files into single requirements.txt in
the root of security_content.
Removed explicit calls to python3
in CI/CD workflows and inside of
the docker_detection_testing tool.
These are not required and in fact
should not be done since python
interpreters started by the
detection tester inherit the
venv the parent was run under.
but failing in CI/CD. I believe this is because
they are not being given enough time to finish
their data ingest completely. If a search fails,
wait some time and run it a few more times to
see if it will complete.
a single container. Same wait time
between containers when launching
multiple containers. This gets us
to startup much faster for the most
common testing case, a single
container.
the python code for generating the
default config. Also updated the
print behavior for when files are
downloaded.
App baseline is now current, and
files are hosted on S3, as
of 06/21/2022.
to denote the source of all the data
sets that we upload. This means that
we don't need hacks to get around
waiting for all of the data to finish
indexing.
to delete after a test in each attack_data
dataset in the test file. It is important to
have this level of control (per-dataset), not
just per test or per-file!
Updated the following apps to the latest versions:
Splunk Add on for Microsoft Windows
Splunk Add on for Unix and Linux
Splunk Stream
Splunk Stream Knowledge Objects for Wire Data
Splunk Stream Add On
Splunk Add on for Microsoft Office 365
Splunk Common Information Model
Splunk Add on for Microsoft Windows
Splunk Add on for Unix and Linux
Splunk Stream
Splunk Stream Knowledge Objects for Wire Data
Splunk Stream Add On
Splunk Add on for Microsoft Office 365
Splunk Common Information Model
detection of test.yml files that do
not have a detection .yml file.
The reverse checking was already
in place.
Removed an outdated
and unused Python file
new_arguments.py.
Removed the unused option
detections_file from the
test_config.json - because
detections_list exists, this is
no longer required or usable.
the summary.json file AND the
print output to make it easier
to see the pass rate at a glance.
This means we don't have to
calculate it by hand and it's
easier to integrate into our
high-level metrics.
pyth0n1c