07d1fc4a28
Merge branch 'develop' into TR_2410_Domain_Controller_Attacks
2023-03-06 10:19:45 -08:00
2c87b92e01
Updated a few more paths for apps
2023-03-03 11:04:43 -08:00
12315feb53
Update the baseline in validate_args and test_config_github_actions to use the latest versions of all apps. Also include replay fix for windows ta data ingest via hec and upload
2023-03-03 10:23:03 -08:00
55850fe25e
adding custom app
2023-02-22 13:28:41 -05:00
9f0394613d
updating microsoft cloud services app metadata
2023-01-26 11:13:28 -05:00
0117d03428
fixing wrong URL
2022-11-15 11:15:49 -08:00
feb1c94d11
add crowdstrike fdr to baseline
2022-11-15 11:11:08 -08:00
bdaf3ebcf9
updating amazon S3 url
2022-10-17 12:11:19 -04:00
cd70fb50e7
adding gcp configs
2022-10-12 18:09:41 -07:00
4ac73c8614
Branch was auto-updated.
2022-08-22 14:51:20 -07:00
b0c3232991
adding microsoft cloud services ta
2022-08-22 17:38:49 -04:00
02930ad974
Change from ResultsReader to
...
JSONResultsReader since
ResultsReader was deprecated
in the latest Splunk SDK.
2022-07-21 12:38:15 -07:00
93cf4d1d3f
Merge branch 'develop' into 20220715_app_baseline
2022-07-19 12:57:52 -07:00
9a3302512a
Update Office 365 AddOn to 4.0
2022-07-15 09:13:10 -07:00
ea70270940
Update CIM and MS Sysmon as well
2022-07-15 09:04:21 -07:00
e993ff1dce
Updating baseline to latest apps as of
...
20220715. Apps have already been
uploaded to S3.
2022-07-15 08:48:32 -07:00
bf127dc0c0
Updating authorize.conf to allow us to delete from internal indexes. Reordering how delete works.
2022-07-12 08:39:08 -07:00
71b7c5d45c
Forgot to specify the host that data
...
was being uploaded from. This means
that delete does not work as expected,
causing a large number of tests to fail
and slower searches.
2022-07-11 14:06:01 -07:00
1e6f2d79b0
Don't modify the original search variable.
...
This can cause problems if we need to run
the search again.
2022-07-11 12:48:25 -07:00
b1ba36517e
Updated wait time
...
and fixed typo in print
statement.
2022-07-07 17:09:51 -07:00
81324ddb00
A number of detections are passing locally
...
but failing in CI/CD. I believe this is because
they are not being given enough time to finish
their data ingest completely. If a search fails,
wait some time and run it a few more times to
see if it will complete.
2022-07-07 15:58:46 -07:00
f2b7f155eb
Faster container startup when launching
...
a single container. Same wait time
between containers when launching
multiple containers. This gets us
to startup much faster for the most
common testing case, a single
container.
2022-07-07 15:30:24 -07:00
6cfa2014d2
Remove ambiguity from the git checkout
...
command used by the detection testing code.
2022-06-28 16:46:51 -07:00
e818a0d1ed
Fixing print statement that was
...
was not obeying the verbose argument.
2022-06-23 15:35:56 -07:00
050491a1cc
Forgot to include a print statement, causing
...
lines to be jumbled together.
2022-06-23 15:28:24 -07:00
d5d0868005
merge from develop
2022-06-21 14:53:25 -07:00
26f6bbfc92
Adding the URL_TOOLBOX app to
...
the application baseline.
2022-06-21 14:29:11 -07:00
5762b4e373
Updated the app baseline as well as
...
the python code for generating the
default config. Also updated the
print behavior for when files are
downloaded.
App baseline is now current, and
files are hosted on S3, as
of 06/21/2022.
2022-06-21 13:53:26 -07:00
c98d7b6855
Fix an issue where trying to download a file from attack_data that returns a 404 fails too late in the process, giving a nondescriptive error message and resulting in a bad filename being included in the detection failure manifest.
2022-06-21 12:52:32 -07:00
8ca9ac7b57
adding urltoolbox and spl updates
2022-06-21 12:05:52 -07:00
1e9b95542d
Missing parenthesis added
2022-06-08 15:30:49 -07:00
8eb675522e
Moved printout of delete status
...
updates to a better location and
condensed multiple printouts for
multiple indices to 1.
2022-06-08 15:21:54 -07:00
5e36835ce9
Moving default data index
...
definition to splunk_sdk file.
2022-06-08 14:57:33 -07:00
7c2047e2cf
Unbalanced quote - fixed
2022-06-07 13:05:05 -07:00
9191057b1b
Changed to use a special host field
...
to denote the source of all the data
sets that we upload. This means that
we don't need hacks to get around
waiting for all of the data to finish
indexing.
2022-06-07 12:55:54 -07:00
aca19c102b
Forgot to include return type from function
2022-06-06 17:15:08 -07:00
8212e22bcb
Forgot to include a break on
...
the forced timeout
2022-06-06 17:03:59 -07:00
7a18850877
Forcing a timeout... certain indexes
...
may continue growing and never have
the same number of events!
2022-06-06 16:53:15 -07:00
d3da287905
Added support for specifying a custom index
...
to delete after a test in each attack_data
dataset in the test file. It is important to
have this level of control (per-dataset), not
just per test or per-file!
2022-06-06 16:08:06 -07:00
ecc896bd11
Forgot to include updates to the the valdiate_args file as well.
2022-05-27 14:56:02 -07:00
a5f9241650
Added Palo Alto TA in support of CRITICAL CVE 2022-1388 Detection.
2022-05-10 10:31:16 -07:00
6804803c8b
Add application folder to tests & detections
2022-03-28 12:30:57 -05:00
2d4032e7a5
A number of changes to support
...
detection of test.yml files that do
not have a detection .yml file.
The reverse checking was already
in place.
Removed an outdated
and unused Python file
new_arguments.py.
Removed the unused option
detections_file from the
test_config.json - because
detections_list exists, this is
no longer required or usable.
2022-03-23 13:26:00 -07:00
98ec30b49c
Merge branch 'develop' into deprecate_aws_batch_testing
2022-03-22 15:51:32 -04:00
cff7ba417a
cleaning up old CI jobs
2022-03-22 15:37:49 -04:00
Bhavin Patel