Граф коммитов

615 Коммитов

Автор SHA1 Сообщение Дата
Brandon Myers 80713ecd34
Remove uptycs data source (#1721) 2021-06-16 13:49:44 -05:00
Brandon Myers 2c4108fb24
Improve papertrail mq worker (#1720) 2021-06-11 10:53:36 -05:00
A Smith ce13d3c32a
deprecating fxa logic (#1669) 2020-08-03 10:57:32 -05:00
A Smith dbe90e355d
adding new triagebot escalation alert (#1666)
* adding new triagebot escalation alert

* changing critical to info for pre-release
2020-07-29 14:39:06 -05:00
A Smith 6e2cb9b293
checking that keys exist and are not empty or None (#1663) 2020-07-21 09:41:08 -05:00
A Smith 8350ebcf98
Reverts edit made to the check for the details.requestparameters.htmlpart (#1662)
* truncates htmlpart to something ES can handle

* adding comments to code and checking if values exist per @arcrose's suggestion

* removing whitespace

* adds a constnat and adds description for the ES_FIELD_LIMIT_VALUE constant.

* reverting check for details.requestparameters.htmlpart edit

* fixing whitespace

* fixing whitespace
2020-07-20 16:10:46 -05:00
A Smith d1b66ec378
moving plugins into mozdef data class (#1659) 2020-07-16 18:21:15 -05:00
A Smith 08b0ae2526
truncates htmlpart to something ES can handle and adds authparameters to modify_keys (#1661)
* truncates htmlpart to something ES can handle

* adding comments to code and checking if values exist per @arcrose's suggestion

* removing whitespace

* adds a constnat and adds description for the ES_FIELD_LIMIT_VALUE constant.
2020-07-16 18:20:46 -05:00
A Smith e2194350cf
remove dots from the start or end of a key (#1650)
* remove dots from the start or end of a key

* updating the comment text

* re-envisioned code per @pwnbus' suggestion

* addressing review comments

* adds logic to check for null keys
2020-07-16 16:38:24 -05:00
Arcadia Rose a8a1663452
Eis 2329 (#1660)
* Write some new test cases that break the current implementation of the ldap_fixup email parser

* Tweak tests to break as expected

* Fix breaking test cases

* Add example from input that caused failure

* Split actor strings on spaces and on commas
2020-07-15 14:58:12 -05:00
A Smith 49973b5256
adds requestparameter for cloudtrail plugin (#1648) 2020-06-29 10:23:51 -05:00
Arcadia Rose da5546fede
Have the ldap_group alert aggregate on details.email (#1642)
* Have the ldap_fixup mq plugin parse the email and username out of an actor string and add them to ldap events

* Set email and username to none when not parsed out of details.actor

* Have the ldapGroupModify alert aggregate on the new details.email field

* Wildcards around member

* Shorten line > 80 characters

* Import syntax fix
2020-06-24 10:41:08 -05:00
A Smith bfea37de3a
removing deprecated references to fluentd sqs (#1644) 2020-06-24 09:57:15 -05:00
Michal Purzynski 0b10f83438
Update the GuardDuty schema to reflect upstream changes (#1641) 2020-06-03 14:15:03 -07:00
Arcadia Rose 8d831ef9db
replace the details.response key with details.userresponse to satisfy ES (#1637)
Co-authored-by: Arcadia Rose <arose@mozilla.com>
2020-05-27 17:48:21 -05:00
A Smith 0fe049f158
remove old_topic (#1636)
* remove old_topic

* adding test for change
2020-05-27 17:28:40 -05:00
A Smith 0031fd9f20
adding logic to handle empty recording_file_end (#1631)
* adding logic to handle empty recording_file_end

* updating changes to account for both recording fields, and adding test
2020-05-27 17:06:08 -05:00
A Smith 325bab4d14
adding a few fields for parsing fixup (#1630)
* adding a few fields for parsing fixup

* adding all conflicting fields we register that are  not present
2020-05-19 15:41:52 -05:00
Emma Rose 7ab26651b5
Fix triagebot mq format (#1627) 2020-05-12 11:15:30 -05:00
Brandon Myers 68fbf17bf6
Add vpc requestparameters to cloudtrail mapping plugin (#1623) 2020-05-06 14:05:06 -05:00
A Smith 5735323e1b
removes sso-dashboard-feedback (#1615) 2020-05-06 14:00:34 -05:00
Brandon Myers 348e761759
Update cloudtrail mapping for details.responseelements.state (#1622) 2020-04-30 14:40:58 -05:00
Brandon Myers 3cd9ff6bea
Update cloudtrail mapping conflicts (#1610) 2020-04-23 15:08:23 -05:00
A Smith 04bd718aab
remove empty start time keys, or assume value (#1605)
* remove empty start time keys, or assume value

* adding new test case for multiple empty start fields

* updating summary of test

* updating zoom_fixup.py to correct parsing errors.
2020-04-23 15:07:50 -05:00
Brandon Myers b19005b996
Tweak triage bot logger levels to debug (#1603) 2020-04-20 16:20:47 -05:00
Emma Rose d005603cba
Adjust debug logs to a reasonable level (#1602) 2020-04-14 18:01:22 -05:00
Emma Rose 6e849f2fdb
Feature triage bot v02 (#1576) 2020-04-14 15:37:17 -05:00
Gene Wood 0858c4fd74
Change raw_value to JSON
This changes raw_value to JSON so it's searchable in ES
2020-03-27 15:34:03 -07:00
Brandon Myers 87b1083587
Add cloudtrail sqs queue name as a tag to each event 2020-02-12 15:07:51 -06:00
Brandon Myers 62a6976b47
Add conditional to dropMessage plugin 2020-02-12 11:17:33 -06:00
Brandon Myers 11fe76292f
Fixup zoom mq plugin to set start_time if empty string 2020-02-11 14:57:11 -06:00
Michal Purzynski cce6d78095
Merge pull request #1481 from mpurzynski/stackdriver_final
Stackdriver final
2020-02-10 18:29:17 -08:00
Brandon Myers 31c530cfec
Throw exception if mq plugin registration is not list 2020-02-10 11:17:21 -06:00
Brandon Myers f6493d4535
Convert dropMessage registration to list 2020-02-10 11:16:36 -06:00
Michal Purzynski 85879dd2cf Add unit tests for summary fields 2020-02-06 15:09:27 -08:00
Brandon Myers 814a4069e5
Merge pull request #1544 from mpurzynski/gdnew1
Information about domains being queried like to jump all over the place
2020-02-04 11:47:55 -06:00
Michal Purzynski 788684dbec removed unnecessary configuration options 2020-01-14 17:34:41 -08:00
Michal Purzynski 6b401f71fc Merge branch 'master' of https://github.com/mozilla/mozdef into stackdriver_final
* 'master' of https://github.com/mozilla/mozdef: (247 commits)
  Export mongo in docker tests
  Add a mongoclient to RestTestSuite instances and write a test to make sure that using it works
  Add mongohost to rest conf
  Run mongodb as an external resource for testing
  Fixup ssh access alert to consider pid beginning of summary
  Modify update geolocation script to require credentials and not run by default
  Add steps to pull docker images from docker hub to install docs
  Update kibana setup script to no longer need kibana version
  Make data directory in initial setup docs
  Make cronic command executable
  Fixup mozdef and external service categories
  Modify mozdef services landing page title
  Add steps to enable management plugin in rabbitmq install docs
  Update cron manual installation docs
  Tune up manual service installation docs
  Tune up external manual service installation docs
  Add logger command to manual installation docs
  Add user execute to esCacheMaint script
  Update restapi and loginput to verify service is working
  Update manual installation format of docs
  ...
2020-01-14 13:55:51 -08:00
Michal Purzynski 87999198e6 Information about domains being queried like to jump all over the place 2020-01-14 13:54:06 -08:00
Brandon Myers 1ae379f4dd
Merge pull request #1539 from mozilla/update_docs_format
Update installation docs
2020-01-14 12:01:57 -06:00
Brandon Myers 6012f7cbfe
Update configs to align with manual installation docs 2020-01-02 16:12:59 -06:00
Brandon Myers 39ec432bcd
Add callerreference to cloudtrail plugin 2020-01-02 11:54:17 -06:00
Michal Purzynski ef3944fdbb Handle the case when a single API call name is sent as a json dict instead of a single-element list 2019-12-11 17:50:47 -08:00
Michal ef636a1800 Correct ./mq/plugins/guardDuty.py:108:13: W503 line break before binary operator 2019-12-09 14:37:28 -08:00
Michal 97f719052b Correct messages demultiplexing and some mapping errors. 2019-12-09 14:22:59 -08:00
Michal 985ecbaeb9 line break before binary operator 2019-12-02 16:54:47 -08:00
Michal 810c991d3a add more supported event types 2019-12-02 16:47:05 -08:00
Michal 9d5458c476 patch for some extremly rare cases of the apicalls structure not being present where we expect it 2019-12-02 16:23:33 -08:00
A Smith 1e5eb6d1f3
Merge pull request #1516 from mpurzynski/gdnew
A new version of the guardduty plugin and a dedicated worker
2019-12-02 15:22:37 -06:00
Michal Purzynski a0556723e5 create summary messages out of the thin air 2019-11-21 19:09:41 -08:00