From e21e2a6304bd71b151f6ba1e012bd67cd9299a28 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 12 Jul 2021 11:21:23 +0200 Subject: [PATCH 1/4] bug fix in detection testing --- .circleci/config.yml | 7 ++++++- .../ci/detection_testing_batch/Dockerfile | 1 + .../detection_testing_batch/detection_testing_execution.py | 7 ++++++- .../ci/detection_testing_batch/modules/github_service.py | 4 +++- 4 files changed, 16 insertions(+), 3 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 979e0e2fb8..1c77003daf 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -432,7 +432,12 @@ jobs: - run: name: checkout repo command: | - if [ "${CIRCLE_BRANCH}" == "" ]; then + if [[ ! -z "${CIRCLE_PULL_REQUEST}" && ! -z "${CIRCLE_PR_NUMBER}" ]]; then + git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git + cd security-content + git fetch origin pull/${CIRCLE_PR_NUMBER}/head:${CIRCLE_BRANCH} + git checkout ${CIRCLE_BRANCH} + elif [ "${CIRCLE_BRANCH}" == "" ]; then git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git else git clone --branch ${CIRCLE_BRANCH} https://${GITHUB_TOKEN}@github.com/splunk/security-content.git diff --git a/automated_detection_testing/ci/detection_testing_batch/Dockerfile b/automated_detection_testing/ci/detection_testing_batch/Dockerfile index ffe88f2650..1ed762dde5 100644 --- a/automated_detection_testing/ci/detection_testing_batch/Dockerfile +++ b/automated_detection_testing/ci/detection_testing_batch/Dockerfile @@ -5,6 +5,7 @@ RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata RUN apt-get install -y python3-dev git python-dev unzip python3-pip awscli RUN apt-get install -y python-gitdb RUN apt-get install -y wget unzip +RUN apt-get install -y git ADD . /app diff --git a/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py b/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py index 9f21d3418b..a1f58721f5 100644 --- a/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py +++ b/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py @@ -19,12 +19,17 @@ def main(args): parser = argparse.ArgumentParser(description="CI Detection Testing") parser.add_argument("-b", "--branch", required=True, help="security content branch") parser.add_argument("-u", "--uuid", required=True, help="uuid for detection test") + parser.add_argument("-pr", "--pr-number", required=False, help="Pull Request Number") args = parser.parse_args() branch = args.branch uuid_test = args.uuid + pr_number = args.pr_number - github_service = GithubService(branch) + if pr_number: + github_service = GithubService(branch, pr_number) + else: + github_service = GithubService(branch) test_files = github_service.get_changed_test_files() if len(test_files) == 0: print("No new detections to test.") diff --git a/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py b/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py index 62913aeeec..6658d8b063 100644 --- a/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py +++ b/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py @@ -15,9 +15,11 @@ SECURITY_CONTENT_URL = "https://github.com/splunk/security_content" class GithubService: - def __init__(self, security_content_branch): + def __init__(self, security_content_branch, PR_number = None): self.security_content_branch = security_content_branch self.security_content_repo_obj = self.clone_project(SECURITY_CONTENT_URL, f"security_content", f"develop") + if PR_number: + os.system('cd security_content && git fetch origin refs/pull/' + PR_number + '/head:' + security_content_branch + ' && cd ..') self.security_content_repo_obj.git.checkout(security_content_branch) def clone_project(self, url, project, branch): From e86c4a24c4ca78815d1f6b51b038c2eeccc653c2 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 12 Jul 2021 11:26:31 +0200 Subject: [PATCH 2/4] bug fix in detection testing --- .../ci/python_ci_code/main.py | 30 ++++++++++++++----- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/automated_detection_testing/ci/python_ci_code/main.py b/automated_detection_testing/ci/python_ci_code/main.py index 2cd876f469..800d40085e 100644 --- a/automated_detection_testing/ci/python_ci_code/main.py +++ b/automated_detection_testing/ci/python_ci_code/main.py @@ -10,9 +10,11 @@ def main(args): parser = argparse.ArgumentParser(description="Detection Testing Execution") parser.add_argument("-b", "--branch", required=True, help="security content branch") + parser.add_argument("-pr", "--pr-number", required=False, help="Pull Request Number") args = parser.parse_args() branch = args.branch + pr_number = args.pr_number # vars max_waiting_time = 7200 @@ -23,14 +25,26 @@ def main(args): # start aws batch job client = boto3.client("batch", region_name="eu-central-1") - response = client.submit_job( - jobName='detection_testing', - jobQueue='detection_testing_execution_queue', - jobDefinition='detection_testing_execution:2', - containerOverrides={ - 'command': ['-b', branch, '-u', uuid_test] - } - ) + + if pr_number: + response = client.submit_job( + jobName='detection_testing', + jobQueue='detection_testing_execution_queue', + jobDefinition='detection_testing_execution:2', + containerOverrides={ + 'command': ['-b', branch, '-u', uuid_test, '-pr', pr_number] + } + ) + else: + response = client.submit_job( + jobName='detection_testing', + jobQueue='detection_testing_execution_queue', + jobDefinition='detection_testing_execution:2', + containerOverrides={ + 'command': ['-b', branch, '-u', uuid_test] + } + ) + while max_waiting_time > current_waiting_time: From 6fdad9ba382e796a4cecfd0ddb27d2f01c4782c6 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 12 Jul 2021 11:38:09 +0200 Subject: [PATCH 3/4] improvements --- .circleci/config.yml | 6 +++++- .../attempted_credential_dump_from_registry_via_reg_exe.yml | 2 ++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 1c77003daf..3c32c95fd1 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -459,7 +459,11 @@ jobs: virtualenv --python=/usr/bin/python3 --clear venv source venv/bin/activate pip install -q -r requirements.txt - python main.py -b ${CIRCLE_BRANCH} + if [[ ! -z "${CIRCLE_PULL_REQUEST}" && ! -z "${CIRCLE_PR_NUMBER}" ]]; then + python main.py -b ${CIRCLE_BRANCH} + else + python main.py -b ${CIRCLE_BRANCH} -pr ${CIRCLE_PR_NUMBER} + fi workflows: diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index d6f1b914d4..cc40eff0b5 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -50,3 +50,5 @@ tags: - Processes.process - Processes.dest security_domain: endpoint + + \ No newline at end of file From fe2f76e99cc8c61d397dd0ea3ed5f3b18cfaf90c Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 12 Jul 2021 11:47:29 +0200 Subject: [PATCH 4/4] improvements --- .circleci/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 3c32c95fd1..730f789e91 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -460,9 +460,9 @@ jobs: source venv/bin/activate pip install -q -r requirements.txt if [[ ! -z "${CIRCLE_PULL_REQUEST}" && ! -z "${CIRCLE_PR_NUMBER}" ]]; then - python main.py -b ${CIRCLE_BRANCH} - else python main.py -b ${CIRCLE_BRANCH} -pr ${CIRCLE_PR_NUMBER} + else + python main.py -b ${CIRCLE_BRANCH} fi