admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

flake8

Browse Source
This commit is contained in:
bpatel
2019-06-07 13:49:49 -07:00
parent 428cd6a73b
commit f8a4c7aab5
2 changed files with 43 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+1
View File
@@ -99,3 +99,4 @@ venv.bak/
# mypy
.mypy_cache/
package/bin/sftp-config.json
package/bin/detect.py
+42 -57
View File
@@ -7,64 +7,51 @@ from splunklib.searchcommands import dispatch, GeneratingCommand, Configuration,
import splunk.mining.dcutils
import time
@Configuration(streaming=True, local=True)
class DetectCommand(GeneratingCommand):
'''
Class for the runstory SPL command
'''
logger = splunk.mining.dcutils.getLogger()
story = Option(require = True)
risk = Option(require = True)
story = Option(require=True)
risk = Option(require=True)
earliest_time = Option(doc='''
**Syntax:** **domainlist=***<path>*
**Description:** CSV file from which repeated random samples will be drawn
''', name = 'earliest_time', require = True)
''', name='earliest_time', require=True)
latest_time = Option(doc='''
**Syntax:** **domainlist=***<path>*
**Description:** CSV file from which repeated random samples will be drawn
''', name = 'latest_time', require = True)
''', name='latest_time', require=True)
def generate(self):
story = self.story
risk = self.risk
earliest_time = self.earliest_time
latest_time = self.latest_time
detection_searches_to_run = []
investigative_searches_to_run = []
# investigative_searches_to_run = []
support_searches_to_run = []
runstory_results = {}
port = splunk.getDefault('port')
service = splunklib.client.connect(token=self._metadata.searchinfo.session_key, port=port)
f = open("/opt/splunk/etc/apps/DA-ESS-ContentUpdate/bin/errors2.txt", "w")
f.write("Starting run story")
searches_to_run = []
context_searches_to_run = []
investigative_searches_to_run = []
support_searches_to_run = []
runstory_results = {}
savedsearches = service.saved_searches
for savedsearch in savedsearches:
content = savedsearch.content
if content.has_key('action.escu.analytic_story') and story in content['action.escu.analytic_story'] and content['action.escu.search_type'] == 'support':
if 'action.escu.analytic_story' in content and story in content['action.escu.analytic_story'] and \
content['action.escu.search_type'] == 'support':
support_data = {}
support_data['search_name'] = content['action.escu.full_search_name']
support_data['search_description'] = content['description']
support_data['search'] = content['search']
support_searches_to_run.append(support_data)
if content.has_key('action.escu.analytic_story') and story in content['action.escu.analytic_story'] and content['action.escu.search_type'] == 'detection':
if 'action.escu.analytic_story' in content and story in content['action.escu.analytic_story'] and \
content['action.escu.search_type'] == 'detection':
search_data = {}
search_data['search_name'] = content['action.escu.full_search_name']
search_data['search_description'] = content['description']
@@ -75,27 +62,24 @@ class DetectCommand(GeneratingCommand):
search_data['mappings'] = json.loads(content['action.escu.mappings'])
detection_searches_to_run.append(search_data)
'''
if content.has_key('action.escu.analytic_story') and story in content['action.escu.analytic_story'] and content['action.escu.search_type'] == 'investigative':
investigative_data = {}
investigative_data['search_name'] = content['action.escu.full_search_name']
investigative_data['action.escu.fields_required'] = content['action.escu.fields_required']
investigative_data['search'] = content['search']
investigative_searches_to_run.append(investigative_data)
'''
# if content.has_key('action.escu.analytic_story') and story in content['action.escu.analytic_story'] and \
# content['action.escu.search_type'] == 'investigative':
# investigative_data = {}
# investigative_data['search_name'] = content['action.escu.full_search_name']
# investigative_data['action.escu.fields_required'] = content['action.escu.fields_required']
# investigative_data['search'] = content['search']
# investigative_searches_to_run.append(investigative_data)
# Run all Support searches
support_search_name = []
for search in support_searches_to_run:
kwargs = { "exec_mode": "normal", "earliest_time": "-31d" , "latest_time": "-1d"}
kwargs = {"exec_mode": "normal", "earliest_time": "-31d", "latest_time": "-1d"}
spl = search['search']
#f.write("Support search->>>>> " + spl + "\n" )
# f.write("Support search->>>>> " + spl + "\n" )
if spl[0] != "|":
spl = "| search %s" % spl
job = service.jobs.create(spl, **kwargs)
#time.sleep(2)
# time.sleep(2)
while True:
job.refresh()
if job['isDone'] == "1":
@@ -107,10 +91,9 @@ class DetectCommand(GeneratingCommand):
for search in detection_searches_to_run:
runstory_results['detection_results'] = []
item_count = 0
kwargs = { "exec_mode": "normal","earliest_time": earliest_time, "latest_time": latest_time}
kwargs = {"exec_mode": "normal", "earliest_time": earliest_time, "latest_time": latest_time}
spl = search['search']
#f.write("detection search->>>>> " + spl + "\n" )
# f.write("detection search->>>>> " + spl + "\n" )
if spl[0] != "|":
spl = "| search %s" % spl
job = service.jobs.create(spl, **kwargs)
@@ -122,11 +105,11 @@ class DetectCommand(GeneratingCommand):
break
job_results = splunklib.results.ResultsReader(job.results())
#f.write(str(type(job_results)))
# f.write(str(type(job_results)))
runstory_results['detection_result_count'] = job['resultCount']
if job['resultCount'] > "0" and risk == "true":
detection_results=[]
detection_results = []
common_field = []
runstory_results['common_field'] = []
@@ -145,17 +128,21 @@ class DetectCommand(GeneratingCommand):
common_field.append(value)
for i in common_field:
f.write("-------->>>>>>>"+ str(i)+ "\n\n")
create_risk_score="|makeresults" +"| eval search_name=\"" + search['search_name'] +"\"" + "| eval risk_object=\"" + str(i) +"\"" + "|eval risk_score = \""+ search['risk_score'] + "\"" "| eval risk_object_type=\"" + search['risk_object_type'] +"\"" +"| sendalert risk"
f.write("-------->>>>>>>" + str(i) + "\n\n")
create_risk_score = "|makeresults" + "| eval search_name=\"" + \
search['search_name'] + "\"" + "| eval risk_object = \"" + \
str(i) + "\"" + "| eval risk_score = \"" + search['risk_score'] + \
"\"" + "| eval risk_object_type = \"" + search['risk_object_type'] + \
"\"" + "| sendalert risk"
kwargs = { "exec_mode": "normal","earliest_time": earliest_time, "latest_time": latest_time}
kwargs = {"exec_mode": "normal", "earliest_time": earliest_time, "latest_time": latest_time}
job = service.jobs.create(create_risk_score, **kwargs)
while True:
job.refresh()
if job['isDone'] == "1":
break
job.refresh()
if job['isDone'] == "1":
break
runstory_results['common_field'] = common_field
runstory_results['detection_results'] = detection_results
runstory_results['detection_search_name'] = search['search_name']
@@ -167,9 +154,9 @@ class DetectCommand(GeneratingCommand):
'_time': time.time(),
'_raw': runstory_results,
'sourcetype': "_json",
'story':story,
'support_search_name' : runstory_results['support_search_name'],
'common_field' : runstory_results['common_field'],
'story': story,
'support_search_name': runstory_results['support_search_name'],
'common_field': runstory_results['common_field'],
'mappings': runstory_results['mappings'],
'detection_search_name': runstory_results['detection_search_name'],
'detection_result_count': runstory_results['detection_result_count'],
@@ -178,10 +165,8 @@ class DetectCommand(GeneratingCommand):
'risk_object': runstory_results['risk_object']
}
if job['resultCount'] > "0" and risk == "false":
detection_results=[]
detection_results = []
common_field = []
runstory_results['common_field'] = []
@@ -204,9 +189,9 @@ class DetectCommand(GeneratingCommand):
'_time': time.time(),
'_raw': runstory_results,
'sourcetype': "_json",
'story':story,
'support_search_name' : runstory_results['support_search_name'],
'common_field' : runstory_results['common_field'],
'story': story,
'support_search_name': runstory_results['support_search_name'],
'common_field': runstory_results['common_field'],
'mappings': runstory_results['mappings'],
'detection_search_name': runstory_results['detection_search_name'],
'detection_result_count': runstory_results['detection_result_count'],