32569d2931
Branch was auto-updated.
2023-03-03 03:40:52 -08:00
78909f6429
merged with develop
2023-03-03 12:40:16 +01:00
fe1dfb0db0
Fixed some prints to make it easier
...
to understand why certain tests are
being skipped. This is because they
are deprecated, experimental, or
manual_test
2023-02-03 15:27:11 -08:00
5264515a3d
Remove filename printouts in factory.
...
Add reason why file will not be tested in
GitHub service. This could be the wrong type
or the wrong status.
2023-02-03 15:03:57 -08:00
13ccdc1e16
Add validators to automatically set the
...
deprecated and experimental boolean
fields of a detection. Should these fields
still exist given that there is a status
field? Also added enum to help with
validation.
2023-02-03 14:38:19 -08:00
561c60df26
Attempt at adding proper experimental and
...
manual_test parsing support to
detection_testing.
2023-02-03 11:48:05 -08:00
9f0394613d
updating microsoft cloud services app metadata
2023-01-26 11:13:28 -05:00
f1ca2d34f6
Allow detections without tests. This may be an issue in the conversion.
2023-01-09 14:37:06 -08:00
545a106937
forgot to remove exception raise
...
in last commit
2023-01-05 16:38:14 -08:00
b333422bca
don't throw error, just warn
...
when a detection contains
more than one test
2023-01-05 16:29:10 -08:00
1cd81364e3
Resolve issue with file
...
not existing when the
timestamps are updated.
2023-01-04 15:37:42 -08:00
6556205305
initial support for pulling tests
...
from the detection file instead of
separately. This feature is implemented
as a stopgap as we move to new
tooling.
2023-01-04 11:28:50 -08:00
0117d03428
fixing wrong URL
2022-11-15 11:15:49 -08:00
feb1c94d11
add crowdstrike fdr to baseline
2022-11-15 11:11:08 -08:00
bdaf3ebcf9
updating amazon S3 url
2022-10-17 12:11:19 -04:00
cd70fb50e7
adding gcp configs
2022-10-12 18:09:41 -07:00
4ac73c8614
Branch was auto-updated.
2022-08-22 14:51:20 -07:00
b0c3232991
adding microsoft cloud services ta
2022-08-22 17:38:49 -04:00
02930ad974
Change from ResultsReader to
...
JSONResultsReader since
ResultsReader was deprecated
in the latest Splunk SDK.
2022-07-21 12:38:15 -07:00
93cf4d1d3f
Merge branch 'develop' into 20220715_app_baseline
2022-07-19 12:57:52 -07:00
9a3302512a
Update Office 365 AddOn to 4.0
2022-07-15 09:13:10 -07:00
ea70270940
Update CIM and MS Sysmon as well
2022-07-15 09:04:21 -07:00
e993ff1dce
Updating baseline to latest apps as of
...
20220715. Apps have already been
uploaded to S3.
2022-07-15 08:48:32 -07:00
bf127dc0c0
Updating authorize.conf to allow us to delete from internal indexes. Reordering how delete works.
2022-07-12 08:39:08 -07:00
71b7c5d45c
Forgot to specify the host that data
...
was being uploaded from. This means
that delete does not work as expected,
causing a large number of tests to fail
and slower searches.
2022-07-11 14:06:01 -07:00
1e6f2d79b0
Don't modify the original search variable.
...
This can cause problems if we need to run
the search again.
2022-07-11 12:48:25 -07:00
b1ba36517e
Updated wait time
...
and fixed typo in print
statement.
2022-07-07 17:09:51 -07:00
81324ddb00
A number of detections are passing locally
...
but failing in CI/CD. I believe this is because
they are not being given enough time to finish
their data ingest completely. If a search fails,
wait some time and run it a few more times to
see if it will complete.
2022-07-07 15:58:46 -07:00
f2b7f155eb
Faster container startup when launching
...
a single container. Same wait time
between containers when launching
multiple containers. This gets us
to startup much faster for the most
common testing case, a single
container.
2022-07-07 15:30:24 -07:00
6cfa2014d2
Remove ambiguity from the git checkout
...
command used by the detection testing code.
2022-06-28 16:46:51 -07:00
e818a0d1ed
Fixing print statement that was
...
was not obeying the verbose argument.
2022-06-23 15:35:56 -07:00
050491a1cc
Forgot to include a print statement, causing
...
lines to be jumbled together.
2022-06-23 15:28:24 -07:00
d5d0868005
merge from develop
2022-06-21 14:53:25 -07:00
26f6bbfc92
Adding the URL_TOOLBOX app to
...
the application baseline.
2022-06-21 14:29:11 -07:00
5762b4e373
Updated the app baseline as well as
...
the python code for generating the
default config. Also updated the
print behavior for when files are
downloaded.
App baseline is now current, and
files are hosted on S3, as
of 06/21/2022.
2022-06-21 13:53:26 -07:00
c98d7b6855
Fix an issue where trying to download a file from attack_data that returns a 404 fails too late in the process, giving a nondescriptive error message and resulting in a bad filename being included in the detection failure manifest.
2022-06-21 12:52:32 -07:00
8ca9ac7b57
adding urltoolbox and spl updates
2022-06-21 12:05:52 -07:00
1e9b95542d
Missing parenthesis added
2022-06-08 15:30:49 -07:00
8eb675522e
Moved printout of delete status
...
updates to a better location and
condensed multiple printouts for
multiple indices to 1.
2022-06-08 15:21:54 -07:00
5e36835ce9
Moving default data index
...
definition to splunk_sdk file.
2022-06-08 14:57:33 -07:00
7c2047e2cf
Unbalanced quote - fixed
2022-06-07 13:05:05 -07:00
9191057b1b
Changed to use a special host field
...
to denote the source of all the data
sets that we upload. This means that
we don't need hacks to get around
waiting for all of the data to finish
indexing.
2022-06-07 12:55:54 -07:00
aca19c102b
Forgot to include return type from function
2022-06-06 17:15:08 -07:00
8212e22bcb
Forgot to include a break on
...
the forced timeout
2022-06-06 17:03:59 -07:00
7a18850877
Forcing a timeout... certain indexes
...
may continue growing and never have
the same number of events!
2022-06-06 16:53:15 -07:00
d3da287905
Added support for specifying a custom index
...
to delete after a test in each attack_data
dataset in the test file. It is important to
have this level of control (per-dataset), not
just per test or per-file!
2022-06-06 16:08:06 -07:00
ecc896bd11
Forgot to include updates to the the valdiate_args file as well.
2022-05-27 14:56:02 -07:00
a5f9241650
Added Palo Alto TA in support of CRITICAL CVE 2022-1388 Detection.
2022-05-10 10:31:16 -07:00
6804803c8b
Add application folder to tests & detections
2022-03-28 12:30:57 -05:00
2d4032e7a5
A number of changes to support
...
detection of test.yml files that do
not have a detection .yml file.
The reverse checking was already
in place.
Removed an outdated
and unused Python file
new_arguments.py.
Removed the unused option
detections_file from the
test_config.json - because
detections_list exists, this is
no longer required or usable.
2022-03-23 13:26:00 -07:00
srv-rr-gh-researchbt