b69bcfaedb
Branch was auto-updated.
2022-01-12 14:23:27 -08:00
41b58642c4
Merge pull request #1931 from splunk/DockerDetectionUpdatesAndFixes
...
Docker detection updates and fixes
2022-01-12 14:22:53 -08:00
c9d0e72cf3
removed accidental brackets from branch name in
...
CI testing branch name.
2022-01-12 14:04:38 -08:00
588eaad92a
Accidentally hardcoded the branch name for testing.
...
Fixed.
2022-01-12 13:44:01 -08:00
6310427166
Branch was auto-updated.
2022-01-12 12:17:53 -08:00
52e482c604
Merge pull request #1928 from splunk/DockerDetectionUpdatesAndFixes
...
Docker detection updates and fixes
2022-01-12 12:17:22 -08:00
b12ccf0cd2
Added a readme.md. Need to check that the
...
markdown renders appropriately
2022-01-12 10:54:45 -08:00
3afef5d559
Updated the error for providing both PR and
...
commit_hash to a warning. This was causing
an error during PR triggered testing in github
actions as both of these are provided. Perhaps
we actually can include both of these and can
get old PRs based on commit hash, but until
then we will just test using the PR number and
ignore the commit_hash if we find both.
2022-01-12 10:38:23 -08:00
3d75e6df52
Added detection testing service results inLinux NOPASSWD Entry In Sudoers File
2022-01-12 09:22:22 +00:00
6f09d650c8
Merge branch 'linux_persist_priv_batch_5' of https://github.com/splunk/security_content into linux_persist_priv_batch_5
2022-01-12 08:55:53 +00:00
0ac29166d0
Added detection testing service results inLinux Possible Access Or Modification Of sshd_config File
2022-01-12 08:55:52 +00:00
fc0719eda4
Added detection testing service results inLinux Possible Ssh Key File Creation
2022-01-12 08:52:58 +00:00
b24ec7dc20
Branch was auto-updated.
2022-01-12 00:13:25 -08:00
4073b95fae
Merge pull request #1923 from splunk/linux_persist_priv_batch_4
...
linux_persist_priv_batch_4
2022-01-12 09:13:04 +01:00
b9f44d9b2d
linux_persist_priv_batch_5
2022-01-12 09:12:43 +01:00
4d9349084e
Changed to run nightly on develop and changes on other branches for pushes and PRs.
2022-01-11 16:37:03 -08:00
7b3029b187
Removed splunkbase-only test_config file. Pushing to run a test on all. Will push again for changes only.
2022-01-11 16:35:19 -08:00
23da2f45d2
removing file that was accidentally added.
2022-01-11 16:06:47 -08:00
e3ba9f0074
Finished removing dead code from DataManipulation.
...
Added the new_sysmon as an additional default application.
While it is not ideal to have the old and new sysmons installed
side by side, there are some detection that only work with one
and not the other. We will run both until we have moved
all detections to the new sysmon.
2022-01-11 16:03:04 -08:00
6a6bd04819
Removing some dead code from
...
DataManipulation.py
2022-01-11 15:46:38 -08:00
e8b6be29c7
yml changes and testing
2022-01-11 15:44:16 -08:00
79d13fccef
Converted DataManipulation from using FileInput to with open, readline, etc. We needed to do this because FileInput with inplace=True remaps the print command, which may be called by several parallel threads running DataManipulation or to output status info, will cause a crash if multiple threads write to it.
2022-01-11 14:18:04 -08:00
81df4e0eec
A bunch of changes to support parallel testing and waiting to ensure data has been properly ingested/indexed before running a test. Still double-checking edge cases for this. Also improved some error printouts and status printouts. When a test completes, it now includes its runtime in its pass/fail/error print.
2022-01-11 11:59:26 -08:00
1bffb74009
Update linux_possible_append_command_to_profile_config_file.yml
2022-01-11 12:03:24 +01:00
95be27a041
Update linux_nopasswd_entry_in_sudoers_file.yml
2022-01-11 12:01:47 +01:00
8a3b86d5c2
linux_persist_priv_batch_5
2022-01-11 11:57:38 +01:00
60edc89fdc
Added detection testing service results inLinux Common Process For Elevation Control
2022-01-11 10:30:16 +00:00
0770e7b2a1
Merge branch 'linux_persist_priv_batch_4' of github.com:splunk/security_content into linux_persist_priv_batch_4
2022-01-11 11:09:54 +01:00
ec7e006abb
linux_persist_priv_batch_4
2022-01-11 11:09:41 +01:00
d4259f39ef
Added detection testing service results inLinux Possible Access To Sudoers File
2022-01-11 09:12:52 +00:00
68af8de4fe
Branch was auto-updated.
2022-01-10 17:05:26 -08:00
dccafa2887
Merge pull request #1902 from splunk/linux_persist_priv_batch_1
...
linux_persist_priv_batch_1
2022-01-10 17:05:10 -08:00
b44fe4b8d8
text and yml updates
2022-01-10 16:59:08 -08:00
14a775b185
Merge branch 'linux_persist_priv_batch_4' of https://github.com/splunk/security_content into linux_persist_priv_batch_4
2022-01-11 00:54:52 +00:00
d7d8acaced
Added detection testing service results inLinux Sudo OR Su Execution
2022-01-11 00:54:51 +00:00
ba46f791bb
Added detection testing service results inLinux Possible Access To Credential Files
2022-01-11 00:51:50 +00:00
3a82eaf972
Merge branch 'linux_persist_priv_batch_4' of https://github.com/splunk/security_content into linux_persist_priv_batch_4
2022-01-11 00:12:46 +00:00
fbc5e53407
Added detection testing service results inLinux Doas Tool Execution
2022-01-11 00:12:45 +00:00
eeff9d94b2
Added detection testing service results inLinux Doas Conf File Creation
2022-01-11 00:11:47 +00:00
745e918176
Added detection testing service results inLinux Add User Account
2022-01-10 23:51:42 +00:00
f11db775c7
Branch was auto-updated.
2022-01-10 14:37:32 -08:00
c508820126
Branch was auto-updated.
2022-01-10 14:37:31 -08:00
2b00ccf154
Merge pull request #1918 from splunk/linux_persist_priv_batch_3
...
linux_persist_priv_batch_3
2022-01-10 14:37:05 -08:00
a8d236c1c2
test results passed from CI
2022-01-10 13:22:24 -08:00
69c2787e51
text updates
2022-01-10 13:21:39 -08:00
4bc8539d78
Branch was auto-updated.
2022-01-10 13:06:27 -08:00
4a4f99e7a9
Branch was auto-updated.
2022-01-10 13:06:26 -08:00
c76e167d05
Branch was auto-updated.
2022-01-10 13:06:25 -08:00
43e2b40935
Merge pull request #1907 from splunk/linux_persist_priv_batch_2
...
linux_persist_priv_batch_2
2022-01-10 13:05:56 -08:00
3362c243ae
Update linux_setuid_using_setcap_utility.yml
2022-01-10 12:59:21 -08:00
pyth0n1c