admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

testing conf

Browse Source
This commit is contained in:
patel-bhavin
2021-09-29 15:24:41 -07:00
parent 1f6c5070d0
commit a2e509aef9
5 changed files with 4 additions and 179 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/jinja2_templates/analyticstories.j2
+1 -1
View File
@@ -38,7 +38,7 @@ how_to_implement = {{ detection.how_to_implement }}
{% else %}
how_to_implement = none
{% endif %}
annotations = {{ detection.mappings | tojson }}
annotations = {{ detection.savedsearch_annotations | tojson }}
known_false_positives = {{ detection.known_false_positives }}
providing_technologies = []
bin/validate.py
+3 -4
View File
@@ -73,7 +73,7 @@ def validate_objects(REPO_PATH, objects, verbose):
for lookup in objects['lookups']:
errors = errors + validate_lookups_content(REPO_PATH, "lookups/%s", lookup)
objects_array = objects['stories'] + objects['detections'] + objects['response_tasks'] + objects['responses']
objects_array = objects['stories'] + objects['detections']
for object in objects_array:
validation_errors, uuids = validate_standard_fields(object, uuids)
errors = errors + validation_errors
@@ -244,7 +244,7 @@ def validate_tests(REPO_PATH, object):
def main(REPO_PATH, verbose):
validation_objects = ['macros','lookups','stories','detections','response_tasks','responses','deployments', 'tests']
validation_objects = ['macros','lookups','stories','detections','deployments', 'tests']
objects = {}
schema_error = False
@@ -272,8 +272,7 @@ def main(REPO_PATH, verbose):
if __name__ == "__main__":
# grab arguments
parser = argparse.ArgumentParser(description="validates security content manifest files", epilog="""
Validates security manifest for correctness, adhering to spec and other common items.
VALIDATE DOES NOT PROCESS RESPONSES SPEC for the moment.""")
Validates security manifest for correctness, adhering to spec and other common items.""")
parser.add_argument("-p", "--path", required=True, help="path to security-security content repo")
parser.add_argument("-v", "--verbose", required=False, action='store_true', help="prints verbose output")
# parse them
dist/escu/default/data/ui/nav/default.xml
Vendored
-1
View File
@@ -2,6 +2,5 @@
<view name="escu_summary" default="true"/>
<view name="feedback"/>
<view name="search"/>
<view name="escu_usage"/>
<a href="http://docs.splunk.com/Documentation/ESSOC">Docs</a>
</nav>
dist/escu/default/data/ui/views/analytic_story_details.xml
Vendored
-21
View File
@@ -1,21 +0,0 @@
<form script="analytic_story_details.js" hideFilters="false" version="1.1">
<label>Analytic Story Detail</label>
<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="analytic_story_name">
<label>Choose an Analytic Story from the drop-down menu to view more detail and run the searches.</label>
<search>
<query>| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | fields title | sort title</query>
</search>
<fieldForLabel>title</fieldForLabel>
<fieldForValue>title</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<html>
<div id="analytic_story_details">
</div>
</html>
</panel>
</row>
</form>
dist/escu/default/data/ui/views/escu_usage.xml
Vendored
-152
View File
@@ -1,152 +0,0 @@
<form version="1.1">
<label>Usage Details</label>
<search id="escu_usage" ref="escu-metrics-search-events">
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="field1" searchWhenChanged="true">
<label></label>
<default>
<earliest>-7d</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<search base="escu_usage">
<query>| stats sum(search_count)</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x091448","0xd93f3c"]</option>
<option name="rangeValues">[1000]</option>
<option name="underLabel">Searches Ran</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query>| stats dc(savedsearch_name)</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x091448","0xd93f3c"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Unique Searches</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query>| stats sum(search_count) by savedsearch_name | sort -sum(search_count) | head 1 | table savedsearch_name</query>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0x091448","0x091448"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Most Run</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
<row>
<panel>
<single>
<search base="escu_usage">
<query> | stats sum(search_count) AS sum_search_count by usage| search usage=adhoc | table sum_search_count</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x066661","0x091448"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Ad hoc searches</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query> | stats sum(search_count) AS sum_search_count by usage| search usage=scheduled | table sum_search_count</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x066661","0x066661"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Scheduled</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query>| stats sum(search_count) AS search_count by user | sort -search_count | head 1 | table user</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x066661","0x066661"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Most Active User</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query>| stats dc(user)</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x066661","0x066661"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Total Active Users</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
<row>
<panel>
<single>
<search base="escu_usage">
<query>| stats sum(search_total_run_time)</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x334907","0x334907"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Total Search Run Time (seconds)</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query> | stats avg(search_total_run_time)</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x334907","0x334907"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Average Run Time (seconds)</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<single>
<search base="escu_usage">
<query>|sort -search_total_run_time | head 1| table search_total_run_time</query>
</search>
<option name="colorMode">block</option>
<option name="rangeColors">["0x334907","0x334907"]</option>
<option name="rangeValues">[12000]</option>
<option name="underLabel">Max Run Time (seconds)</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
<row>
<panel>
<table>
<search base="escu_usage">
<query>| table savedsearch_name search_count last_run first_run search_avg_run_time search_total_run_time search_total_results </query>
</search>
</table>
</panel>
</row>
</form>