admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • c778a2e35c Branch was auto-updated. Bhavin Patel 2021-11-25 05:07:24 -08:00
  • b25f7b80c3 Branch was auto-updated. Bhavin Patel 2021-11-25 05:07:23 -08:00
  • 2451defe2a Merge pull request #1848 from splunk/remcos_evasion tccontre 2021-11-25 14:07:03 +01:00
  • 6d8151d915 Merge branch 'remcos_evasion' of https://github.com/splunk/security_content into remcos_evasion Detection Testing Service 2021-11-25 12:13:52 +00:00
  • 1b28033819 Added detection testing service results inPowershell Windows Defender Exclusion Commands root 2021-11-25 12:13:51 +00:00
  • 724101f8ed Merge branch 'remcos_evasion' of https://github.com/splunk/security_content into remcos_evasion Detection Testing Service 2021-11-25 12:00:54 +00:00
  • 4ed89e21a2 Added detection testing service results inWindows Defender Exclusion Registry Entry root 2021-11-25 12:00:54 +00:00
  • b6bb18d20c Added detection testing service results inAdd or Set Windows Defender Exclusion root 2021-11-25 11:55:39 +00:00
  • dfd210cf29 remcos_evasion tccontre 2021-11-25 12:27:39 +01:00
  • 49e82e39ff Branch was auto-updated. Bhavin Patel 2021-11-25 01:25:30 -08:00
  • 6d291d2600 Branch was auto-updated. Bhavin Patel 2021-11-25 01:25:29 -08:00
  • 469f9ab43f Branch was auto-updated. Bhavin Patel 2021-11-25 01:25:28 -08:00
  • 5addbd5188 Branch was auto-updated. Bhavin Patel 2021-11-25 01:25:27 -08:00
  • 00755bf36b Branch was auto-updated. Bhavin Patel 2021-11-25 01:25:26 -08:00
  • 3dd77f6058 Branch was auto-updated. Bhavin Patel 2021-11-25 01:25:22 -08:00
  • 06b65d7163 Merge pull request #1841 from splunk/more_ioc_detections tccontre 2021-11-25 10:25:05 +01:00
  • 694b4ddc0e Branch was auto-updated. Bhavin Patel 2021-11-25 01:04:22 -08:00
  • bb2a01499a Branch was auto-updated. Bhavin Patel 2021-11-25 01:04:18 -08:00
  • 67bbcd8d30 Branch was auto-updated. Bhavin Patel 2021-11-25 01:04:17 -08:00
  • 0a01fb8181 Branch was auto-updated. Bhavin Patel 2021-11-25 01:04:17 -08:00
  • c681fb48b4 Branch was auto-updated. Bhavin Patel 2021-11-25 01:04:16 -08:00
  • c753fb67c3 Branch was auto-updated. Bhavin Patel 2021-11-25 01:04:15 -08:00
  • 8b9637b86f Branch was auto-updated. Bhavin Patel 2021-11-25 01:04:14 -08:00
  • a14e50ac10 Merge pull request #1847 from splunk/improvements P4T12ICK 2021-11-25 10:03:58 +01:00
  • 295acf12f0 Update ssa___delete_a_net_user.test.yml tccontre 2021-11-25 09:30:44 +01:00
  • e1844e0333 removed devsecops P4T12ICK 2021-11-25 08:55:22 +01:00
  • 2993c66134 Merge branch 'ssa_anomalous_usage_of_7zip' of github.com:splunk/security_content into ssa_anomalous_usage_of_7zip P4T12ICK 2021-11-25 08:37:12 +01:00
  • 40a80473a2 Merge branch 'develop' into ssa_anomalous_usage_of_7zip P4T12ICK 2021-11-25 08:36:33 +01:00
  • 28ad164d89 Branch was auto-updated. Bhavin Patel 2021-11-24 23:36:30 -08:00
  • a619c9829e Branch was auto-updated. Bhavin Patel 2021-11-24 23:36:29 -08:00
  • d9525ef7e3 Branch was auto-updated. Bhavin Patel 2021-11-24 23:36:28 -08:00
  • 86fd20b169 Branch was auto-updated. Bhavin Patel 2021-11-24 23:36:28 -08:00
  • 3e22487ffc Branch was auto-updated. Bhavin Patel 2021-11-24 23:36:27 -08:00
  • 85e6ab49d2 Branch was auto-updated. Bhavin Patel 2021-11-24 23:36:24 -08:00
  • 9697382643 Branch was auto-updated. Bhavin Patel 2021-11-24 23:36:23 -08:00
  • 2eda496ddd Merge pull request #1845 from splunk/ssa_test_ci_cd_pipeline P4T12ICK 2021-11-25 08:36:00 +01:00
  • afb07b6714 Run it on push too for an immediate test pyth0n1c 2021-11-24 17:14:33 -08:00
  • b94ef641ec Changed the detection testing to run on all, develop instead of changes to a different branch. This will collect some data for us over the next few days. pyth0n1c 2021-11-24 17:13:41 -08:00
  • 827cc97cdc Better support for arg validation and command line arguments. Print out the password for the container, if the flag exists to print it out, to enable interactive testing. A few other format updates. pyth0n1c 2021-11-24 17:06:07 -08:00
  • abd568f7d7 Small update to summarize_json.py to set show_splunk_app_password to True when generatingf the detection_failure_manifest.json file. This way, you can run that file directly as the configuration without making any other changes or passing command line values and get right into debugging everything pyth0n1c 2021-11-24 15:57:13 -08:00
  • eb01127d03 Fixed key error in summarize.json. Had called detection_list detections_list, so it was failing jsonschema validation. pyth0n1c 2021-11-24 15:25:24 -08:00
  • ae3e8f1b75 slim failed to install, causing escu app install to fail. pyth0n1c 2021-11-24 14:56:38 -08:00
  • aa985d5077 Made some small changes to printed strings. Fixed summarize_json missing python library error by sourcing virtualenv set up in previous step. pyth0n1c 2021-11-24 14:42:18 -08:00
  • 9517171204 Small change to the output format of the test-config file that is generated at runtime to accurately describe the current test. Also added install of requirements.txt to final summary step. pyth0n1c 2021-11-24 14:20:46 -08:00
  • 88977a9fb8 Changes to template and summary to support passing a commit_hash parameter, not just a branch parameter, so that even old tests can be replicated. pyth0n1c 2021-11-24 13:58:32 -08:00
  • bda64cb7d4 added logic to include test file in the detections, also renamed the files to have prefixed ssa____ on name d1vious 2021-11-24 16:26:17 -05:00
  • 4f6be10581 Testing with the proper mode for a specific branch. pyth0n1c 2021-11-24 12:00:02 -08:00
  • f32f1bed2a More verbose debug messages in summarize_json. pyth0n1c 2021-11-24 11:45:52 -08:00
  • ccc29005fa Still diagnosing path issues for summarize. pyth0n1c 2021-11-24 11:12:19 -08:00
  • 54a34608fe Fixed results paths once more for summary. pyth0n1c 2021-11-24 10:36:33 -08:00
  • 5012b0f766 Another run to check and see if the summarization works and confirm the directory structure of the artifacts. pyth0n1c 2021-11-24 10:10:27 -08:00
  • 3cd3ca6692 Another CI change to list directory structure during summarize step. pyth0n1c 2021-11-24 09:54:27 -08:00
  • ef126c979d Branch was auto-updated. Bhavin Patel 2021-11-24 09:13:43 -08:00
  • 28f5d0f1b4 Branch was auto-updated. Bhavin Patel 2021-11-24 09:13:42 -08:00
  • 9392c15f40 Branch was auto-updated. Bhavin Patel 2021-11-24 09:13:38 -08:00
  • 9fd5ba2d7b Branch was auto-updated. Bhavin Patel 2021-11-24 09:13:37 -08:00
  • 945377a3cc Branch was auto-updated. Bhavin Patel 2021-11-24 09:13:36 -08:00
  • c57f06c3a9 Branch was auto-updated. Bhavin Patel 2021-11-24 09:13:35 -08:00
  • 61b717f51d Branch was auto-updated. Bhavin Patel 2021-11-24 09:13:34 -08:00
  • fd77109f22 Branch was auto-updated. Bhavin Patel 2021-11-24 09:13:34 -08:00
  • 694e5ef724 Merge pull request #1844 from splunk/TR-1085_LateralMovement_3 Michael Haag 2021-11-24 10:13:14 -07:00
  • 144b6971d2 Update wsmprovhost_exe_lolbas_execution_process_spawn.yml Michael Haag 2021-11-24 10:08:13 -07:00
  • 097683ffbb Update wmiprsve_exe_lolbas_execution_process_spawn.yml Michael Haag 2021-11-24 10:07:35 -07:00
  • ba111107f8 Added detection testing service results inWindows Service Created Within Public Path root 2021-11-24 15:24:21 +00:00
  • 9f122d542c Added detection testing service results inSvchost.exe LOLBAS Execution Process Spawn root 2021-11-24 14:58:42 +00:00
  • 42913444c4 update dataset location mvelazco 2021-11-24 09:37:47 -05:00
  • 1fa6e25756 ssa test ci cd P4T12ICK 2021-11-24 15:14:31 +01:00
  • 704e469362 ssa test ci cd P4T12ICK 2021-11-24 14:38:08 +01:00
  • ebbc82c8c3 ssa test ci cd P4T12ICK 2021-11-24 14:09:39 +01:00
  • 7baeb01691 ssa test ci cd P4T12ICK 2021-11-24 13:28:56 +01:00
  • e7a55b8d29 ssa test ci cd P4T12ICK 2021-11-24 13:15:50 +01:00
  • b02e05a11c ssa test ci cd P4T12ICK 2021-11-24 13:12:39 +01:00
  • 312209bea7 ssa test ci cd P4T12ICK 2021-11-24 13:10:56 +01:00
  • 395ef2c546 ssa test ci cd P4T12ICK 2021-11-24 12:46:18 +01:00
  • 2eea8708ed ssa test ci cd P4T12ICK 2021-11-24 12:34:55 +01:00
  • 59b3520084 ssa test ci cd P4T12ICK 2021-11-24 11:50:45 +01:00
  • b4e4c1385f ssa test ci cd P4T12ICK 2021-11-24 11:33:10 +01:00
  • 9310c27941 ssa test ci cd P4T12ICK 2021-11-24 09:17:42 +01:00
  • 421aebbf68 ssa test ci cd P4T12ICK 2021-11-24 08:28:45 +01:00
  • 2f85b48839 ba essentials content ba_essentials_content_pack P4T12ICK 2021-11-24 08:24:34 +01:00
  • 46aa673605 Merge branch 'TR-1085_LateralMovement_3' of github.com:splunk/security_content into TR-1085_LateralMovement_3 mvelazco 2021-11-23 21:04:10 -05:00
  • 33e9597304 updating logic and adding datasets mvelazco 2021-11-23 21:04:04 -05:00
  • 9e165574c0 Added detection testing service results inWsmprovhost.exe LOLBAS Execution Process Spawn root 2021-11-24 01:53:58 +00:00
  • eba7f33aa9 Merge branch 'TR-1085_LateralMovement_3' of github.com:splunk/security_content into TR-1085_LateralMovement_3 mvelazco 2021-11-23 20:33:28 -05:00
  • ad273d4ca1 update datasets mvelazco 2021-11-23 20:33:27 -05:00
  • 6b292ba2c1 upload artifacts even if summarize fails. pyth0n1c 2021-11-23 17:13:44 -08:00
  • a302d952b4 tiny ci change to test everything overnight pyth0n1c 2021-11-23 17:12:25 -08:00
  • ae7fb14085 Updated summarize_json.py to provide a total success/failure field and also return a nonzero return code if at least one test fails. pyth0n1c 2021-11-23 16:38:22 -08:00
  • 25a60dfdc7 Merge branch 'TR-1085_LateralMovement_3' of https://github.com/splunk/security_content into TR-1085_LateralMovement_3 Detection Testing Service 2021-11-24 00:03:26 +00:00
  • 6c45a549e3 Added detection testing service results inWmiprsve.exe LOLBAS Execution Process Spawn root 2021-11-24 00:03:25 +00:00
  • 1a39321be6 Small typo in artifact filename. pyth0n1c 2021-11-23 15:54:12 -08:00
  • 2c6ae766cc Merge branch 'TR-1085_LateralMovement_3' of https://github.com/splunk/security_content into TR-1085_LateralMovement_3 Detection Testing Service 2021-11-23 23:52:09 +00:00
  • e7ad40a54b Added detection testing service results inMmc.exe LOLBAS Execution Process Spawn root 2021-11-23 23:52:08 +00:00
  • 2e86ded458 Merge branch 'TR-1085_LateralMovement_3' of github.com:splunk/security_content into TR-1085_LateralMovement_3 mvelazco 2021-11-23 18:42:50 -05:00
  • c13de25f73 update dataset metadata mvelazco 2021-11-23 18:42:48 -05:00
  • 1afbaa3a1d Fixed bad value substitution into the schema coming from command line arguments. pyth0n1c 2021-11-23 15:35:05 -08:00
  • 451d2500db Fixed overwriting mode with null if nothing is passed on the command line. pyth0n1c 2021-11-23 15:22:11 -08:00
  • b0e7c33c4d Changing mode for CI PR test from selected to changes. pyth0n1c 2021-11-23 15:14:49 -08:00
  • 1015abc30a Finally ready to try the full integration test after modifying the docker-detection-testing.yml with new names, paths, and arguments. Fingers crossed... pyth0n1c 2021-11-23 15:10:28 -08:00
  • fab525a682 Added support for more command line arguments for number containers and mode and branch. pyth0n1c 2021-11-23 14:48:37 -08:00