ec0770604e
Add content changer
2023-06-20 18:56:36 +02:00
92d73aae24
improvements srs detections
2023-05-08 15:34:46 +02:00
684cad0ff9
update sigma ba conversion
2023-03-06 11:26:51 +01:00
ecf25b566f
updates
2023-02-17 17:21:55 +01:00
58c6987122
update finding report generation
2023-01-30 14:08:14 +01:00
a1bc51a4e8
ocsf ba
2023-01-26 16:12:24 +01:00
5ae53c9368
Migrated all detections to v4
2023-01-03 13:42:10 +01:00
524766e532
updated detections
2022-12-22 17:18:19 +01:00
7056578d21
Fix generate API. Also, return nonzero error
...
code when contentctl action raises an
uncaught error
2022-10-13 10:08:12 -07:00
c8a7c61b74
Changes to apss the name of the app to the story builder, since it is required for generate.
2022-09-15 16:26:34 -07:00
1a02a53f5d
Updated the order of the options in the help menu for contentctl. This way, the options flow logically from creation to validation to building to deployment.
2022-08-12 12:59:53 -07:00
14b16fa87b
Updated some of the documentation in contentctl.py and updated the README file with usage documentation.
2022-08-11 12:13:18 -07:00
2c0888a090
Merge branch 'develop' into Clean_and_Deploy
2022-08-11 11:12:49 -07:00
87a8bc0442
Merged develop into this branch and resolved merge conflicts.
2022-08-03 06:47:22 -07:00
9dac698c46
solve merge conflicts
2022-08-01 11:39:02 +02:00
b21d754be3
attack_data_helper
2022-07-20 10:54:59 +02:00
1cdfb1916f
Fixed paths in content generation to use the input path instead of hardcoded relative paths.
2022-07-15 08:02:17 -07:00
a74ebee88f
Added the --skip_enrichment option to the
...
contentctl tool. This can save a huge amount
of time when generating an app. Also
added a progress meter when the documentation
is being generated. Finally, correctly initialized
the default values of some class member fields
in order to get all the contentctl steps working.
2022-06-22 13:44:17 -07:00
f6790d12c3
Updated the initialize output path and
...
documentation in contentctl help.
2022-05-18 01:50:49 -07:00
e3459eaeb3
Updates to contentctl, deploy,
...
enums, and initialize to support
building the app scaffold and
removing all the content that needs
to be removed.
2022-05-17 23:13:53 -07:00
a9b118a6ce
Deployment using acs is working. It is currently difficult to tell whether the acs command has failed since even an ACS failure gives a return code of 0. I have raised this issue with the ACS team and am waiting on a reponse and guidance.
2022-05-17 16:15:45 -07:00
c9552fcf89
Updates to deploy towards working with the ACS application for deployment of apps to Splunk Cloud using Automated Private App Vetting / APAV
2022-05-17 15:26:34 -07:00
123600d2f2
Added generation of an app.manifest file based on command line arguments.
2022-05-17 13:49:29 -07:00
6d6feb9508
Name conflict on init... fixed
2022-05-17 12:47:54 -07:00
e751727b5b
Changed all of the clean terminology to init. This is in preparation for distributing the tool standalone in a separate repo as opposed to a part of the security_content repo.
2022-05-17 12:45:03 -07:00
4a86d06212
Remove overwrite app as
...
a default argument for deploy.
2022-05-13 14:50:13 -04:00
751736f5e3
Better error handling for inspect
2022-05-13 13:53:49 -04:00
3ef1542000
Added another folder to clean.
...
Updated command line arguments
for build. Improved implmentation of
inspect.
2022-05-13 12:58:53 -04:00
83c6448e6f
Fixing some paths and command line arguments for the contentctl build option.
2022-05-13 11:42:01 -04:00
bf27f47d1f
Moved from using a pickled dictionary, loaded and written manually, to shelve.Shelf for Reference cache. The interface is nearly identical, but it results in much cleaner code. We will likely do the same in the next commit for CVE cache.
2022-05-11 12:00:47 -07:00
e7580faf5f
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
cdb66ae143
More optimizations in content_ctl. No longer generate ba_factory or factory if they are not needed - only generate the one or ones that are required. Also, provide status printouts for the AttackEnrichment so that the user can monitor progress and be sure something is happening.
2022-05-10 15:49:45 -07:00
c1ab5a491b
Added check_references passthrough
...
from contentctl to the builders.
2022-05-04 17:09:36 -07:00
b60db04b71
Added link validator code to baselines, detections,
...
investigations, and stories. Still some testing to
be done.
2022-05-04 16:50:18 -07:00
03035d1c78
Enhancement to use threaded detection construction, which really speeds up verification of URLS. Also, got the cache working and the force cache argument passed all the way through to the detection builder. Please note that this will take much longer to run the first time, because the cache has not been populated. Subsequent runs will be slower. If data exists in this cache, it is NOT updated and will become stale if the web resource is updated. This is only suitable for development purposes and offline environments.
2022-05-02 12:59:28 -07:00
31149c3e61
More changes to defaults and argument parsing to support offline and cached mode.
2022-04-29 17:04:57 -07:00
f81a103b01
Added the majority of support for offline and cached mode for contentctl. This means that developers can much more rapidly test new builds without waiting on slow API end points \(taking build and validate job from upwards of 10 minutes to a few seconds\). It also means that the tool can be used in completely offline, secure environments that do not mirror the required HTTP endpoints.
2022-04-29 16:53:20 -07:00
3c5a342479
Better support in contentctl and content_changer for updating yml files. The help statement for content_changer in content_ctl now dynamically lists the transforms that can be performed on detections. In addition, a redundant transfrom was removed.
2022-04-29 15:43:01 -07:00
6694a5f659
building and appinspecting of the package are now working. removed an errorneous comma from lookups/attack_tools.csv that caused errors during appinspect and resulted in a badly cormatted csv.
2022-04-23 10:22:56 -07:00
0db105e00c
More progress toward build and inspect of the app.
2022-04-23 09:27:41 -07:00
aecd70e74d
Now support building the app. Added requirements to support CLI-based appinspect.
2022-04-23 07:39:31 -07:00
d6e09d3c1b
Actually calling clean now instead of just passing over it.
2022-04-22 13:39:09 -07:00
760242e45b
Included basic implementation of clean, which is yet to be tested.
2022-04-22 13:25:53 -07:00
804123257e
Small change - renamed a caraible from type to content_type. It is better not to overwrite python builtins.
2022-04-22 12:04:43 -07:00
8cc82a9d0d
Added modes and stub functions to the contentctl.py as an entry point for cleaning and deploying.
2022-04-22 11:59:10 -07:00
afc1860132
Add Mitre Attack Csv generation
2022-03-29 12:14:20 +02:00
510a196a0d
Improve validation
2022-03-21 09:27:53 +01:00
6f0ee68913
Refactored security content
2022-03-09 14:43:09 +01:00
55848f9277
fixed bug in handling imports
2021-11-17 13:47:13 +01:00
bfc25f0cec
adding skeleton for ssa package generation
2021-10-30 21:31:04 -04:00
P4T12ICK