1ee1b76968
Branch was auto-updated.
2022-08-04 00:42:05 -07:00
939493337d
adding research site links
2022-08-03 17:34:32 -04:00
9dac698c46
solve merge conflicts
2022-08-01 11:39:02 +02:00
b21d754be3
attack_data_helper
2022-07-20 10:54:59 +02:00
72c1153383
Branch was auto-updated.
2022-07-19 12:40:38 -07:00
236f0ce71f
Branch was auto-updated.
2022-07-19 12:36:12 -07:00
bf4c565f79
Branch was auto-updated.
2022-07-19 12:36:08 -07:00
d4779f44ad
Branch was auto-updated.
2022-07-19 11:16:25 -07:00
03ccafe319
Branch was auto-updated.
2022-07-19 11:16:21 -07:00
d04c5e49f5
Branch was auto-updated.
2022-07-19 11:16:17 -07:00
7554992aa0
Updates to reduce duplication in the check_references code. Other updates to fix a number of issues introduced which cause Pytests to fail
2022-07-18 15:58:12 -07:00
b71e570891
Update cobalt_strike_named_pipes.yml
...
Updated to Hunting
2022-07-15 10:16:14 -06:00
97ad9beaa2
Fixed the pathing issue for reporting.
2022-07-15 06:44:25 -07:00
20ab9f27ce
Moved id collision checking into
...
the Utils module since it will
be used by the Factory and the
BA Factory. Updated a duplicate
UUID to mitigate the collision
issue raised on GitHub.
2022-07-12 15:06:35 -07:00
9b21029bea
Added logic for checking to
...
see if there are duplicate ids
for any/all kinds of content that
have an ID associated with it.
2022-07-12 14:26:34 -07:00
0c41f0a2f8
Branch was auto-updated.
2022-07-07 17:08:03 -07:00
cb1ba3c884
Added slightly more verbose printing
...
to track high-level progress in CICD.
2022-06-30 11:12:50 -07:00
45736b5ed7
Updated CI/CD Workflow and
...
python code in contentctl so that
progress update are not output
when running in CICD environment.
Outputting all of this data
causes thousands of lines of output
logs to be generated in CICD.
This info is only relevant when
running locally in a tty.
2022-06-30 10:52:00 -07:00
5eda0215e4
Branch was auto-updated.
2022-06-29 12:59:29 -07:00
bb3a73b0dd
array
2022-06-27 15:26:45 -07:00
e92699f315
st
2022-06-24 14:27:27 -07:00
d40ca09d61
Merged develop into content_changer_improvements to resolve merge conflict. this was making it impossible to merge the PR in the GitHub Interface.
2022-06-23 14:19:17 -07:00
a74ebee88f
Added the --skip_enrichment option to the
...
contentctl tool. This can save a huge amount
of time when generating an app. Also
added a progress meter when the documentation
is being generated. Finally, correctly initialized
the default values of some class member fields
in order to get all the contentctl steps working.
2022-06-22 13:44:17 -07:00
c7ad4a013b
Updating DM enum
2022-05-31 10:58:08 -05:00
61df5c96ef
Delete cobalt_strike_named_pipes.yml
2022-05-16 13:04:05 -06:00
86391a5843
HaagCat
2022-05-16 12:59:46 -06:00
926317f5c4
Updated status print information around the
...
creation of App Enrichment, CVE, and
link validator caches. Made sure to close
CVE and App Enrichment caches after
they are opened and accessed instead of
relying on Python to close them for us
when their reference count is zero.
Also tested to ensure that if a previous
validate and generate succeeded, it
can be run again with no internet access!
This is perfect not just for performance
reasons, but offline/disconnected
environments.
2022-05-13 07:51:31 -04:00
bf27f47d1f
Moved from using a pickled dictionary, loaded and written manually, to shelve.Shelf for Reference cache. The interface is nearly identical, but it results in much cleaner code. We will likely do the same in the next commit for CVE cache.
2022-05-11 12:00:47 -07:00
e7580faf5f
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
cdb66ae143
More optimizations in content_ctl. No longer generate ba_factory or factory if they are not needed - only generate the one or ones that are required. Also, provide status printouts for the AttackEnrichment so that the user can monitor progress and be sure something is happening.
2022-05-10 15:49:45 -07:00
6e6c7f5f4a
More finishing touches on link validation. Now, failures are printed out at the end after all links have been checked instead of when the tool is running, making it easier to read. Files that referernce the link are also included.
2022-05-10 13:15:52 -07:00
67a0ed2821
Removed some un needed prints from Link Validator. Added progress indicators to the steps of the factory so that users have feedback on what is going on when contentctl is running. This is helpful since it can run for an extended period of time, especially on a slower or high latency connection, when links are being validated, or when caching is not enabled.
2022-05-10 12:00:31 -07:00
d814d4d74a
Added link validation to playbooks and
...
performed successful tests against
all Stories, Playbooks, Baselines,
Detections, and Investigations.
Also tested when the check_references
or --no-check_references flags are passed
successfully!
2022-05-04 17:08:41 -07:00
b60db04b71
Added link validator code to baselines, detections,
...
investigations, and stories. Still some testing to
be done.
2022-05-04 16:50:18 -07:00
54798186a9
Saving changes made to support URL verification which is working - but we have now broken these out into a more robust class link_validator.py
2022-05-04 16:24:02 -07:00
c0dc8541b4
Added a class for validating links. This class performs its own type of caching, similar to functools caching, but keeps additional metrics suitable for dumping when all validation has completed.
2022-05-04 16:22:40 -07:00
0957d0de03
Updates to the detection ref validator. Still needs a few tweaks.
2022-05-03 16:24:29 -07:00
900bd9e7e2
Updated a large number of the links in other detections. Also, adjusted the number of threads that run and tweaked the timeout time.
2022-05-03 10:34:10 -07:00
646afbf214
A number of small updates to support resolving and verifying all of the reference URLs in detections at scale. Also, fixed a few more HTTP Status Code 301 references in the tests folder.
2022-05-02 17:15:09 -07:00
03035d1c78
Enhancement to use threaded detection construction, which really speeds up verification of URLS. Also, got the cache working and the force cache argument passed all the way through to the detection builder. Please note that this will take much longer to run the first time, because the cache has not been populated. Subsequent runs will be slower. If data exists in this cache, it is NOT updated and will become stale if the web resource is updated. This is only suitable for development purposes and offline environments.
2022-05-02 12:59:28 -07:00
31149c3e61
More changes to defaults and argument parsing to support offline and cached mode.
2022-04-29 17:04:57 -07:00
f81a103b01
Added the majority of support for offline and cached mode for contentctl. This means that developers can much more rapidly test new builds without waiting on slow API end points \(taking build and validate job from upwards of 10 minutes to a few seconds\). It also means that the tool can be used in completely offline, secure environments that do not mirror the required HTTP endpoints.
2022-04-29 16:53:20 -07:00
710b582b15
Added an option for all, meaning that all of the transforms \(besides the transform on test files\) will be run.
2022-04-29 15:58:03 -07:00
3c5a342479
Better support in contentctl and content_changer for updating yml files. The help statement for content_changer in content_ctl now dynamically lists the transforms that can be performed on detections. In addition, a redundant transfrom was removed.
2022-04-29 15:43:01 -07:00
52c8023678
Added support for enumerating all of the different actions
...
that content_changer can make. This list of actions
will be dynamically updated base on the names of
the functions added in content_changer.py!
2022-04-29 13:31:56 -07:00
8d8998d243
adding nes to detection object
2022-04-12 11:03:52 -07:00
ac3bed4a4b
str for nes fields
2022-04-05 13:32:31 -07:00
f87c0062c4
Update new_content_factory.py
2022-03-28 09:55:27 -07:00
ed13f34bfa
added datamodels for SSA
2022-03-24 14:28:52 -07:00
7a5ba38255
Branch was auto-updated.
2022-03-24 02:09:31 -07:00
pyth0n1c