From c98d7b68550a308b9a2e217b9de8a8d4bc06cb2a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 12:52:32 -0700 Subject: [PATCH 1/5] Fix an issue where trying to download a file from attack_data that returns a 404 fails too late in the process, giving a nondescriptive error message and resulting in a bad filename being included in the detection failure manifest. --- .../detection_testing_execution.py | 20 +++++-------------- .../modules/splunk_container.py | 12 ++++++++++- .../modules/testing_service.py | 9 ++++----- bin/docker_detection_tester/modules/utils.py | 15 ++++++++++++++ 4 files changed, 35 insertions(+), 21 deletions(-) create mode 100644 bin/docker_detection_tester/modules/utils.py diff --git a/bin/docker_detection_tester/detection_testing_execution.py b/bin/docker_detection_tester/detection_testing_execution.py index 4d9f1898f2..990d6a8d66 100644 --- a/bin/docker_detection_tester/detection_testing_execution.py +++ b/bin/docker_detection_tester/detection_testing_execution.py @@ -29,9 +29,10 @@ import requests.packages.urllib3 from docker.client import DockerClient from requests import get -import modules.new_arguments2 + + from modules import (container_manager, new_arguments2, - testing_service, validate_args) + testing_service, validate_args, utils) from modules.github_service import GithubService from modules.validate_args import validate, validate_and_write, ES_APP_NAME @@ -56,17 +57,6 @@ MAX_RECOMMENDED_CONTAINERS_BEFORE_WARNING = 2 -def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False)->None: - if os.path.exists(destination_file) and overwrite_file is False: - print(f"[{destination_file}] already exists...using cached version") - return - print(f"downloading to [{destination_file}]") - file_to_download = requests.get(url, stream=True) - with open(destination_file, "wb") as output: - for piece in file_to_download.iter_content(chunk_size=(1024*1024)): - output.write(piece) - - def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tuple[str,None] = None, splunkbase_password:tuple[str,None] = None, mock:bool = False, target_directory:str = "apps") -> str: if mock is True: target_directory = os.path.join("prior_config", target_directory) @@ -128,7 +118,7 @@ def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tupl path_after_host = url_parse_obj[2].rstrip('/') #removes / at the end, if applicable base_name = path_after_host.rpartition('/')[-1] #just get the file name dest_path = os.path.join(target_directory, base_name) #write the whole path - download_file_from_http(http_path, dest_path) + utils.download_file_from_http(http_path, dest_path) #we need to update the local path because this is used to copy it into the container later item['local_path'] = dest_path #Remove the HTTP Path, we will use the local_path instead @@ -341,7 +331,7 @@ def main(args: list[str]): start_datetime = datetime.now() - action, settings = modules.new_arguments2.parse(args) + action, settings = new_arguments2.parse(args) if action == "configure": # Done, nothing else to do print("Configuration complete!") diff --git a/bin/docker_detection_tester/modules/splunk_container.py b/bin/docker_detection_tester/modules/splunk_container.py index 1c2c3c7f28..52c07ba832 100644 --- a/bin/docker_detection_tester/modules/splunk_container.py +++ b/bin/docker_detection_tester/modules/splunk_container.py @@ -455,8 +455,18 @@ class SplunkContainer: #pdb.set_trace() # Fill in all the "Empty" fields with default values. Otherwise, we will not be able to # process the result correctly. + detection_to_test.replace("security_content/tests", "security_content/detections") + try: + test_file_obj = testing_service.load_file(os.path.join("security_content/", detection_to_test)) + if 'file' not in test_file_obj: + raise Exception(f"'file' field not found in {detection_to_test}") + except: + test_file_obj['file'] = detection_to_test.replace("tests/", "").replace(".test.yml", ".yml") + print(f"Error getting the detection file associated with the test file. We will try our best to convert it: {detection_to_test}-->{test_file_obj['file']}") + + self.synchronization_object.addError( - {"detection_file": detection_to_test, + {"detection_file": test_file_obj['file'], "detection_error": str(e)}, duration_string = datetime.timedelta(seconds=round(timeit.default_timer() - current_test_start_time)) diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index 00fd03d3e8..72b39cfc69 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -9,6 +9,7 @@ import os import time import requests from modules.DataManipulation import DataManipulation +from modules import utils from modules import splunk_sdk import timeit from typing import Union, Tuple @@ -103,12 +104,10 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa data_upload_index = splunk_sdk.DEFAULT_DATA_INDEX indices_to_delete.add(data_upload_index) - - r = requests.get(url, allow_redirects=True) + target_file = os.path.join(folder_name, attack_data['file_name']) - with open(target_file, 'wb') as target: - target.write(r.content) - #print(target_file) + utils.download_file_from_http(url, target_file) + # Update timestamps before replay diff --git a/bin/docker_detection_tester/modules/utils.py b/bin/docker_detection_tester/modules/utils.py new file mode 100644 index 0000000000..c818e44bc0 --- /dev/null +++ b/bin/docker_detection_tester/modules/utils.py @@ -0,0 +1,15 @@ +import os +import requests + + +def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False, chunk_size=1024*1024)->None: + if os.path.exists(destination_file) and overwrite_file is False: + print(f"[{destination_file}] already exists...using cached version") + return + print(f"downloading to [{destination_file}]") + file_to_download = requests.get(url, stream=True) + if file_to_download.status_code != 200: + raise Exception(f"Error downloading the file {url}: Status Code {file_to_download.status_code}") + with open(destination_file, "wb") as output: + for piece in file_to_download.iter_content(chunk_size=chunk_size): + output.write(piece) \ No newline at end of file From 6b06ab718b1d5c247ded51e67b8c978313128245 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 13:13:50 -0700 Subject: [PATCH 2/5] Fixing a link to a dataset that has been moved. --- tests/endpoint/linux_at_allow_config_file_creation.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/linux_at_allow_config_file_creation.test.yml b/tests/endpoint/linux_at_allow_config_file_creation.test.yml index c070af54f3..b8ffb65369 100644 --- a/tests/endpoint/linux_at_allow_config_file_creation.test.yml +++ b/tests/endpoint/linux_at_allow_config_file_creation.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: sysmon_linux.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon_linux From 5762b4e3738eb4c3fd09807d006901293dbc7520 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 13:53:26 -0700 Subject: [PATCH 3/5] Updated the app baseline as well as the python code for generating the default config. Also updated the print behavior for when files are downloaded. App baseline is now current, and files are hosted on S3, as of 06/21/2022. --- .../detection_testing_execution.py | 2 +- bin/docker_detection_tester/modules/utils.py | 24 +- .../modules/validate_args.py | 137 +++++------ .../test_config_github_actions.json | 226 +++++++++--------- 4 files changed, 199 insertions(+), 190 deletions(-) diff --git a/bin/docker_detection_tester/detection_testing_execution.py b/bin/docker_detection_tester/detection_testing_execution.py index 990d6a8d66..2b58110445 100644 --- a/bin/docker_detection_tester/detection_testing_execution.py +++ b/bin/docker_detection_tester/detection_testing_execution.py @@ -118,7 +118,7 @@ def copy_local_apps_to_directory(apps: dict[str, dict], splunkbase_username:tupl path_after_host = url_parse_obj[2].rstrip('/') #removes / at the end, if applicable base_name = path_after_host.rpartition('/')[-1] #just get the file name dest_path = os.path.join(target_directory, base_name) #write the whole path - utils.download_file_from_http(http_path, dest_path) + utils.download_file_from_http(http_path, dest_path, verbose_print=True) #we need to update the local path because this is used to copy it into the container later item['local_path'] = dest_path #Remove the HTTP Path, we will use the local_path instead diff --git a/bin/docker_detection_tester/modules/utils.py b/bin/docker_detection_tester/modules/utils.py index c818e44bc0..6671e16367 100644 --- a/bin/docker_detection_tester/modules/utils.py +++ b/bin/docker_detection_tester/modules/utils.py @@ -2,14 +2,22 @@ import os import requests -def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False, chunk_size=1024*1024)->None: +def download_file_from_http(url:str, destination_file:str, overwrite_file:bool=False, chunk_size:int=1024*1024, verbose_print:bool=False)->None: if os.path.exists(destination_file) and overwrite_file is False: print(f"[{destination_file}] already exists...using cached version") return - print(f"downloading to [{destination_file}]") - file_to_download = requests.get(url, stream=True) - if file_to_download.status_code != 200: - raise Exception(f"Error downloading the file {url}: Status Code {file_to_download.status_code}") - with open(destination_file, "wb") as output: - for piece in file_to_download.iter_content(chunk_size=chunk_size): - output.write(piece) \ No newline at end of file + if verbose_print: + print(f"downloading to [{destination_file}]...",end="") + try: + file_to_download = requests.get(url, stream=True) + if file_to_download.status_code != 200: + if verbose_print: + print("FAILED") + raise Exception(f"Error downloading the file {url}: Status Code {file_to_download.status_code}") + with open(destination_file, "wb") as output: + for piece in file_to_download.iter_content(chunk_size=chunk_size): + output.write(piece) + except Exception as e: + if verbose_print: + print("FAILED") + raise e \ No newline at end of file diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index 7d870c4781..6f6fde9ed1 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -52,13 +52,13 @@ setup_schema = { "additionalProperties": False, "properties": { "app_number": { - "type": ["integer","null"] + "type": ["integer", "null"] }, "app_version": { - "type": ["string","null"] + "type": ["string", "null"] }, "local_path": { - "type": ["string","null"] + "type": ["string", "null"] }, "http_path": { "type": ["string", "null"] @@ -66,71 +66,36 @@ setup_schema = { }, "anyOf": [ {"required": ["local_path"]}, - {"required": ["http_path"] }, - {"required": ["app_number", "app_version"] }, + {"required": ["http_path"]}, + {"required": ["app_number", "app_version"]}, ] } }, "default": { - ES_APP_NAME : { + ES_APP_NAME: { "app_number": 3449, "app_version": None, "local_path": None }, - #The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template + # The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template - "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { - "app_number": 2757, - "app_version": "7.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { - "app_number": 742, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" - }, "ADD_ON_FOR_LINUX_SYSMON": { "app_number": 6176, "app_version": "1.0.4", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" }, - "SPLUNK_ADD_ON_FOR_SYSMON": { - "app_number": 5709, - "app_version": "2.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" - }, - "SPLUNK_COMMON_INFORMATION_MODEL": { - "app_number": 1621, - "app_version": "5.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" + "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { + "app_number": 2757, + "app_version": "7.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" }, "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { "app_number": 2882, "app_version": "3.0.2", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" }, - "SPLUNK_MACHINE_LEARNING_TOOLKIT": { - "app_number": 2890, - "app_version": "5.3.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" - }, - "SPLUNK_APP_FOR_STREAM": { - "app_number": 1809, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { - "app_number": 5234, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { - "app_number": 5238, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" - }, "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { "app_number": 3719, "app_version": "1.3.2", @@ -138,25 +103,60 @@ setup_schema = { }, "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { "app_number": 4055, - "app_version": "2.2.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" + "app_version": "4.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz" }, - "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { - "app_number": 833, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" + "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { + "app_number": 742, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" }, "SPLUNK_ADD_ON_FOR_NGINX": { "app_number": 3258, "app_version": "3.1.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" }, + "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { + "app_number": 5238, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { + "app_number": 5234, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_SYSMON": { + "app_number": 5709, + "app_version": "3.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz" + }, + "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { + "app_number": 833, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz" + }, + "SPLUNK_APP_FOR_STREAM": { + "app_number": 1809, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz" + }, + "SPLUNK_COMMON_INFORMATION_MODEL": { + "app_number": 1621, + "app_version": "5.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" + }, + "SPLUNK_MACHINE_LEARNING_TOOLKIT": { + "app_number": 2890, + "app_version": "5.3.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" + }, "SPLUNK_TA_FOR_ZEEK": { "app_number": 5466, "app_version": "1.0.5", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - }, - + } + } }, @@ -227,9 +227,9 @@ setup_schema = { "type": "array", "items": { "type": "string", - "enum": ["endpoint", "cloud", "network","web","application", "experimental"] + "enum": ["endpoint", "cloud", "network", "web", "application", "experimental"] }, - "default": ["endpoint", "cloud", "network","web", "application"] + "default": ["endpoint", "cloud", "network", "web", "application"] }, "types": { @@ -252,7 +252,7 @@ def validate_file(file: io.TextIOWrapper) -> tuple[Union[dict, None], dict]: raise(e) -def check_dependencies(settings: dict, skip_password_accessibility_check:bool=True) -> bool: +def check_dependencies(settings: dict, skip_password_accessibility_check: bool = True) -> bool: # Check complex mode dependencies error_free = True @@ -268,20 +268,19 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr print("Error - mode was not 'selected' but detections_list was supplied.", file=sys.stderr) error_free = False - # Make sure that if we will be in an interactive mode, that either the user has provided the password or the password will be printed if skip_password_accessibility_check: pass elif (settings['interactive'] or not settings['no_interactive_failure']) and settings['show_splunk_app_password'] is False: print("\n\n******************************************************\n\n") if settings['splunk_app_password'] is not None: - print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\ - "and provided a password in the config file. We will NOT print this password to\n"\ - "stdout. Look in the config file for this password.",file=sys.stderr) + print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n" + "and provided a password in the config file. We will NOT print this password to\n" + "stdout. Look in the config file for this password.", file=sys.stderr) else: - print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"\ - "and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"\ - "to True for you. Otherwise, interactive mode login would be impossible.",file=sys.stderr) + print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n" + "and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n" + "to True for you. Otherwise, interactive mode login would be impossible.", file=sys.stderr) settings['show_splunk_app_password'] = True print("\n\n******************************************************\n\n") @@ -289,7 +288,7 @@ def check_dependencies(settings: dict, skip_password_accessibility_check:bool=Tr return error_free -def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]: +def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]: closeFile = False if output_file is None: import datetime @@ -305,7 +304,8 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, configuration['container_password'] = None configuration['show_splunk_app_password'] = True - validated_json, setup_schema = validate(configuration,skip_password_accessibility_check) + validated_json, setup_schema = validate( + configuration, skip_password_accessibility_check) if validated_json == None: print("Error in the new settings! No output file written") else: @@ -324,7 +324,7 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, return validated_json, setup_schema -def validate(configuration: dict, skip_password_accessibility_check:bool=True) -> tuple[Union[dict, None], dict]: +def validate(configuration: dict, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]: # v = jsonschema.Draft201909Validator(argument_schema) try: @@ -334,7 +334,8 @@ def validate(configuration: dict, skip_password_accessibility_check:bool=True) - if len(validation_errors) == 0: # check to make sure there were no complex errors - no_complex_errors = check_dependencies(validated_json,skip_password_accessibility_check) + no_complex_errors = check_dependencies( + validated_json, skip_password_accessibility_check) if no_complex_errors: return validated_json, setup_schema else: diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 36fc631670..5b664c4d4a 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -1,114 +1,114 @@ { - "apps": { - "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { - "app_number": 2757, - "app_version": "7.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" - }, - "ADD_ON_FOR_LINUX_SYSMON": { - "app_number": 6176, - "app_version": "1.0.4", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" - }, - "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { - "app_number": 2882, - "app_version": "3.0.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" - }, - "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { - "app_number": 3719, - "app_version": "1.3.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { - "app_number": 4055, - "app_version": "2.2.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { - "app_number": 742, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" - }, - "SPLUNK_ADD_ON_FOR_NGINX": { - "app_number": 3258, - "app_version": "3.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { - "app_number": 5238, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { - "app_number": 5234, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_SYSMON": { - "app_number": 5709, - "app_version": "2.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" - }, - "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { - "app_number": 833, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" - }, - "SPLUNK_APP_FOR_STREAM": { - "app_number": 1809, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" - }, - "SPLUNK_COMMON_INFORMATION_MODEL": { - "app_number": 1621, - "app_version": "5.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" - }, - "SPLUNK_ES_CONTENT_UPDATE": { - "app_number": 3449, - "app_version": null, - "local_path": null - }, - "SPLUNK_MACHINE_LEARNING_TOOLKIT": { - "app_number": 2890, - "app_version": "5.3.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" - }, - "SPLUNK_TA_FOR_ZEEK": { - "app_number": 5466, - "app_version": "1.0.5", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - } - }, - "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", - "commit_hash": null, - "container_tag": "latest", - "detections_list": null, - "folders": [ - "endpoint", - "cloud", - "network", - "web", - "application" - ], - "interactive": false, - "local_base_container_name": "splunk_test_%d", - "mock": false, - "mode": "changes", - "no_interactive_failure": true, - "num_containers": 10, - "persist_security_content": false, - "pr_number": null, - "reuse_image": true, - "show_splunk_app_password": false, - "splunk_app_password": null, - "splunk_container_apps_directory": "/opt/splunk/etc/apps", - "splunkbase_password": null, - "splunkbase_username": null, - "types": [ - "Anomaly", - "Hunting", - "TTP" - ] -} + "apps": { + "ADD_ON_FOR_LINUX_SYSMON": { + "app_number": 6176, + "app_version": "1.0.4", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" + }, + "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { + "app_number": 2757, + "app_version": "7.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" + }, + "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { + "app_number": 2882, + "app_version": "3.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" + }, + "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { + "app_number": 3719, + "app_version": "1.3.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { + "app_number": 4055, + "app_version": "4.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { + "app_number": 742, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" + }, + "SPLUNK_ADD_ON_FOR_NGINX": { + "app_number": 3258, + "app_version": "3.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { + "app_number": 5238, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { + "app_number": 5234, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz" + }, + "SPLUNK_ADD_ON_FOR_SYSMON": { + "app_number": 5709, + "app_version": "3.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz" + }, + "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { + "app_number": 833, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz" + }, + "SPLUNK_APP_FOR_STREAM": { + "app_number": 1809, + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz" + }, + "SPLUNK_COMMON_INFORMATION_MODEL": { + "app_number": 1621, + "app_version": "5.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" + }, + "SPLUNK_ES_CONTENT_UPDATE": { + "app_number": 3449, + "app_version": null, + "local_path": null + }, + "SPLUNK_MACHINE_LEARNING_TOOLKIT": { + "app_number": 2890, + "app_version": "5.3.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" + }, + "SPLUNK_TA_FOR_ZEEK": { + "app_number": 5466, + "app_version": "1.0.5", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" + } + }, + "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", + "commit_hash": null, + "container_tag": "latest", + "detections_list": null, + "folders": [ + "endpoint", + "cloud", + "network", + "web", + "application" + ], + "interactive": false, + "local_base_container_name": "splunk_test_%d", + "mock": false, + "mode": "changes", + "no_interactive_failure": true, + "num_containers": 10, + "persist_security_content": false, + "pr_number": null, + "reuse_image": true, + "show_splunk_app_password": false, + "splunk_app_password": null, + "splunk_container_apps_directory": "/opt/splunk/etc/apps", + "splunkbase_password": null, + "splunkbase_username": null, + "types": [ + "Anomaly", + "Hunting", + "TTP" + ] +} \ No newline at end of file From 6554d4a42b9e87e07a1491650181d2ec4cef5b62 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 13:59:50 -0700 Subject: [PATCH 4/5] Moved ssa___ test file from the tests/network directory to the tests/experimental/endpoint directory because that's where the corresponding detection resides. --- ...mmand_and_scripting_interpreter_outbound_ldap_traffic.test.yml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/{ => experimental}/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml (100%) diff --git a/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml b/tests/experimental/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml similarity index 100% rename from tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml rename to tests/experimental/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml From 26f6bbfc924662f4439dc447ec7035157b33b255 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 21 Jun 2022 14:29:11 -0700 Subject: [PATCH 5/5] Adding the URL_TOOLBOX app to the application baseline. --- bin/docker_detection_tester/modules/validate_args.py | 7 ++++++- .../test_config_github_actions.json | 5 +++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index 6f6fde9ed1..411f395e52 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -155,7 +155,12 @@ setup_schema = { "app_number": 5466, "app_version": "1.0.5", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - } + }, + "URL_TOOLBOX": { + "app_number": 2734, + "app_version": "1.9.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" + }, } }, diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 5b664c4d4a..126ab4d2c1 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -79,6 +79,11 @@ "app_number": 5466, "app_version": "1.0.5", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" + }, + "URL_TOOLBOX": { + "app_number": 2734, + "app_version": "1.9.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" } }, "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",