admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • f0d10d05cf Branch was auto-updated. Bhavin Patel 2021-10-27 10:10:32 -07:00
  • a344abbc38 Branch was auto-updated. Bhavin Patel 2021-10-27 10:10:31 -07:00
  • d90ac44455 Branch was auto-updated. Bhavin Patel 2021-10-27 10:10:30 -07:00
  • addeec70ce Branch was auto-updated. Bhavin Patel 2021-10-27 10:10:29 -07:00
  • b37902cac4 Branch was auto-updated. Bhavin Patel 2021-10-27 10:10:26 -07:00
  • 10c62f5ecb Branch was auto-updated. Bhavin Patel 2021-10-27 10:10:26 -07:00
  • 155a25f6c3 Branch was auto-updated. Bhavin Patel 2021-10-27 10:10:25 -07:00
  • aa6eb2501f Branch was auto-updated. Bhavin Patel 2021-10-27 10:10:24 -07:00
  • d3c8a8a30b Bump tomli from 1.2.1 to 1.2.2 dependabot[bot] 2021-10-27 17:10:21 +00:00
  • 241923e29c Merge pull request #1711 from splunk/dependabot/pip/protobuf-3.18.1 Jose Enrique Hernandez 2021-10-27 13:09:51 -04:00
  • 1646c35428 Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:54 -07:00
  • 7dbac3a9da Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:52 -07:00
  • 711d18e001 Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:51 -07:00
  • a58ba6a92a Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:50 -07:00
  • b230c03f92 Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:49 -07:00
  • a93598da11 Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:49 -07:00
  • a9cbba7f71 Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:48 -07:00
  • 7f3d539809 Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:46 -07:00
  • 7bbfa75d3e Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:46 -07:00
  • 9132c4ec78 Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:45 -07:00
  • a239d03588 Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:44 -07:00
  • 44968ebfec Branch was auto-updated. Bhavin Patel 2021-10-27 07:51:42 -07:00
  • bc93e670f5 Merge pull request #1738 from splunk/adding_cve_docs Jose Enrique Hernandez 2021-10-27 10:51:21 -04:00
  • c24c062206 fixing display bugs divious1 2021-10-27 10:40:45 -04:00
  • afbc033601 Wait some time after ready before starting all of the tests to allow the container to settle. pyth0n1c 2021-10-26 16:58:24 -07:00
  • 710efec1a0 Tweak how long we wait before starting tests with the containers. pyth0n1c 2021-10-26 16:19:37 -07:00
  • 5fc1b7585b Fixed the last source to . changes for building slim. Also added the number of containers argument to the Synchronization object. pyth0n1c 2021-10-26 15:55:07 -07:00
  • b97fb13555 Rolling back some changes that introduced slim installation errors pyth0n1c 2021-10-26 15:25:26 -07:00
  • 673c95673c Fixed slim install pyth0n1c 2021-10-26 14:47:01 -07:00
  • 549bcac8a7 Changes to support Ubuntu, which doesn't have curl installed by default, and moving to python3 for slim. pyth0n1c 2021-10-26 14:33:01 -07:00
  • e05b95130c adding cve to annotations d1vious 2021-10-25 21:25:49 -04:00
  • 73ca3b59d7 added CVESearch to requirements d1vious 2021-10-25 21:09:37 -04:00
  • 4da636a426 adding cves to docs d1vious 2021-10-25 21:05:57 -04:00
  • fd9e91d569 Write out a summary csv and write environment iformation, to include datetime, splunk version, and installed splunk apps, to the csv files. pyth0n1c 2021-10-25 14:28:06 -07:00
  • 9acac939bf Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2021-10-25 13:45:04 -07:00
  • 83d6869c6c Better support for different types of structured output files, including a summary of all the detections before they are even run. pyth0n1c 2021-10-25 11:24:16 -07:00
  • 60d6d3c804 adding a report body example Jose Enrique Hernandez 2021-10-25 13:11:56 -04:00
  • 94bdfa90b1 Branch was auto-updated. Bhavin Patel 2021-10-25 08:09:05 -07:00
  • f74e2a9fbe Branch was auto-updated. Bhavin Patel 2021-10-25 08:09:04 -07:00
  • 9fc04a9e83 Branch was auto-updated. Bhavin Patel 2021-10-25 08:09:03 -07:00
  • c641c0b9e6 Branch was auto-updated. Bhavin Patel 2021-10-25 08:09:03 -07:00
  • 70df86065b Branch was auto-updated. Bhavin Patel 2021-10-25 08:09:01 -07:00
  • 45bc334721 Branch was auto-updated. Bhavin Patel 2021-10-25 08:09:00 -07:00
  • abc891dca1 Branch was auto-updated. Bhavin Patel 2021-10-25 08:08:59 -07:00
  • 1d0cc9cc97 Branch was auto-updated. Bhavin Patel 2021-10-25 08:08:57 -07:00
  • e686c17f46 Branch was auto-updated. Bhavin Patel 2021-10-25 08:08:56 -07:00
  • 296f4d528b Branch was auto-updated. Bhavin Patel 2021-10-25 08:08:55 -07:00
  • 1694d401e3 Branch was auto-updated. Bhavin Patel 2021-10-25 08:08:51 -07:00
  • 8f1af508e4 Branch was auto-updated. Bhavin Patel 2021-10-25 08:08:50 -07:00
  • c93daad34f Merge pull request #1734 from drewchurch/add-cve-tag Jose Enrique Hernandez 2021-10-25 11:08:29 -04:00
  • e9d1a85251 prforbhavingsuiteexperimentalsearches Rod Soto 2021-10-24 12:08:39 -07:00
  • a67a2b18e0 added check if detections are present or not divious1 2021-10-22 23:29:45 -04:00
  • 0846bb6d0b Putting download attack data into a 'temp dir' and removing attack data as soon as it's used. We need to do this when we're testing on CI/CD, otherwise we will run out of space. Should keep/remove attack data be an option instead of forced? pyth0n1c 2021-10-22 16:42:53 -07:00
  • 194de0c28a Added ability to test individual detection by specifying them on the command line. pyth0n1c 2021-10-22 15:41:18 -07:00
  • 53dedd468f Big changes to make the tool much more usable. Actually useful for testing, but no nice output files just yet. pyth0n1c 2021-10-22 12:57:38 -07:00
  • 3b18c5abcb Added CVE tags to 35 files Drew Church 2021-10-22 10:03:24 -07:00
  • 94950c337a Merge branch 'splunk:develop' into develop drew 2021-10-22 12:21:22 -04:00
  • 8e42d76725 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2021-10-22 03:38:47 -07:00
  • 4faf474711 PEX-33: initial commit Danny Leung 2021-10-22 00:01:59 -07:00
  • c5b5dfac88 Lots more changes - adding more error checking, typing to more functions, and better logging for testing detections. Initial cut at fixing up issues involving bad return types. Still had not been run/tested yet. pyth0n1c 2021-10-21 17:06:35 -07:00
  • 365bcc82ac More cleanup and removal of dead code. Created an object to synchronize all the threads and their status instead of having a massive number of arguments to each thread. Includes a synchronization primitive. pyth0n1c 2021-10-21 15:32:57 -07:00
  • 7ba61bc2b5 Generate good password for a container instead of always using a static password. Note that a password can also be supplied on the command line. pyth0n1c 2021-10-21 12:22:28 -07:00
  • 3dda0e6571 Update winevent_windows_task_scheduler_event_action_started.test.yml mhaag-spl 2021-10-21 13:02:34 -06:00
  • 27521060d9 Update wineventlog_task_scheduler.yml mhaag-spl 2021-10-21 12:07:26 -06:00
  • 0772e6352b taskscheduler hunting mhaag-spl 2021-10-21 09:56:27 -06:00
  • 2347743eed Add one stage in gitlab CI file which will trigger on tag push, which will publish build to pre_qa artifactory mjobanputra 2021-10-21 18:50:54 +05:30
  • 0f12c3141a Added detection testing service results inCMD Carry Out String Command Parameter root 2021-10-21 10:46:20 +00:00
  • bb1a684667 iceid_ttps tccontre 2021-10-21 12:24:22 +02:00
  • ca54d339da Added detection testing service results inDisabling Defender Services root 2021-10-21 10:10:35 +00:00
  • 10d43aa599 Added functionality and checks to remove the security_content directory or persist the security_content directory. This is useful because, on slow connections, it makes running subsequent tests A LOT faster. It is also faster on a fast connection. Finally, and most importantly, it lets you easily persist and re-test changes that you've made to detections. pyth0n1c 2021-10-20 18:17:07 -07:00
  • 60262a57f8 Added some more command line arguments to speed up testing and did some more smoketesting. pyth0n1c 2021-10-20 17:33:26 -07:00
  • 4e52891726 Better parsing of files to test, better error handling, more code reuse. pyth0n1c 2021-10-20 17:06:44 -07:00
  • 505e2f7986 Cleanup and restructuring of main logic. Better prints, error handling, and readability. pyth0n1c 2021-10-20 15:13:50 -07:00
  • ebfe049534 Update windows_curl_download_to_suspicious_path.yml mhaag-spl 2021-10-20 15:25:48 -06:00
  • 682b9cbc74 Added detection testing service results inWindows Curl Download to Suspicious Path root 2021-10-20 13:34:35 +00:00
  • f7112aca62 fixes mhaag-spl 2021-10-20 07:08:14 -06:00
  • 50f4a08cca Added detection testing service results inWmic NonInteractive App Uninstallation root 2021-10-20 12:01:43 +00:00
  • efdc9df9d5 iceid_ttps tccontre 2021-10-20 11:38:22 +02:00
  • 9995e9123d Added some additional arguments to control which detections we will test. pyth0n1c 2021-10-19 17:14:30 -07:00
  • 9e76ab75fc Working better during testing, but still needs a huge amount of cleanup. Lots of dead code and magic strings. pyth0n1c 2021-10-19 16:49:43 -07:00
  • ee54fa595a Update windows_curl_download_to_suspicious_path.yml mhaag-spl 2021-10-19 10:45:39 -06:00
  • f8d6ce147d Curling mhaag-spl 2021-10-19 10:44:17 -06:00
  • 590722abf9 Added detection testing service results inDisable Defender AntiVirus Registry root 2021-10-19 13:20:04 +00:00
  • 8cc1b51807 Added detection testing service results inDisable Defender BlockAtFirstSeen Feature root 2021-10-19 11:19:35 +00:00
  • 810f878c7f Added detection testing service results inDisable Defender Enhanced Notification root 2021-10-19 10:55:31 +00:00
  • dba4e97378 Added detection testing service results inDisable Defender MpEngine Registry root 2021-10-19 10:24:05 +00:00
  • a201b87285 Added detection testing service results inDisable Defender Spynet Reporting root 2021-10-19 10:00:24 +00:00
  • 498f464337 Added detection testing service results inDisable Defender Submit Samples Consent Feature root 2021-10-19 09:28:48 +00:00
  • 6048d9697a Added detection testing service results inDisable Schedule Task root 2021-10-19 08:42:46 +00:00
  • cebe2118e5 Fixed name of one of the test files. pyth0n1c 2021-10-18 16:45:34 -07:00
  • 46fb396506 Changed one registry related detection to fix field name. pyth0n1c 2021-10-18 13:55:49 -07:00
  • fc7e90bd37 iceid_ttps tccontre 2021-10-18 17:11:53 +02:00
  • 794adbe6f3 iceid_ttps tccontre 2021-10-18 16:56:46 +02:00
  • 2460d6b93b Fixing the naming of more Registry values pyth0n1c 2021-10-15 16:19:37 -07:00
  • a6522d37b6 Changed registry_key_name to registry_value_name in a number of detections in response to sysmonTA updates (correcting a previous error). pyth0n1c 2021-10-15 15:31:54 -07:00
  • 69b809579d Fixed filenames on some tests. There were named *.yml.test.yml instead of *.test.yml pyth0n1c 2021-10-15 14:58:21 -07:00
  • 75fe6a9f61 More progress. Now build and upload apps from local file system as well as install from splunkbase. pyth0n1c 2021-10-15 13:55:46 -07:00
  • 5fe2633537 Branch was auto-updated. Bhavin Patel 2021-10-15 13:42:49 -07:00
  • 036ab4d78d Branch was auto-updated. Bhavin Patel 2021-10-15 13:42:48 -07:00
  • e63f04d84b Branch was auto-updated. Bhavin Patel 2021-10-15 13:42:47 -07:00