cc8113ec86
Fixed output of manifest for detection_failure_manifest.json. Previously, it contained mostly default settings and most notably did not container the proper apps configuration. Also updated a few documentation strings.
2021-12-20 08:34:54 -08:00
76364bf1c0
Updated the default configuration to use attack_range
...
apps stored on S3. Pointed at the PATCHED linux_sysmon.
Added a slight delay in between starts of containers for
performance reasons. Enabled better handling and ability
to download http_path local apps to a folder instead of
passing them in as string for the container to download.
2021-12-17 20:06:42 -08:00
c8082984f0
A large number of changes and fixes to make
...
everything smoother. The largest differences
are improving detection of containers that
take too long to start (or that crash while)
they are starting by adding a timeout. That
timeout is set to 360 seconds and might need
to be tuned in the future to a larger number
since this was tested on a fast machine with
fast network. The other large change is an
initial pass at updating and committing
detections that have passed the test back
to the repo. This still needs a lot of testing and
refinement.
2021-12-17 10:13:49 -08:00
34cfcef5cb
Fixed a bug where we were printing the wrong skipped tests due to folder names. Instead we were printing the tests we did not skip.
2021-12-14 13:14:31 -08:00
a475df1cb0
Removed throwing error if experimental is
...
in the path of a test/detection.
2021-12-14 13:01:07 -08:00
49695ed2c5
Preparing fixes for properly allowing testing to include or exclude folders. For example, by default we will not include and test detections or tests in experimental.
2021-12-14 12:59:17 -08:00
5a554f3b5b
Updated paths in workflows that changed due to
...
relocating the automated_detection_testing
folder in bin/
2021-12-08 14:09:22 -08:00
04ba2b5ae6
Merge branch 'develop' into DetectionTestingDocker
2021-12-08 13:04:28 -08:00
cc4f91d8c2
Moved everything into the bin directory.
2021-12-08 12:46:06 -08:00
8f55eb5848
Proper summary.json files are now always generated after a run of the CI. It does not require a separate run of summarize_json.py. Becuase the CI runs different jobs, though, it is still required to run this explicitly in the CI. Also fixed an issue where searches that resulted in an error had incorrect json output due to improper python error handling.
2021-12-08 12:00:51 -08:00
0934e5ea2f
Merge pull request #1860 from splunk/BA
...
Data Stream Haag
2021-12-08 12:36:06 -05:00
16a5285957
Merge pull request #1859 from splunk/re-ssa
...
A Nightmare on Haag Street
2021-12-08 10:37:18 -05:00
934a3727f2
A number of changes. First we quit immediately if docker is not running on the machine... we were missing the quit before but not the check and error message. Next, we fix a persistent problem with storing the output of a test that encounters an error. We also remove some un-needed print statements
2021-12-07 17:08:11 -08:00
0f87a6011c
Changes to support more of interactive mode and interactive_failure_mode as well as better logic around whether or not the password should be printed to the command line. In short, it will be printed if you are in interactive mode and have not included it in the config. If you are interactive and the password is in the config file, you will be warned but it will not be printed. If you are not interactive, it will not be printed unless you ask it to print.
2021-12-07 13:27:38 -08:00
692a565bef
Update ssa___wbadmin_delete_system_backups.test.yml
2021-12-07 14:01:52 -07:00
3c2c99fb9c
Update ssa___wbadmin_delete_system_backups.test.yml
2021-12-07 13:55:05 -07:00
44bf73018a
wbadmin
2021-12-07 13:31:19 -07:00
9176e24d44
A number of small usability updates. Added and tested a --interactive mode flag and changed --interactive_failure to --no_interactive_failure. Interactive_failure mode is now the default mode. Improved spacing and messages on some error strings.
2021-12-07 12:11:29 -08:00
890e31a9c1
Update ssa___bcdedit_failure_recovery_modification.test.yml
2021-12-07 12:38:37 -07:00
51a47f76df
Update ssa___bcdedit_failure_recovery_modification.yml
2021-12-07 12:30:48 -07:00
e2abbaffe1
fsutil and bcdedit
2021-12-07 12:19:41 -07:00
faebd2b7cd
Merge branch 'BA' of https://github.com/splunk/security_content into BA
2021-12-07 12:02:14 -07:00
b4bab318d2
Branch was auto-updated.
2021-12-07 11:01:46 -08:00
52ce90917e
Branch was auto-updated.
2021-12-07 11:01:45 -08:00
b409336f85
Merge pull request #1865 from splunk/DetectionBaselineFixes
...
Detection baseline fixes
2021-12-07 11:01:28 -08:00
16849ba96e
Update ssa___dns_exfiltration_using_nslookup_app.yml
2021-12-07 11:58:44 -07:00
77d186e946
Update ssa___dns_exfiltration_using_nslookup_app.yml
2021-12-07 11:51:15 -07:00
6b36d8c6ec
DNS Exfil
2021-12-07 11:43:34 -07:00
b51b7dbdf1
Update ssa___detect_rclone_command_line_usage.yml
2021-12-07 11:40:46 -07:00
3807a2565b
Branch was auto-updated.
2021-12-07 08:16:58 -08:00
3b07aa32bb
Branch was auto-updated.
2021-12-07 08:16:57 -08:00
108881783b
Branch was auto-updated.
2021-12-07 08:16:50 -08:00
0fc4bdbdee
Merge pull request #1868 from splunk/dependabot/pip/configparser-5.2.0
...
Bump configparser from 5.1.0 to 5.2.0
2021-12-07 08:16:45 -08:00
c47fd8fa3b
Merge pull request #1867 from splunk/dependabot/pip/more-itertools-8.12.0
...
Bump more-itertools from 8.11.0 to 8.12.0
2021-12-07 08:16:32 -08:00
32870a934f
Merge branch 'develop' into dependabot/pip/more-itertools-8.12.0
2021-12-07 08:09:48 -08:00
25ff9017fc
Branch was auto-updated.
2021-12-07 08:09:17 -08:00
f3c9f21652
Branch was auto-updated.
2021-12-07 08:09:10 -08:00
8ae88f38f3
Branch was auto-updated.
2021-12-07 08:09:08 -08:00
a7b8ad9830
Branch was auto-updated.
2021-12-07 08:09:06 -08:00
adb4f2c492
Merge pull request #1866 from splunk/dependabot/pip/packaging-21.3
...
Bump packaging from 21.2 to 21.3
2021-12-07 08:08:45 -08:00
11784add74
Update ssa___detect_rclone_command_line_usage.yml
2021-12-06 18:18:45 -07:00
77f671932e
Bump configparser from 5.1.0 to 5.2.0
...
Bumps [configparser](https://github.com/jaraco/configparser ) from 5.1.0 to 5.2.0.
- [Release notes](https://github.com/jaraco/configparser/releases )
- [Changelog](https://github.com/jaraco/configparser/blob/main/CHANGES.rst )
- [Commits](https://github.com/jaraco/configparser/compare/v5.1.0...v5.2.0 )
---
updated-dependencies:
- dependency-name: configparser
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2021-12-07 00:39:06 +00:00
38b5c47405
Bump more-itertools from 8.11.0 to 8.12.0
...
Bumps [more-itertools](https://github.com/more-itertools/more-itertools ) from 8.11.0 to 8.12.0.
- [Release notes](https://github.com/more-itertools/more-itertools/releases )
- [Commits](https://github.com/more-itertools/more-itertools/compare/v8.11.0...v8.12.0 )
---
updated-dependencies:
- dependency-name: more-itertools
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2021-12-07 00:38:54 +00:00
90b8696569
Bump packaging from 21.2 to 21.3
...
Bumps [packaging](https://github.com/pypa/packaging ) from 21.2 to 21.3.
- [Release notes](https://github.com/pypa/packaging/releases )
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst )
- [Commits](https://github.com/pypa/packaging/compare/21.2...21.3 )
---
updated-dependencies:
- dependency-name: packaging
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2021-12-07 00:38:46 +00:00
4b9daeda56
Branch was auto-updated.
2021-12-06 16:32:05 -08:00
06097ee518
Branch was auto-updated.
2021-12-06 16:32:04 -08:00
b194d7ceec
Branch was auto-updated.
2021-12-06 16:32:03 -08:00
3ce2a1322d
Merge pull request #1856 from splunk/dependabot/pip/filelock-3.4.0
...
Bump filelock from 3.3.2 to 3.4.0
2021-12-06 16:31:44 -08:00
2432d28517
Branch was auto-updated.
2021-12-06 16:26:14 -08:00
ad3ec08d71
Branch was auto-updated.
2021-12-06 16:26:13 -08:00
pyth0n1c