08b779a8d1
change hec config order
2022-10-21 12:39:30 -07:00
a989b43613
another quick fix
2022-10-21 11:59:51 -07:00
0c7d9ba27f
static password fix
2022-10-21 11:56:46 -07:00
066f50f9b9
more info on setup
2022-10-21 11:42:25 -07:00
c5239bf367
typo 2
2022-10-21 11:36:24 -07:00
ddc0171958
fixed typo
2022-10-21 11:36:01 -07:00
ab57825c81
some changes to just use a running
...
splunk app on localhost
instead of a docker container
2022-10-21 11:33:04 -07:00
71a83de29c
Fixed error - referring to
...
variable by wrong name.
2022-09-28 15:37:34 -07:00
5c3b66194a
Large number of changes to support testing
...
against repos that are not the exact
security_content repo on GitHub. This
includes different main branch name,
different project name, and different
url name for the repo.
2022-09-28 14:29:03 -07:00
342d098c86
Better building of ESCU app. Include mlmodel
...
files in ESCU app when built.
2022-09-27 17:29:54 -07:00
1ab2f401c7
Updates to simplify escu app generation, removing
...
legacy code that is no longer used. This is progress
towards fixing the issue where *.mlmodel files
were not included in the detection_testing app
generation.
2022-09-27 10:18:02 -07:00
2a5807af83
Fix infinite loop when baselines search fails
...
even after tmax time
2022-09-27 09:20:13 -07:00
2555556301
Removed extra printout and added
...
a clear success/failure printout
2022-09-26 17:06:21 -07:00
124bcd1974
Better error detection/collection for baselines.
...
Previously we treated a failed search in a baseline
as an exception, but this is not necessarily true.
This was causing searches which didn't
immediately have a successful baseline to fail,
which is obviously not correct - we were not
allowing multiple attempts for the data to
be ingested before quitting.
2022-09-26 16:49:05 -07:00
7b365ddde6
experimental support for local data sources
2022-09-23 13:32:08 -07:00
33d27fbcc5
Merge branch 'support_multiple_tests_per_detection' of https://github.com/splunk/security_content into support_multiple_tests_per_detection
2022-09-23 12:40:31 -07:00
d5b4099798
Removed power_user reference and
...
unused enable_delete functionality.
2022-09-23 12:37:19 -07:00
23b960f788
Update Windows TA to patched Windows TA
...
to resolve issues with Powershell Script
Block logging events, long events greater
than 10k characters, events that are
not split properly, and events greater
than 256 lines. The modified TA contains
a number of changes to props.conf.
2022-09-23 12:29:08 -07:00
ab95f8374a
Updated the summarization
...
code to work with the
new output files
2022-09-20 14:28:43 -07:00
8b68e20e80
Fixed bug where we did not update
...
the result_count after a failed
test completed.
2022-09-20 11:54:46 -07:00
701bebd0a6
Generate proper output file name
...
in the proper location. Resolve
issue with cleanup when a test
generates an exception that
prevented shutdown from finishing.
2022-09-20 11:07:09 -07:00
5dbdf3ce38
Fixed logic for handling when a test
...
fails with an uncaught error.
Previously, this could get testing
stuck in an infinite loop.
2022-09-20 09:42:54 -07:00
99b8b2f4eb
Fixed output of files names when running
...
a mock. Handle errors when processing
a detection test generates an error.
2022-09-20 07:46:15 -07:00
091f35ee4a
Update to get selected mode working and
...
to force-test everything in GitHub Actions
2022-09-19 17:01:21 -07:00
6b09b24a5a
wait a bit longer to check on ackid
2022-09-19 16:18:59 -07:00
f07ac5187b
Must use shutil.rmtree to
...
delete non-empty directory.
2022-09-19 15:50:54 -07:00
38f135ee81
Remove data after a single detection
...
is tested instead of when all detections
have finished testing.
2022-09-19 15:46:00 -07:00
c97c6a3180
Use the proper port for HEC
...
replay on multiple containers.
Fast fail if there is an actual
error when testing.
2022-09-19 15:30:52 -07:00
46da0af83b
Use hec, with hec setup and
...
token grabbing and indexer
acknowledgement, to replay
data. Test seaches, to include
baselines, using exponential
backoff algorithm. This can result
in a huge testing speedup.
2022-09-19 14:47:12 -07:00
55a57ddd13
Remnoved extra kwargs from
...
delete api call
2022-09-13 17:06:05 -07:00
f3f6e9649a
Always download the data file when it's
...
linked via a URL
2022-09-13 14:39:18 -07:00
a9395f7aa7
Fixed downloaded file caching
...
behavior and better output file
generation.
2022-09-13 14:12:10 -07:00
486805934f
Forgot to include the change that
...
outputs the results file.
2022-09-12 16:06:15 -07:00
60e8c13ddc
Tests are now running successfully and a basic
...
output file is being generating. Still needs lots
of smoketesting, but the new workflow is looking
good!
2022-09-12 16:05:30 -07:00
dba6767016
More progress towards generating the
...
output summary.
2022-09-11 11:42:02 -07:00
37ce70685e
Updates to results collection and
...
output file generation.
2022-09-10 10:30:11 -07:00
ac506cde60
Initial testing workflow looks
...
like it is correct. However,
errors during
2022-09-10 09:10:01 -07:00
e8e8b89f6c
fix reference to attack_data
...
of dict type instead of AttackData
type
2022-09-09 14:54:40 -07:00
ad8be14783
Fix how data is fetched and make
...
sure to move on to another test
after a failure
2022-09-09 14:52:38 -07:00
8290981f01
Temporary fix with warning to
...
pathing for a baseline
2022-09-09 14:35:29 -07:00
5b04f3811e
Better organization of objects
...
and resolving a circular import
2022-09-09 14:31:22 -07:00
7ce4a575f4
Still a lot more changes, especially
...
to how results are returned. Have not
tested it running yet.
2022-09-09 14:20:37 -07:00
8eef2e3e64
More refactoring of how tests are
...
executed as we move from dicts
to objects. Makes changes, maintenance,
etc so much easier moving forward.
2022-09-09 11:15:46 -07:00
43a6c3b87d
More changes moving from
...
detection filenames to
detection objects.
2022-09-09 10:20:32 -07:00
5f9d6b0981
Fix whitespace difference
2022-09-09 09:55:26 -07:00
b207948975
Simplified diffing of changed
...
content.
2022-09-08 17:26:48 -07:00
c973b3493c
Check all files and accumulate
...
all errors before raising any
exceptions.
2022-09-08 13:31:08 -07:00
6f3a3746ab
Simplifications for treating each
...
detection as an object instead
of as a file. This makes the
logic for dealing with them much
easier.
2022-09-08 13:20:06 -07:00
341b40aed4
Updates to make the detection testing more
...
object-oriented instead of passing
complicated dictionaries around
2022-09-08 11:50:30 -07:00
bd4ab39e3c
More huge updates to support testing
...
multiple tests per file. dicts are getting
hard to manage - it may make more
sense to turn all of this state into
objects instead.
2022-09-07 17:06:38 -07:00
pyth0n1c