36f13ecf46
Branch was auto-updated.
2022-09-30 10:37:03 -07:00
fe36f9f5bc
Re-Added and improved duplicate ID checking
...
for ESCU and BA detections.
2022-09-29 14:35:21 -07:00
9657101fc3
Fixes for more robust catching of duplicate ids.
2022-09-29 13:46:52 -07:00
1fc3b74c84
Branch was auto-updated.
2022-09-29 11:20:09 -07:00
c02e8a9314
Branch was auto-updated.
2022-09-29 11:20:02 -07:00
bd85a2be5a
Branch was auto-updated.
2022-09-29 11:16:36 -07:00
64c354f963
Branch was auto-updated.
2022-09-29 11:16:31 -07:00
fd556e9063
Branch was auto-updated.
2022-09-29 11:16:30 -07:00
71a83de29c
Fixed error - referring to
...
variable by wrong name.
2022-09-28 15:37:34 -07:00
5c3b66194a
Large number of changes to support testing
...
against repos that are not the exact
security_content repo on GitHub. This
includes different main branch name,
different project name, and different
url name for the repo.
2022-09-28 14:29:03 -07:00
342d098c86
Better building of ESCU app. Include mlmodel
...
files in ESCU app when built.
2022-09-27 17:29:54 -07:00
1ab2f401c7
Updates to simplify escu app generation, removing
...
legacy code that is no longer used. This is progress
towards fixing the issue where *.mlmodel files
were not included in the detection_testing app
generation.
2022-09-27 10:18:02 -07:00
2a5807af83
Fix infinite loop when baselines search fails
...
even after tmax time
2022-09-27 09:20:13 -07:00
2555556301
Removed extra printout and added
...
a clear success/failure printout
2022-09-26 17:06:21 -07:00
124bcd1974
Better error detection/collection for baselines.
...
Previously we treated a failed search in a baseline
as an exception, but this is not necessarily true.
This was causing searches which didn't
immediately have a successful baseline to fail,
which is obviously not correct - we were not
allowing multiple attempts for the data to
be ingested before quitting.
2022-09-26 16:49:05 -07:00
7b365ddde6
experimental support for local data sources
2022-09-23 13:32:08 -07:00
33d27fbcc5
Merge branch 'support_multiple_tests_per_detection' of https://github.com/splunk/security_content into support_multiple_tests_per_detection
2022-09-23 12:40:31 -07:00
d5b4099798
Removed power_user reference and
...
unused enable_delete functionality.
2022-09-23 12:37:19 -07:00
23b960f788
Update Windows TA to patched Windows TA
...
to resolve issues with Powershell Script
Block logging events, long events greater
than 10k characters, events that are
not split properly, and events greater
than 256 lines. The modified TA contains
a number of changes to props.conf.
2022-09-23 12:29:08 -07:00
58d0653161
Merge branch 'develop' into support_multiple_tests_per_detection
2022-09-22 11:34:25 -07:00
ab95f8374a
Updated the summarization
...
code to work with the
new output files
2022-09-20 14:28:43 -07:00
8b68e20e80
Fixed bug where we did not update
...
the result_count after a failed
test completed.
2022-09-20 11:54:46 -07:00
701bebd0a6
Generate proper output file name
...
in the proper location. Resolve
issue with cleanup when a test
generates an exception that
prevented shutdown from finishing.
2022-09-20 11:07:09 -07:00
5dbdf3ce38
Fixed logic for handling when a test
...
fails with an uncaught error.
Previously, this could get testing
stuck in an infinite loop.
2022-09-20 09:42:54 -07:00
99b8b2f4eb
Fixed output of files names when running
...
a mock. Handle errors when processing
a detection test generates an error.
2022-09-20 07:46:15 -07:00
091f35ee4a
Update to get selected mode working and
...
to force-test everything in GitHub Actions
2022-09-19 17:01:21 -07:00
6b09b24a5a
wait a bit longer to check on ackid
2022-09-19 16:18:59 -07:00
f07ac5187b
Must use shutil.rmtree to
...
delete non-empty directory.
2022-09-19 15:50:54 -07:00
38f135ee81
Remove data after a single detection
...
is tested instead of when all detections
have finished testing.
2022-09-19 15:46:00 -07:00
c97c6a3180
Use the proper port for HEC
...
replay on multiple containers.
Fast fail if there is an actual
error when testing.
2022-09-19 15:30:52 -07:00
46da0af83b
Use hec, with hec setup and
...
token grabbing and indexer
acknowledgement, to replay
data. Test seaches, to include
baselines, using exponential
backoff algorithm. This can result
in a huge testing speedup.
2022-09-19 14:47:12 -07:00
23b140e8e6
A few more changes in the story builder to get references working properly.
2022-09-15 17:18:50 -07:00
bb84ef752b
One more change to substitution string
2022-09-15 16:30:32 -07:00
c8a7c61b74
Changes to apss the name of the app to the story builder, since it is required for generate.
2022-09-15 16:26:34 -07:00
d84aba8af0
Fixed another issue with the filename.
2022-09-15 13:28:36 -07:00
af16d25ca2
Fixed file name find and replace issue
2022-09-15 13:27:48 -07:00
6fe804f8ed
changed one more location where the path to escu is hardcoded.
2022-09-15 13:18:00 -07:00
a4d143d4f1
better app name valdiation message
2022-09-15 12:58:52 -07:00
b5bfc29fb5
Basic validation on the app_name
2022-09-15 12:57:12 -07:00
444026f32b
Another small modification to replace
...
static ESCU name with the name of
your app
2022-09-15 12:53:29 -07:00
49f0d7ac0c
Branch was auto-updated.
2022-09-15 11:33:13 -07:00
2ab2821d0d
Branch was auto-updated.
2022-09-15 11:33:09 -07:00
124fd0d465
Fix search string to be more broad
2022-09-15 11:22:05 -07:00
3030c694bf
Branch was auto-updated.
2022-09-15 08:08:58 -07:00
710e6aab5e
Branch was auto-updated.
2022-09-15 08:08:50 -07:00
3397919067
new-xml-src-data
2022-09-15 09:59:04 +02:00
50a2d18163
fixing missing test
2022-09-14 19:20:57 -04:00
e027f13add
removing risk objects from correlation searches on savedsearchesconf to avoid circular risk loop
2022-09-14 18:33:15 -04:00
55a57ddd13
Remnoved extra kwargs from
...
delete api call
2022-09-13 17:06:05 -07:00
f3f6e9649a
Always download the data file when it's
...
linked via a URL
2022-09-13 14:39:18 -07:00
srv-rr-gh-researchbt