batch datamodel: [] -description: This search detects logins from the same user from different states in +description: This search detects logins from the same user from different cities in a 24 hour period. search: '`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) diff --git a/lookups/rare_process_allow_list_default.csv b/lookups/rare_process_allow_list_default.csv index f13f3a18c5..cfc193563d 100644 --- a/lookups/rare_process_allow_list_default.csv +++ b/lookups/rare_process_allow_list_default.csv @@ -1,4 +1,4 @@ -process,whitelist +process,allow_list splunk-regmon.exe,true winword.exe,true excel.exe,true diff --git a/lookups/rare_process_allow_list_local.csv b/lookups/rare_process_allow_list_local.csv index 8b3eaefceb..2cca84e0ea 100644 --- a/lookups/rare_process_allow_list_local.csv +++ b/lookups/rare_process_allow_list_local.csv @@ -1 +1 @@ -process,whitelist +process,allow_list