From e090010a69fc764db065b1d7c0da203c0c723eaa Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 12 Apr 2021 13:56:26 -0700 Subject: [PATCH 1/2] remove ui and app is not visible --- dist/saaws/default/app.conf | 2 +- dist/saaws/default/data/ui/nav/default.xml | 6 - .../default/data/ui/views/escu_summary.xml | 244 ------------------ dist/saaws/default/data/ui/views/feedback.xml | 14 - 4 files changed, 1 insertion(+), 265 deletions(-) delete mode 100644 dist/saaws/default/data/ui/nav/default.xml delete mode 100644 dist/saaws/default/data/ui/views/escu_summary.xml delete mode 100644 dist/saaws/default/data/ui/views/feedback.xml diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf index b6185cf528..c3cf930f08 100644 --- a/dist/saaws/default/app.conf +++ b/dist/saaws/default/app.conf @@ -23,7 +23,7 @@ version = 3.18.0 description = Explore the Analytic Stories included with Splunk Security Analytics for AWS Content [ui] -is_visible = true +is_visible = false label = Splunk Security Analytics for AWS Content [package] diff --git a/dist/saaws/default/data/ui/nav/default.xml b/dist/saaws/default/data/ui/nav/default.xml deleted file mode 100644 index 234fa77cd9..0000000000 --- a/dist/saaws/default/data/ui/nav/default.xml +++ /dev/null @@ -1,6 +0,0 @@ - diff --git a/dist/saaws/default/data/ui/views/escu_summary.xml b/dist/saaws/default/data/ui/views/escu_summary.xml deleted file mode 100644 index b50088996c..0000000000 --- a/dist/saaws/default/data/ui/views/escu_summary.xml +++ /dev/null @@ -1,244 +0,0 @@ -
- - - - Splunk Security Content - - | rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *" action.escu.product="*Splunk Security Analytics for AWS*" - - - | rest /services/configs/conf-analytic_stories splunk_server=local count=0 | search product="*Splunk Security Analytics for AWS*" - - - * - * - * - * - - - - -
- - - -

Explore the Analytic Stories included with Splunk Security via ES Use Case Library or Splunk Security Essentials.

- - - - - - -
- - - - - - - Total Analytic Stories - - stats count - - - - - - - - - - - - - - - - - - - - Total Detections - - stats count by action.correlationsearch.label| eventstats sum(count) as total_detection_count| fields total_detection_count - - - - - - - - - - - - - - - - - - - - ESCU App Version - - | rest /services/configs/conf-content-version splunk_server=local count=0 | table version - - - - - - - - - - - - - - - - - - - - - Story Categories - - - | rest /services/configs/conf-analytic_stories splunk_server=local count=0 | stats count by category - - - $click.value$ - $click.value$ - - - - - - - - - - - Analytic Stories by MITRE Technique ID - - - - | rest /services/configs/conf-analytic_stories splunk_server=local count=0 - | spath input=mappings path=mitre_attack{} output="MITRE Technique ID" - | stats dc(title) as "Analytic Stories" by "MITRE Technique ID" - - - - $click.value$ - $click.value$ - - - - - - - - - - All - - now - | dedup title | rename title as story | fields story - - story - story - * - " - " - - - - All - - now - rename action.correlationsearch.label as Detection | dedup Detection | fields Detection - - Detection - Detection - " - " - * - - - - All - - now - | dedup category | fields category - - category - category - * - " - " - - - - All - - now - | spath input=mappings path=mitre_attack{} output="MITRE Technique ID" | mvexpand "MITRE Technique ID"| dedup "MITRE Technique ID" | fields "MITRE Technique ID" - - MITRE Technique ID - MITRE Technique ID - " - " - * - - - - All - - now - | spath input=data_models path={} output=dm | mvexpand dm | dedup dm | fields dm - - dm - dm - * - " - " - - - - - - Analytic Story Details - - - spath input=data_models path={} output="Data Models" - | spath input=mappings path=kill_chain_phases{} output="Kill Chain Phases" - | spath input=detection_searches path={} output="Detections" - | spath input=mappings path=mitre_attack{} output="MITRE Technique ID" - | rename title as "Analytic Story" description as "Description" category as "Category" modification_date as "Last Updated" - | fillnull value="-" - | search "Analytic Story"=$as_story$ - | search "Data Models"=$as_data_models$ - | search "Category"=$as_category$ - | search "MITRE Technique ID"=$as_attack_id$ - | search "Detections"=$detection$ - | table "Analytic Story", Description, Category, "MITRE Technique ID", "Data Models", Detections, "Last Updated" - - - - - - - - - - - - -
- - - diff --git a/dist/saaws/default/data/ui/views/feedback.xml b/dist/saaws/default/data/ui/views/feedback.xml deleted file mode 100644 index 21de8ed752..0000000000 --- a/dist/saaws/default/data/ui/views/feedback.xml +++ /dev/null @@ -1,14 +0,0 @@ - - - Welcome to Splunk Security Analytics for AWS Content Feedback Center. - - - - Contact us at research@splunk.com to send us support requests, bug reports, or questions directly to the Splunk Security Research Team. -
Please specify your request type and/or the title of any related Analytic Stories.
- You can also find us in the #security-research room in the Splunk Slack channel - - - - - From 8461aef53b95cb77c5e6dd962b73d0fec76a1d3c Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 12 Apr 2021 14:37:25 -0700 Subject: [PATCH 2/2] update build package name --- .circleci/config.yml | 12 ++++++------ dist/saaws/app.manifest | 2 +- dist/saaws/default/app.conf | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 9c30ed1292..c5622c5b89 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -202,11 +202,11 @@ jobs: tar -zxf content-pack-build-escu.tar.gz tar -zxf content-pack-build-saaws.tar.gz mv dist/escu DA-ESS-ContentUpdate - mv dist/saaws Splunk_DA-ESS_AmazonWebServices_Content + mv dist/saaws DA-ESS_AmazonWebServices_Content slim package -o upload DA-ESS-ContentUpdate - slim package -o upload Splunk_DA-ESS_AmazonWebServices_Content + slim package -o upload DA-ESS_AmazonWebServices_Content cp upload/DA-ESS-ContentUpdate-*.tar.gz DA-ESS-ContentUpdate-latest.tar.gz - cp upload/Splunk_DA-ESS_AmazonWebServices_Content-*tar.gz Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz + cp upload/DA-ESS_AmazonWebServices_Content-*tar.gz DA-ESS_AmazonWebServices_Content-latest.tar.gz - store_artifacts: path: ~/build/upload destination: package/ @@ -214,7 +214,7 @@ jobs: root: ~/build paths: - DA-ESS-ContentUpdate-latest.tar.gz - - Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz + - DA-ESS_AmazonWebServices_Content-latest.tar.gz run-appinspect: executor: content-executor @@ -244,7 +244,7 @@ jobs: name: submit saaws package to appinspect API command: | cd security-content/bin - ./appinspect.sh ~/ Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD + ./appinspect.sh ~/ DA-ESS_AmazonWebServices_Content-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD - store_artifacts: path: ~/report destination: report/ @@ -252,7 +252,7 @@ jobs: root: ~/ paths: - DA-ESS-ContentUpdate-latest.tar.gz - - Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz + - DA-ESS_AmazonWebServices_Content-latest.tar.gz update-sources-github: executor: content-executor steps: diff --git a/dist/saaws/app.manifest b/dist/saaws/app.manifest index d857b6ebf1..f95645b7e6 100644 --- a/dist/saaws/app.manifest +++ b/dist/saaws/app.manifest @@ -4,7 +4,7 @@ "title": "Splunk Security Analytics for AWS Content", "id": { "group": null, - "name": "Splunk_DA-ESS_AmazonWebServices_Content", + "name": "DA-ESS_AmazonWebServices_Content", "version": "3.18.0" }, "author": [ diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf index c3cf930f08..980a4b23a8 100644 --- a/dist/saaws/default/app.conf +++ b/dist/saaws/default/app.conf @@ -27,4 +27,4 @@ is_visible = false label = Splunk Security Analytics for AWS Content [package] -id = Splunk_DA-ESS_AmazonWebServices_Content +id = DA-ESS_AmazonWebServices_Content