mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
test:added enriched detections and script for the same
This commit is contained in:
Detection Testing Service
@@ -0,0 +1,802 @@
|
||||
Abnormally High Number Of Cloud Infrastructure API Calls Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_citrix-netscaler
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_rsa-securid
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_rsa_securid_cas
|
||||
- Splunk_TA_ossec
|
||||
- Splunk_TA_juniper
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_box
|
||||
- Splunk_TA_cisco-asa
|
||||
- Splunk_TA_infoblox
|
||||
- Splunk_TA_salesforce
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Abnormally High Number Of Cloud Instances Destroyed Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_citrix-netscaler
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_rsa-securid
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_rsa_securid_cas
|
||||
- Splunk_TA_ossec
|
||||
- Splunk_TA_juniper
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_box
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
- Splunk_TA_cisco-asa
|
||||
- Splunk_TA_salesforce
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Abnormally High Number Of Cloud Security Group API Calls Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_citrix-netscaler
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_rsa-securid
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_rsa_securid_cas
|
||||
- Splunk_TA_ossec
|
||||
- Splunk_TA_juniper
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_box
|
||||
- Splunk_TA_infoblox
|
||||
- Splunk_TA_salesforce
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Abnormally High Number of Cloud Instances Launched Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_citrix-netscaler
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_rsa-securid
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_rsa_securid_cas
|
||||
- Splunk_TA_ossec
|
||||
- Splunk_TA_juniper
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_box
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
- Splunk_TA_cisco-asa
|
||||
- Splunk_TA_salesforce
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Active Setup Registry Autostart Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Add DefaultUser And Password In Registry Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Allow Inbound Traffic By Firewall Rule Registry Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Allow Operation with Consent Admin Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Anomalous usage of 7zip Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Attacker Tools On Endpoint Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_windows
|
||||
Attempt To Add Certificate To Untrusted Store Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Auto Admin Logon Registry Entry Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
BCDEdit Failure Recovery Modification:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Batch File Write to System32 Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_windows
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Bcdedit Command Back To Normal Mode Boot Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Change Default File Association Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Change To Safe Mode With Network Config Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Check Elevated CMD using whoami Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Cloud API Calls From Previously Unseen User Roles Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_rsa_securid_cas
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_box
|
||||
- Splunk_TA_infoblox
|
||||
- Splunk_TA_salesforce
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Cloud Compute Instance Created By Previously Unseen User Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Cloud Compute Instance Created In Previously Unused Region Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Cloud Compute Instance Created With Previously Unseen Image Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Cloud Compute Instance Created With Previously Unseen Instance Type Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Cloud Instance Modified By Previously Unseen User Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_citrix-netscaler
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_rsa-securid
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_rsa_securid_cas
|
||||
- Splunk_TA_ossec
|
||||
- Splunk_TA_juniper
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_box
|
||||
- Splunk_TA_salesforce
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Cloud Provisioning Activity From Previously Unseen City Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_citrix-netscaler
|
||||
- Splunk_TA_rsa-securid
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_rsa_securid_cas
|
||||
- Splunk_TA_juniper
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_box
|
||||
- Splunk_TA_cisco-asa
|
||||
- Splunk_TA_infoblox
|
||||
- Splunk_TA_salesforce
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Cloud Provisioning Activity From Previously Unseen Country Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_citrix-netscaler
|
||||
- Splunk_TA_rsa-securid
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_rsa_securid_cas
|
||||
- Splunk_TA_juniper
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_box
|
||||
- Splunk_TA_cisco-asa
|
||||
- Splunk_TA_infoblox
|
||||
- Splunk_TA_salesforce
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Cloud Provisioning Activity From Previously Unseen IP Address Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_citrix-netscaler
|
||||
- Splunk_TA_rsa-securid
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_rsa_securid_cas
|
||||
- Splunk_TA_juniper
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_box
|
||||
- Splunk_TA_salesforce
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
Cloud Provisioning Activity From Previously Unseen Region Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_citrix-netscaler
|
||||
- Splunk_TA_rsa-securid
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_rsa_securid_cas
|
||||
- Splunk_TA_juniper
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_box
|
||||
- Splunk_TA_cisco-asa
|
||||
- Splunk_TA_infoblox
|
||||
- Splunk_TA_salesforce
|
||||
tas_with_data:
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
DNS Query Length With High Standard Deviation Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_isc-bind
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
- Splunk_TA_infoblox
|
||||
DSQuery Domain Discovery Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Detect Exchange Web Shell Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Detect RClone Command-Line Usage Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Detect Regasm Spawning a Process Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Detect Regsvcs Regasm Spawning a Process Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Detect SharpHound Command-Line Arguments Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Detect Use of cmd exe to Launch Script Interpreters Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disable AMSI Through Registry Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disable ETW Through Registry Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disable Logs Using WevtUtil Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disable Registry Tool Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disable Schedule Task Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Disable Windows App Hotkeys Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disable Windows Behavior Monitoring Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disabling CMD Application Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disabling ControlPanel Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disabling FolderOptions Windows Feature Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disabling NoRun Windows App Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disabling SystemRestore In Registry Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Disabling Task Manager Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Domain Account Discovery With Net App Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Domain Account Discovery with Wmic Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Dump LSASS via procdump Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Enable RDP In Other Port Number Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Eventvwr UAC Bypass Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Excessive Attempt To Disable Services Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Excessive Usage Of Cacls App Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Excessive Usage Of Taskkill Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Excessive number of distinct processes created in Windows Temp folder Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_windows
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
- Splunk_TA_cyberark_epm
|
||||
tas_with_data:
|
||||
- Splunk_TA_windows
|
||||
Excessive number of service control start as disabled Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Excessive number of taskhost processes Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_windows
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
tas_with_data:
|
||||
- Splunk_TA_windows
|
||||
Executables Or Script Creation In Suspicious Path Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Execute Javascript With Jscript COM CLSID Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Execution of File with Multiple Extensions Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_windows
|
||||
File with Samsam Extension Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_sophos
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_windows
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Firewall Allowed Program Enable Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
FodHelper UAC Bypass Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Fsutil Zeroing File Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Get ADUserResultantPasswordPolicy with Powershell Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Get DomainPolicy with Powershell Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Get DomainUser with PowerShell Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
GetWmiObject DS User with PowerShell Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Hide User Account From Sign-In Screen Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Hiding Files And Directories With Attrib exe Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_windows
|
||||
ICACLS Grant Command Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Icacls Deny Command Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Jscript Execution Using Cscript App Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Logon Script Event Trigger Execution Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Modify ACL permission To Files Or Folder Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Msmpeng Application DLL Side Loading Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
NET Profiler UAC bypass Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
NLTest Domain Trust Discovery:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
NTdsutil export ntds dit Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Overwriting Accessibility Binaries Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_ossec
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_sophos
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_windows
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Permission Modification using Takeown App Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Powershell Execute COM Object Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_cisco-ucs
|
||||
- Splunk_TA_citrix-netscaler
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_nginx
|
||||
- Splunk_TA_microsoft-iis
|
||||
- Splunk_TA_microsoft-sqlserver
|
||||
- Splunk_TA_rsa-securid
|
||||
- Splunk_TA_remedy
|
||||
- Splunk_TA_bluecoat-proxysg
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_rsa_securid_cas
|
||||
- Splunk_TA_jboss
|
||||
- Splunk_TA_websense-cg
|
||||
- Splunk_TA_ossec
|
||||
- Splunk_TA_bromium
|
||||
- Splunk_TA_nagios-core
|
||||
- Splunk_TA_isc-bind
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_snow
|
||||
- Splunk_TA_squid
|
||||
- Splunk_TA_apache
|
||||
- Splunk_TA_imperva-waf
|
||||
- Splunk_TA_juniper
|
||||
- Splunk_TA_cisco-esa
|
||||
- Splunk_TA_microsoft_sysmon
|
||||
- Splunk_TA_cisco-ise
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_f5-bigip
|
||||
- Splunk_TA_symantec-ep
|
||||
- Splunk_TA_google-cloudplatform
|
||||
- Splunk_TA_sophos
|
||||
- Splunk_TA_mcafee_epo_syslog
|
||||
- Splunk_TA_haproxy
|
||||
- Splunk_TA_tomcat
|
||||
- Splunk_TA_jmx
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_symantec-dlp
|
||||
- Splunk_TA_ibm-was
|
||||
- Splunk_TA_microsoft-hyperv
|
||||
- Splunk_TA_windows
|
||||
- Splunk_TA_mcafee-wg
|
||||
- Splunk_TA_isc-dhcp
|
||||
- Splunk_TA_websense-dlp
|
||||
- Splunk_TA_box
|
||||
- Splunk_TA_microsoft-scom
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
- Splunk_TA_rsa-dlp
|
||||
- Splunk_TA_cisco-wsa
|
||||
- Splunk_TA_mysql
|
||||
- Splunk_TA_cisco-asa
|
||||
- Splunk_TA_infoblox
|
||||
- Splunk_TA_salesforce
|
||||
- Splunk_TA_cyberark_epm
|
||||
- Splunk_TA_linux
|
||||
- Splunk_TA_oracle
|
||||
tas_with_data:
|
||||
- Splunk_TA_windows
|
||||
Prevent Automatic Repair Mode using Bcdedit Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Print Processor Registry Autostart Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Process Creating LNK file in Suspicious location Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Process execution via wmi Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Processes created by netsh Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Reg exe Manipulating Windows Services Registry Keys Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Registry Keys Used For Persistence Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Remote WMI Command Attempt Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Resize ShadowStorage volume Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Revil Common Exec Parameter Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Revil Registry Entry Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Ryuk Wake on LAN Command Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
SLUI RunAs Elevated Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
SLUI Spawning a Process Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Samsam Test File Write Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- splunk_ta_o365
|
||||
- Splunk_TA_sophos
|
||||
- Splunk_TA_cyberark
|
||||
- Splunk_TA_windows
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Sc exe Manipulating Windows Services Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Scheduled Task Deleted Or Created Via CMD:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Schtasks Run Task On Demand Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Schtasks scheduling job on remote system Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Schtasks used for forcing a reboot Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Screensaver Event Trigger Execution Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Script Execution via WMI Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_windows
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
- Splunk_TA_cyberark_epm
|
||||
Sdclt UAC Bypass Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
SecretDumps Offline NTDS Dumping Tool Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Services Escalate Exe Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Set Default PowerShell Execution Policy To Unrestricted or Bypass Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Shim Database Installation With Suspicious Parameters Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Short Lived Windows Accounts Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_rsa-securid
|
||||
- Splunk_TA_aws-kinesis-firehose
|
||||
- Splunk_TA_cyberark
|
||||
SilentCleanup UAC Bypass Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Single Letter Process On Endpoint Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_windows
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
- Splunk_TA_cyberark_epm
|
||||
Spoolsv Writing a DLL Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_windows
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Start Up During Safe Mode Boot Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Suspicious File Write Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Suspicious Process File Path Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Suspicious Reg exe Process Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Suspicious Scheduled Task from Public Directory Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Suspicious mshta child process Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
System Information Discovery Detection Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_nix
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_windows
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
- Splunk_TA_cyberark_epm
|
||||
System Processes Run From Unexpected Locations Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
Time Provider Persistence Registry Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
USN Journal Deletion Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Unified Messaging Service Spawning a Process Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Uninstall App Using MsiExec Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Unload Sysmon Filter Driver Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
WBAdmin Delete System Backups Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
- Splunk_TA_CrowdStrike_FDR
|
||||
WSReset UAC Bypass Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Windows AdFind Exe Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
Windows Disable Antispyware Reg Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
XSL Script Execution With WMIC Unit Test:
|
||||
CIM_version: 4.20.2
|
||||
supported_tas:
|
||||
- Splunk_TA_bit9-carbonblack
|
||||
@@ -0,0 +1,270 @@
|
||||
# 1. Take github token, branch_name from user to raise a PR for enriched detection of security_content repo
|
||||
# 2. Iterate through each detection file
|
||||
# 3. For each detection iterate through ta_cim_mapping report
|
||||
# 4. map detection file and ta_cim_mapping reports and finalise the TA required for particular detection
|
||||
# 5. Add the list of TA's in detection file
|
||||
# 6. Create a new branch and raise an MR for it
|
||||
|
||||
import os
|
||||
import git
|
||||
import sys
|
||||
import shutil
|
||||
import yaml
|
||||
import json
|
||||
import time
|
||||
import argparse
|
||||
import logging
|
||||
import io
|
||||
import re
|
||||
from github import Github
|
||||
|
||||
|
||||
def fetch_ta_cim_mapping_report(file_name):
|
||||
try:
|
||||
with open(file_name) as file_content:
|
||||
cim_field_report = json.load(file_content)
|
||||
return cim_field_report
|
||||
except Exception as error:
|
||||
error_message = f"Unexpected error occurred while reading file. Error: {error}"
|
||||
logging.error(error_message)
|
||||
|
||||
|
||||
def load_file(file_path):
|
||||
with open(file_path, "r", encoding="utf-8") as stream:
|
||||
try:
|
||||
file = list(yaml.safe_load_all(stream))[0]
|
||||
except yaml.YAMLError as exc:
|
||||
sys.exit("ERROR: reading {0}".format(file_path))
|
||||
return file
|
||||
|
||||
|
||||
def map_required_fields(cim_summary, datamodel, required_fields):
|
||||
datasets_fields = {}
|
||||
add_addon = True
|
||||
flag = 0
|
||||
for item in required_fields:
|
||||
if re.match("^[A-Za-z0-9_.]*$", item):
|
||||
if item == "_time" or item == "_times":
|
||||
continue
|
||||
else:
|
||||
dataset_field = item.split(".")
|
||||
length = len(dataset_field)
|
||||
if length == 1:
|
||||
dataset = datamodel[0]
|
||||
field = dataset_field[0]
|
||||
else:
|
||||
dataset = dataset_field[length - 2]
|
||||
field = dataset_field[length - 1]
|
||||
if dataset not in datasets_fields:
|
||||
datasets_fields[dataset] = []
|
||||
datasets_fields[dataset].append(field)
|
||||
|
||||
for dataset in datasets_fields:
|
||||
add_addon = False
|
||||
mapping_set = datamodel[0] + ":" + dataset
|
||||
for item in cim_summary:
|
||||
if mapping_set in item:
|
||||
for eventtype in cim_summary[item].values():
|
||||
for e_type in eventtype:
|
||||
cim_fields = e_type.get("fields", [])
|
||||
if set(datasets_fields[dataset]).issubset(set(cim_fields)):
|
||||
add_addon = True
|
||||
|
||||
return add_addon
|
||||
|
||||
|
||||
def is_valid_detection_file(filepath) -> bool:
|
||||
"""
|
||||
check if detection file have valid analytic type and have valid
|
||||
data-model name.
|
||||
:param detection_test_path: detection test path i.e. security_content/tests/cloud
|
||||
:param test_file: detection test file name
|
||||
:param detection_products: detection tag product list for which detection test will filterised
|
||||
:return: boolean
|
||||
"""
|
||||
detection_analytic_type = ["ttp", "anomaly"]
|
||||
detection_with_valid_analytic_type = False
|
||||
detection_with_valid_datamodel = False
|
||||
detection_file_path = load_file(filepath)
|
||||
|
||||
if detection_file_path.get("type", "").lower() in detection_analytic_type:
|
||||
detection_with_valid_analytic_type = True
|
||||
|
||||
if detection_file_path.get("datamodel", []):
|
||||
detection_with_valid_datamodel = True
|
||||
|
||||
return detection_with_valid_analytic_type & detection_with_valid_datamodel
|
||||
|
||||
|
||||
def enrich_detection_file(file, ta_list, keyname):
|
||||
# file_path = 'security_content/detections/' + test['detection_result']['detection_file']
|
||||
detection_obj = load_file(file)
|
||||
detection_obj["tags"][keyname] = ta_list
|
||||
|
||||
with open(file, "w") as f:
|
||||
yaml.dump(detection_obj, f, sort_keys=False, allow_unicode=True)
|
||||
|
||||
|
||||
def main():
|
||||
|
||||
parser = argparse.ArgumentParser(
|
||||
description="Enrich detections with relevant TA names"
|
||||
)
|
||||
parser.add_argument(
|
||||
"-scr",
|
||||
"--security_content_repo",
|
||||
required=False,
|
||||
default="kirtankhatana-crest/security_content",
|
||||
help="specify the url of the security content repository",
|
||||
)
|
||||
parser.add_argument(
|
||||
"-scb",
|
||||
"--security_content_branch",
|
||||
required=False,
|
||||
default="develop",
|
||||
help="specify the security content branch",
|
||||
)
|
||||
parser.add_argument(
|
||||
"-gt",
|
||||
"--github_token",
|
||||
required=False,
|
||||
default=os.environ.get("GIT_TOKEN"),
|
||||
help="specify the github token for the PR",
|
||||
)
|
||||
|
||||
args = parser.parse_args()
|
||||
security_content_repo = args.security_content_repo
|
||||
security_content_branch = args.security_content_branch
|
||||
github_token = args.github_token
|
||||
g = Github(github_token)
|
||||
detection_types = ["cloud", "endpoint", "network"]
|
||||
|
||||
# clone security content repository
|
||||
security_content_repo_obj = git.Repo.clone_from(
|
||||
"https://"
|
||||
+ github_token
|
||||
+ ":x-oauth-basic@github.com/"
|
||||
+ security_content_repo,
|
||||
"security_content",
|
||||
branch=security_content_branch,
|
||||
)
|
||||
|
||||
# clone ta cim field reports repository
|
||||
ta_cim_field_reports_obj = git.Repo.clone_from(
|
||||
"https://"
|
||||
+ github_token
|
||||
+ ":x-oauth-basic@github.com/"
|
||||
+ "splunk/ta-cim-field-reports",
|
||||
"ta_cim_mapping_reports",
|
||||
branch="feat/cim-field-mapping",
|
||||
)
|
||||
|
||||
# iterate for every detection types
|
||||
detection_ta_mapping = {}
|
||||
for detection_type in detection_types:
|
||||
|
||||
for subdir, _, files in os.walk(f"security_content/tests/{detection_type}"):
|
||||
print(subdir)
|
||||
for file in files:
|
||||
filepath = subdir + os.sep + file
|
||||
supported_ta_list = []
|
||||
tas_with_data_list = []
|
||||
detection_obj = load_file(filepath)
|
||||
detection_name = detection_obj["name"]
|
||||
source_type = (
|
||||
detection_obj.get("tests")[0]
|
||||
.get("attack_data")[0]
|
||||
.get("sourcetype")
|
||||
)
|
||||
filepath = "security_content/detections/" + detection_obj.get("tests")[
|
||||
0
|
||||
].get("file")
|
||||
if is_valid_detection_file(filepath):
|
||||
for ta_cim_mapping_file in os.listdir(
|
||||
"./ta_cim_mapping_reports/ta_cim_mapping/cim_mapping_reports/latest/"
|
||||
):
|
||||
|
||||
ta_cim_map = fetch_ta_cim_mapping_report(
|
||||
"./ta_cim_mapping_reports/ta_cim_mapping/cim_mapping_reports/latest/"
|
||||
+ ta_cim_mapping_file
|
||||
)
|
||||
|
||||
detection_obj = load_file(filepath)
|
||||
required_fields = detection_obj.get("tags", {}).get(
|
||||
"required_fields"
|
||||
)
|
||||
datamodel = detection_obj.get("datamodel", [])
|
||||
result = map_required_fields(
|
||||
ta_cim_map["cimsummary"], datamodel, required_fields
|
||||
)
|
||||
cim_version = ta_cim_map["cim_version"]
|
||||
|
||||
if result:
|
||||
supported_ta_list.append(
|
||||
ta_cim_map.get("ta_name").get("name")
|
||||
)
|
||||
ta_sourcetype = ta_cim_map["sourcetypes"]
|
||||
if source_type in ta_sourcetype:
|
||||
tas_with_data_list.append(
|
||||
ta_cim_map.get("ta_name").get("name")
|
||||
)
|
||||
detection_ta_mapping[detection_name] = {}
|
||||
|
||||
if supported_ta_list:
|
||||
keyname = "supported_tas"
|
||||
print(filepath)
|
||||
enrich_detection_file(filepath, cim_version, "CIM_version")
|
||||
enrich_detection_file(filepath, supported_ta_list, keyname)
|
||||
detection_ta_mapping[detection_name][
|
||||
"CIM_version"
|
||||
] = cim_version
|
||||
detection_ta_mapping[detection_name][
|
||||
keyname
|
||||
] = supported_ta_list
|
||||
|
||||
if tas_with_data_list:
|
||||
keyname = "tas_with_data"
|
||||
enrich_detection_file(filepath, tas_with_data_list, keyname)
|
||||
detection_ta_mapping[detection_name][
|
||||
keyname
|
||||
] = tas_with_data_list
|
||||
|
||||
security_content_repo_obj.index.add(
|
||||
[filepath.strip("security_content/")]
|
||||
)
|
||||
|
||||
print("done")
|
||||
with io.open(
|
||||
r"./security_content_automation/detection_ta_mapping.yaml", "w", encoding="utf8"
|
||||
) as outfile:
|
||||
yaml.safe_dump(
|
||||
detection_ta_mapping, outfile, default_flow_style=False, allow_unicode=True
|
||||
)
|
||||
|
||||
security_content_repo_obj.index.commit(
|
||||
"Updated detection files with supported TA list."
|
||||
)
|
||||
|
||||
epoch_time = str(int(time.time()))
|
||||
branch_name = "security_content_automation_" + epoch_time
|
||||
security_content_repo_obj.git.checkout("-b", branch_name)
|
||||
|
||||
security_content_repo_obj.git.push("--set-upstream", "origin", branch_name)
|
||||
repo = g.get_repo("kirtankhatana-crest/security_content")
|
||||
|
||||
pr = repo.create_pull(
|
||||
title="Enrich Detection PR " + branch_name,
|
||||
body="This is a dummy PR",
|
||||
head=branch_name,
|
||||
base="develop",
|
||||
)
|
||||
|
||||
try:
|
||||
shutil.rmtree("./security_content")
|
||||
shutil.rmtree("./ta_cim_mapping_reports")
|
||||
except OSError as e:
|
||||
print("Error: %s - %s." % (e.filename, e.strerror))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,2 @@
|
||||
GitPython==3.1.24
|
||||
PyYAML==6.0
|
||||
Reference in New Issue
Block a user