ba98c8c7e1
Initial improvements for handling the
...
--pr_number argument and
commit_hash arguments. These were
not working as intended.
2022-07-13 17:08:47 -07:00
bf127dc0c0
Updating authorize.conf to allow us to delete from internal indexes. Reordering how delete works.
2022-07-12 08:39:08 -07:00
71b7c5d45c
Forgot to specify the host that data
...
was being uploaded from. This means
that delete does not work as expected,
causing a large number of tests to fail
and slower searches.
2022-07-11 14:06:01 -07:00
1e6f2d79b0
Don't modify the original search variable.
...
This can cause problems if we need to run
the search again.
2022-07-11 12:48:25 -07:00
8f0e5be32d
Merge pull request #2279 from splunk/retry_failed_detections_in_cicd
...
Small changes to CI/CD detection testing system. We merge these in now so that we can examine the results of the nightly scheduled run.
2022-07-07 17:11:56 -07:00
b1ba36517e
Updated wait time
...
and fixed typo in print
statement.
2022-07-07 17:09:51 -07:00
81324ddb00
A number of detections are passing locally
...
but failing in CI/CD. I believe this is because
they are not being given enough time to finish
their data ingest completely. If a search fails,
wait some time and run it a few more times to
see if it will complete.
2022-07-07 15:58:46 -07:00
f2b7f155eb
Faster container startup when launching
...
a single container. Same wait time
between containers when launching
multiple containers. This gets us
to startup much faster for the most
common testing case, a single
container.
2022-07-07 15:30:24 -07:00
8ed9372401
On CVESearch API failure, added a
...
brief sleep to allow the API to
begin working again before trying
to resolve it again.
2022-07-07 14:40:39 -07:00
80af56d397
Fixing the rare case where enrichment fails
...
due to CVESearch API failure, causing the
entire workflow to fail. Now, we will retry
enrichment up to a total of 3 times. This should
virtually eliminate all CVE Enrichment failures.
If they do still occur, we will receive a
descriptive message indicating why there was
a failure instead of the cryptic message
that we were getting before.
2022-07-07 14:33:57 -07:00
52abbc9408
Changing enrichment failures from
...
error prints to error prints AND
failures.
2022-06-30 15:47:29 -07:00
cb1ba3c884
Added slightly more verbose printing
...
to track high-level progress in CICD.
2022-06-30 11:12:50 -07:00
45736b5ed7
Updated CI/CD Workflow and
...
python code in contentctl so that
progress update are not output
when running in CICD environment.
Outputting all of this data
causes thousands of lines of output
logs to be generated in CICD.
This info is only relevant when
running locally in a tty.
2022-06-30 10:52:00 -07:00
8b7f7d20eb
in-memory optimization for fetching CVE enrichment and app enrichment, even if skip_enrichment or cached_and_offline are disabled.
2022-06-29 16:53:17 -07:00
6cfa2014d2
Remove ambiguity from the git checkout
...
command used by the detection testing code.
2022-06-28 16:46:51 -07:00
e818a0d1ed
Fixing print statement that was
...
was not obeying the verbose argument.
2022-06-23 15:35:56 -07:00
050491a1cc
Forgot to include a print statement, causing
...
lines to be jumbled together.
2022-06-23 15:28:24 -07:00
0181c9fd63
Update the docker detection testing code
...
to use the latest contentctl from develop
as well as skip enrichment.
2022-06-23 15:18:56 -07:00
d40ca09d61
Merged develop into content_changer_improvements to resolve merge conflict. this was making it impossible to merge the PR in the GitHub Interface.
2022-06-23 14:19:17 -07:00
a74ebee88f
Added the --skip_enrichment option to the
...
contentctl tool. This can save a huge amount
of time when generating an app. Also
added a progress meter when the documentation
is being generated. Finally, correctly initialized
the default values of some class member fields
in order to get all the contentctl steps working.
2022-06-22 13:44:17 -07:00
d5d0868005
merge from develop
2022-06-21 14:53:25 -07:00
26f6bbfc92
Adding the URL_TOOLBOX app to
...
the application baseline.
2022-06-21 14:29:11 -07:00
5762b4e373
Updated the app baseline as well as
...
the python code for generating the
default config. Also updated the
print behavior for when files are
downloaded.
App baseline is now current, and
files are hosted on S3, as
of 06/21/2022.
2022-06-21 13:53:26 -07:00
c98d7b6855
Fix an issue where trying to download a file from attack_data that returns a 404 fails too late in the process, giving a nondescriptive error message and resulting in a bad filename being included in the detection failure manifest.
2022-06-21 12:52:32 -07:00
8ca9ac7b57
adding urltoolbox and spl updates
2022-06-21 12:05:52 -07:00
10e1b51251
Branch was auto-updated.
2022-06-08 19:58:36 -07:00
9bcd3dff27
Branch was auto-updated.
2022-06-08 15:58:43 -07:00
66280ea4cb
Branch was auto-updated.
2022-06-08 15:58:40 -07:00
1e9b95542d
Missing parenthesis added
2022-06-08 15:30:49 -07:00
8eb675522e
Moved printout of delete status
...
updates to a better location and
condensed multiple printouts for
multiple indices to 1.
2022-06-08 15:21:54 -07:00
5e36835ce9
Moving default data index
...
definition to splunk_sdk file.
2022-06-08 14:57:33 -07:00
7c2047e2cf
Unbalanced quote - fixed
2022-06-07 13:05:05 -07:00
9191057b1b
Changed to use a special host field
...
to denote the source of all the data
sets that we upload. This means that
we don't need hacks to get around
waiting for all of the data to finish
indexing.
2022-06-07 12:55:54 -07:00
aca19c102b
Forgot to include return type from function
2022-06-06 17:15:08 -07:00
8212e22bcb
Forgot to include a break on
...
the forced timeout
2022-06-06 17:03:59 -07:00
7a18850877
Forcing a timeout... certain indexes
...
may continue growing and never have
the same number of events!
2022-06-06 16:53:15 -07:00
d3da287905
Added support for specifying a custom index
...
to delete after a test in each attack_data
dataset in the test file. It is important to
have this level of control (per-dataset), not
just per test or per-file!
2022-06-06 16:08:06 -07:00
84420a1912
PEX-76: fix the detections obj to include the J2 docs fields
2022-06-06 15:01:26 -07:00
518251e8c8
PEX-76: add back the detection_names obj
2022-06-06 09:51:16 -07:00
c247d2cdd4
PEX-76: remove detection_names; modify detections to only contain name attribute
2022-06-02 21:03:36 -07:00
15c16fe736
Branch was auto-updated.
2022-05-31 10:27:37 -07:00
30faa736ff
Branch was auto-updated.
2022-05-31 10:07:40 -07:00
346c21cdfc
Branch was auto-updated.
2022-05-31 10:07:38 -07:00
c7ad4a013b
Updating DM enum
2022-05-31 10:58:08 -05:00
ce00e2414e
fixing testing redux
2022-05-31 11:11:40 -04:00
baac782e94
updating tests
2022-05-31 10:14:24 -04:00
f16de553cc
fix issue 2215
2022-05-31 11:04:09 +02:00
917d4e0dca
just removing bolding
2022-05-27 20:36:32 -04:00
2514983361
adding a note about how the score is calculated
2022-05-27 20:33:28 -04:00
bc4e55c32a
Revert "Updated the following apps:"
...
This reverts commit 0c74525449
2022-05-27 14:38:09 -07:00
pyth0n1c