Commit Graph

18 Commits

Author SHA1 Message Date
pyth0n1c ab57825c81 some changes to just use a running
splunk app on localhost
instead of a docker container
2022-10-21 11:33:04 -07:00
pyth0n1c 71a83de29c Fixed error - referring to
variable by wrong name.
2022-09-28 15:37:34 -07:00
pyth0n1c 5c3b66194a Large number of changes to support testing
against repos that are not the exact
security_content repo on GitHub.  This
includes different main branch name,
different project name, and different
url name for the repo.
2022-09-28 14:29:03 -07:00
pyth0n1c 342d098c86 Better building of ESCU app. Include mlmodel
files in ESCU app when built.
2022-09-27 17:29:54 -07:00
pyth0n1c 1ab2f401c7 Updates to simplify escu app generation, removing
legacy code that is no longer used.  This is progress
towards fixing the issue where *.mlmodel files
were not included in the detection_testing app
generation.
2022-09-27 10:18:02 -07:00
pyth0n1c 701bebd0a6 Generate proper output file name
in the proper location. Resolve
issue with cleanup when a test
generates an exception that
prevented shutdown from finishing.
2022-09-20 11:07:09 -07:00
pyth0n1c 99b8b2f4eb Fixed output of files names when running
a mock.  Handle errors when processing
a detection test generates an error.
2022-09-20 07:46:15 -07:00
pyth0n1c 091f35ee4a Update to get selected mode working and
to force-test everything in GitHub Actions
2022-09-19 17:01:21 -07:00
pyth0n1c 46da0af83b Use hec, with hec setup and
token grabbing and indexer
acknowledgement, to replay
data.  Test seaches, to include
baselines, using exponential
backoff algorithm. This can result
in a huge testing speedup.
2022-09-19 14:47:12 -07:00
pyth0n1c 486805934f Forgot to include the change that
outputs the results file.
2022-09-12 16:06:15 -07:00
pyth0n1c ac506cde60 Initial testing workflow looks
like it is correct.  However,
errors during
2022-09-10 09:10:01 -07:00
pyth0n1c 43a6c3b87d More changes moving from
detection filenames to
detection objects.
2022-09-09 10:20:32 -07:00
pyth0n1c 51edd7950a Condensed multiple requirements.txt
files into single requirements.txt in
the root of security_content.
Removed explicit calls to python3
in CI/CD workflows and inside of
the docker_detection_testing tool.
These are not required and in fact
should not be done since python
interpreters started by the
detection tester inherit the
venv the parent was run under.
2022-07-20 15:53:20 -07:00
pyth0n1c 0181c9fd63 Update the docker detection testing code
to use the latest contentctl from develop
as well as skip enrichment.
2022-06-23 15:18:56 -07:00
pyth0n1c 5762b4e373 Updated the app baseline as well as
the python code for generating the
default config. Also updated the
print behavior for when files are
downloaded.
App baseline is now current, and
files are hosted on S3, as
of 06/21/2022.
2022-06-21 13:53:26 -07:00
pyth0n1c c98d7b6855 Fix an issue where trying to download a file from attack_data that returns a 404 fails too late in the process, giving a nondescriptive error message and resulting in a bad filename being included in the detection failure manifest. 2022-06-21 12:52:32 -07:00
pyth0n1c 2d4032e7a5 A number of changes to support
detection of test.yml files that do
not have a detection .yml file.  
The reverse checking was already
in place.  

Removed an outdated
and unused Python file
new_arguments.py.

Removed the unused option
detections_file from the 
test_config.json - because
detections_list exists, this is
no longer required or usable.
2022-03-23 13:26:00 -07:00
d1vious cff7ba417a cleaning up old CI jobs 2022-03-22 15:37:49 -04:00