admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
bhavin_dp
splunk-security_content/bin/docker_detection_tester/modules/validate_args.py
T
pyth0n1c 4b04df1ff8 Updated all app baselines in validate_args
2023-05-15 13:52:12 -07:00

353 lines
15 KiB
Python
Raw Permalink Blame History

import argparse
import copy
import io
import json
import modules.jsonschema_errorprinter as jsonschema_errorprinter
import sys
from typing import Union
# If we want, we can easily add a description field to any of the objects here!
ES_APP_NAME = "SPLUNK_ES_CONTENT_UPDATE"
setup_schema = {
"type": "object",
"properties": {
"branch": {"type": "string", "default": "develop"},
"commit_hash": {"type": ["string", "null"], "default": None},
"container_tag": {"type": "string", "default": "latest"},
"no_interactive_failure": {"type": "boolean", "default": False},
"interactive": {"type": "boolean", "default": False},
"detections_list": {
"type": ["array", "null"],
"items": {"type": "string"},
"default": None,
},
"apps": {
"type": "object",
"additionalProperties": False,
"patternProperties": {
"^.*$": {
"type": "object",
"additionalProperties": False,
"properties": {
"app_number": {"type": ["integer", "null"]},
"app_version": {"type": ["string", "null"]},
"local_path": {"type": ["string", "null"]},
"http_path": {"type": ["string", "null"]},
},
"anyOf": [
{"required": ["local_path"]},
{"required": ["http_path"]},
{"required": ["app_number", "app_version"]},
],
}
},
"default": {
# The default apps below were taken from the attack_range loadout: https://github.com/splunk/attack_range/blob/develop/attack_range.conf.template
"Splunk Add-on for CrowdStrike FDR": {
"app_number": 5579,
"app_version": "1.3.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-crowdstrike-fdr_140.tgz",
},
"ADD_ON_FOR_LINUX_SYSMON": {
"app_number": 6176,
"app_version": "1.0.4",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz",
},
"SPLUNK_TA_FOR_IIS": {
"app_number": 3185,
"app_version": "1.2.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-iis_120.tgz",
},
ES_APP_NAME: {
"app_number": 3449,
"app_version": None,
"local_path": None,
},
"PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": {
"app_number": 2757,
"app_version": "8.0.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/palo-alto-networks-add-on-for-splunk_802.tgz",
},
"PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": {
"app_number": 2882,
"app_version": "4.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_410.tgz",
},
"SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": {
"app_number": 3719,
"app_version": "1.3.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz",
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": {
"app_number": 4055,
"app_version": "4.2.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_430.tgz",
},
"SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": {
"app_number": 742,
"app_version": "8.5.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_870.tgz",
},
"SPLUNK_ADD_ON_FOR_NGINX": {
"app_number": 3258,
"app_version": "3.2.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_321.tgz",
},
"SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": {
"app_number": 5238,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz",
},
"SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": {
"app_number": 5234,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz",
},
"SPLUNK_ADD_ON_FOR_SYSMON": {
"app_number": 5709,
"app_version": "3.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_310.tgz",
},
"SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": {
"app_number": 833,
"app_version": "8.8.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_890.tgz",
},
"SPLUNK_APP_FOR_STREAM": {
"app_number": 1809,
"app_version": "8.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz",
},
"SPLUNK_MACHINE_LEARNING_TOOLKIT": {
"app_number": 2890,
"app_version": "5.4.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_540.tgz",
},
"SPLUNK_TA_FOR_ZEEK": {
"app_number": 5466,
"app_version": "1.0.5",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz",
},
"URL_TOOLBOX": {
"app_number": 2734,
"app_version": "1.9.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz",
},
"SPLUNK_TA_FIX_WINDOWS": {
"app_number": 9999,
"app_version": "1.0.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz",
},
"SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
"app_number": 3110,
"app_version": "4.5.2",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_510.tgz",
},
"SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
"app_number": 3088,
"app_version": "4.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-cloud-platform_410.tgz",
},
"SPLUNK_ADD_ON_FOR_GOOGLE_WORKSPACE": {
"app_number": 3110,
"app_version": "2.4.1",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-google-workspace_251.tgz",
},
"SPLUNK_TA_FOR_SURICATA": {
"app_number": 2760,
"app_version": "2.3.3",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-suricata_234.tgz",
},
"SPLUNK_COMMON_INFORMATION_MODEL": {
"app_number": 1621,
"app_version": "5.1.0",
"http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_511.tgz",
}
},
},
"mode": {
"type": "string",
"enum": ["changes", "selected", "all", "smoketest"],
"default": "changes",
},
"num_containers": {"type": "integer", "minimum": 1, "default": 1},
"persist_security_content": {"type": "boolean", "default": False},
"pr_number": {"type": ["integer", "null"], "default": None},
"reuse_image": {"type": "boolean", "default": True},
"show_splunk_app_password": {"type": "boolean", "default": False},
"splunkbase_username": {"type": ["string", "null"], "default": None},
"splunkbase_password": {"type": ["string", "null"], "default": None},
"splunk_app_password": {"type": ["string", "null"], "default": None},
"splunk_container_apps_directory": {
"type": "string",
"default": "/opt/splunk/etc/apps",
},
"local_base_container_name": {"type": "string", "default": "splunk_test_%d"},
"mock": {"type": "boolean", "default": False},
"folders": {
"type": "array",
"items": {
"type": "string",
"enum": [
"endpoint",
"cloud",
"network",
"web",
"application",
"experimental",
],
},
"default": ["endpoint", "cloud", "network", "web", "application"],
},
"types": {
"type": "array",
"items": {"type": "string", "enum": ["Anomaly", "Hunting", "TTP"]},
"default": ["Anomaly", "Hunting", "TTP"],
},
},
}
def validate_file(file: io.TextIOWrapper) -> tuple[Union[dict, None], dict]:
try:
settings = json.loads(file.read())
return validate(settings)
except Exception as e:
raise (e)
def check_dependencies(
settings: dict, skip_password_accessibility_check: bool = True
) -> bool:
# Check complex mode dependencies
error_free = True
# Make sure that all the mode arguments are sane
if settings["mode"] == "selected":
# Make sure that exactly one of the following fields is populated
if settings["detections_list"] == None:
print(
"Error - mode was 'selected' but no detections_list was supplied.",
file=sys.stderr,
)
error_free = False
if settings["mode"] != "selected" and settings["detections_list"] != None:
print(
"Error - mode was not 'selected' but detections_list was supplied.",
file=sys.stderr,
)
error_free = False
# Make sure that if we will be in an interactive mode, that either the user has provided the password or the password will be printed
if skip_password_accessibility_check:
pass
elif (
settings["interactive"] or not settings["no_interactive_failure"]
) and settings["show_splunk_app_password"] is False:
print("\n\n******************************************************\n\n")
if settings["splunk_app_password"] is not None:
print(
"Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
"and provided a password in the config file. We will NOT print this password to\n"
"stdout. Look in the config file for this password.",
file=sys.stderr,
)
else:
print(
"Warning: You have chosen an interactive mode, set show_splunk_app_password False,\n"
"and DID NOT provide a password in the config file. We have updated show_splunk_app_password\n"
"to True for you. Otherwise, interactive mode login would be impossible.",
file=sys.stderr,
)
settings["show_splunk_app_password"] = True
print("\n\n******************************************************\n\n")
# Returns true if there are not errors
return error_free
def validate_and_write(
configuration: dict,
output_file: Union[io.TextIOWrapper, None] = None,
strip_credentials: bool = False,
skip_password_accessibility_check: bool = True,
) -> tuple[Union[dict, None], dict]:
closeFile = False
if output_file is None:
import datetime
now = datetime.datetime.now()
configname = now.strftime("%Y-%m-%dT%H:%M:%S%z") + "-test-run.json"
output_file = open(configname, "w")
closeFile = True
if strip_credentials:
configuration = copy.deepcopy(configuration)
configuration["splunkbase_password"] = None
configuration["splunkbase_username"] = None
configuration["container_password"] = None
configuration["show_splunk_app_password"] = True
validated_json, setup_schema = validate(
configuration, skip_password_accessibility_check
)
if validated_json == None:
print("Error in the new settings! No output file written")
else:
print("Settings updated. Writing results to: %s" % (output_file.name))
try:
output_file.write(json.dumps(validated_json, sort_keys=True, indent=4))
except Exception as e:
print(
"Error writing settings to %s: [%s]" % (output_file.name, str(e)),
file=sys.stderr,
)
sys.exit(1)
if closeFile is True:
output_file.close()
return validated_json, setup_schema
def validate(
configuration: dict, skip_password_accessibility_check: bool = True
) -> tuple[Union[dict, None], dict]:
# v = jsonschema.Draft201909Validator(argument_schema)
try:
validation_errors, validated_json = jsonschema_errorprinter.check_json(
configuration, setup_schema
)
if len(validation_errors) == 0:
# check to make sure there were no complex errors
no_complex_errors = check_dependencies(
validated_json, skip_password_accessibility_check
)
if no_complex_errors:
return validated_json, setup_schema
else:
print(
"Validation failed due to error(s) listed above.", file=sys.stderr
)
return None, setup_schema
else:
print(
"[%d] failures detected during validation of the configuration!"
% (len(validation_errors)),
file=sys.stderr,
)
for error in validation_errors:
print(error, end="\n\n", file=sys.stderr)
return None, setup_schema
except Exception as e:
print(
"There was an error validation the configuration: [%s]" % (str(e)),
file=sys.stderr,
)
return None, setup_schema
Reference in New Issue View Git Blame Copy Permalink