From d5b4099798575eddc2e1d0ce429aa10484b384bc Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 23 Sep 2022 12:37:19 -0700
Subject: [PATCH] Removed power_user reference and unused enable_delete
 functionality.

---
 .../authorize.conf.tar                        | Bin 2048 -> 2048 bytes
 .../modules/splunk_sdk.py                     |  48 ------------------
 2 files changed, 48 deletions(-)

diff --git a/bin/docker_detection_tester/authorize.conf.tar b/bin/docker_detection_tester/authorize.conf.tar
index a525572e5ba253077e89f845ae279d9d9eadd1b7..f0a9515e4e26358e0a8700f34ef46ebd4fcaba1f 100644
GIT binary patch
delta 84
zcmZn=Xb_lCp=xBJz+eCc#)f7Jh9<^_#)js`#-?Tp28N~vW~K}Z29pyRQzkPqYOofU
iB&MZJ6qMfV$tc3e%2iyHoH4nNNqTb!Qw8fp1#SQ<ITTd@

delta 79
zcmZn=Xb_lCp=w~Dz+eCc#>R#Uh9*X4#)if~(oDg?(A2=xj6uO*aw22OWJX2}*7A(h
c)SQWe(wjXQMHtzw3-ZfTi{dv&GR<KH0LW$&SO5S3

diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py
index ddf12e0bde..a09e128bad 100644
--- a/bin/docker_detection_tester/modules/splunk_sdk.py
+++ b/bin/docker_detection_tester/modules/splunk_sdk.py
@@ -13,54 +13,6 @@ DEFAULT_EVENT_HOST = "ATTACK_DATA_HOST"
 DEFAULT_DATA_INDEX = set(["main"])
 FAILURE_SLEEP_INTERVAL_SECONDS = 60
 
-def enable_delete_for_admin(splunk_host:str, splunk_port:int, splunk_password:str)->bool:
-    try:
-        service = client.connect(
-            host=splunk_host,
-            port=splunk_port,
-            username='admin',
-            password=splunk_password
-        )
-    except Exception as e:
-        raise(Exception("Unable to connect to Splunk instance: " + str(e)))
-        
-
-    #write the following contents to /opt/splunk/etc/system/local/authorize.conf
-    "[role_admin]"\
-    "delete_by_keyword = enabled"\
-    "grantableRoles = admin"\
-    "importRoles = can_delete;user;power_user"\
-    "srchIndexesAllowed = *;_*;main"\
-    "srchIndexesDefault = main"\
-    "srchMaxTime = 8640000"
-
-    #Run the following search, equivalent to running ./splunk reload auth, to get the settings to take effect
-    
-    update_changed_auth_search = "| rest splunk_server=* /services/authentication/providers/services/_reload"
-
-
-    try:
-        job = service.jobs.create(update_changed_auth_search)
-    except Exception as e:
-        error_message = "Unable to enable delete: %s"%(str(e))
-        return False
-    
-    input("Waiting for you to check that delete has been enabled with: %s"%(update_changed_auth_search))
-    return True
-    '''
-    # search and replace \\ with \\\
-    # search = search.replace('\\','\\\\')
-    role = service.roles['admin']
-    try:
-        role.grant('delete_by_keyword')
-    except Exception as e:
-        print("Error - failed trying to grant 'can_delete' privs to admin: [%s]"%(str(e)))
-        return False
-    '''
-    return True
-
-
-
 
 def get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index:str, event_host:str=DEFAULT_EVENT_HOST, sourcetype:Union[str,None]=None )->int: