From 1a5526942ffd27e8c029d4aec4a371e521910a67 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Aug 2024 16:13:23 +0530 Subject: [PATCH 1/6] testing data source validation --- .github/workflows/appinspect.yml | 12 +++----- .github/workflows/build.yml | 9 ++---- .github/workflows/datasource-ta-check.yml | 34 +++++++++++++++++++++++ 3 files changed, 41 insertions(+), 14 deletions(-) create mode 100644 .github/workflows/datasource-ta-check.yml diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 2f9378f920..61dea4a3fd 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -7,9 +7,6 @@ on: jobs: appinspect: - #Note that the CircleCI job used a Container. The way to do this with Github Actions - #is to first start up a Virtual Machine, then we can by following: - # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer runs-on: ubuntu-latest steps: - name: Check out the repository code @@ -17,16 +14,15 @@ jobs: - uses: actions/setup-python@v5 with: - python-version: '3.11' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy - architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified - - + python-version: '3.11' + architecture: 'x64' + - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | pip install contentctl>=4.0.0 git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git - - name: Running build with enrichments + - name: Running appinspect with enrichments env: APPINSPECTUSERNAME: "${{ secrets.APPINSPECTUSERNAME }}" APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 785fc9db36..aff5f3c37a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -7,9 +7,6 @@ on: - develop jobs: build: - #Note that the CircleCI job used a Container. The way to do this with Github Actions - #is to first start up a Virtual Machine, then we can by following: - # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer runs-on: ubuntu-latest steps: - name: Check out the repository code @@ -17,9 +14,9 @@ jobs: - uses: actions/setup-python@v5 with: - python-version: '3.11' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy - architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified - + python-version: '3.11' + architecture: 'x64' + - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | pip install contentctl>=4.0.0 diff --git a/.github/workflows/datasource-ta-check.yml b/.github/workflows/datasource-ta-check.yml new file mode 100644 index 0000000000..a341549281 --- /dev/null +++ b/.github/workflows/datasource-ta-check.yml @@ -0,0 +1,34 @@ +name: datasource-ta-check +on: + pull_request_target: + push: + branches: + - develop + +jobs: + datasource-ta-check: + runs-on: ubuntu-latest + steps: + - name: Check out the repository code + uses: actions/checkout@v4 + + - uses: actions/setup-python@v5 + with: + python-version: '3.11' + architecture: 'x64' + + - name: Install Python Dependencies and ContentCTL and Atomic Red Team + run: | + pip install contentctl>=4.0.0 + git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git + + run: | + contentctl validate --data-source-TA-validation + + # - name: store_artifacts + # uses: actions/upload-artifact@v4 + # with: + # name: content-latest + # path: | + # artifacts/DA-ESS-ContentUpdate-latest.tar.gz + # artifacts/app_inspect_report \ No newline at end of file From ab424feb175bf51b75dac235dcf6cba9a279d049 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Aug 2024 16:15:08 +0530 Subject: [PATCH 2/6] updating job --- .github/workflows/datasource-ta-check.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/datasource-ta-check.yml b/.github/workflows/datasource-ta-check.yml index a341549281..f8faa79040 100644 --- a/.github/workflows/datasource-ta-check.yml +++ b/.github/workflows/datasource-ta-check.yml @@ -8,6 +8,7 @@ on: jobs: datasource-ta-check: runs-on: ubuntu-latest + continue-on-error: true steps: - name: Check out the repository code uses: actions/checkout@v4 @@ -17,11 +18,11 @@ jobs: python-version: '3.11' architecture: 'x64' - - name: Install Python Dependencies and ContentCTL and Atomic Red Team + - name: Install Python Dependencies and contentctl run: | pip install contentctl>=4.0.0 - git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git - + + - name: Run datasource TA check run: | contentctl validate --data-source-TA-validation From e8397076f402429c01be0be28db4872a9181dc13 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Aug 2024 16:21:05 +0530 Subject: [PATCH 3/6] update trigger conditions --- .github/workflows/datasource-ta-check.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/datasource-ta-check.yml b/.github/workflows/datasource-ta-check.yml index f8faa79040..0cafaa3de1 100644 --- a/.github/workflows/datasource-ta-check.yml +++ b/.github/workflows/datasource-ta-check.yml @@ -1,6 +1,8 @@ name: datasource-ta-check on: - pull_request_target: + pull_request: + branches: + - develop push: branches: - develop From ff71e9f012bb2c08ec2f97746d61df89c5342b15 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Aug 2024 16:22:39 +0530 Subject: [PATCH 4/6] udpating datasource --- data_sources/aws_cloudfront.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index 2ae90e54e6..f59618d6c7 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -9,7 +9,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.6.0 + version: 7.5.0 fields: - _time - action From 8f27c8b51189df1e3b34de3114860b2afea8e0bc Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Aug 2024 16:28:35 +0530 Subject: [PATCH 5/6] updating trigger and revert --- .github/workflows/datasource-ta-check.yml | 4 +--- data_sources/aws_cloudfront.yml | 2 +- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/datasource-ta-check.yml b/.github/workflows/datasource-ta-check.yml index 0cafaa3de1..f8faa79040 100644 --- a/.github/workflows/datasource-ta-check.yml +++ b/.github/workflows/datasource-ta-check.yml @@ -1,8 +1,6 @@ name: datasource-ta-check on: - pull_request: - branches: - - develop + pull_request_target: push: branches: - develop diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index f59618d6c7..2ae90e54e6 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -9,7 +9,7 @@ sourcetype: aws:cloudfront:accesslogs supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.5.0 + version: 7.6.0 fields: - _time - action From 2047d2a1fb67b19086f11b6795633618dd228511 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Aug 2024 16:29:38 +0530 Subject: [PATCH 6/6] remove artifacts --- .github/workflows/datasource-ta-check.yml | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/.github/workflows/datasource-ta-check.yml b/.github/workflows/datasource-ta-check.yml index f8faa79040..20e50d5841 100644 --- a/.github/workflows/datasource-ta-check.yml +++ b/.github/workflows/datasource-ta-check.yml @@ -24,12 +24,4 @@ jobs: - name: Run datasource TA check run: | - contentctl validate --data-source-TA-validation - - # - name: store_artifacts - # uses: actions/upload-artifact@v4 - # with: - # name: content-latest - # path: | - # artifacts/DA-ESS-ContentUpdate-latest.tar.gz - # artifacts/app_inspect_report \ No newline at end of file + contentctl validate --data-source-TA-validation \ No newline at end of file