admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1516 from splunk/detection_testing_fix

Browse Source 
Detection testing fix
This commit is contained in:
P4T12ICK
2021-07-14 13:04:03 +02:00
committed by GitHub
parent 9944856c3f cae682c137
commit f2aa2091ea
3 changed files with 24 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.circleci/config.yml
+16 -7
View File
@@ -496,14 +496,22 @@ workflows:
filters:
tags:
only: /.*/
- detection-testing:
# build always
requires:
- validate-content
- build-sources
- build-package
filters:
tags:
only: /^v.*/
- run-appinspect:
# build always
requires:
- validate-content
- build-sources
- build-package
- detection-testing
filters:
tags:
only: /^v.*/
@@ -514,7 +522,7 @@ workflows:
- validate-content
- build-sources
- build-package
- detection-testing
- run-appinspect
filters:
tags:
@@ -527,7 +535,7 @@ workflows:
- validate-content
- build-sources
- build-package
- detection-testing
- run-appinspect
- create-report
filters:
@@ -541,7 +549,7 @@ workflows:
- validate-content
- build-sources
- build-package
- detection-testing
- run-appinspect
- create-report
- update-sources-github
@@ -556,7 +564,7 @@ workflows:
- validate-content
- build-sources
- build-package
- detection-testing
- run-appinspect
- create-report
- update-sources-github
@@ -571,7 +579,8 @@ workflows:
requires:
- validate-content
- build-sources
- build-package
- build-package
- detection-testing
- run-appinspect
- create-report
- update-sources-github
automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py
+6 -1
View File
@@ -51,7 +51,12 @@ def test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_
def test_detection(ssh_key_name, private_key, splunk_ip, splunk_password, test_file, test_index, uuid_test, uuid_var):
test_file_obj = load_file("security_content/" + test_file[2:])
try:
test_file_obj = load_file("security_content/" + test_file[2:])
except Exception as e:
print('Error: ' + str(e))
return
if not test_file_obj:
return
#print(test_file_obj)
detections/endpoint/anomalous_usage_of_7zip.yml
+2
View File
@@ -54,3 +54,5 @@ tags:
- Processes.process_id
- Processes.parent_process_id
security_domain: endpoint