96ba6f8e73
fixed more detections
2022-01-18 13:51:37 +01:00
cc5d778466
fixed more detections
2022-01-18 13:41:02 +01:00
338f22f7e2
fixed more detections
2022-01-18 13:13:30 +01:00
84092434a2
fixed more detections
2022-01-18 12:53:54 +01:00
1568a95b47
fixed a bunch of detections
2022-01-18 08:25:39 +01:00
f48f8f5b71
fixed bugs in detections after running new validate
2022-01-17 17:45:12 +01:00
98e5af3713
put baselines and investigations into its own folder
2022-01-17 10:56:04 +01:00
49ed1fad9e
add content_organizer
2022-01-17 10:51:45 +01:00
15531b5cfc
add content_organizer
2022-01-17 10:49:57 +01:00
9ed2766f6c
improved content_changer
2022-01-17 09:44:04 +01:00
f45d2067da
fix for test key in yml
2022-01-14 14:11:23 -08:00
b928268e90
Merge pull request #1937 from splunk/DockerDetectionUpdatesAndFixes
...
Docker detection updates and fixes
2022-01-14 08:55:34 -08:00
da7e80580e
content_changer working
2022-01-14 11:34:40 +01:00
032e1bdf76
content_changer implemented
2022-01-14 11:24:49 +01:00
34a048b787
content_changer implemented
2022-01-14 10:54:31 +01:00
50d75da7b8
content_changer implemented
2022-01-14 10:27:49 +01:00
5ecb9f5fbd
Tests were failing on GH Actions that should not have been failing. This is likely due to not enough time waiting for indexing to fail. Doubled the time we wait between indexing complete check. Also moved from hourly tests of all detections to daily.
2022-01-13 15:50:07 -08:00
67ef36117b
Fixed bad printout to console where, if a test failed but --interactive mode was declared, the test would print out as having succeeded. Improved error handling if there is an issue where an uploaded data file generates and exception.
2022-01-13 12:03:49 -08:00
82a85b1305
Branch was auto-updated.
2022-01-13 09:33:10 -08:00
359c3159d0
Branch was auto-updated.
2022-01-13 09:20:09 -08:00
0a7b4d27de
minor fix
2022-01-13 09:17:03 -08:00
860320c367
Branch was auto-updated.
2022-01-12 16:50:15 -08:00
20df3795b3
Merge pull request #1933 from splunk/DockerDetectionUpdatesAndFixes
...
Move Detection Testing job to detection-testing
2022-01-12 16:49:51 -08:00
6a7f917707
Fix to requirements to include psutil. Removed import of deleted modules/aws_service.py
2022-01-12 16:40:56 -08:00
cdc902e052
Removed ansible from requirements and boto3 from requirements. Neither are used anymore
2022-01-12 16:35:11 -08:00
8d669b66f8
Removing previous file that was added accidentally in last commit. Updating the detection-testing.yml file to remove ls of non-existant directory as intended
2022-01-12 16:17:38 -08:00
fc189e92ee
Removed ls or directory that didn't exist anymore
...
in detection-testing.yml
2022-01-12 16:10:21 -08:00
85ac64bb8f
Branch was auto-updated.
2022-01-12 15:19:35 -08:00
dee77e7957
Merge pull request #1932 from splunk/DockerDetectionUpdatesAndFixes
...
Changed summarize_json.py to return success
2022-01-12 15:19:13 -08:00
73998ca5c1
Changed summarize_json.py to return success
...
(0) code even if there are failures or errors found
during testing during the initial testing of CI/CD.
This is because we don't want these to hold up
the build process. Eventually we will report actual
success/failure of all tests after we have the
opportunity to validate the new testing pipeline and
make updates to failing searches.
2022-01-12 14:57:17 -08:00
5d42ca4454
Branch was auto-updated.
2022-01-12 12:17:54 -08:00
52e482c604
Merge pull request #1928 from splunk/DockerDetectionUpdatesAndFixes
...
Docker detection updates and fixes
2022-01-12 12:17:22 -08:00
b12ccf0cd2
Added a readme.md. Need to check that the
...
markdown renders appropriately
2022-01-12 10:54:45 -08:00
3afef5d559
Updated the error for providing both PR and
...
commit_hash to a warning. This was causing
an error during PR triggered testing in github
actions as both of these are provided. Perhaps
we actually can include both of these and can
get old PRs based on commit hash, but until
then we will just test using the PR number and
ignore the commit_hash if we find both.
2022-01-12 10:38:23 -08:00
7b3029b187
Removed splunkbase-only test_config file. Pushing to run a test on all. Will push again for changes only.
2022-01-11 16:35:19 -08:00
23da2f45d2
removing file that was accidentally added.
2022-01-11 16:06:47 -08:00
e3ba9f0074
Finished removing dead code from DataManipulation.
...
Added the new_sysmon as an additional default application.
While it is not ideal to have the old and new sysmons installed
side by side, there are some detection that only work with one
and not the other. We will run both until we have moved
all detections to the new sysmon.
2022-01-11 16:03:04 -08:00
6a6bd04819
Removing some dead code from
...
DataManipulation.py
2022-01-11 15:46:38 -08:00
79d13fccef
Converted DataManipulation from using FileInput to with open, readline, etc. We needed to do this because FileInput with inplace=True remaps the print command, which may be called by several parallel threads running DataManipulation or to output status info, will cause a crash if multiple threads write to it.
2022-01-11 14:18:04 -08:00
81df4e0eec
A bunch of changes to support parallel testing and waiting to ensure data has been properly ingested/indexed before running a test. Still double-checking edge cases for this. Also improved some error printouts and status printouts. When a test completes, it now includes its runtime in its pass/fail/error print.
2022-01-11 11:59:26 -08:00
ffb734456a
Merge branch 'develop' into refactored_security_content
2022-01-11 16:01:07 +01:00
a8f1d083f8
WIP rewrite scripts
2022-01-11 15:59:57 +01:00
17d7312bc6
excluding experimental detections from the package
2022-01-10 18:00:59 -05:00
2197a6986c
removed deprecated detections from ssa package
2022-01-10 17:45:57 -05:00
6edaa90519
updated generate to match javiers feedback
2022-01-10 15:12:30 -05:00
871a66ebae
changed to use srs and complex division
2022-01-10 14:59:29 -05:00
1dea66d75c
Added authorize.conf.tar to make it possible to delete data from completed searches properly.
2022-01-05 15:26:43 -08:00
64abbe4458
Significant changes. Most importantly, instead of a hard-coded wait time after uploading data, we poll to make sure that all the data has been indexed. When this is complete, we move ahead with the test. While this costs extra in terms of CPU and Disk access, it usually allows us to go much faster since wait time is usually just a few seconds. Better tracking of time per test and time estimation.
2022-01-05 14:39:13 -08:00
8f0518b5af
spelling fix
2022-01-03 14:39:48 -05:00
7c1025425a
fixed spelling
2022-01-03 14:35:49 -05:00
P4T12ICK