From f176eeb109415d4aabdf3fb2e9d4a9a7c597c24f Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 9 Nov 2021 12:37:04 -0800
Subject: [PATCH 1/7] Fixed generation, checksumming, and appinspect of SSA and
 dev_sec_ops packages.

---
 .github/workflows/build-and-validate.yml | 26 ++++++++++++------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml
index f1d869c931..b4ea773810 100644
--- a/.github/workflows/build-and-validate.yml
+++ b/.github/workflows/build-and-validate.yml
@@ -262,13 +262,17 @@ jobs:
           tar -zxf content-pack-build-escu.tar.gz
           tar -zxf content-pack-build-saaws.tar.gz
           tar -zxf content-pack-build-devsecops.tar.gz
-          mv dist/escu DA-ESS-ContentUpdate
-          mv dist/saaws DA-ESS_AmazonWebServices_Content
+          tar -zxf content-pack-build-ssa.tar.gz
+
+          mv dist/escu      DA-ESS-ContentUpdate
+          mv dist/saaws     DA-ESS_AmazonWebServices_Content
           mv dist/devsecops dev_sec_ops_analytics
+          mv dist/ssa       SSA_Content
 
           slim package -o upload DA-ESS-ContentUpdate
           slim package -o upload DA-ESS_AmazonWebServices_Content
           slim package -o upload dev_sec_ops_analytics
+          slim package -o upload SSA_Content
 
           cp upload/DA-ESS-ContentUpdate-*.tar.gz DA-ESS-ContentUpdate-latest.tar.gz
           sha256sum DA-ESS-ContentUpdate-latest.tar.gz > checksum.txt
@@ -277,9 +281,10 @@ jobs:
           sha256sum DA-ESS_AmazonWebServices_Content-latest.tar.gz >> checksum.txt
 
           cp upload/dev_sec_ops_analytics-*tar.gz dev_sec_ops_analytics-latest.tar.gz
+          sha256sum dev_sec_ops_analytics-latest.tar.gz >> checksum.txt
 
-          cp content-pack-build-ssa.tar.gz upload/SSA_Content-latest.tar.gz
-          sha256sum upload/SSA_Content-latest.tar.gz >> checksum.txt
+          cp upload/SSA_Content-*.tar.gz SSA_Content-latest.tar.gz
+          sha256sum SSA_Content-latest.tar.gz >> checksum.txt
 
           touch tag-canary.txt
 
@@ -307,7 +312,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [validate-content, build-sources, build-package]
     #Only run when tagged
-    if: startsWith(github.ref, 'refs/tags/')
+    #if: startsWith(github.ref, 'refs/tags/')
     steps:
 
       - name: Checkout Repo
@@ -331,7 +336,7 @@ jobs:
 
 
 
-      - name: Submit ESCU Package to AppInspect API
+      - name: Submit ESCU, SAAWS, dev_sec_ops_analytics, and SSA Packages to AppInspect API
         env:
           APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }}
           APPINSPECT_PASSWORD: ${{ secrets.AppInspectPassword }}
@@ -340,14 +345,9 @@ jobs:
           #Enclose in quotes in case there are any special characters in the username/password
           #Better not to pass these arguments on the command line, if possible
           ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
-
-      - name: Submit SAAWS Package to AppInspect API
-        env:
-          APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }}
-          APPINSPECT_PASSWORD: ${{ secrets.AppInspectPassword }}
-        run: |
-          cd bin
           ./appinspect.sh ../ DA-ESS_AmazonWebServices_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
+          ./appinspect.sh ../ dev_sec_ops_analytics-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
+          ./appinspect.sh ../ SSA_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
 
       - name: Create report artifact
         if: always()

From 9cb134658de53cb62481cac8477f4152afbc4827 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 9 Nov 2021 12:58:13 -0800
Subject: [PATCH 2/7] Realized SSA isn't a full app, it's just a directory with
 detections.  Made changes so that it won't run through slim or appinspect.
 Will manually verify by looking at the artifacts that it is correct.

---
 .github/workflows/build-and-validate.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml
index b4ea773810..79cd5294d3 100644
--- a/.github/workflows/build-and-validate.yml
+++ b/.github/workflows/build-and-validate.yml
@@ -272,7 +272,7 @@ jobs:
           slim package -o upload DA-ESS-ContentUpdate
           slim package -o upload DA-ESS_AmazonWebServices_Content
           slim package -o upload dev_sec_ops_analytics
-          slim package -o upload SSA_Content
+          $slim package -o upload SSA_Content
 
           cp upload/DA-ESS-ContentUpdate-*.tar.gz DA-ESS-ContentUpdate-latest.tar.gz
           sha256sum DA-ESS-ContentUpdate-latest.tar.gz > checksum.txt
@@ -283,10 +283,14 @@ jobs:
           cp upload/dev_sec_ops_analytics-*tar.gz dev_sec_ops_analytics-latest.tar.gz
           sha256sum dev_sec_ops_analytics-latest.tar.gz >> checksum.txt
 
+          #Do this copy so that we conform as much as possible, and have to make 
+          #as few changes as possible, once we start generating this as a real,
+          #properly packaged app
+          tar -zcf upload/SSA_Content-NO_SLIM.tar.gz SSA_Content  
           cp upload/SSA_Content-*.tar.gz SSA_Content-latest.tar.gz
           sha256sum SSA_Content-latest.tar.gz >> checksum.txt
 
-          touch tag-canary.txt
+          
 
       - name: store_artifacts
         uses: actions/upload-artifact@v2
@@ -347,7 +351,8 @@ jobs:
           ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
           ./appinspect.sh ../ DA-ESS_AmazonWebServices_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
           ./appinspect.sh ../ dev_sec_ops_analytics-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
-          ./appinspect.sh ../ SSA_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
+          #Not a real app yet, so it will fail appinspect - remove the comment when it's a real app generated with SLIM
+          #./appinspect.sh ../ SSA_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
 
       - name: Create report artifact
         if: always()

From 5fa9c7a9fe5d5fb77fc8f99bc972e926eeed21aa Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 9 Nov 2021 13:04:53 -0800
Subject: [PATCH 3/7] Comment typo in build-and-validate.yml $ sign instead of
 # for comment

---
 .github/workflows/build-and-validate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml
index 79cd5294d3..cd3b668142 100644
--- a/.github/workflows/build-and-validate.yml
+++ b/.github/workflows/build-and-validate.yml
@@ -272,7 +272,7 @@ jobs:
           slim package -o upload DA-ESS-ContentUpdate
           slim package -o upload DA-ESS_AmazonWebServices_Content
           slim package -o upload dev_sec_ops_analytics
-          $slim package -o upload SSA_Content
+          #slim package -o upload SSA_Content
 
           cp upload/DA-ESS-ContentUpdate-*.tar.gz DA-ESS-ContentUpdate-latest.tar.gz
           sha256sum DA-ESS-ContentUpdate-latest.tar.gz > checksum.txt

From f31a303babdfdb982ea6a882f1c1731543dba739 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 9 Nov 2021 13:50:48 -0800
Subject: [PATCH 4/7] Fixed app.conf so that we can pass appinspect. Added
 [package] check_for_updates =0 and simple reload triggers.

---
 dist/devsecops/default/app.conf | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/dist/devsecops/default/app.conf b/dist/devsecops/default/app.conf
index 66cd511ed6..4f7674528e 100644
--- a/dist/devsecops/default/app.conf
+++ b/dist/devsecops/default/app.conf
@@ -9,8 +9,16 @@ is_configured = 0
 is_visible = 1
 label = Dev Sec Ops Analytics
 
+[triggers]
+reload.analytic_stories = simple
+reload.analyticstories = simple
+reload.es_investigations = simple
+reload.use_case_library = simple
+
 [launcher]
 author = Splunk Threat Research Team
 description = 
 version = 1.0.0
 
+[package]
+check_for_updates = 0
\ No newline at end of file

From 3bf8de2066c2e626198c169c809cc444b143d3ee Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 9 Nov 2021 16:51:22 -0800
Subject: [PATCH 5/7] changed [stash] in props.conf for devsecops app to
 [MODIFIED-stash] since the name [stash] conflicts with a value in
 $SPLUNK_HOME/system/default/props.conf and appinspect does not like that.  We
 may be able to just remove it, but we will keep it for now until we determine
 whether it can be entirely removed.

---
 dist/devsecops/default/props.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dist/devsecops/default/props.conf b/dist/devsecops/default/props.conf
index a5803cae9f..788639b4c7 100644
--- a/dist/devsecops/default/props.conf
+++ b/dist/devsecops/default/props.conf
@@ -1,2 +1,2 @@
-[stash]
+[MODIFIED-stash]
 lookup_image_to_repository = images_to_repository image OUTPUT repository
\ No newline at end of file

From f57185496c3d5bf9542f90e0005fc2bbe8c5fff2 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 9 Nov 2021 17:18:07 -0800
Subject: [PATCH 6/7] Removed comment from if: for run_appinspect CI job.  This
 is in prep for merging it into develop. It was commented so that it would run
 on testing.

---
 .github/workflows/build-and-validate.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml
index cd3b668142..08bce460da 100644
--- a/.github/workflows/build-and-validate.yml
+++ b/.github/workflows/build-and-validate.yml
@@ -316,7 +316,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [validate-content, build-sources, build-package]
     #Only run when tagged
-    #if: startsWith(github.ref, 'refs/tags/')
+    if: startsWith(github.ref, 'refs/tags/')
     steps:
 
       - name: Checkout Repo

From 67f77aaf179fb29abe4ac7f47e5311ddad784ee2 Mon Sep 17 00:00:00 2001
From: Jose Enrique Hernandez <josehelps@gmail.com>
Date: Wed, 10 Nov 2021 10:30:38 -0500
Subject: [PATCH 7/7] won't ever be a splunk app format as we know it,

removing for now
---
 .github/workflows/build-and-validate.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml
index 08bce460da..74f20021f4 100644
--- a/.github/workflows/build-and-validate.yml
+++ b/.github/workflows/build-and-validate.yml
@@ -351,8 +351,6 @@ jobs:
           ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
           ./appinspect.sh ../ DA-ESS_AmazonWebServices_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
           ./appinspect.sh ../ dev_sec_ops_analytics-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
-          #Not a real app yet, so it will fail appinspect - remove the comment when it's a real app generated with SLIM
-          #./appinspect.sh ../ SSA_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
 
       - name: Create report artifact
         if: always()