e226b9a994
Branch was auto-updated.
2022-07-12 10:01:09 -07:00
32c29963ac
Merge pull request #2283 from splunk/add_gitpod
...
Add gitpod config
2022-07-12 19:00:41 +02:00
ed713c24da
Add gitpod config
2022-07-12 16:52:25 +00:00
012a22b1a2
Branch was auto-updated.
2022-07-07 17:12:31 -07:00
8f0e5be32d
Merge pull request #2279 from splunk/retry_failed_detections_in_cicd
...
Small changes to CI/CD detection testing system. We merge these in now so that we can examine the results of the nightly scheduled run.
2022-07-07 17:11:56 -07:00
b1ba36517e
Updated wait time
...
and fixed typo in print
statement.
2022-07-07 17:09:51 -07:00
aefc5a7f3e
Branch was auto-updated.
2022-07-07 17:07:58 -07:00
4bae19f854
Merge pull request #2277 from splunk/contentctl_inmemory_cache_and_bugfix
...
Minor changes that we want to be in effect for tonight's CI/CD Scheduled Run. These changes have been tested locally and look good. If there are any issues, we can roll back this PR.
2022-07-07 17:07:40 -07:00
81324ddb00
A number of detections are passing locally
...
but failing in CI/CD. I believe this is because
they are not being given enough time to finish
their data ingest completely. If a search fails,
wait some time and run it a few more times to
see if it will complete.
2022-07-07 15:58:46 -07:00
f2b7f155eb
Faster container startup when launching
...
a single container. Same wait time
between containers when launching
multiple containers. This gets us
to startup much faster for the most
common testing case, a single
container.
2022-07-07 15:30:24 -07:00
8ed9372401
On CVESearch API failure, added a
...
brief sleep to allow the API to
begin working again before trying
to resolve it again.
2022-07-07 14:40:39 -07:00
80af56d397
Fixing the rare case where enrichment fails
...
due to CVESearch API failure, causing the
entire workflow to fail. Now, we will retry
enrichment up to a total of 3 times. This should
virtually eliminate all CVE Enrichment failures.
If they do still occur, we will receive a
descriptive message indicating why there was
a failure instead of the cryptic message
that we were getting before.
2022-07-07 14:33:57 -07:00
6dba7cc848
mav
2022-07-07 15:24:13 -06:00
236ea67d30
Merge pull request #2270 from splunk/TR-2210_Edit_Windows_PowerView_Kerberos_Service_Ticket_Request
...
Edit windows_powerview_kerberos_service_ticket_request detection
2022-07-07 12:47:00 -04:00
1f4af38d5e
Branch was auto-updated.
2022-07-07 08:12:33 -07:00
e0f43b02f4
Merge pull request #2274 from splunk/fix-join-issue
...
fix-join-issue
2022-07-07 11:12:09 -04:00
f28fbb6c54
fix-join-issue
2022-07-07 17:01:52 +02:00
169739041d
Branch was auto-updated.
2022-07-07 07:56:45 -07:00
61a698f574
Merge pull request #2273 from splunk/mispelling_in_lookup
...
Update security_services.csv
2022-07-07 10:56:19 -04:00
9cc85a614f
Update security_services.csv
2022-07-07 10:43:17 -04:00
0ed61a57f4
Edit the search SPL
...
Edit the search SPL of windows_powerview_kerberos_service_ticket_request
2022-07-01 17:12:05 -04:00
9689073946
Edit windows_powerview_kerberos_service_ticket_request detection
...
Edit the windows_powerview_kerberos_service_ticket_request detection to support xml logs
2022-07-01 16:24:42 -04:00
52abbc9408
Changing enrichment failures from
...
error prints to error prints AND
failures.
2022-06-30 15:47:29 -07:00
cb1ba3c884
Added slightly more verbose printing
...
to track high-level progress in CICD.
2022-06-30 11:12:50 -07:00
45736b5ed7
Updated CI/CD Workflow and
...
python code in contentctl so that
progress update are not output
when running in CICD environment.
Outputting all of this data
causes thousands of lines of output
logs to be generated in CICD.
This info is only relevant when
running locally in a tty.
2022-06-30 10:52:00 -07:00
8b7f7d20eb
in-memory optimization for fetching CVE enrichment and app enrichment, even if skip_enrichment or cached_and_offline are disabled.
2022-06-29 16:53:17 -07:00
aeceacc737
updating docs and package bits [ci skip]
2022-06-29 21:25:28 +00:00
d060bfd5db
Merge pull request #2192 from splunk/content_changer_improvements
...
Content changer improvements and Stale Reference Updates
2022-06-29 12:59:06 -07:00
83bbfce55a
Branch was auto-updated.
2022-06-29 11:55:55 -07:00
73ea092e8d
Merge pull request #2267 from splunk/deprecate_TR-2160_deprecated_complex_test_files
...
removing test files
2022-06-29 11:55:32 -07:00
b75b56b81d
removing test files
2022-06-29 14:18:47 -04:00
6cfa2014d2
Remove ambiguity from the git checkout
...
command used by the detection testing code.
2022-06-28 16:46:51 -07:00
ea26b98186
Branch was auto-updated.
2022-06-28 15:14:00 -07:00
1d036b3af5
Merge pull request #2265 from splunk/DM_updates
...
Added Datamodel values
2022-06-28 15:13:30 -07:00
8a79086933
Missed one
2022-06-28 16:01:51 -05:00
9290c8c03d
Updated DM and fields
2022-06-28 14:59:51 -05:00
12b174f7d7
Changed to Network_Traffic, joining on process_id
2022-06-28 14:53:32 -05:00
ce7b96b31c
Branch was auto-updated.
2022-06-28 11:33:23 -07:00
a11c62e121
Branch was auto-updated.
2022-06-28 11:33:22 -07:00
c29b61b0d7
Merge pull request #2266 from splunk/TR-2160_deprecated_complex
...
moving complex pipelines to deprecated
2022-06-28 14:33:01 -04:00
3bd6477ec7
moving complex pipelines to deprecated
2022-06-28 14:13:38 -04:00
27417d7cb6
Suppress more output for
...
performance test
2022-06-28 11:10:46 -07:00
f75b406a2f
Suppress output of contentctl in CI/CD
...
to test runtime constraints.
2022-06-28 11:08:27 -07:00
cf86f899b6
Added Datamodel values
2022-06-28 12:03:12 -05:00
f5ec4b0500
Branch was auto-updated.
2022-06-24 10:16:00 -07:00
73a76ac59a
Merge pull request #2262 from splunk/TR-2113_New_Kerberoasting_detections
...
Adding new kerberoasting detections
2022-06-24 13:13:52 -04:00
0df3dc5e51
updating fields
2022-06-24 12:50:43 -04:00
757e6b92b8
updating field name to use ScriptBlockText
2022-06-24 11:18:28 -04:00
2637c12014
updating sourcetype to xmlwineventlog
2022-06-24 11:05:02 -04:00
fd78ddcb6f
Merge branch 'TR-2113_New_Kerberoasting_detections' of https://github.com/splunk/security_content into TR-2113_New_Kerberoasting_detections
2022-06-24 10:17:56 -04:00
pyth0n1c