9445dd886b
validate and yml fixes
2022-03-08 12:09:16 -08:00
d78bb53baa
Revert "Refactored security content"
2022-03-04 15:13:04 -05:00
3131db9d8c
merged with develop
2022-03-03 14:18:47 +01:00
68543a8dc1
merged with develop
2022-03-03 13:11:56 +01:00
ded483ddf0
added validation
2022-02-28 14:50:31 +01:00
5b581bc959
added validation
2022-02-28 14:16:23 +01:00
3946110a92
added specs
2022-02-28 12:47:14 +01:00
3cd94faaf9
updated ci
2022-02-25 16:21:08 +01:00
26f835751a
integrated reporting
2022-02-25 15:21:25 +01:00
8cf8fc40ac
reporting integrated
2022-02-24 16:18:56 +01:00
8b32ec772f
new_content integrated
2022-02-24 12:35:20 +01:00
743701d542
docgen ready
2022-02-23 14:46:39 +01:00
bda23e1631
Merge branch 'refactored_security_content' of github.com:splunk/security_content into refactored_security_content
2022-02-22 18:40:52 +01:00
2cda47990b
doc_gen ready
2022-02-22 18:40:36 +01:00
f906d579d9
Branch was auto-updated.
2022-02-18 14:38:58 -08:00
46e0bb0a01
Added a timeout to the CVESSEARCH_API enrichment in doc_gen. Sometimes, this was causing doc_gen to freeze. Now, when the API is not working or is extremely slow and a request takes longer than 10 seconds, a descriptive error will be thrown and the process will exit with 1
2022-02-18 14:19:57 -08:00
09c54931af
Memoizing/caching a call to CVESSEARCH_API_URL. Gives a SIGNIFICANT speedup in docgen.
2022-02-18 13:36:09 -08:00
9fc009a44d
Removed:
...
SPLUNK_SECURITY_ESSENTIALS
SPLUNK_APP_FOR_AWS
from default app baseline.
They are not required
for testing as they just
provide some dashboards.
2022-02-18 11:17:21 -08:00
382c107298
adding response section to analytic stories conf
2022-02-17 16:02:43 -08:00
ba05264c80
Branch was auto-updated.
2022-02-17 11:42:02 -08:00
622b5af48b
Branch was auto-updated.
2022-02-17 11:00:56 -08:00
b36fbaea7b
Branch was auto-updated.
2022-02-17 11:00:54 -08:00
1ffb4bbc0a
wip doc_gen
2022-02-17 15:20:25 +01:00
14464f17a4
wip doc_gen
2022-02-16 17:01:48 +01:00
0c89faadd7
Merge branch 'refactored_security_content' of github.com:splunk/security_content into refactored_security_content
2022-02-16 16:08:16 +01:00
60ae79dde6
wip doc_gen
2022-02-16 15:34:59 +01:00
05898d1c72
Updated the test config used for github actions and the workflow to remove the use of the splunkbase username and password secrets. After this is merged, we can remove them from the repository. We will simply use the versions that we update in S3.
2022-02-15 15:43:36 -08:00
580dba242f
Added ability to Ctrl-C/SIGINT the testing process and have it gracefully finish. This stops the containers and writes out partial progress to the output file.
2022-02-15 15:37:17 -08:00
1c5961c4c5
condition for tactic and jinja field for risk
2022-02-15 13:45:08 -08:00
95d060e135
Character sets are difficult
2022-02-15 13:52:01 -06:00
ceabbaad1f
updated github action
2022-02-15 10:03:48 +01:00
f47930004b
updated github action
2022-02-15 09:06:42 +01:00
f7f0b2712d
Merge branch 'refactored_security_content' of github.com:splunk/security_content into refactored_security_content
2022-02-14 16:48:08 +01:00
0b5b4e2388
generate API package working
2022-02-14 16:45:27 +01:00
73ba128590
fixing duplicate lookups bug
2022-02-11 12:11:10 -05:00
4f0622a5aa
Update to latest Splunkbase Windows Sysmon
2022-02-10 16:24:17 -08:00
889f27064c
Downloaded apps are now cached by default. This can save a huge amount of time on startup, especially for a large number of containers or for slower connections. Otherwise, each container that is set up needs over 600MB of throughput.
2022-02-10 15:50:25 -08:00
ec90ee19d5
Now, when one or more detection tests fail in the CI/CD,
...
it will cause the workflow to fail. In turn, this would
prevent a PR from being merged. However, this
lets a developer know more easily (without needing
to dive into the GitHub Actions logs) whether or
not their detections passed successfully. It also
upload an extra file called DetectionFailureManifest
which is a test file for ONLY the failed tests.
You can run this locally on your machine to
quickly, interactively debug the failures only.
2022-02-10 09:17:23 -08:00
428785a15f
Revert "Now, failing one or more CI/CD Tests causes"
...
This reverts commit 55e94c3eab
2022-02-10 09:07:02 -08:00
55e94c3eab
Now, failing one or more CI/CD Tests causes
...
the workflow to fail. An additional file is
also uploaded called "replicate_failures"
which allows the user to easily retest
just the failed tests locally.
2022-02-10 09:04:04 -08:00
d0afcb458d
Check to ensure that Splunkbase username and password are passed in the config or command line when one or more apps is lacking http_path or local_path. Before, this would be caught later on and not in the beginning. Also, the previous commit added new http_paths for all of the default apps.
2022-02-09 15:37:34 -08:00
c45c1335ae
Two changes. First, removed the separate splunkbase_apps and local_apps sections of the config file. They are now unified under a single section called apps. If you don't provide a splunkbase username and password, it will simply use the HTTP target/local_paths. If you do provide those, then it will donwload from splunkbase. However, local_path will override both of these.
2022-02-09 15:23:04 -08:00
00541a9a7d
Branch was auto-updated.
2022-02-07 12:38:07 -08:00
0b609161f9
fixing bug introduced in the macro/lookups addition
2022-02-07 15:28:12 -05:00
1d880e6b0e
merged with latest content and fixed bugs
2022-02-07 15:58:50 +01:00
5fbff3630e
merged with develop
2022-02-07 14:55:34 +01:00
a7da462745
ssa package generation
2022-02-07 13:33:56 +01:00
26a2d80902
switched back to test file format
2022-02-07 13:20:22 +01:00
32798f21ab
old test file format
2022-02-07 10:50:32 +01:00
968d52d2f3
generate ssa package
2022-02-07 10:24:36 +01:00
patel-bhavin