diff --git a/bin/docker_detection_tester/authorize.conf.tar b/bin/docker_detection_tester/authorize.conf.tar index 3a624a3b27..a525572e5b 100644 Binary files a/bin/docker_detection_tester/authorize.conf.tar and b/bin/docker_detection_tester/authorize.conf.tar differ diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index 2dc6c36556..f930e7531b 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -192,15 +192,15 @@ def test_baseline_search(splunk_host, splunk_port, splunk_password, search, pass # search = search.replace('\\','\\\\') if search.startswith('|'): - search = search + updated_search = search else: - search = 'search ' + search + updated_search = 'search ' + search kwargs = {"exec_mode": "blocking", "dispatch.earliest_time": earliest_time, "dispatch.latest_time": latest_time} - splunk_search = search + ' ' + pass_condition + splunk_search = updated_search + ' ' + pass_condition try: job = service.jobs.create(splunk_search, **kwargs) @@ -233,15 +233,15 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str, attempts_remaining -= 1 if search.startswith('|'): - search = search + updated_search = search else: - search = 'search ' + search + updated_search = 'search ' + search kwargs = {"exec_mode": "blocking", "dispatch.earliest_time": "-1d", "dispatch.latest_time": "now"} - splunk_search = search + ' ' + pass_condition + splunk_search = updated_search + ' ' + pass_condition test_results = dict() #These will always be present. By default, we will say that the @@ -317,6 +317,12 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str, def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wait_on_delete:Union[dict,None], search_string:str, detection_filename:str, indices:list[str]=[DEFAULT_DATA_INDEX], host:str=DEFAULT_EVENT_HOST)->bool: + if wait_on_delete: + print(wait_on_delete['message']) + print("FILENAME : [%s]"%(detection_filename)) + print("SEARCH :\n%s"%(search_string)) + _ = input("****************Press ENTER to Complete Test and DELETE data****************\n\n\n") + try: service = client.connect( host=splunk_host, @@ -329,21 +335,11 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa raise(Exception("Unable to connect to Splunk instance: " + str(e))) - #splunk_search = 'search index=test* | delete' - if wait_on_delete: - print(wait_on_delete['message']) - print("FILENAME : [%s]"%(detection_filename)) - print("SEARCH :\n%s"%(search_string)) - _ = input("****************Press ENTER to Complete Test and DELETE data****************\n\n\n") - - data_exists = True - #print(f"Deleting data for {detection_filename}: {indices}") for index in indices: while (get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index, event_host=host) != 0) : splunk_search = f'search index="{index}" host="{host}" | delete' - kwargs = { "exec_mode": "blocking", "dispatch.earliest_time": "-1d", @@ -353,34 +349,9 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa job = service.jobs.create(splunk_search, **kwargs) reader = results.ResultsReader(job) - - ''' - error_in_results = False - for result in reader: - if hasattr(result,"message") and hasattr(result,"type") and ("You have insufficient privileges to delete events" in result.message or result.type == "FATAL"): - print("Delete is not enabled for admin: [%s] - enabling delete and trying to delete again..."%(result.message), file=sys.stderr) - if already_enabled_delete is True: - print("We already enabled delete, but the setting did not take effect.") - raise(Exception("Enabling delete command failed to take effect")) - if enable_delete_for_admin(splunk_host, splunk_port,splunk_password) != True: - raise(Exception("Failure enabling delete for admin. We cannot continue")) - # We enabled delete, so now we will try to delete again - already_enabled_delete = True - break - else: - #This is not one of the error messages, do nothing - pass - ''' - #No need to issue Delete command again, we will now break out of the loop - #if error_in_results is False: - # data_exists = False - - #Otherwise, we will loop again except Exception as e: - print(f"Trouble deleting data from a run.... we will try again: {str(e)}") - time.sleep(5) - #raise(Exception("Unable to delete data from a run: " + str(e))) + raise(Exception(f"Trouble deleting data using the search {splunk_search}: {str(e)}")) return True diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index 72b39cfc69..23a526c5fa 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -122,7 +122,7 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa test_index = service.indexes[data_upload_index] with open(target_file, 'rb') as target: - test_index.submit(target.read(), sourcetype=attack_data['sourcetype'], source=attack_data['source']) + test_index.submit(target.read(), sourcetype=attack_data['sourcetype'], source=attack_data['source'], host=splunk_sdk.DEFAULT_EVENT_HOST) except http.client.HTTPException as e: raise(Exception(f"Failed to submit detection file {target_file} to Splunk Server: {str(e)}"))