19a24a6ad6
Replaced PyInquirer with Questionaire
2022-03-16 11:36:08 +01:00
6cb69836e0
Branch was auto-updated.
2022-03-15 09:57:10 -07:00
994e8b51d6
Updated detection testing
2022-03-15 17:45:33 +01:00
d169636e7f
Updated detection testing
2022-03-15 17:34:48 +01:00
459e2d3fd2
Updated detection testing
2022-03-15 15:46:51 +01:00
3a0a6cf4fa
fixed a small bug in detection builder
2022-03-15 11:19:35 +01:00
5dd13ea167
fix broken detections
2022-03-14 15:51:05 +01:00
ae00b4c948
Add pytest as separate CI workflow
2022-03-14 13:24:29 +01:00
eb5609fb3b
Add pytest as separate CI workflow
2022-03-14 13:07:01 +01:00
e6c8254ede
Added automaticc generation of finding report
2022-03-14 12:12:48 +01:00
10c25b2014
Refactored security content
2022-03-10 10:27:29 +01:00
6f0ee68913
Refactored security content
2022-03-09 14:43:09 +01:00
d78bb53baa
Revert "Refactored security content"
2022-03-04 15:13:04 -05:00
3131db9d8c
merged with develop
2022-03-03 14:18:47 +01:00
68543a8dc1
merged with develop
2022-03-03 13:11:56 +01:00
ded483ddf0
added validation
2022-02-28 14:50:31 +01:00
5b581bc959
added validation
2022-02-28 14:16:23 +01:00
3946110a92
added specs
2022-02-28 12:47:14 +01:00
3cd94faaf9
updated ci
2022-02-25 16:21:08 +01:00
26f835751a
integrated reporting
2022-02-25 15:21:25 +01:00
8cf8fc40ac
reporting integrated
2022-02-24 16:18:56 +01:00
8b32ec772f
new_content integrated
2022-02-24 12:35:20 +01:00
743701d542
docgen ready
2022-02-23 14:46:39 +01:00
bda23e1631
Merge branch 'refactored_security_content' of github.com:splunk/security_content into refactored_security_content
2022-02-22 18:40:52 +01:00
2cda47990b
doc_gen ready
2022-02-22 18:40:36 +01:00
f906d579d9
Branch was auto-updated.
2022-02-18 14:38:58 -08:00
46e0bb0a01
Added a timeout to the CVESSEARCH_API enrichment in doc_gen. Sometimes, this was causing doc_gen to freeze. Now, when the API is not working or is extremely slow and a request takes longer than 10 seconds, a descriptive error will be thrown and the process will exit with 1
2022-02-18 14:19:57 -08:00
09c54931af
Memoizing/caching a call to CVESSEARCH_API_URL. Gives a SIGNIFICANT speedup in docgen.
2022-02-18 13:36:09 -08:00
9fc009a44d
Removed:
...
SPLUNK_SECURITY_ESSENTIALS
SPLUNK_APP_FOR_AWS
from default app baseline.
They are not required
for testing as they just
provide some dashboards.
2022-02-18 11:17:21 -08:00
382c107298
adding response section to analytic stories conf
2022-02-17 16:02:43 -08:00
ba05264c80
Branch was auto-updated.
2022-02-17 11:42:02 -08:00
622b5af48b
Branch was auto-updated.
2022-02-17 11:00:56 -08:00
b36fbaea7b
Branch was auto-updated.
2022-02-17 11:00:54 -08:00
1ffb4bbc0a
wip doc_gen
2022-02-17 15:20:25 +01:00
14464f17a4
wip doc_gen
2022-02-16 17:01:48 +01:00
0c89faadd7
Merge branch 'refactored_security_content' of github.com:splunk/security_content into refactored_security_content
2022-02-16 16:08:16 +01:00
60ae79dde6
wip doc_gen
2022-02-16 15:34:59 +01:00
05898d1c72
Updated the test config used for github actions and the workflow to remove the use of the splunkbase username and password secrets. After this is merged, we can remove them from the repository. We will simply use the versions that we update in S3.
2022-02-15 15:43:36 -08:00
580dba242f
Added ability to Ctrl-C/SIGINT the testing process and have it gracefully finish. This stops the containers and writes out partial progress to the output file.
2022-02-15 15:37:17 -08:00
1c5961c4c5
condition for tactic and jinja field for risk
2022-02-15 13:45:08 -08:00
95d060e135
Character sets are difficult
2022-02-15 13:52:01 -06:00
ceabbaad1f
updated github action
2022-02-15 10:03:48 +01:00
f47930004b
updated github action
2022-02-15 09:06:42 +01:00
f7f0b2712d
Merge branch 'refactored_security_content' of github.com:splunk/security_content into refactored_security_content
2022-02-14 16:48:08 +01:00
0b5b4e2388
generate API package working
2022-02-14 16:45:27 +01:00
73ba128590
fixing duplicate lookups bug
2022-02-11 12:11:10 -05:00
4f0622a5aa
Update to latest Splunkbase Windows Sysmon
2022-02-10 16:24:17 -08:00
889f27064c
Downloaded apps are now cached by default. This can save a huge amount of time on startup, especially for a large number of containers or for slower connections. Otherwise, each container that is set up needs over 600MB of throughput.
2022-02-10 15:50:25 -08:00
ec90ee19d5
Now, when one or more detection tests fail in the CI/CD,
...
it will cause the workflow to fail. In turn, this would
prevent a PR from being merged. However, this
lets a developer know more easily (without needing
to dive into the GitHub Actions logs) whether or
not their detections passed successfully. It also
upload an extra file called DetectionFailureManifest
which is a test file for ONLY the failed tests.
You can run this locally on your machine to
quickly, interactively debug the failures only.
2022-02-10 09:17:23 -08:00
428785a15f
Revert "Now, failing one or more CI/CD Tests causes"
...
This reverts commit 55e94c3eab
2022-02-10 09:07:02 -08:00
P4T12ICK