admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-06-21 14:46:22 -07:00
committed by GitHub
parent 575cd80e01 6fc1b95369
commit c42c8acce2
8 changed files with 235 additions and 202 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/docker_detection_tester/detection_testing_execution.py
+5 -15
View File
@@ -29,9 +29,10 @@ import requests.packages.urllib3
from docker.client import DockerClient
from requests import get
import modules.new_arguments2
from modules import (container_manager, new_arguments2,
testing_service, validate_args)
testing_service, validate_args, utils)
from modules.github_service import GithubService
from modules.validate_args import validate, validate_and_write, ES_APP_NAME
@@ -56,17 +57,6 @@ MAX_RECOMMENDED_CONTAINERS_BEFORE_WARNING = 2
def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False)->None:
if os.path.exists(destination_file) and overwrite_file is False:
print(f"[{destination_file}] already exists...using cached version")
return
print(f"downloading to [{destination_file}]")
file_to_download = requests.get(url, stream=True)
with open(destination_file, "wb") as output:
for piece in file_to_download.iter_content(chunk_size=(1024*1024)):
output.write(piece)
def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tuple[str,None] = None, splunkbase_password:tuple[str,None] = None, mock:bool = False, target_directory:str = "apps") -> str:
if mock is True:
target_directory = os.path.join("prior_config", target_directory)
@@ -128,7 +118,7 @@ def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tupl
path_after_host = url_parse_obj[2].rstrip('/') #removes / at the end, if applicable
base_name = path_after_host.rpartition('/')[-1] #just get the file name
dest_path = os.path.join(target_directory, base_name) #write the whole path
download_file_from_http(http_path, dest_path)
utils.download_file_from_http(http_path, dest_path, verbose_print=True)
#we need to update the local path because this is used to copy it into the container later
item['local_path'] = dest_path
#Remove the HTTP Path, we will use the local_path instead
@@ -341,7 +331,7 @@ def main(args: list[str]):
start_datetime = datetime.now()
action, settings = modules.new_arguments2.parse(args)
action, settings = new_arguments2.parse(args)
if action == "configure":
# Done, nothing else to do
print("Configuration complete!")
bin/docker_detection_tester/modules/splunk_container.py
+11 -1
View File
@@ -455,8 +455,18 @@ class SplunkContainer:
#pdb.set_trace()
# Fill in all the "Empty" fields with default values. Otherwise, we will not be able to
# process the result correctly.
detection_to_test.replace("security_content/tests", "security_content/detections")
try:
test_file_obj = testing_service.load_file(os.path.join("security_content/", detection_to_test))
if 'file' not in test_file_obj:
raise Exception(f"'file' field not found in {detection_to_test}")
except:
test_file_obj['file'] = detection_to_test.replace("tests/", "").replace(".test.yml", ".yml")
print(f"Error getting the detection file associated with the test file. We will try our best to convert it: {detection_to_test}-->{test_file_obj['file']}")
self.synchronization_object.addError(
{"detection_file": detection_to_test,
{"detection_file": test_file_obj['file'],
"detection_error": str(e)}, duration_string = datetime.timedelta(seconds=round(timeit.default_timer() - current_test_start_time))
bin/docker_detection_tester/modules/testing_service.py
+4 -5
View File
@@ -9,6 +9,7 @@ import os
import time
import requests
from modules.DataManipulation import DataManipulation
from modules import utils
from modules import splunk_sdk
import timeit
from typing import Union, Tuple
@@ -103,12 +104,10 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa
data_upload_index = splunk_sdk.DEFAULT_DATA_INDEX
indices_to_delete.add(data_upload_index)
r = requests.get(url, allow_redirects=True)
target_file = os.path.join(folder_name, attack_data['file_name'])
with open(target_file, 'wb') as target:
target.write(r.content)
#print(target_file)
utils.download_file_from_http(url, target_file)
# Update timestamps before replay
bin/docker_detection_tester/modules/utils.py
+23
View File
@@ -0,0 +1,23 @@
import os
import requests
def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False, chunk_size:int=1024*1024, verbose_print:bool=False)->None:
if os.path.exists(destination_file) and overwrite_file is False:
print(f"[{destination_file}] already exists...using cached version")
return
if verbose_print:
print(f"downloading to [{destination_file}]...",end="")
try:
file_to_download = requests.get(url, stream=True)
if file_to_download.status_code != 200:
if verbose_print:
print("FAILED")
raise Exception(f"Error downloading the file {url}: Status Code {file_to_download.status_code}")
with open(destination_file, "wb") as output:
for piece in file_to_download.iter_content(chunk_size=chunk_size):
output.write(piece)
except Exception as e:
if verbose_print:
print("FAILED")
raise e
bin/docker_detection_tester/modules/validate_args.py
+73 -67
View File
@@ -52,13 +52,13 @@ setup_schema = {
"additionalProperties": False,
"properties": {
"app_number": {
"type": ["integer","null"]
"type": ["integer", "null"]
},
"app_version": {
"type": ["string","null"]
"type": ["string", "null"]
},
"local_path": {
"type": ["string","null"]
"type": ["string", "null"]
},
"http_path": {
"type": ["string", "null"]
@@ -66,71 +66,36 @@ setup_schema = {
},
"anyOf": [
{"required": ["local_path"]},
{"required": ["http_path"] },
{"required": ["app_number", "app_version"] },
{"required": ["http_path"]},
{"required": ["app_number", "app_version"]},
]
}
},
"default": {
ES_APP_NAME : {
ES_APP_NAME: {
"app_number": 3449,
"app_version": None,
"local_path": None
},
#The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template
# The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "7.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.4.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz"
},
"ADD_ON_FOR_LINUX_SYSMON": {
"app_number": 6176,
"app_version": "1.0.4",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "2.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz"
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz"
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "7.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
},
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
"app_number": 2882,
"app_version": "3.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz"
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.3.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz"
},
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
"app_number": 3719,
"app_version": "1.3.2",
@@ -138,25 +103,65 @@ setup_schema = {
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
"app_number": 4055,
"app_version": "2.2.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz"
"app_version": "4.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz"
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.4.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz"
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz"
},
"SPLUNK_ADD_ON_FOR_NGINX": {
"app_number": 3258,
"app_version": "3.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz"
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "3.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz"
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz"
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz"
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz"
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.3.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
},
"SPLUNK_TA_FOR_ZEEK": {
"app_number": 5466,
"app_version": "1.0.5",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
},
"URL_TOOLBOX": {
"app_number": 2734,
"app_version": "1.9.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
},
}
},
@@ -227,9 +232,9 @@ setup_schema = {
"type": "array",
"items": {
"type": "string",
"enum": ["endpoint", "cloud", "network","web","application", "experimental"]
"enum": ["endpoint", "cloud", "network", "web", "application", "experimental"]
},
"default": ["endpoint", "cloud", "network","web", "application"]
"default": ["endpoint", "cloud", "network", "web", "application"]
},
"types": {
@@ -252,7 +257,7 @@ def validate_file(file: io.TextIOWrapper) -> tuple[Union[dict, None], dict]:
raise(e)
def check_dependencies(settings: dict, skip_password_accessibility_check:bool=True) -> bool:
def check_dependencies(settings: dict, skip_password_accessibility_check: bool = True) -> bool:
# Check complex mode dependencies
error_free = True
@@ -268,20 +273,19 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr
print("Error - mode was not 'selected' but detections_list was supplied.", file=sys.stderr)
error_free = False
# Make sure that if we will be in an interactive mode, that either the user has provided the password or the password will be printed
if skip_password_accessibility_check:
pass
elif (settings['interactive'] or not settings['no_interactive_failure']) and settings['show_splunk_app_password'] is False:
print("\n\n******************************************************\n\n")
if settings['splunk_app_password'] is not None:
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\
"and provided a password in the config file. We will NOT print this password to\n"\
"stdout. Look in the config file for this password.",file=sys.stderr)
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
"and provided a password in the config file. We will NOT print this password to\n"
"stdout. Look in the config file for this password.", file=sys.stderr)
else:
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\
"and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"\
"to True for you. Otherwise, interactive mode login would be impossible.",file=sys.stderr)
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
"and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"
"to True for you. Otherwise, interactive mode login would be impossible.", file=sys.stderr)
settings['show_splunk_app_password'] = True
print("\n\n******************************************************\n\n")
@@ -289,7 +293,7 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr
return error_free
def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]:
def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]:
closeFile = False
if output_file is None:
import datetime
@@ -305,7 +309,8 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper,
configuration['container_password'] = None
configuration['show_splunk_app_password'] = True
validated_json, setup_schema = validate(configuration,skip_password_accessibility_check)
validated_json, setup_schema = validate(
configuration, skip_password_accessibility_check)
if validated_json == None:
print("Error in the new settings! No output file written")
else:
@@ -324,7 +329,7 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper,
return validated_json, setup_schema
def validate(configuration: dict, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]:
def validate(configuration: dict, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]:
# v = jsonschema.Draft201909Validator(argument_schema)
try:
@@ -334,7 +339,8 @@ def validate(configuration: dict, skip_password_accessibility_check:bool=True) -
if len(validation_errors) == 0:
# check to make sure there were no complex errors
no_complex_errors = check_dependencies(validated_json,skip_password_accessibility_check)
no_complex_errors = check_dependencies(
validated_json, skip_password_accessibility_check)
if no_complex_errors:
return validated_json, setup_schema
else:
bin/docker_detection_tester/test_config_github_actions.json
+118 -113
View File
@@ -1,114 +1,119 @@
{
"apps": {
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "7.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
},
"ADD_ON_FOR_LINUX_SYSMON": {
"app_number": 6176,
"app_version": "1.0.4",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
},
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
"app_number": 2882,
"app_version": "3.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz"
},
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
"app_number": 3719,
"app_version": "1.3.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
"app_number": 4055,
"app_version": "2.2.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.4.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz"
},
"SPLUNK_ADD_ON_FOR_NGINX": {
"app_number": 3258,
"app_version": "3.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz"
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "2.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz"
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.4.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz"
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz"
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz"
},
"SPLUNK_ES_CONTENT_UPDATE": {
"app_number": 3449,
"app_version": null,
"local_path": null
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.3.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
},
"SPLUNK_TA_FOR_ZEEK": {
"app_number": 5466,
"app_version": "1.0.5",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
}
},
"branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
"commit_hash": null,
"container_tag": "latest",
"detections_list": null,
"folders": [
"endpoint",
"cloud",
"network",
"web",
"application"
],
"interactive": false,
"local_base_container_name": "splunk_test_%d",
"mock": false,
"mode": "changes",
"no_interactive_failure": true,
"num_containers": 10,
"persist_security_content": false,
"pr_number": null,
"reuse_image": true,
"show_splunk_app_password": false,
"splunk_app_password": null,
"splunk_container_apps_directory": "/opt/splunk/etc/apps",
"splunkbase_password": null,
"splunkbase_username": null,
"types": [
"Anomaly",
"Hunting",
"TTP"
]
}
"apps": {
"ADD_ON_FOR_LINUX_SYSMON": {
"app_number": 6176,
"app_version": "1.0.4",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
},
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "7.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
},
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
"app_number": 2882,
"app_version": "3.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz"
},
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
"app_number": 3719,
"app_version": "1.3.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
"app_number": 4055,
"app_version": "4.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz"
},
"SPLUNK_ADD_ON_FOR_NGINX": {
"app_number": 3258,
"app_version": "3.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz"
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "3.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz"
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz"
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz"
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz"
},
"SPLUNK_ES_CONTENT_UPDATE": {
"app_number": 3449,
"app_version": null,
"local_path": null
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.3.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
},
"SPLUNK_TA_FOR_ZEEK": {
"app_number": 5466,
"app_version": "1.0.5",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
},
"URL_TOOLBOX": {
"app_number": 2734,
"app_version": "1.9.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
}
},
"branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
"commit_hash": null,
"container_tag": "latest",
"detections_list": null,
"folders": [
"endpoint",
"cloud",
"network",
"web",
"application"
],
"interactive": false,
"local_base_container_name": "splunk_test_%d",
"mock": false,
"mode": "changes",
"no_interactive_failure": true,
"num_containers": 10,
"persist_security_content": false,
"pr_number": null,
"reuse_image": true,
"show_splunk_app_password": false,
"splunk_app_password": null,
"splunk_container_apps_directory": "/opt/splunk/etc/apps",
"splunkbase_password": null,
"splunkbase_username": null,
"types": [
"Anomaly",
"Hunting",
"TTP"
]
}
tests/endpoint/linux_at_allow_config_file_creation.test.yml
+1 -1
View File
@@ -7,6 +7,6 @@ tests:
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml → tests/experimental/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml
View File