diff --git a/bin/docker_detection_tester/detection_testing_execution.py b/bin/docker_detection_tester/detection_testing_execution.py index 4d9f1898f2..2b58110445 100644 --- a/bin/docker_detection_tester/detection_testing_execution.py +++ b/bin/docker_detection_tester/detection_testing_execution.py @@ -29,9 +29,10 @@ import requests.packages.urllib3 from docker.client import DockerClient from requests import get -import modules.new_arguments2 + + from modules import (container_manager, new_arguments2, - testing_service, validate_args) + testing_service, validate_args, utils) from modules.github_service import GithubService from modules.validate_args import validate, validate_and_write, ES_APP_NAME @@ -56,17 +57,6 @@ MAX_RECOMMENDED_CONTAINERS_BEFORE_WARNING = 2 -def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False)->None: - if os.path.exists(destination_file) and overwrite_file is False: - print(f"[{destination_file}] already exists...using cached version") - return - print(f"downloading to [{destination_file}]") - file_to_download = requests.get(url, stream=True) - with open(destination_file, "wb") as output: - for piece in file_to_download.iter_content(chunk_size=(1024*1024)): - output.write(piece) - - def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tuple[str,None] = None, splunkbase_password:tuple[str,None] = None, mock:bool = False, target_directory:str = "apps") -> str: if mock is True: target_directory = os.path.join("prior_config", target_directory) @@ -128,7 +118,7 @@ def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tupl path_after_host = url_parse_obj[2].rstrip('/') #removes / at the end, if applicable base_name = path_after_host.rpartition('/')[-1] #just get the file name dest_path = os.path.join(target_directory, base_name) #write the whole path - download_file_from_http(http_path, dest_path) + utils.download_file_from_http(http_path, dest_path, verbose_print=True) #we need to update the local path because this is used to copy it into the container later item['local_path'] = dest_path #Remove the HTTP Path, we will use the local_path instead @@ -341,7 +331,7 @@ def main(args: list[str]): start_datetime = datetime.now() - action, settings = modules.new_arguments2.parse(args) + action, settings = new_arguments2.parse(args) if action == "configure": # Done, nothing else to do print("Configuration complete!") diff --git a/bin/docker_detection_tester/modules/splunk_container.py b/bin/docker_detection_tester/modules/splunk_container.py index 1c2c3c7f28..52c07ba832 100644 --- a/bin/docker_detection_tester/modules/splunk_container.py +++ b/bin/docker_detection_tester/modules/splunk_container.py @@ -455,8 +455,18 @@ class SplunkContainer: #pdb.set_trace() # Fill in all the "Empty" fields with default values. Otherwise, we will not be able to # process the result correctly. + detection_to_test.replace("security_content/tests", "security_content/detections") + try: + test_file_obj = testing_service.load_file(os.path.join("security_content/", detection_to_test)) + if 'file' not in test_file_obj: + raise Exception(f"'file' field not found in {detection_to_test}") + except: + test_file_obj['file'] = detection_to_test.replace("tests/", "").replace(".test.yml", ".yml") + print(f"Error getting the detection file associated with the test file. We will try our best to convert it: {detection_to_test}-->{test_file_obj['file']}") + + self.synchronization_object.addError( - {"detection_file": detection_to_test, + {"detection_file": test_file_obj['file'], "detection_error": str(e)}, duration_string = datetime.timedelta(seconds=round(timeit.default_timer() - current_test_start_time)) diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index 00fd03d3e8..72b39cfc69 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -9,6 +9,7 @@ import os import time import requests from modules.DataManipulation import DataManipulation +from modules import utils from modules import splunk_sdk import timeit from typing import Union, Tuple @@ -103,12 +104,10 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa data_upload_index = splunk_sdk.DEFAULT_DATA_INDEX indices_to_delete.add(data_upload_index) - - r = requests.get(url, allow_redirects=True) + target_file = os.path.join(folder_name, attack_data['file_name']) - with open(target_file, 'wb') as target: - target.write(r.content) - #print(target_file) + utils.download_file_from_http(url, target_file) + # Update timestamps before replay diff --git a/bin/docker_detection_tester/modules/utils.py b/bin/docker_detection_tester/modules/utils.py new file mode 100644 index 0000000000..6671e16367 --- /dev/null +++ b/bin/docker_detection_tester/modules/utils.py @@ -0,0 +1,23 @@ +import os +import requests + + +def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False, chunk_size:int=1024*1024, verbose_print:bool=False)->None: + if os.path.exists(destination_file) and overwrite_file is False: + print(f"[{destination_file}] already exists...using cached version") + return + if verbose_print: + print(f"downloading to [{destination_file}]...",end="") + try: + file_to_download = requests.get(url, stream=True) + if file_to_download.status_code != 200: + if verbose_print: + print("FAILED") + raise Exception(f"Error downloading the file {url}: Status Code {file_to_download.status_code}") + with open(destination_file, "wb") as output: + for piece in file_to_download.iter_content(chunk_size=chunk_size): + output.write(piece) + except Exception as e: + if verbose_print: + print("FAILED") + raise e \ No newline at end of file diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index 7d870c4781..411f395e52 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -52,13 +52,13 @@ setup_schema = { "additionalProperties": False, "properties": { "app_number": { - "type": ["integer","null"] + "type": ["integer", "null"] }, "app_version": { - "type": ["string","null"] + "type": ["string", "null"] }, "local_path": { - "type": ["string","null"] + "type": ["string", "null"] }, "http_path": { "type": ["string", "null"] @@ -66,71 +66,36 @@ setup_schema = { }, "anyOf": [ {"required": ["local_path"]}, - {"required": ["http_path"] }, - {"required": ["app_number", "app_version"] }, + {"required": ["http_path"]}, + {"required": ["app_number", "app_version"]}, ] } }, "default": { - ES_APP_NAME : { + ES_APP_NAME: { "app_number": 3449, "app_version": None, "local_path": None }, - #The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template + # The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template - "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { - "app_number": 2757, - "app_version": "7.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { - "app_number": 742, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" - }, "ADD_ON_FOR_LINUX_SYSMON": { "app_number": 6176, "app_version": "1.0.4", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" }, - "SPLUNK_ADD_ON_FOR_SYSMON": { - "app_number": 5709, - "app_version": "2.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" - }, - "SPLUNK_COMMON_INFORMATION_MODEL": { - "app_number": 1621, - "app_version": "5.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" + "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { + "app_number": 2757, + "app_version": "7.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" }, "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { "app_number": 2882, "app_version": "3.0.2", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" }, - "SPLUNK_MACHINE_LEARNING_TOOLKIT": { - "app_number": 2890, - "app_version": "5.3.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" - }, - "SPLUNK_APP_FOR_STREAM": { - "app_number": 1809, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { - "app_number": 5234, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { - "app_number": 5238, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" - }, "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { "app_number": 3719, "app_version": "1.3.2", @@ -138,25 +103,65 @@ setup_schema = { }, "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { "app_number": 4055, - "app_version": "2.2.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" + "app_version": "4.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz" }, - "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { - "app_number": 833, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" + "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { + "app_number": 742, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" }, "SPLUNK_ADD_ON_FOR_NGINX": { "app_number": 3258, "app_version": "3.1.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" }, + "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { + "app_number": 5238, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { + "app_number": 5234, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_SYSMON": { + "app_number": 5709, + "app_version": "3.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz" + }, + "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { + "app_number": 833, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz" + }, + "SPLUNK_APP_FOR_STREAM": { + "app_number": 1809, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz" + }, + "SPLUNK_COMMON_INFORMATION_MODEL": { + "app_number": 1621, + "app_version": "5.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" + }, + "SPLUNK_MACHINE_LEARNING_TOOLKIT": { + "app_number": 2890, + "app_version": "5.3.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" + }, "SPLUNK_TA_FOR_ZEEK": { "app_number": 5466, "app_version": "1.0.5", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" }, - + "URL_TOOLBOX": { + "app_number": 2734, + "app_version": "1.9.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" + }, + } }, @@ -227,9 +232,9 @@ setup_schema = { "type": "array", "items": { "type": "string", - "enum": ["endpoint", "cloud", "network","web","application", "experimental"] + "enum": ["endpoint", "cloud", "network", "web", "application", "experimental"] }, - "default": ["endpoint", "cloud", "network","web", "application"] + "default": ["endpoint", "cloud", "network", "web", "application"] }, "types": { @@ -252,7 +257,7 @@ def validate_file(file: io.TextIOWrapper) -> tuple[Union[dict, None], dict]: raise(e) -def check_dependencies(settings: dict, skip_password_accessibility_check:bool=True) -> bool: +def check_dependencies(settings: dict, skip_password_accessibility_check: bool = True) -> bool: # Check complex mode dependencies error_free = True @@ -268,20 +273,19 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr print("Error - mode was not 'selected' but detections_list was supplied.", file=sys.stderr) error_free = False - # Make sure that if we will be in an interactive mode, that either the user has provided the password or the password will be printed if skip_password_accessibility_check: pass elif (settings['interactive'] or not settings['no_interactive_failure']) and settings['show_splunk_app_password'] is False: print("\n\n******************************************************\n\n") if settings['splunk_app_password'] is not None: - print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\ - "and provided a password in the config file. We will NOT print this password to\n"\ - "stdout. Look in the config file for this password.",file=sys.stderr) + print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n" + "and provided a password in the config file. We will NOT print this password to\n" + "stdout. Look in the config file for this password.", file=sys.stderr) else: - print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\ - "and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"\ - "to True for you. Otherwise, interactive mode login would be impossible.",file=sys.stderr) + print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n" + "and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n" + "to True for you. Otherwise, interactive mode login would be impossible.", file=sys.stderr) settings['show_splunk_app_password'] = True print("\n\n******************************************************\n\n") @@ -289,7 +293,7 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr return error_free -def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]: +def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]: closeFile = False if output_file is None: import datetime @@ -305,7 +309,8 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, configuration['container_password'] = None configuration['show_splunk_app_password'] = True - validated_json, setup_schema = validate(configuration,skip_password_accessibility_check) + validated_json, setup_schema = validate( + configuration, skip_password_accessibility_check) if validated_json == None: print("Error in the new settings! No output file written") else: @@ -324,7 +329,7 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, return validated_json, setup_schema -def validate(configuration: dict, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]: +def validate(configuration: dict, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]: # v = jsonschema.Draft201909Validator(argument_schema) try: @@ -334,7 +339,8 @@ def validate(configuration: dict, skip_password_accessibility_check:bool=True) - if len(validation_errors) == 0: # check to make sure there were no complex errors - no_complex_errors = check_dependencies(validated_json,skip_password_accessibility_check) + no_complex_errors = check_dependencies( + validated_json, skip_password_accessibility_check) if no_complex_errors: return validated_json, setup_schema else: diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 36fc631670..126ab4d2c1 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -1,114 +1,119 @@ { - "apps": { - "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { - "app_number": 2757, - "app_version": "7.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" - }, - "ADD_ON_FOR_LINUX_SYSMON": { - "app_number": 6176, - "app_version": "1.0.4", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" - }, - "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { - "app_number": 2882, - "app_version": "3.0.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" - }, - "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { - "app_number": 3719, - "app_version": "1.3.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { - "app_number": 4055, - "app_version": "2.2.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { - "app_number": 742, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" - }, - "SPLUNK_ADD_ON_FOR_NGINX": { - "app_number": 3258, - "app_version": "3.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { - "app_number": 5238, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { - "app_number": 5234, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_SYSMON": { - "app_number": 5709, - "app_version": "2.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" - }, - "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { - "app_number": 833, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" - }, - "SPLUNK_APP_FOR_STREAM": { - "app_number": 1809, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" - }, - "SPLUNK_COMMON_INFORMATION_MODEL": { - "app_number": 1621, - "app_version": "5.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" - }, - "SPLUNK_ES_CONTENT_UPDATE": { - "app_number": 3449, - "app_version": null, - "local_path": null - }, - "SPLUNK_MACHINE_LEARNING_TOOLKIT": { - "app_number": 2890, - "app_version": "5.3.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" - }, - "SPLUNK_TA_FOR_ZEEK": { - "app_number": 5466, - "app_version": "1.0.5", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - } - }, - "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", - "commit_hash": null, - "container_tag": "latest", - "detections_list": null, - "folders": [ - "endpoint", - "cloud", - "network", - "web", - "application" - ], - "interactive": false, - "local_base_container_name": "splunk_test_%d", - "mock": false, - "mode": "changes", - "no_interactive_failure": true, - "num_containers": 10, - "persist_security_content": false, - "pr_number": null, - "reuse_image": true, - "show_splunk_app_password": false, - "splunk_app_password": null, - "splunk_container_apps_directory": "/opt/splunk/etc/apps", - "splunkbase_password": null, - "splunkbase_username": null, - "types": [ - "Anomaly", - "Hunting", - "TTP" - ] -} + "apps": { + "ADD_ON_FOR_LINUX_SYSMON": { + "app_number": 6176, + "app_version": "1.0.4", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" + }, + "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { + "app_number": 2757, + "app_version": "7.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" + }, + "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { + "app_number": 2882, + "app_version": "3.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" + }, + "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { + "app_number": 3719, + "app_version": "1.3.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { + "app_number": 4055, + "app_version": "4.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { + "app_number": 742, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" + }, + "SPLUNK_ADD_ON_FOR_NGINX": { + "app_number": 3258, + "app_version": "3.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { + "app_number": 5238, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { + "app_number": 5234, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_SYSMON": { + "app_number": 5709, + "app_version": "3.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz" + }, + "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { + "app_number": 833, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz" + }, + "SPLUNK_APP_FOR_STREAM": { + "app_number": 1809, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz" + }, + "SPLUNK_COMMON_INFORMATION_MODEL": { + "app_number": 1621, + "app_version": "5.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" + }, + "SPLUNK_ES_CONTENT_UPDATE": { + "app_number": 3449, + "app_version": null, + "local_path": null + }, + "SPLUNK_MACHINE_LEARNING_TOOLKIT": { + "app_number": 2890, + "app_version": "5.3.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" + }, + "SPLUNK_TA_FOR_ZEEK": { + "app_number": 5466, + "app_version": "1.0.5", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" + }, + "URL_TOOLBOX": { + "app_number": 2734, + "app_version": "1.9.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" + } + }, + "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", + "commit_hash": null, + "container_tag": "latest", + "detections_list": null, + "folders": [ + "endpoint", + "cloud", + "network", + "web", + "application" + ], + "interactive": false, + "local_base_container_name": "splunk_test_%d", + "mock": false, + "mode": "changes", + "no_interactive_failure": true, + "num_containers": 10, + "persist_security_content": false, + "pr_number": null, + "reuse_image": true, + "show_splunk_app_password": false, + "splunk_app_password": null, + "splunk_container_apps_directory": "/opt/splunk/etc/apps", + "splunkbase_password": null, + "splunkbase_username": null, + "types": [ + "Anomaly", + "Hunting", + "TTP" + ] +} \ No newline at end of file diff --git a/tests/endpoint/linux_at_allow_config_file_creation.test.yml b/tests/endpoint/linux_at_allow_config_file_creation.test.yml index c070af54f3..b8ffb65369 100644 --- a/tests/endpoint/linux_at_allow_config_file_creation.test.yml +++ b/tests/endpoint/linux_at_allow_config_file_creation.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: sysmon_linux.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon_linux diff --git a/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml b/tests/experimental/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml similarity index 100% rename from tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml rename to tests/experimental/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml