Branch was auto-updated.

bin/docker_detection_tester/modules/splunk_sdk.py

@@ -192,15 +192,15 @@ def test_baseline_search(splunk_host, splunk_port, splunk_password, search, pass
     # search = search.replace('\\','\\\\')
 
     if search.startswith('|'):
-        search = search
+        updated_search = search
     else:
-        search = 'search ' + search
+        updated_search = 'search ' + search
 
     kwargs = {"exec_mode": "blocking",
               "dispatch.earliest_time": earliest_time,
               "dispatch.latest_time": latest_time}
 
-    splunk_search = search + ' ' + pass_condition
+    splunk_search = updated_search + ' ' + pass_condition
 
     try:
         job = service.jobs.create(splunk_search, **kwargs)
@@ -233,15 +233,15 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str,
     attempts_remaining -= 1
     
     if search.startswith('|'):
-        search = search
+        updated_search = search
     else:
-        search = 'search ' + search 
+        updated_search = 'search ' + search 
 
     kwargs = {"exec_mode": "blocking",
               "dispatch.earliest_time": "-1d",
               "dispatch.latest_time": "now"}
 
-    splunk_search = search + ' ' + pass_condition
+    splunk_search = updated_search + ' ' + pass_condition
     test_results = dict()
     
     #These will always be present. By default, we will say that the
@@ -317,6 +317,12 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str,
 
 def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wait_on_delete:Union[dict,None], search_string:str, detection_filename:str, indices:list[str]=[DEFAULT_DATA_INDEX], host:str=DEFAULT_EVENT_HOST)->bool:
     
+    if wait_on_delete:
+        print(wait_on_delete['message'])
+        print("FILENAME : [%s]"%(detection_filename))
+        print("SEARCH   :\n%s"%(search_string))
+        _ = input("****************Press ENTER to Complete Test and DELETE data****************\n\n\n")
+    
     try:
         service = client.connect(
             host=splunk_host,
@@ -329,21 +335,11 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa
 
         raise(Exception("Unable to connect to Splunk instance: " + str(e)))
 
-    #splunk_search = 'search index=test* | delete'
-    if wait_on_delete:
-        print(wait_on_delete['message'])
-        print("FILENAME : [%s]"%(detection_filename))
-        print("SEARCH   :\n%s"%(search_string))
-        _ = input("****************Press ENTER to Complete Test and DELETE data****************\n\n\n")
-    
-    data_exists = True
-
 
     #print(f"Deleting data for {detection_filename}: {indices}")
     for index in indices:
         while (get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index, event_host=host) != 0) :
             splunk_search = f'search index="{index}" host="{host}" | delete'
-
             kwargs = {
                     "exec_mode": "blocking",
                     "dispatch.earliest_time": "-1d",
@@ -353,34 +349,9 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa
                 job = service.jobs.create(splunk_search, **kwargs)
                 reader = results.ResultsReader(job)
 
-                
-                '''
-                error_in_results = False
-                for result in reader:
-                    if hasattr(result,"message") and hasattr(result,"type") and ("You have insufficient privileges to delete events" in result.message or result.type == "FATAL"):
-                        print("Delete is not enabled for admin: [%s] - enabling delete and trying to delete again..."%(result.message), file=sys.stderr)
-                        if already_enabled_delete is True:
-                            print("We already enabled delete, but the setting did not take effect.")
-                            raise(Exception("Enabling delete command failed to take effect"))
-                        if enable_delete_for_admin(splunk_host, splunk_port,splunk_password) != True:
-                            raise(Exception("Failure enabling delete for admin. We cannot continue"))
-                        # We enabled delete, so now we will try to delete again
-                        already_enabled_delete = True
-                        break
-                    else:
-                        #This is not one of the error messages, do nothing
-                        pass
-                '''
-                #No need to issue Delete command again, we will now break out of the loop
-                #if error_in_results is False:
-                #    data_exists = False
-
-                #Otherwise, we will loop again
 
             except Exception as e:
-                print(f"Trouble deleting data from a run.... we will try again: {str(e)}")
-                time.sleep(5)
-                #raise(Exception("Unable to delete data from a run: " + str(e)))
+                raise(Exception(f"Trouble deleting data using the search {splunk_search}: {str(e)}"))
         
     
     return True

bin/docker_detection_tester/modules/testing_service.py

@@ -122,7 +122,7 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa
             test_index = service.indexes[data_upload_index]
             
             with open(target_file, 'rb') as target:
-                test_index.submit(target.read(), sourcetype=attack_data['sourcetype'], source=attack_data['source'])
+                test_index.submit(target.read(), sourcetype=attack_data['sourcetype'], source=attack_data['source'], host=splunk_sdk.DEFAULT_EVENT_HOST)
         
         except http.client.HTTPException as e:
             raise(Exception(f"Failed to submit detection file {target_file} to Splunk Server: {str(e)}"))