admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Changed a port back to the original since it's run inside the docker container as part of a playbook

Browse Source
This commit is contained in:
pyth0n1c
2021-09-17 18:12:02 -07:00
parent 2a3e220249
commit ba78e372e2
2 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
automated_detection_testing/ci/detection_testing_batch/ansible/roles/attack_replay/tasks/main.yml
+1 -1
View File
@@ -8,7 +8,7 @@
- name: Call oneshot import
uri:
url: https://localhost:{{ splunk_management_port }}/services/data/inputs/oneshot
url: https://localhost:8089/services/data/inputs/oneshot
validate_certs: no
method: POST
user: admin
automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py
+2 -3
View File
@@ -71,7 +71,7 @@ def test_detection(splunk_ip, splunk_port, container_name, splunk_password, test
data_manipulation = DataManipulation()
data_manipulation.manipulate_timestamp(folder_name + '/' + attack_data['file_name'], attack_data['sourcetype'], attack_data['source'])
replay_attack_dataset(container_name, splunk_port, splunk_password, folder_name, 'test' + str(test_index), attack_data['sourcetype'], attack_data['source'], attack_data['file_name'])
replay_attack_dataset(container_name, splunk_password, folder_name, 'test' + str(test_index), attack_data['sourcetype'], attack_data['source'], attack_data['file_name'])
time.sleep(200)
@@ -141,7 +141,7 @@ def update_ESCU_app(container_name, splunk_password):
print("Successfully updated the ESCU App!")
def replay_attack_dataset(container_name, splunk_port, splunk_password, folder_name, index, sourcetype, source, out):
def replay_attack_dataset(container_name, splunk_password, folder_name, index, sourcetype, source, out):
ansible_vars = {}
ansible_vars['folder_name'] = folder_name
ansible_vars['ansible_user'] = 'ansible'
@@ -150,7 +150,6 @@ def replay_attack_dataset(container_name, splunk_port, splunk_password, folder_n
ansible_vars['sourcetype'] = sourcetype
ansible_vars['source'] = source
ansible_vars['index'] = index
ansible_vars['splunk_management_port'] = splunk_port
cmdline = "--connection docker -i %s, -u %s" % (container_name, ansible_vars['ansible_user'])
runner = ansible_runner.run(private_data_dir=os.path.join(os.path.dirname(__file__), '../'),