admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-03-03 15:45:39 -08:00
committed by GitHub
parent 55c6fd9c72 b9da84183b
commit c64cab5546
2 changed files with 326 additions and 357 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/docker_detection_tester/modules/validate_args.py
+206 -237
View File
@@ -12,35 +12,14 @@ ES_APP_NAME = "SPLUNK_ES_CONTENT_UPDATE"
setup_schema = {
"type": "object",
"properties": {
"branch": {
"type": "string",
"default": "develop"
},
"commit_hash": {
"type": ["string", "null"],
"default": None
},
"container_tag": {
"type": "string",
"default": "latest"
},
"no_interactive_failure": {
"type": "boolean",
"default": False
},
"interactive": {
"type": "boolean",
"default": False
},
"branch": {"type": "string", "default": "develop"},
"commit_hash": {"type": ["string", "null"], "default": None},
"container_tag": {"type": "string", "default": "latest"},
"no_interactive_failure": {"type": "boolean", "default": False},
"interactive": {"type": "boolean", "default": False},
"detections_list": {
"type": ["array", "null"],
"items": {
"type": "string"
},
"items": {"type": "string"},
"default": None,
},
"apps": {
@@ -51,220 +30,177 @@ setup_schema = {
"type": "object",
"additionalProperties": False,
"properties": {
"app_number": {
"type": ["integer", "null"]
},
"app_version": {
"type": ["string", "null"]
},
"local_path": {
"type": ["string", "null"]
},
"http_path": {
"type": ["string", "null"]
}
"app_number": {"type": ["integer", "null"]},
"app_version": {"type": ["string", "null"]},
"local_path": {"type": ["string", "null"]},
"http_path": {"type": ["string", "null"]},
},
"anyOf": [
{"required": ["local_path"]},
{"required": ["http_path"]},
{"required": ["app_number", "app_version"]},
]
],
}
},
"default": {
# The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template
"Splunk Add-on for CrowdStrike FDR": {
"app_number": 5579,
"app_version": "1.2.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz"
},
"app_version": "1.3.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_130.tgz",
},
"ADD_ON_FOR_LINUX_SYSMON": {
"app_number": 6176,
"app_version": "1.0.4",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
},
ES_APP_NAME: {
"app_number": 3449,
"app_version": None,
"local_path": None
},
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "7.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
},
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
"app_number": 2882,
"app_version": "3.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz"
},
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
"app_number": 3719,
"app_version": "1.3.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
"app_number": 4055,
"app_version": "4.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz"
},
"SPLUNK_ADD_ON_FOR_NGINX": {
"app_number": 3258,
"app_version": "3.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz"
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "3.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz"
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.6.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_860.tgz"
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz"
},
"SPLUNK_TA_FIX_WINDOWS":{
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz",
},
"SPLUNK_TA_FIX_WINDOWS": {
"app_number": 9999,
"app_version": "1.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz"
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz",
},
"SPLUNK_TA_FOR_IIS": {
"app_number": 3185,
"app_version": "1.2.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz",
},
ES_APP_NAME: {
"app_number": 3449,
"app_version": None,
"local_path": None,
},
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_801.tgz",
},
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
"app_number": 2882,
"app_version": "4.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_410.tgz",
},
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
"app_number": 3719,
"app_version": "1.3.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz",
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
"app_number": 4055,
"app_version": "4.2.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_421.tgz",
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz",
},
"SPLUNK_ADD_ON_FOR_NGINX": {
"app_number": 3258,
"app_version": "3.2.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_321.tgz",
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz",
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz",
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "3.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_310.tgz",
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.8.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_880.tgz",
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz",
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz"
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_version": "5.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_510.tgz",
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.3.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
},
"SPLUNK_TA_FOR_ZEEK": {
"app_version": "5.4.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_540.tgz",
},
"SPLUNK_TA_FOR_ZEEK": {
"app_number": 5466,
"app_version": "1.0.5",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
},
"URL_TOOLBOX": {
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz",
},
"URL_TOOLBOX": {
"app_number": 2734,
"app_version": "1.9.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
},
"SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz",
},
"SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
"app_number": 3110,
"app_version": "4.5.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz"
},
"SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
"app_version": "4.5.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_452.tgz",
},
"SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
"app_number": 3088,
"app_version": "4.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-cloud-platform_400.tgz"
},
"SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
"app_version": "4.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_410.tgz",
},
"SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
"app_number": 3110,
"app_version": "2.3.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_230.tgz"
}
}
"app_version": "2.4.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_241.tgz",
},
},
},
"mode": {
"type": "string",
"enum": ["changes", "selected", "all"],
"default": "changes"
},
"num_containers": {
"type": "integer",
"minimum": 1,
"default": 1
},
"persist_security_content": {
"type": "boolean",
"default": False
},
"pr_number": {
"type": ["integer", "null"],
"default": None
},
"reuse_image": {
"type": "boolean",
"default": True
},
"show_splunk_app_password": {
"type": "boolean",
"default": False
},
"splunkbase_username": {
"type": ["string", "null"],
"default": None
},
"splunkbase_password": {
"type": ["string", "null"],
"default": None
},
"splunk_app_password": {
"type": ["string", "null"],
"default": None
"default": "changes",
},
"num_containers": {"type": "integer", "minimum": 1, "default": 1},
"persist_security_content": {"type": "boolean", "default": False},
"pr_number": {"type": ["integer", "null"], "default": None},
"reuse_image": {"type": "boolean", "default": True},
"show_splunk_app_password": {"type": "boolean", "default": False},
"splunkbase_username": {"type": ["string", "null"], "default": None},
"splunkbase_password": {"type": ["string", "null"], "default": None},
"splunk_app_password": {"type": ["string", "null"], "default": None},
"splunk_container_apps_directory": {
"type": "string",
"default": "/opt/splunk/etc/apps"
"default": "/opt/splunk/etc/apps",
},
"local_base_container_name": {
"type": "string",
"default": "splunk_test_%d"
},
"mock": {
"type": "boolean",
"default": False
},
"local_base_container_name": {"type": "string", "default": "splunk_test_%d"},
"mock": {"type": "boolean", "default": False},
"folders": {
"type": "array",
"items": {
"type": "string",
"enum": ["endpoint", "cloud", "network", "web", "application", "experimental"]
"enum": [
"endpoint",
"cloud",
"network",
"web",
"application",
"experimental",
],
},
"default": ["endpoint", "cloud", "network", "web", "application"]
"default": ["endpoint", "cloud", "network", "web", "application"],
},
"types": {
"type": "array",
"items": {
"type": "string",
"enum": ["Anomaly", "Hunting", "TTP"]
},
"default": ["Anomaly", "Hunting", "TTP"]
"items": {"type": "string", "enum": ["Anomaly", "Hunting", "TTP"]},
"default": ["Anomaly", "Hunting", "TTP"],
},
}
},
}
@@ -273,74 +209,97 @@ def validate_file(file: io.TextIOWrapper) -> tuple[Union[dict, None], dict]:
settings = json.loads(file.read())
return validate(settings)
except Exception as e:
raise(e)
raise (e)
def check_dependencies(settings: dict, skip_password_accessibility_check: bool = True) -> bool:
def check_dependencies(
settings: dict, skip_password_accessibility_check: bool = True
) -> bool:
# Check complex mode dependencies
error_free = True
# Make sure that all the mode arguments are sane
if settings['mode'] == 'selected':
if settings["mode"] == "selected":
# Make sure that exactly one of the following fields is populated
if settings['detections_list'] == None:
print("Error - mode was 'selected' but no detections_list was supplied.", file=sys.stderr)
if settings["detections_list"] == None:
print(
"Error - mode was 'selected' but no detections_list was supplied.",
file=sys.stderr,
)
error_free = False
if settings['mode'] != 'selected' and settings['detections_list'] != None:
print("Error - mode was not 'selected' but detections_list was supplied.", file=sys.stderr)
if settings["mode"] != "selected" and settings["detections_list"] != None:
print(
"Error - mode was not 'selected' but detections_list was supplied.",
file=sys.stderr,
)
error_free = False
# Make sure that if we will be in an interactive mode, that either the user has provided the password or the password will be printed
if skip_password_accessibility_check:
pass
elif (settings['interactive'] or not settings['no_interactive_failure']) and settings['show_splunk_app_password'] is False:
elif (
settings["interactive"] or not settings["no_interactive_failure"]
) and settings["show_splunk_app_password"] is False:
print("\n\n******************************************************\n\n")
if settings['splunk_app_password'] is not None:
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
"and provided a password in the config file. We will NOT print this password to\n"
"stdout. Look in the config file for this password.", file=sys.stderr)
if settings["splunk_app_password"] is not None:
print(
"Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
"and provided a password in the config file. We will NOT print this password to\n"
"stdout. Look in the config file for this password.",
file=sys.stderr,
)
else:
print("Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
"and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"
"to True for you. Otherwise, interactive mode login would be impossible.", file=sys.stderr)
settings['show_splunk_app_password'] = True
print(
"Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
"and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"
"to True for you. Otherwise, interactive mode login would be impossible.",
file=sys.stderr,
)
settings["show_splunk_app_password"] = True
print("\n\n******************************************************\n\n")
# Returns true if there are not errors
return error_free
def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper, None] = None, strip_credentials: bool = False, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]:
def validate_and_write(
configuration: dict,
output_file: Union[io.TextIOWrapper, None] = None,
strip_credentials: bool = False,
skip_password_accessibility_check: bool = True,
) -> tuple[Union[dict, None], dict]:
closeFile = False
if output_file is None:
import datetime
now = datetime.datetime.now()
configname = now.strftime('%Y-%m-%dT%H:%M:%S%z') + '-test-run.json'
configname = now.strftime("%Y-%m-%dT%H:%M:%S%z") + "-test-run.json"
output_file = open(configname, "w")
closeFile = True
if strip_credentials:
configuration = copy.deepcopy(configuration)
configuration['splunkbase_password'] = None
configuration['splunkbase_username'] = None
configuration['container_password'] = None
configuration['show_splunk_app_password'] = True
configuration["splunkbase_password"] = None
configuration["splunkbase_username"] = None
configuration["container_password"] = None
configuration["show_splunk_app_password"] = True
validated_json, setup_schema = validate(
configuration, skip_password_accessibility_check)
configuration, skip_password_accessibility_check
)
if validated_json == None:
print("Error in the new settings! No output file written")
else:
print("Settings updated. Writing results to: %s" %
(output_file.name))
print("Settings updated. Writing results to: %s" % (output_file.name))
try:
output_file.write(json.dumps(
validated_json, sort_keys=True, indent=4))
output_file.write(json.dumps(validated_json, sort_keys=True, indent=4))
except Exception as e:
print("Error writing settings to %s: [%s]" % (
output_file.name, str(e)), file=sys.stderr)
print(
"Error writing settings to %s: [%s]" % (output_file.name, str(e)),
file=sys.stderr,
)
sys.exit(1)
if closeFile is True:
output_file.close()
@@ -348,32 +307,42 @@ def validate_and_write(configuration: dict, output_file: Union[io.TextIOWrapper,
return validated_json, setup_schema
def validate(configuration: dict, skip_password_accessibility_check: bool = True) -> tuple[Union[dict, None], dict]:
def validate(
configuration: dict, skip_password_accessibility_check: bool = True
) -> tuple[Union[dict, None], dict]:
# v = jsonschema.Draft201909Validator(argument_schema)
try:
validation_errors, validated_json = jsonschema_errorprinter.check_json(
configuration, setup_schema)
configuration, setup_schema
)
if len(validation_errors) == 0:
# check to make sure there were no complex errors
no_complex_errors = check_dependencies(
validated_json, skip_password_accessibility_check)
validated_json, skip_password_accessibility_check
)
if no_complex_errors:
return validated_json, setup_schema
else:
print("Validation failed due to error(s) listed above.",
file=sys.stderr)
print(
"Validation failed due to error(s) listed above.", file=sys.stderr
)
return None, setup_schema
else:
print("[%d] failures detected during validation of the configuration!" % (
len(validation_errors)), file=sys.stderr)
print(
"[%d] failures detected during validation of the configuration!"
% (len(validation_errors)),
file=sys.stderr,
)
for error in validation_errors:
print(error, end="\n\n", file=sys.stderr)
return None, setup_schema
except Exception as e:
print("There was an error validation the configuration: [%s]" % (
str(e)), file=sys.stderr)
print(
"There was an error validation the configuration: [%s]" % (str(e)),
file=sys.stderr,
)
return None, setup_schema
bin/docker_detection_tester/test_config_github_actions.json
+120 -120
View File
@@ -1,131 +1,131 @@
{
"apps": {
"Splunk Add-on for CrowdStrike FDR": {
"app_number": 5579,
"app_version": "1.2.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_120.tgz"
},
"ADD_ON_FOR_LINUX_SYSMON": {
"app_number": 6176,
"app_version": "1.0.4",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
},
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "7.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz"
},
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
"app_number": 2882,
"app_version": "3.0.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz"
},
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
"app_number": 3719,
"app_version": "1.3.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
"app_number": 4055,
"app_version": "4.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz"
},
"SPLUNK_ADD_ON_FOR_NGINX": {
"app_number": 3258,
"app_version": "3.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz"
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "3.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz"
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.6.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_860.tgz"
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz"
},
"SPLUNK_TA_FIX_WINDOWS":{
"app_number": 9999,
"app_version": "1.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz"
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz"
},
"SPLUNK_ES_CONTENT_UPDATE": {
"app_number": 3449,
"app_version": null,
"local_path": null
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.3.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz"
},
"SPLUNK_TA_FOR_ZEEK": {
"app_number": 5466,
"app_version": "1.0.5",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
},
"URL_TOOLBOX": {
"app_number": 2734,
"app_version": "1.9.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
},
"SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
"app_number": 3088,
"app_version": "4.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-cloud-platform_400.tgz"
},
"SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
"app_number": 3110,
"app_version": "2.3.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-google-workspace_230.tgz"
"ADD_ON_FOR_LINUX_SYSMON": {
"app_number": 6176,
"app_version": "1.0.4",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz"
},
"SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
"app_number": 3110,
"app_version": "4.5.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz"
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_801.tgz"
},
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
"app_number": 2882,
"app_version": "4.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_410.tgz"
},
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
"app_number": 3719,
"app_version": "1.3.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz"
},
"SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
"app_number": 3088,
"app_version": "4.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_410.tgz"
},
"SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
"app_number": 3110,
"app_version": "2.4.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_241.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
"app_number": 4055,
"app_version": "4.2.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_421.tgz"
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz"
},
"SPLUNK_ADD_ON_FOR_NGINX": {
"app_number": 3258,
"app_version": "3.2.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_321.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz"
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz"
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "3.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_310.tgz"
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.8.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_880.tgz"
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz"
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_510.tgz"
},
"SPLUNK_ES_CONTENT_UPDATE": {
"app_number": 3449,
"app_version": null,
"local_path": null
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.4.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_540.tgz"
},
"SPLUNK_TA_FIX_WINDOWS": {
"app_number": 9999,
"app_version": "1.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz"
},
"SPLUNK_TA_FOR_IIS": {
"app_number": 3185,
"app_version": "1.2.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-iis_120.tgz"
}
},
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz"
},
"SPLUNK_TA_FOR_ZEEK": {
"app_number": 5466,
"app_version": "1.0.5",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz"
},
"SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
"app_number": 3110,
"app_version": "4.5.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_452.tgz"
},
"Splunk Add-on for CrowdStrike FDR": {
"app_number": 5579,
"app_version": "1.3.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_130.tgz"
},
"URL_TOOLBOX": {
"app_number": 2734,
"app_version": "1.9.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz"
}
},
"branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT",
"commit_hash": null,
"container_tag": "latest",
"detections_list": null,
"folders": [
"endpoint",
"cloud",
"network",
"web",
"application"
"endpoint",
"cloud",
"network",
"web",
"application"
],
"interactive": false,
"local_base_container_name": "splunk_test_%d",
@@ -142,8 +142,8 @@
"splunkbase_password": null,
"splunkbase_username": null,
"types": [
"Anomaly",
"Hunting",
"TTP"
"Anomaly",
"Hunting",
"TTP"
]
}
}