Commit Graph

14636 Commits

Author SHA1 Message Date
mvelazco af31bdb3ec updating observable 2021-12-20 17:20:58 -05:00
mvelazco 243e60a3cc minor fix 2021-12-20 17:04:58 -05:00
pyth0n1c 264dbfb7f4 Fixed up and error that could occur where the environment is not properly set up if the users requested PERSIST_SECURITY_CONTENT, but the directory did not exist. Also fixed the default argument for this on GitHub Actions., 2021-12-20 13:58:58 -08:00
mvelazco 82a4a63093 creating analytic story and first detection 2021-12-20 16:58:34 -05:00
pyth0n1c d26032b912 Updated the github_actions config with S3 binary
paths.Updated the default args to include web and
experimental as possible folders with Web being a
default.
2021-12-20 13:38:51 -08:00
pyth0n1c 0e26dc76ff Changed so that we no longer start a container if
we know that we will not have a test for it. For example,
if we try to start 4 containers by have only 2 tests at
the beginning we will only start 2 containers. This saves
a lot of startup time and resources. There is a descriptive
printout for this as well.
Also, bumped the maximum startup time for 6 minutes to
10 minutes.  This, combined with the system info from
the previous commit should let us determine if we can
bump the number of containers per GitHub Actions
VM from 1 to 2 or more.
2021-12-20 13:17:46 -08:00
Bhavin Patel 2a15f8b170 Branch was auto-updated. 2021-12-20 12:42:51 -08:00
Bhavin Patel d60bcec3a4 Branch was auto-updated. 2021-12-20 12:42:50 -08:00
mvelazco 59b9068998 Merge pull request #1894 from splunk/Fix_Log4j_detection
Update Log4J Detection to use data models
2021-12-20 15:42:26 -05:00
pyth0n1c 7230b5c63d Print out some system usage information on each update.
This will help users dianose if their systems are overburdend
and also helps us figure out what the appropriate number
of containers to run on cloud infrastructure, like GitHub
Actions, may be without logging directly into the machine
doing the testing.  In some cases, we can't log into those
machines by design.  If you're running tests at home, you
can also just listen to the volume of your computer's fans.
2021-12-20 12:02:11 -08:00
pyth0n1c cc8113ec86 Fixed output of manifest for detection_failure_manifest.json. Previously, it contained mostly default settings and most notably did not container the proper apps configuration. Also updated a few documentation strings. 2021-12-20 08:34:54 -08:00
tccontre e1261b36ca Update ssa___hiding_files_and_directories_with_attrib_exe.yml 2021-12-20 17:18:44 +01:00
tccontre b61311f72b new_ssa_info_sabotage 2021-12-20 13:44:02 +01:00
tccontre f144fc5df3 new_ssa_info_sabotage 2021-12-20 12:37:12 +01:00
tccontre c53510c42a new_ssa_info_sabotage 2021-12-20 12:31:21 +01:00
tccontre 9cf834a5f1 new_ssa_info_sabotage 2021-12-20 12:25:34 +01:00
tccontre d6581e728b new_ssa_info_sabotage 2021-12-20 12:21:04 +01:00
tccontre cdab1e8c74 new_ssa_ifo_sabotage 2021-12-20 12:17:04 +01:00
pyth0n1c 76364bf1c0 Updated the default configuration to use attack_range
apps stored on S3.  Pointed at the PATCHED linux_sysmon.
Added a slight delay in between starts of containers for
performance reasons.  Enabled better handling and ability
to download http_path local apps to a folder instead of
passing them in as string for the container to download.
2021-12-17 20:06:42 -08:00
mhaag-spl 2ebb9f8c40 Updated Log4shell hunt 2021-12-17 11:43:40 -07:00
pyth0n1c c8082984f0 A large number of changes and fixes to make
everything smoother. The largest differences
are improving detection of containers that
take too long to start (or that crash while)
they are starting by adding a timeout. That
timeout is set to 360 seconds and might need
to be tuned in the future to a larger number
since this was tested on a fast machine with
fast network.  The other large change is an
initial pass at updating and committing
detections that have passed the test back
to the repo. This still needs a lot of testing and
refinement.
2021-12-17 10:13:49 -08:00
P4T12ICK 422a0f5b9d add builder design pattern instead of repository 2021-12-17 18:08:12 +01:00
Bhavin Patel 6e12b4f2ad Branch was auto-updated. 2021-12-16 12:55:23 -08:00
Bhavin Patel 3eb630b220 Branch was auto-updated. 2021-12-16 12:55:22 -08:00
peter eff3306f89 Merge pull request #1897 from splunk/ssa_descriptive_branch_name
SSA descriptive branch name
2021-12-16 14:55:05 -06:00
peter-cg 55fd63fe2f Caps fix 2021-12-16 14:53:54 -06:00
peter-cg 3aa223a948 Adding sourcetype to sysproc_unexpected_location test 2021-12-16 10:44:05 -06:00
peter-cg ba83011191 Adding addl humvee runner and fixing macro def 2021-12-16 10:42:01 -06:00
P4T12ICK 4a1b55931b WIP 2021-12-16 09:42:36 +01:00
Bhavin Patel 46c4c874d3 Branch was auto-updated. 2021-12-15 15:52:05 -08:00
Bhavin Patel ab3eb94c83 Branch was auto-updated. 2021-12-15 15:52:04 -08:00
pyth0n1c 7431dabd65 Merge pull request #1896 from splunk/doc_updates
Docs Update for playbook changes
2021-12-15 15:51:51 -08:00
Lou Stella 2f8de77b7c Docs Update for playbook changes 2021-12-15 17:42:47 -06:00
Bhavin Patel 72a04655d0 Branch was auto-updated. 2021-12-15 15:20:37 -08:00
Bhavin Patel ae3484780a Branch was auto-updated. 2021-12-15 15:20:36 -08:00
Lou Stella 9c21e7f869 Merge pull request #1895 from splunk/The_Day_After_The_Day_After_log4shell
The Day After The Day After log4shell
2021-12-15 17:20:18 -06:00
Lou Stella 01bc5757b6 removed married parent playbook 2021-12-15 17:06:02 -06:00
Lou Stella fbf15c3424 Final copy from phantomcyber/playbooks 2021-12-15 16:58:31 -06:00
Lou Stella 872ea4b55c Standardized type 2021-12-15 15:52:40 -06:00
root 496f97a0ee Added detection testing service results inOutbound Network Connection from Java Using Default Ports 2021-12-15 21:19:25 +00:00
Lou Stella ca0aaa46c5 divorced parent playbook 2021-12-15 15:03:21 -06:00
mvelazco 3bb9712286 updating detection to use data models 2021-12-15 15:53:06 -05:00
Lou Stella 337e077224 Merge pull request #1892 from splunk/bug_with_playbook_detection
bug with playbooks detection page
2021-12-15 14:16:09 -06:00
d1vious 0df62338c9 bug with playbooks detection page 2021-12-15 15:01:27 -05:00
mhaag-spl 9eea4ded41 It's Raining Haags 2021-12-15 13:01:04 -07:00
Jose Enrique Hernandez 8566c56a0e Merge pull request #1889 from splunk/minor_api_gen_bug
fixes a logic bug with the api that caused ci to fail
2021-12-15 14:56:09 -05:00
Bhavin Patel 974d1bfc40 Branch was auto-updated. 2021-12-15 11:47:08 -08:00
Jose Enrique Hernandez 589aa6e233 Merge pull request #1891 from splunk/bug_with_playbook_detections
fixing bug with dead links
2021-12-15 14:46:51 -05:00
d1vious 2862f68474 fixing bug with dead links 2021-12-15 14:35:04 -05:00
Lou Stella b341343435 Updated friendly name 2021-12-15 11:30:26 -06:00