From 84e54e26d6bb58bb86dbe5ffc291973135d19b14 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 29 Nov 2021 16:44:40 -0800 Subject: [PATCH 1/2] Changing to the correct baseline paths after restructuring repo --- .../cloud/abnormally_high_cloud_instances_destroyed.test.yml | 2 +- tests/cloud/abnormally_high_cloud_instances_launched.test.yml | 2 +- ...lly_high_number_of_cloud_infrastructure_api_calls.test.yml | 2 +- ...lly_high_number_of_cloud_security_group_api_calls.test.yml | 2 +- ...s_account_activity_from_previously_unseen_account.test.yml | 4 ++-- ...cloud_api_calls_from_previously_unseen_user_roles.test.yml | 4 ++-- ...ompute_instance_created_by_previously_unseen_user.test.yml | 4 ++-- ...pute_instance_created_in_previously_unused_region.test.yml | 4 ++-- ...ute_instance_created_with_previously_unseen_image.test.yml | 4 ++-- ...ance_created_with_previously_unseen_instance_type.test.yml | 4 ++-- ...oud_instance_modified_with_previously_unseen_user.test.yml | 4 ++-- .../cloud_provisioning_from_previously_unseen_city.test.yml | 4 ++-- ...cloud_provisioning_from_previously_unseen_country.test.yml | 4 ++-- ...ud_provisioning_from_previously_unseen_ip_address.test.yml | 4 ++-- .../cloud_provisioning_from_previously_unseen_region.test.yml | 4 ++-- tests/cloud/detect_aws_console_login_by_new_user.test.yml | 4 ++-- .../detect_aws_console_login_by_user_from_new_city.test.yml | 4 ++-- ...detect_aws_console_login_by_user_from_new_country.test.yml | 4 ++-- .../detect_aws_console_login_by_user_from_new_region.test.yml | 4 ++-- 19 files changed, 34 insertions(+), 34 deletions(-) diff --git a/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml b/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml index ea5f32d97b..dd48257250 100644 --- a/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml +++ b/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Instances Launched - file: baselines/baseline_of_cloud_instances_destroyed.yml + file: detections/cloud/baseline_of_cloud_instances_destroyed.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/abnormally_high_cloud_instances_launched.test.yml b/tests/cloud/abnormally_high_cloud_instances_launched.test.yml index 704a2bc39a..a082a3c435 100644 --- a/tests/cloud/abnormally_high_cloud_instances_launched.test.yml +++ b/tests/cloud/abnormally_high_cloud_instances_launched.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Instances Launched - file: baselines/baseline_of_cloud_instances_launched.yml + file: detections/cloud/baseline_of_cloud_instances_launched.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml index c9943d8552..000c10ed68 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Infrastructure API Calls Per User - file: baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml + file: detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml index 050d9eaf1f..f2074430c2 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Security Group API Calls Per User - file: baselines/baseline_of_cloud_security_group_api_calls_per_user.yml + file: detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml index 7135ebd7ae..cc782a4a7e 100644 --- a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml +++ b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen AWS Cross Account Activity - Initial - file: baselines/previously_seen_aws_cross_account_activity_initial.yml + file: detections/cloud/previously_seen_aws_cross_account_activity_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen AWS Cross Account Activity - Update - file: baselines/previously_seen_aws_cross_account_activity_update.yml + file: detections/cloud/previously_seen_aws_cross_account_activity_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml index 47371cb887..d55a8bb52f 100644 --- a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml +++ b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud API Calls Per User Role - Initial - file: baselines/previously_seen_cloud_api_calls_per_user_role_initial.yml + file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud API Calls Per User Role - Update - file: baselines/previously_seen_cloud_api_calls_per_user_role_update.yml + file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml index 34ff1d2ad6..19fec95d05 100644 --- a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Compute Creations By User - Initial - file: baselines/previously_seen_cloud_compute_creations_by_user_initial.yml + file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Compute Creations By User - Update - file: baselines/previously_seen_cloud_compute_creations_by_user_update.yml + file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml index 4aaf714aa3..adce8dbd51 100644 --- a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml +++ b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Regions - Initial - file: baselines/previously_seen_cloud_regions_initial.yml + file: detections/cloud/previously_seen_cloud_regions_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Regions - Update - file: baselines/previously_seen_cloud_regions_update.yml + file: detections/cloud/previously_seen_cloud_regions_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml index 22263f5b15..5f5ca038f3 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Compute Images - Initial - file: baselines/previously_seen_cloud_compute_images_initial.yml + file: detections/cloud/previously_seen_cloud_compute_images_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Compute Images - Update - file: baselines/previously_seen_cloud_compute_images_update.yml + file: detections/cloud/previously_seen_cloud_compute_images_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml index ace490888d..f3873c8264 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Compute Instance Types - Initial - file: baselines/previously_seen_cloud_compute_instance_types_initial.yml + file: detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Compute Instance Types - Update - file: baselines/previously_seen_cloud_compute_instance_types_update.yml + file: detections/cloud/previously_seen_cloud_compute_instance_types_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml index bdf58b91f8..f7db1c4a6a 100644 --- a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Instance Modifications By User - Initial - file: baselines/previously_seen_cloud_instance_modifications_by_user_initial.yml + file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Instance Modifications By User - Update - file: baselines/previously_seen_cloud_instance_modifications_by_user_update.yml + file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml index 207ea9898d..741d779eb2 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml index d095d33251..232de687dc 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml index ee410cda1d..720252edac 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml index d4d7c727ec..e821a9025b 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Cloud Provisioning Activity Sources - Initial - file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Cloud Provisioning Activity Sources - Update - file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml + file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/detect_aws_console_login_by_new_user.test.yml b/tests/cloud/detect_aws_console_login_by_new_user.test.yml index 6e0fdf4290..b84e13d7a6 100644 --- a/tests/cloud/detect_aws_console_login_by_new_user.test.yml +++ b/tests/cloud/detect_aws_console_login_by_new_user.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: baselines/previously_seen_users_in_cloudtrail_initial.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Users In Cloudtrail - Update - file: baselines/previously_seen_users_in_cloudtrail_update.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml index e032cbbd35..674b1c5f55 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: baselines/previously_seen_users_in_cloudtrail_initial.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Users In Cloudtrail - Update - file: baselines/previously_seen_users_in_cloudtrail_update.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml index 691c5fa5af..7195ba7f46 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: baselines/previously_seen_users_in_cloudtrail_initial.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Users In Cloudtrail - Update - file: baselines/previously_seen_users_in_cloudtrail_update.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml index 9ea20d1e25..c09f7ce926 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml @@ -7,12 +7,12 @@ tests: latest_time: 'now' baselines: - name: Previously Seen Users In Cloudtrail - Initial - file: baselines/previously_seen_users_in_cloudtrail_initial.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' - name: Previously Seen Users In Cloudtrail - Update - file: baselines/previously_seen_users_in_cloudtrail_update.yml + file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' From 97c83a1864c92f1199e8c9669b26eb382f21de8a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 30 Nov 2021 09:47:01 -0800 Subject: [PATCH 2/2] Created Experimental folder in tests, as well as cloud, endpoint, and network subfolders, and moved some tests into it. This corresponds with the experimental folder in detections. --- .../cloud/abnormally_high_cloud_instances_destroyed.test.yml | 2 +- .../cloud/abnormally_high_cloud_instances_launched.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename tests/{ => experimental}/cloud/abnormally_high_cloud_instances_destroyed.test.yml (92%) rename tests/{ => experimental}/cloud/abnormally_high_cloud_instances_launched.test.yml (92%) diff --git a/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml b/tests/experimental/cloud/abnormally_high_cloud_instances_destroyed.test.yml similarity index 92% rename from tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml rename to tests/experimental/cloud/abnormally_high_cloud_instances_destroyed.test.yml index dd48257250..ea5f32d97b 100644 --- a/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml +++ b/tests/experimental/cloud/abnormally_high_cloud_instances_destroyed.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Instances Launched - file: detections/cloud/baseline_of_cloud_instances_destroyed.yml + file: baselines/baseline_of_cloud_instances_destroyed.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d' diff --git a/tests/cloud/abnormally_high_cloud_instances_launched.test.yml b/tests/experimental/cloud/abnormally_high_cloud_instances_launched.test.yml similarity index 92% rename from tests/cloud/abnormally_high_cloud_instances_launched.test.yml rename to tests/experimental/cloud/abnormally_high_cloud_instances_launched.test.yml index a082a3c435..704a2bc39a 100644 --- a/tests/cloud/abnormally_high_cloud_instances_launched.test.yml +++ b/tests/experimental/cloud/abnormally_high_cloud_instances_launched.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' baselines: - name: Baseline Of Cloud Instances Launched - file: detections/cloud/baseline_of_cloud_instances_launched.yml + file: baselines/baseline_of_cloud_instances_launched.yml pass_condition: '| stats count | where count > 0' earliest_time: '-30d' latest_time: '-1d'