2ca7679c84
Fixed missing paren, sourcetype
2022-07-19 09:05:19 -05:00
f52137cb8f
new mpcmdrun detection
2022-07-19 08:53:04 -05:00
38cd9baaef
Removed mpcmdrun.exe
2022-07-18 09:44:25 -05:00
3bd256120f
Merge pull request #2242 from splunk/azorult-sfx-package
...
azorult-sfx-package
2022-07-12 17:52:18 -07:00
3841520566
Branch was auto-updated.
2022-07-12 12:33:21 -07:00
debf5ddda6
Merge pull request #2275 from splunk/fix-join-issue2
...
fix-join-issue2
2022-07-12 12:32:55 -07:00
85d8b50be9
Branch was auto-updated.
2022-07-12 12:14:23 -07:00
b9cb41d763
Branch was auto-updated.
2022-07-12 12:14:18 -07:00
3da5f6c6c8
Merge pull request #2284 from splunk/resolve_local_gha_delta
...
Resolve local gha delta
2022-07-12 12:13:55 -07:00
f8ac5616a0
Reverting the workflow and all of the detections that were touched to their original versions.
2022-07-12 10:08:07 -07:00
ae4208c489
Branch was auto-updated.
2022-07-12 10:01:17 -07:00
ed5bb40174
Branch was auto-updated.
2022-07-12 10:01:07 -07:00
32c29963ac
Merge pull request #2283 from splunk/add_gitpod
...
Add gitpod config
2022-07-12 19:00:41 +02:00
ed713c24da
Add gitpod config
2022-07-12 16:52:25 +00:00
bf127dc0c0
Updating authorize.conf to allow us to delete from internal indexes. Reordering how delete works.
2022-07-12 08:39:08 -07:00
d8458b882e
Quick hack to get everything
...
tested in GHA using this verison
of the CI/CD code.
2022-07-11 14:31:02 -07:00
71b7c5d45c
Forgot to specify the host that data
...
was being uploaded from. This means
that delete does not work as expected,
causing a large number of tests to fail
and slower searches.
2022-07-11 14:06:01 -07:00
ccbe770e21
Modify all tests that fail in gha
...
but pass in local testing for easier
troubleshooting.
2022-07-11 12:53:51 -07:00
1e6f2d79b0
Don't modify the original search variable.
...
This can cause problems if we need to run
the search again.
2022-07-11 12:48:25 -07:00
d461a5b5ed
Branch was auto-updated.
2022-07-07 17:12:29 -07:00
9a139e1cb9
Branch was auto-updated.
2022-07-07 17:12:20 -07:00
8f0e5be32d
Merge pull request #2279 from splunk/retry_failed_detections_in_cicd
...
Small changes to CI/CD detection testing system. We merge these in now so that we can examine the results of the nightly scheduled run.
2022-07-07 17:11:56 -07:00
b1ba36517e
Updated wait time
...
and fixed typo in print
statement.
2022-07-07 17:09:51 -07:00
d2ecec653f
Branch was auto-updated.
2022-07-07 17:08:07 -07:00
6722d936f8
Branch was auto-updated.
2022-07-07 17:08:00 -07:00
4bae19f854
Merge pull request #2277 from splunk/contentctl_inmemory_cache_and_bugfix
...
Minor changes that we want to be in effect for tonight's CI/CD Scheduled Run. These changes have been tested locally and look good. If there are any issues, we can roll back this PR.
2022-07-07 17:07:40 -07:00
81324ddb00
A number of detections are passing locally
...
but failing in CI/CD. I believe this is because
they are not being given enough time to finish
their data ingest completely. If a search fails,
wait some time and run it a few more times to
see if it will complete.
2022-07-07 15:58:46 -07:00
f2b7f155eb
Faster container startup when launching
...
a single container. Same wait time
between containers when launching
multiple containers. This gets us
to startup much faster for the most
common testing case, a single
container.
2022-07-07 15:30:24 -07:00
8ed9372401
On CVESearch API failure, added a
...
brief sleep to allow the API to
begin working again before trying
to resolve it again.
2022-07-07 14:40:39 -07:00
80af56d397
Fixing the rare case where enrichment fails
...
due to CVESearch API failure, causing the
entire workflow to fail. Now, we will retry
enrichment up to a total of 3 times. This should
virtually eliminate all CVE Enrichment failures.
If they do still occur, we will receive a
descriptive message indicating why there was
a failure instead of the cryptic message
that we were getting before.
2022-07-07 14:33:57 -07:00
4aff29e922
Branch was auto-updated.
2022-07-07 09:47:20 -07:00
d68dadb7ab
Branch was auto-updated.
2022-07-07 09:47:17 -07:00
236ea67d30
Merge pull request #2270 from splunk/TR-2210_Edit_Windows_PowerView_Kerberos_Service_Ticket_Request
...
Edit windows_powerview_kerberos_service_ticket_request detection
2022-07-07 12:47:00 -04:00
10aa2d0a0a
Update office_product_writing_cab_or_inf.yml
2022-07-07 17:55:57 +02:00
cb7523dfd9
fix-join-issue2
2022-07-07 17:46:24 +02:00
d8a24be09a
Branch was auto-updated.
2022-07-07 08:12:36 -07:00
1f4af38d5e
Branch was auto-updated.
2022-07-07 08:12:33 -07:00
e0f43b02f4
Merge pull request #2274 from splunk/fix-join-issue
...
fix-join-issue
2022-07-07 11:12:09 -04:00
f28fbb6c54
fix-join-issue
2022-07-07 17:01:52 +02:00
169739041d
Branch was auto-updated.
2022-07-07 07:56:45 -07:00
38d91caf77
Branch was auto-updated.
2022-07-07 07:56:41 -07:00
61a698f574
Merge pull request #2273 from splunk/mispelling_in_lookup
...
Update security_services.csv
2022-07-07 10:56:19 -04:00
9cc85a614f
Update security_services.csv
2022-07-07 10:43:17 -04:00
0ed61a57f4
Edit the search SPL
...
Edit the search SPL of windows_powerview_kerberos_service_ticket_request
2022-07-01 17:12:05 -04:00
9689073946
Edit windows_powerview_kerberos_service_ticket_request detection
...
Edit the windows_powerview_kerberos_service_ticket_request detection to support xml logs
2022-07-01 16:24:42 -04:00
f6500dc1f6
Update disable_defender_submit_samples_consent_feature.yml
2022-07-01 11:47:38 +02:00
52abbc9408
Changing enrichment failures from
...
error prints to error prints AND
failures.
2022-06-30 15:47:29 -07:00
cb1ba3c884
Added slightly more verbose printing
...
to track high-level progress in CICD.
2022-06-30 11:12:50 -07:00
45736b5ed7
Updated CI/CD Workflow and
...
python code in contentctl so that
progress update are not output
when running in CICD environment.
Outputting all of this data
causes thousands of lines of output
logs to be generated in CICD.
This info is only relevant when
running locally in a tty.
2022-06-30 10:52:00 -07:00
8b7f7d20eb
in-memory optimization for fetching CVE enrichment and app enrichment, even if skip_enrichment or cached_and_offline are disabled.
2022-06-29 16:53:17 -07:00
Lou Stella