wip labeled data

automated_detection_testing/ci/detection_testing_batch/modules/splunk_sdk.py

@@ -54,6 +54,38 @@ def test_baseline_search(splunk_host, splunk_password, search, pass_condition, b
         return test_results
 
 
+def run_modified_splunk_search(splunk_host, splunk_password, search, detection_name, detection_file, earliest_time, latest_time):
+    try:
+        service = client.connect(
+            host=splunk_host,
+            port=8089,
+            username='admin',
+            password=splunk_password
+        )
+    except Exception as e:
+        print("Unable to connect to Splunk instance: " + str(e))
+        return 1, {}
+
+    if search.startswith('|'):
+        search = search
+    else:
+        search = 'search ' + search
+
+    kwargs = {"exec_mode": "blocking",
+              "dispatch.earliest_time": "-1d",
+              "dispatch.latest_time": "now"}
+
+    splunk_search = search + ' ' + pass_condition
+
+    try:
+        job = service.jobs.create(splunk_search, **kwargs)
+    except Exception as e:
+        print("Unable to execute detection: " + str(e))
+        return 1, {}
+
+    print(job)
+
+
 def test_detection_search(splunk_host, splunk_password, search, pass_condition, detection_name, detection_file, earliest_time, latest_time):
     try:
         service = client.connect(

automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py

@@ -9,6 +9,7 @@ import requests
 from modules.DataManipulation import DataManipulation
 from modules import splunk_sdk, aws_service
 
+
 def prepare_detection_testing(ssh_key_name, private_key, splunk_ip, splunk_password):
     with open(ssh_key_name, 'w') as file :
         file.write(private_key)
@@ -97,6 +98,9 @@ def test_detection(ssh_key_name, private_key, splunk_ip, splunk_password, test_f
     detection = load_file(os.path.join(os.path.dirname(__file__), '../security_content/detections', detection_file_name))
     result_detection = splunk_sdk.test_detection_search(splunk_ip, splunk_password, detection['search'], test['pass_condition'], detection['name'], test['file'], test['earliest_time'], test['latest_time'])
 
+    # for testing
+    splunk_sdk.run_modified_splunk_search(splunk_ip, splunk_password, detection['search'], detection['name'], test['file'], test['earliest_time'], test['latest_time'])
+
     result_detection['detection_name'] = test['name']
     result_detection['detection_file'] = test['file']
     result_test['detection_result'] = result_detection

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -51,3 +51,4 @@ tags:
   - Processes.dest
   security_domain: endpoint
 
+