e282f28135
Add support for apple silicon
...
to docker testing container
2023-05-31 13:44:53 -07:00
b24394affd
Push a new github_actions test config file
2023-05-15 13:54:53 -07:00
4b04df1ff8
Updated all app baselines in validate_args
2023-05-15 13:52:12 -07:00
9e535bb5f0
Update baseline to include
...
suricata ta. TA required
for testing new detections.
Also, remove some
duplicates apps from the
baseline.
2023-05-15 12:49:18 -07:00
3754611943
Fix a number of experimental and
...
deprecated detections so that
they do not raise error when run
out of the box.
2023-04-11 16:27:40 -07:00
66eb63e06c
Fixing how smoketest is passed
...
to detection wrapper
2023-04-11 12:49:49 -07:00
94a7845f9c
Add experimental support for smoketest.
...
That means running all detections
without replaying data or checking
correctness.
2023-04-11 12:48:49 -07:00
ab28004b7e
Branch was auto-updated.
2023-03-16 01:45:49 -07:00
153b2d44ae
merged with develop
2023-03-16 09:44:35 +01:00
07d1fc4a28
Merge branch 'develop' into TR_2410_Domain_Controller_Attacks
2023-03-06 10:19:45 -08:00
2c87b92e01
Updated a few more paths for apps
2023-03-03 11:04:43 -08:00
12315feb53
Update the baseline in validate_args and test_config_github_actions to use the latest versions of all apps. Also include replay fix for windows ta data ingest via hec and upload
2023-03-03 10:23:03 -08:00
32569d2931
Branch was auto-updated.
2023-03-03 03:40:52 -08:00
78909f6429
merged with develop
2023-03-03 12:40:16 +01:00
55850fe25e
adding custom app
2023-02-22 13:28:41 -05:00
54ec5991d7
Branch was auto-updated.
2023-02-06 16:31:13 -08:00
fe1dfb0db0
Fixed some prints to make it easier
...
to understand why certain tests are
being skipped. This is because they
are deprecated, experimental, or
manual_test
2023-02-03 15:27:11 -08:00
5264515a3d
Remove filename printouts in factory.
...
Add reason why file will not be tested in
GitHub service. This could be the wrong type
or the wrong status.
2023-02-03 15:03:57 -08:00
13ccdc1e16
Add validators to automatically set the
...
deprecated and experimental boolean
fields of a detection. Should these fields
still exist given that there is a status
field? Also added enum to help with
validation.
2023-02-03 14:38:19 -08:00
561c60df26
Attempt at adding proper experimental and
...
manual_test parsing support to
detection_testing.
2023-02-03 11:48:05 -08:00
621fe10dfd
Delete test_config_bak.json
2023-02-03 12:40:01 -05:00
5306030d74
fixes
2023-01-26 16:35:43 -05:00
9f0394613d
updating microsoft cloud services app metadata
2023-01-26 11:13:28 -05:00
f1ca2d34f6
Allow detections without tests. This may be an issue in the conversion.
2023-01-09 14:37:06 -08:00
545a106937
forgot to remove exception raise
...
in last commit
2023-01-05 16:38:14 -08:00
b333422bca
don't throw error, just warn
...
when a detection contains
more than one test
2023-01-05 16:29:10 -08:00
1cd81364e3
Resolve issue with file
...
not existing when the
timestamps are updated.
2023-01-04 15:37:42 -08:00
6556205305
initial support for pulling tests
...
from the detection file instead of
separately. This feature is implemented
as a stopgap as we move to new
tooling.
2023-01-04 11:28:50 -08:00
957a4644de
Delete test_config_github_actions.json.bak
2022-11-17 14:15:54 -05:00
57811dab57
Branch was auto-updated.
2022-11-15 11:28:05 -08:00
0117d03428
fixing wrong URL
2022-11-15 11:15:49 -08:00
feb1c94d11
add crowdstrike fdr to baseline
2022-11-15 11:11:08 -08:00
5ce1492097
Branch was auto-updated.
2022-10-31 14:21:42 -07:00
0f1b6189ab
Merge branch 'develop' into gcp_account_takeover
2022-10-31 12:41:52 -07:00
6145916174
Branch was auto-updated.
2022-10-18 11:42:33 -07:00
bdaf3ebcf9
updating amazon S3 url
2022-10-17 12:11:19 -04:00
ab378d6705
addo_test
2022-10-13 16:47:29 -07:00
cd70fb50e7
adding gcp configs
2022-10-12 18:09:41 -07:00
c9b12aa911
Update test_config_github_actions.json
2022-10-10 13:30:50 -06:00
8f3fbdfcbf
Update test_config_github_actions.json
2022-10-10 11:33:06 -06:00
9daccac060
Branch was auto-updated.
2022-10-03 17:04:10 -07:00
5cca541cbc
Branch was auto-updated.
2022-09-30 10:40:25 -07:00
da6416a8b7
Branch was auto-updated.
2022-09-30 10:40:16 -07:00
3968693c33
Remove slim as a dependency. Still requires
...
some testing. This will break the contentctl build
functionality as it still requires slim. A user can
install splunk-packaging-toolkit separately,
but it is not currently compatible with Python3.10.
2022-09-30 09:54:19 -07:00
819b016b37
search updaate and remove import
2022-09-14 18:24:59 -05:00
65e996fffe
Adding Privileged User SID History Detection
2022-09-12 21:31:24 +10:00
c314119341
Adding Privileged User SID History Detection
2022-09-12 21:05:45 +10:00
d472fbd0d2
Adding Privileged User SID History Detection
2022-09-12 20:53:56 +10:00
6a1236f059
Adding Privileged User SID History Detection
2022-09-12 20:31:11 +10:00
eaa4ab9265
Adding Privileged User SID History Detection
2022-09-12 18:27:57 +10:00
pyth0n1c