e282f28135
Add support for apple silicon
...
to docker testing container
2023-05-31 13:44:53 -07:00
4b04df1ff8
Updated all app baselines in validate_args
2023-05-15 13:52:12 -07:00
9e535bb5f0
Update baseline to include
...
suricata ta. TA required
for testing new detections.
Also, remove some
duplicates apps from the
baseline.
2023-05-15 12:49:18 -07:00
66eb63e06c
Fixing how smoketest is passed
...
to detection wrapper
2023-04-11 12:49:49 -07:00
94a7845f9c
Add experimental support for smoketest.
...
That means running all detections
without replaying data or checking
correctness.
2023-04-11 12:48:49 -07:00
ab28004b7e
Branch was auto-updated.
2023-03-16 01:45:49 -07:00
153b2d44ae
merged with develop
2023-03-16 09:44:35 +01:00
07d1fc4a28
Merge branch 'develop' into TR_2410_Domain_Controller_Attacks
2023-03-06 10:19:45 -08:00
2c87b92e01
Updated a few more paths for apps
2023-03-03 11:04:43 -08:00
12315feb53
Update the baseline in validate_args and test_config_github_actions to use the latest versions of all apps. Also include replay fix for windows ta data ingest via hec and upload
2023-03-03 10:23:03 -08:00
32569d2931
Branch was auto-updated.
2023-03-03 03:40:52 -08:00
78909f6429
merged with develop
2023-03-03 12:40:16 +01:00
55850fe25e
adding custom app
2023-02-22 13:28:41 -05:00
fe1dfb0db0
Fixed some prints to make it easier
...
to understand why certain tests are
being skipped. This is because they
are deprecated, experimental, or
manual_test
2023-02-03 15:27:11 -08:00
5264515a3d
Remove filename printouts in factory.
...
Add reason why file will not be tested in
GitHub service. This could be the wrong type
or the wrong status.
2023-02-03 15:03:57 -08:00
13ccdc1e16
Add validators to automatically set the
...
deprecated and experimental boolean
fields of a detection. Should these fields
still exist given that there is a status
field? Also added enum to help with
validation.
2023-02-03 14:38:19 -08:00
561c60df26
Attempt at adding proper experimental and
...
manual_test parsing support to
detection_testing.
2023-02-03 11:48:05 -08:00
9f0394613d
updating microsoft cloud services app metadata
2023-01-26 11:13:28 -05:00
f1ca2d34f6
Allow detections without tests. This may be an issue in the conversion.
2023-01-09 14:37:06 -08:00
545a106937
forgot to remove exception raise
...
in last commit
2023-01-05 16:38:14 -08:00
b333422bca
don't throw error, just warn
...
when a detection contains
more than one test
2023-01-05 16:29:10 -08:00
1cd81364e3
Resolve issue with file
...
not existing when the
timestamps are updated.
2023-01-04 15:37:42 -08:00
6556205305
initial support for pulling tests
...
from the detection file instead of
separately. This feature is implemented
as a stopgap as we move to new
tooling.
2023-01-04 11:28:50 -08:00
0117d03428
fixing wrong URL
2022-11-15 11:15:49 -08:00
feb1c94d11
add crowdstrike fdr to baseline
2022-11-15 11:11:08 -08:00
bdaf3ebcf9
updating amazon S3 url
2022-10-17 12:11:19 -04:00
cd70fb50e7
adding gcp configs
2022-10-12 18:09:41 -07:00
4ac73c8614
Branch was auto-updated.
2022-08-22 14:51:20 -07:00
b0c3232991
adding microsoft cloud services ta
2022-08-22 17:38:49 -04:00
02930ad974
Change from ResultsReader to
...
JSONResultsReader since
ResultsReader was deprecated
in the latest Splunk SDK.
2022-07-21 12:38:15 -07:00
93cf4d1d3f
Merge branch 'develop' into 20220715_app_baseline
2022-07-19 12:57:52 -07:00
9a3302512a
Update Office 365 AddOn to 4.0
2022-07-15 09:13:10 -07:00
ea70270940
Update CIM and MS Sysmon as well
2022-07-15 09:04:21 -07:00
e993ff1dce
Updating baseline to latest apps as of
...
20220715. Apps have already been
uploaded to S3.
2022-07-15 08:48:32 -07:00
bf127dc0c0
Updating authorize.conf to allow us to delete from internal indexes. Reordering how delete works.
2022-07-12 08:39:08 -07:00
71b7c5d45c
Forgot to specify the host that data
...
was being uploaded from. This means
that delete does not work as expected,
causing a large number of tests to fail
and slower searches.
2022-07-11 14:06:01 -07:00
1e6f2d79b0
Don't modify the original search variable.
...
This can cause problems if we need to run
the search again.
2022-07-11 12:48:25 -07:00
b1ba36517e
Updated wait time
...
and fixed typo in print
statement.
2022-07-07 17:09:51 -07:00
81324ddb00
A number of detections are passing locally
...
but failing in CI/CD. I believe this is because
they are not being given enough time to finish
their data ingest completely. If a search fails,
wait some time and run it a few more times to
see if it will complete.
2022-07-07 15:58:46 -07:00
f2b7f155eb
Faster container startup when launching
...
a single container. Same wait time
between containers when launching
multiple containers. This gets us
to startup much faster for the most
common testing case, a single
container.
2022-07-07 15:30:24 -07:00
6cfa2014d2
Remove ambiguity from the git checkout
...
command used by the detection testing code.
2022-06-28 16:46:51 -07:00
e818a0d1ed
Fixing print statement that was
...
was not obeying the verbose argument.
2022-06-23 15:35:56 -07:00
050491a1cc
Forgot to include a print statement, causing
...
lines to be jumbled together.
2022-06-23 15:28:24 -07:00
d5d0868005
merge from develop
2022-06-21 14:53:25 -07:00
26f6bbfc92
Adding the URL_TOOLBOX app to
...
the application baseline.
2022-06-21 14:29:11 -07:00
5762b4e373
Updated the app baseline as well as
...
the python code for generating the
default config. Also updated the
print behavior for when files are
downloaded.
App baseline is now current, and
files are hosted on S3, as
of 06/21/2022.
2022-06-21 13:53:26 -07:00
c98d7b6855
Fix an issue where trying to download a file from attack_data that returns a 404 fails too late in the process, giving a nondescriptive error message and resulting in a bad filename being included in the detection failure manifest.
2022-06-21 12:52:32 -07:00
8ca9ac7b57
adding urltoolbox and spl updates
2022-06-21 12:05:52 -07:00
1e9b95542d
Missing parenthesis added
2022-06-08 15:30:49 -07:00
8eb675522e
Moved printout of delete status
...
updates to a better location and
condensed multiple printouts for
multiple indices to 1.
2022-06-08 15:21:54 -07:00
pyth0n1c