From aee30a3812d41fcc59f57ed97100c14906f33eb9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 12 Feb 2021 14:02:38 +0000 Subject: [PATCH 1/4] Bump ansible-runner from 1.4.6 to 1.4.7 Bumps [ansible-runner](https://github.com/ansible/ansible-runner) from 1.4.6 to 1.4.7. - [Release notes](https://github.com/ansible/ansible-runner/releases) - [Changelog](https://github.com/ansible/ansible-runner/blob/1.4.7/CHANGES.rst) - [Commits](https://github.com/ansible/ansible-runner/compare/1.4.6...1.4.7) Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 4ce1f2241b..02aef10429 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -1,5 +1,5 @@ ansible==2.10.7 -ansible-runner==1.4.6 +ansible-runner==1.4.7 apipkg==1.5 aspy.yaml==1.3.0 atomicwrites==1.4.0 From c189c7b3410ca2385520387a9eb4eda76cf7459d Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 16 Feb 2021 10:10:20 +0100 Subject: [PATCH 2/4] Add custom Detection Count Banner --- README.md | 2 ++ bin/jinja2_templates/detection_count.j2 | 18 ++++++++++++++++++ .../{svg_badge.j2 => detection_coverage.j2} | 1 - bin/reporting.py | 13 ++++++++++++- bin/reporting/detection_count.svg | 18 ++++++++++++++++++ bin/reporting/detection_coverage.svg | 3 +-- 6 files changed, 51 insertions(+), 4 deletions(-) create mode 100644 bin/jinja2_templates/detection_count.j2 rename bin/jinja2_templates/{svg_badge.j2 => detection_coverage.j2} (90%) create mode 100644 bin/reporting/detection_count.svg diff --git a/README.md b/README.md index d207e71a1d..473442f261 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,8 @@ + + diff --git a/bin/jinja2_templates/detection_count.j2 b/bin/jinja2_templates/detection_count.j2 new file mode 100644 index 0000000000..993e7ce876 --- /dev/null +++ b/bin/jinja2_templates/detection_count.j2 @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + detections + {{ detection_count }} + + diff --git a/bin/jinja2_templates/svg_badge.j2 b/bin/jinja2_templates/detection_coverage.j2 similarity index 90% rename from bin/jinja2_templates/svg_badge.j2 rename to bin/jinja2_templates/detection_coverage.j2 index b598da6aac..2c8362be37 100644 --- a/bin/jinja2_templates/svg_badge.j2 +++ b/bin/jinja2_templates/detection_coverage.j2 @@ -12,7 +12,6 @@ - coverage coverage {{ detection_coverage }} diff --git a/bin/reporting.py b/bin/reporting.py index ced2479ed1..06d2646f92 100644 --- a/bin/reporting.py +++ b/bin/reporting.py @@ -40,6 +40,11 @@ def main(args): detections.extend(load_objects("detections/network/*.yml", REPO_PATH)) detections.extend(load_objects("detections/web/*.yml", REPO_PATH)) + detections_all = detections.copy() + detections_all.extend(load_objects("detections/deprecated/*.yml", REPO_PATH)) + detections_all.extend(load_objects("detections/experimental/*/*.yml", REPO_PATH)) + count_detections_all = len(detections_all) + tests = load_objects("tests/*/*.yml", REPO_PATH) counter_tests=0 @@ -56,12 +61,18 @@ def main(args): TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates') OUTPUT_PATH = os.path.join(os.path.dirname(__file__), 'reporting') j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), trim_blocks=True) - template = j2_env.get_template('svg_badge.j2') + template = j2_env.get_template('detection_coverage.j2') output_path = path.join(OUTPUT_PATH, 'detection_coverage.svg') output = template.render(detection_coverage=detection_coverage) with open(output_path, 'w', encoding="utf-8") as f: f.write(output) + template = j2_env.get_template('detection_count.j2') + output_path = path.join(OUTPUT_PATH, 'detection_count.svg') + output = template.render(detection_count=count_detections_all) + with open(output_path, 'w', encoding="utf-8") as f: + f.write(output) + if __name__ == "__main__": main(sys.argv[1:]) diff --git a/bin/reporting/detection_count.svg b/bin/reporting/detection_count.svg new file mode 100644 index 0000000000..aad718c430 --- /dev/null +++ b/bin/reporting/detection_count.svg @@ -0,0 +1,18 @@ + + + + + + + + + + + + + + + detections + 357 + + \ No newline at end of file diff --git a/bin/reporting/detection_coverage.svg b/bin/reporting/detection_coverage.svg index ae73966523..d04a62141a 100644 --- a/bin/reporting/detection_coverage.svg +++ b/bin/reporting/detection_coverage.svg @@ -12,8 +12,7 @@ - coverage coverage - 82% + 83% \ No newline at end of file From 6afaf49e44384d06f7895b593201b4f9e7c174dc Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 16 Feb 2021 09:45:00 -0500 Subject: [PATCH 3/4] fixing error reported by user --- lookups/rare_process_allow_list_default.csv | 2 +- lookups/rare_process_allow_list_local.csv | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lookups/rare_process_allow_list_default.csv b/lookups/rare_process_allow_list_default.csv index f13f3a18c5..cfc193563d 100644 --- a/lookups/rare_process_allow_list_default.csv +++ b/lookups/rare_process_allow_list_default.csv @@ -1,4 +1,4 @@ -process,whitelist +process,allow_list splunk-regmon.exe,true winword.exe,true excel.exe,true diff --git a/lookups/rare_process_allow_list_local.csv b/lookups/rare_process_allow_list_local.csv index 8b3eaefceb..2cca84e0ea 100644 --- a/lookups/rare_process_allow_list_local.csv +++ b/lookups/rare_process_allow_list_local.csv @@ -1 +1 @@ -process,whitelist +process,allow_list From 31b04f33a96e995fb9a71794245be8f19bd3a3ca Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 16 Feb 2021 16:26:07 -0500 Subject: [PATCH 4/4] fixed minor spelling mistake reported by George Starcher via user slack --- .../application/okta_user_logins_from_multiple_cities.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/okta_user_logins_from_multiple_cities.yml b/detections/application/okta_user_logins_from_multiple_cities.yml index 80a5e47e0b..35dba10164 100644 --- a/detections/application/okta_user_logins_from_multiple_cities.yml +++ b/detections/application/okta_user_logins_from_multiple_cities.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Rico Valdez, Splunk type: batch datamodel: [] -description: This search detects logins from the same user from different states in +description: This search detects logins from the same user from different cities in a 24 hour period. search: '`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city)