mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
udpated all bins to include new name
This commit is contained in:
+1
-1
@@ -663,7 +663,7 @@ if __name__ == "__main__":
|
||||
# grab arguments
|
||||
parser = argparse.ArgumentParser(description="generates documentation from our content", epilog="""
|
||||
This tool converts manifests information to documents in variious format like markdown and wiki markup used by Splunk docs.""")
|
||||
parser.add_argument("-p", "--path", required=True, help="path to security-content repo")
|
||||
parser.add_argument("-p", "--path", required=True, help="path to security_content repo")
|
||||
parser.add_argument("-o", "--output", required=True, help="path to the output directory for the docs")
|
||||
parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
|
||||
parser.add_argument("-gsd", "--gen_splunk_docs", required=False, default=True, action='store_true',
|
||||
|
||||
@@ -13,7 +13,7 @@ from stix2 import Filter
|
||||
|
||||
VERSION = "4.1"
|
||||
NAME = "Detection Priority by Threat Actors"
|
||||
DESCRIPTION = "security-content detection priorty by common techniques used from threat actors"
|
||||
DESCRIPTION = "security_content detection priorty by common techniques used from threat actors"
|
||||
DOMAIN = "mitre-enterprise"
|
||||
|
||||
def main(argv):
|
||||
@@ -111,7 +111,7 @@ def get_matched_techniques(counted_techniques, detections):
|
||||
matched_splunk_detections = []
|
||||
|
||||
# find detections from Splunks security content
|
||||
# https://github.com/splunk/security-content
|
||||
# https://github.com/splunk/security_content
|
||||
for detection in detections:
|
||||
if 'mitre_attack_id' in detection['object']['tags']:
|
||||
for mitreid in detection['object']['tags']['mitre_attack_id']:
|
||||
@@ -150,7 +150,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):
|
||||
|
||||
if len(technique["splunk_rules"]) > 0:
|
||||
for splunk_rule in technique["splunk_rules"]:
|
||||
comments.append("https://github.com/splunk/security-content/blob/develop/detections/" + splunk_rule['filename'])
|
||||
comments.append("https://github.com/splunk/security_content/blob/develop/detections/" + splunk_rule['filename'])
|
||||
|
||||
if len(comments) > 0:
|
||||
layer_technique["comment"] = "\n\n".join(comments)
|
||||
@@ -209,7 +209,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):
|
||||
|
||||
def generate_csv_file(matched_techniques, output):
|
||||
|
||||
security_content_url = 'https://github.com/splunk/security-content/blob/develop/detections/'
|
||||
security_content_url = 'https://github.com/splunk/security_content/blob/develop/detections/'
|
||||
|
||||
with open(output + '/detections.csv', 'w') as f:
|
||||
writer = csv.writer(f)
|
||||
|
||||
@@ -13,7 +13,7 @@ from stix2 import Filter
|
||||
|
||||
VERSION = "4.1"
|
||||
NAME = "Detection Coverage"
|
||||
DESCRIPTION = "security-content detection coverage"
|
||||
DESCRIPTION = "security_content detection coverage"
|
||||
DOMAIN = "mitre-enterprise"
|
||||
|
||||
def main(argv):
|
||||
@@ -86,7 +86,7 @@ def get_matched_techniques(counted_techniques, detections):
|
||||
matched_splunk_detections = []
|
||||
|
||||
# find detections from Splunks security content
|
||||
# https://github.com/splunk/security-content
|
||||
# https://github.com/splunk/security_content
|
||||
for detection in detections:
|
||||
if 'mitre_attack_id' in detection['object']['tags']:
|
||||
for mitreid in detection['object']['tags']['mitre_attack_id']:
|
||||
@@ -115,7 +115,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):
|
||||
comments = []
|
||||
if len(technique["splunk_rules"]) > 0:
|
||||
for splunk_rule in technique["splunk_rules"]:
|
||||
comments.append("https://github.com/splunk/security-content/blob/develop/detections/" + splunk_rule['filename'])
|
||||
comments.append("https://github.com/splunk/security_content/blob/develop/detections/" + splunk_rule['filename'])
|
||||
layer_technique = {
|
||||
"techniqueID": technique["ID"],
|
||||
"score" : technique["score"]
|
||||
@@ -177,7 +177,7 @@ def generate_navigator_layer(matched_techniques, max_count, output):
|
||||
|
||||
def generate_csv_file(matched_techniques, output):
|
||||
|
||||
security_content_url = 'https://github.com/splunk/security-content/blob/develop/detections/'
|
||||
security_content_url = 'https://github.com/splunk/security_content/blob/develop/detections/'
|
||||
|
||||
with open(output + '/coverage.csv', 'w') as f:
|
||||
writer = csv.writer(f)
|
||||
|
||||
+3
-3
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
'''
|
||||
Generates splunk configurations from manifest files under the security-content repo.
|
||||
Generates splunk configurations from manifest files under the security_content repo.
|
||||
'''
|
||||
|
||||
import glob
|
||||
@@ -580,10 +580,10 @@ def generate_mitre_lookup(OUTPUT_PATH):
|
||||
|
||||
def main(args):
|
||||
|
||||
parser = argparse.ArgumentParser(description="generates splunk conf files out of security-content manifests", epilog="""
|
||||
parser = argparse.ArgumentParser(description="generates splunk conf files out of security_content manifests", epilog="""
|
||||
This tool converts manifests to the source files to be used by products like Splunk Enterprise.
|
||||
It generates the savesearches.conf, analytics_stories.conf files for ES.""")
|
||||
parser.add_argument("-p", "--path", required=True, help="path to security-content repo")
|
||||
parser.add_argument("-p", "--path", required=True, help="path to security_content repo")
|
||||
parser.add_argument("-o", "--output", required=True, help="path to the output directory")
|
||||
parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: {{ time }} UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: {{ time }} UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: {{ time }} UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: {{ time }} UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: {{ time }} UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#############
|
||||
# Automatically generated by generator.py in splunk/security-content
|
||||
# Automatically generated by generator.py in splunk/security_content
|
||||
# On Date: {{ time }} UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
|
||||
+1
-1
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/python
|
||||
|
||||
'''
|
||||
Validates Manifest file under the security-content repo for correctness.
|
||||
Validates Manifest file under the security_content repo for correctness.
|
||||
'''
|
||||
|
||||
import glob
|
||||
|
||||
Reference in New Issue
Block a user