d7b159aea3
test: fixed a typo
2021-12-29 13:30:10 +05:30
500986bfb4
Update README.md
2021-12-28 18:00:14 +05:30
9da1778b53
Update README.md
2021-12-28 17:57:15 +05:30
c13428f57b
Update README.md
2021-12-27 17:10:22 +05:30
8f4c7ea68f
test: encoded git token
2021-12-27 16:03:28 +05:30
a5dcbab86c
test: updated code with some minor fixes
2021-12-24 13:31:15 +05:30
2723fab278
WIP
2021-12-23 15:30:35 +01:00
e21247f2d2
linux_persist_priv_batch_2
2021-12-23 12:31:05 +01:00
eb48e000a8
Updated default app loadout for splunkbase.
...
Added splunk_ta_for_nginz,
splunk_security_essentials,
and ta_for_zeek.
2021-12-22 14:05:55 -08:00
2574fb2fea
Hardcoding the branch to develop for CI testing.
2021-12-22 13:19:05 -08:00
dc3fc8296d
Added a config file to run tests against latest splunkbase apps.
...
Also, added slightly better error output for certain types
of test failures. Finally updated splunkbase app defaults in
validate_args, but they are commented out for now while we
use the S3 versions.
2021-12-22 13:02:21 -08:00
f300a6c4a6
Merge branch 'splunk:develop' into test/enrich_detections
2021-12-22 18:42:07 +05:30
77f963cd11
test:updated detection-ta-mapping.yml
2021-12-22 18:30:21 +05:30
0d62a0f22c
Merge branch 'linux_persist_priv_batch_1' of https://github.com/splunk/security_content into linux_persist_priv_batch_1
2021-12-22 10:54:27 +00:00
ae6cca1cf4
Added detection testing service results inLinux Add Files In Known Crontab Directories
2021-12-22 10:54:26 +00:00
9b3ecff018
Update linux_possible_append_command_to_at_allow_config_file.test.yml
2021-12-22 11:51:16 +01:00
24431a7891
Merge branch 'linux_persist_priv_batch_1' of https://github.com/splunk/security_content into linux_persist_priv_batch_1
2021-12-22 10:25:23 +00:00
d708418dd8
Added detection testing service results inLinux At Allow Config File Creation
2021-12-22 10:25:23 +00:00
9a6806ce75
Added detection testing service results inLinux At Application Execution
2021-12-22 10:22:07 +00:00
b38beadde2
Added detection testing service results inLinux Edit Cron Table Parameter
2021-12-22 10:03:26 +00:00
3a68d044ef
Update linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml
2021-12-22 10:46:27 +01:00
7549ae7c7b
Update ssa___hiding_files_and_directories_with_attrib_exe.yml
2021-12-22 10:22:49 +01:00
d1c95a44ad
Added detection testing service results inLinux Possible Cronjob Modification With Editor
2021-12-22 09:02:46 +00:00
05821f4303
Fixed some parts of the CI that don't give a descriptive error message
...
in the output files when a search generates certain types of errors.
For example, an error where it cannot reach the Splunk endpoint
server. These are rare, but good to have.
2021-12-21 14:46:44 -08:00
47e155b747
Changed back to one container per
...
GH Action Machine config with the
mock option. Also, shuffling detections after they are put into a
list to distribute runtime and load as
much as possible.
2021-12-21 14:22:33 -08:00
94130345ab
Branch was auto-updated.
2021-12-21 11:22:20 -08:00
0ff1e78f11
Branch was auto-updated.
2021-12-21 11:22:19 -08:00
5b820c2af9
Branch was auto-updated.
2021-12-21 11:22:17 -08:00
930a6db140
Merge pull request #1901 from splunk/AD_Privilege_Escalation_CVE-2021-42278
2021-12-21 14:21:54 -05:00
04c526ba6d
Changed the wrong line to trigger a test of everything. Trying again.
2021-12-21 11:17:09 -08:00
9243038c09
Added detection testing service results inSuspicious Ticket Granting Ticket Request
2021-12-21 19:06:04 +00:00
5f972f734f
Re-push to test everything with 2 containers per GH Actions machine.
2021-12-21 11:00:11 -08:00
9ba7abd0e8
Fixed a small error. If you specified a PR number and a branch that did not exist, then it would create a branch and that would be bad. Now, when you specify a branch and a PR number, the branch MUST exist. If not, we fail and bail.
2021-12-21 10:44:50 -08:00
bb8ae58f84
adding new detection
2021-12-21 13:44:17 -05:00
11dbcdf473
Update ssa___hiding_files_and_directories_with_attrib_exe.yml
2021-12-21 15:13:54 +01:00
fb087ea8b3
linux_persist_priv_batch_1
2021-12-21 11:02:15 +01:00
da634d5c25
Added detection testing service results inSuspicious Kerberos Service Ticket Request
2021-12-21 03:57:17 +00:00
4631c84a60
updating logic
2021-12-20 22:38:27 -05:00
122d403d6c
Added detection testing service results inSuspicious Kerberos Service Ticket Request
2021-12-21 03:34:17 +00:00
d5d7e0ce1a
Update suspicious_computer_account_name_change.yml
2021-12-20 22:11:09 -05:00
6fa0f9b30b
adding new detection
2021-12-20 22:08:19 -05:00
653a7755e8
Added detection testing service results inSuspicious Computer Account Name Change
2021-12-20 22:50:20 +00:00
63555bc531
Added some more robust error handling to the high level test runner. It looks like we were getting errors pulling the image from docker hub - was it down...
2021-12-20 14:45:01 -08:00
d4aae32b3d
Removed Python 2 which was previously used for splunk packaging toolkit. Replaced with python3
2021-12-20 14:26:57 -08:00
af31bdb3ec
updating observable
2021-12-20 17:20:58 -05:00
243e60a3cc
minor fix
2021-12-20 17:04:58 -05:00
264dbfb7f4
Fixed up and error that could occur where the environment is not properly set up if the users requested PERSIST_SECURITY_CONTENT, but the directory did not exist. Also fixed the default argument for this on GitHub Actions.,
2021-12-20 13:58:58 -08:00
82a4a63093
creating analytic story and first detection
2021-12-20 16:58:34 -05:00
d26032b912
Updated the github_actions config with S3 binary
...
paths.Updated the default args to include web and
experimental as possible folders with Web being a
default.
2021-12-20 13:38:51 -08:00
0e26dc76ff
Changed so that we no longer start a container if
...
we know that we will not have a test for it. For example,
if we try to start 4 containers by have only 2 tests at
the beginning we will only start 2 containers. This saves
a lot of startup time and resources. There is a descriptive
printout for this as well.
Also, bumped the maximum startup time for 6 minutes to
10 minutes. This, combined with the system info from
the previous commit should let us determine if we can
bump the number of containers per GitHub Actions
VM from 1 to 2 or more.
2021-12-20 13:17:46 -08:00
Arjun Khunti