-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Feature/detector navigation to findings and alerts opensearch-project…
…#195 (opensearch-project#210) (opensearch-project#221) * [FEATURE] Navigate from the Detector page to Alerts/Findings filtered by the detector opensearch-project#195 Signed-off-by: Jovan Cvetkovic <[email protected]> * [FEATURE] Navigate from the Detector page to Alerts/Findings filtered by the detector opensearch-project#195 Signed-off-by: Jovan Cvetkovic <[email protected]> * [FEATURE] Navigate from the Detector page to Alerts/Findings filtered by the detector opensearch-project#195 Signed-off-by: Jovan Cvetkovic <[email protected]> * Fixing jest tests for helper utilities Signed-off-by: Jovan Cvetkovic <[email protected]> * Feature/detector navigation to findings and alerts opensearch-project#195 opensearch-project#210 Signed-off-by: Jovan Cvetkovic <[email protected]> Signed-off-by: Jovan Cvetkovic <[email protected]> (cherry picked from commit d412ea6) Co-authored-by: Jovan Cvetkovic <[email protected]> Signed-off-by: AWSHurneyt <[email protected]>
- Loading branch information
1 parent
dc87ec7
commit e9204c7
Showing
20 changed files
with
4,588 additions
and
115 deletions.
There are no files selected for viewing
57 changes: 57 additions & 0 deletions
57
cypress/fixtures/integration_tests/detector/create_dns_detector_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| { | ||
| "type": "detector", | ||
| "detector_type": "dns", | ||
| "name": "Cypress DNS Detector", | ||
| "enabled": true, | ||
| "createdBy": "", | ||
| "schedule": { | ||
| "period": { | ||
| "interval": 1, | ||
| "unit": "MINUTES" | ||
| } | ||
| }, | ||
| "inputs": [ | ||
| { | ||
| "detector_input": { | ||
| "description": "Detects DNS names.", | ||
| "indices": ["cypress-index-dns"], | ||
| "pre_packaged_rules": [], | ||
| "custom_rules": [ | ||
| { | ||
| "id": "25b9c01c-350d-4b95-bed1-836d04a4f325" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ], | ||
| "triggers": [ | ||
| { | ||
| "name": "DNS name alert", | ||
| "sev_levels": ["low"], | ||
| "tags": ["dns.low"], | ||
| "actions": [ | ||
| { | ||
| "id": "", | ||
| "name": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: Cypress DNS Detector", | ||
| "destination_id": "", | ||
| "subject_template": { | ||
| "source": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: Cypress DNS Detector", | ||
| "lang": "mustache" | ||
| }, | ||
| "message_template": { | ||
| "source": "Triggered alert condition: \nSeverity: 1 (Highest)\nThreat detector: Cypress DNS Detector\nDescription: Detects DNS names.\nDetector data sources:\n\tdns", | ||
| "lang": "mustache" | ||
| }, | ||
| "throttle_enabled": false, | ||
| "throttle": { | ||
| "value": 10, | ||
| "unit": "MINUTES" | ||
| } | ||
| } | ||
| ], | ||
| "types": ["dns"], | ||
| "severity": "1", | ||
| "ids": ["R1ng94QBbw8UQ2Cvqe6h"] | ||
| } | ||
| ] | ||
| } |
16 changes: 16 additions & 0 deletions
16
cypress/fixtures/integration_tests/detector/create_dns_detector_mappings_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| { | ||
| "properties": { | ||
| "dns-answers-type": { | ||
| "type": "alias", | ||
| "path": "DnsAnswerType" | ||
| }, | ||
| "dns-question-name": { | ||
| "type": "alias", | ||
| "path": "DnsQuestionName" | ||
| }, | ||
| "dns-question-registered_domain": { | ||
| "type": "alias", | ||
| "path": "DnsQuestionRegisteredDomain" | ||
| } | ||
| } | ||
| } |
57 changes: 57 additions & 0 deletions
57
cypress/fixtures/integration_tests/detector/create_usb_detector_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| { | ||
| "type": "detector", | ||
| "detector_type": "windows", | ||
| "name": "Cypress USB Detector", | ||
| "enabled": true, | ||
| "createdBy": "", | ||
| "schedule": { | ||
| "period": { | ||
| "interval": 1, | ||
| "unit": "MINUTES" | ||
| } | ||
| }, | ||
| "inputs": [ | ||
| { | ||
| "detector_input": { | ||
| "description": "Detect USB plugged in.", | ||
| "indices": ["cypress-index-windows"], | ||
| "pre_packaged_rules": [], | ||
| "custom_rules": [ | ||
| { | ||
| "id": "25b9c01c-350d-4b95-bed1-836d04a4f324" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ], | ||
| "triggers": [ | ||
| { | ||
| "name": "USB plugged in alert", | ||
| "sev_levels": ["low"], | ||
| "tags": ["windows.usb"], | ||
| "actions": [ | ||
| { | ||
| "id": "", | ||
| "name": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: USB Detector", | ||
| "destination_id": "", | ||
| "subject_template": { | ||
| "source": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: USB Detector", | ||
| "lang": "mustache" | ||
| }, | ||
| "message_template": { | ||
| "source": "Triggered alert condition: \nSeverity: 1 (Highest)\nThreat detector: USB Detector\nDescription: Detect USB plugged in.\nDetector data sources:\n\twindows", | ||
| "lang": "mustache" | ||
| }, | ||
| "throttle_enabled": false, | ||
| "throttle": { | ||
| "value": 10, | ||
| "unit": "MINUTES" | ||
| } | ||
| } | ||
| ], | ||
| "types": ["windows"], | ||
| "severity": "1", | ||
| "ids": ["25b9c01c-350d-4b95-bed1-836d04a4f123"] | ||
| } | ||
| ] | ||
| } |
28 changes: 28 additions & 0 deletions
28
cypress/fixtures/integration_tests/detector/create_usb_detector_mappings_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| { | ||
| "properties": { | ||
| "event_uid": { | ||
| "type": "alias", | ||
| "path": "EventID" | ||
| }, | ||
| "windows-event_data-CommandLine": { | ||
| "type": "alias", | ||
| "path": "CommandLine" | ||
| }, | ||
| "windows-hostname": { | ||
| "type": "alias", | ||
| "path": "HostName" | ||
| }, | ||
| "windows-message": { | ||
| "type": "alias", | ||
| "path": "Message" | ||
| }, | ||
| "windows-provider-name": { | ||
| "type": "alias", | ||
| "path": "Provider_Name" | ||
| }, | ||
| "windows-servicename": { | ||
| "type": "alias", | ||
| "path": "ServiceName" | ||
| } | ||
| } | ||
| } |
5 changes: 5 additions & 0 deletions
5
cypress/fixtures/integration_tests/index/add_dns_index_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| { | ||
| "DnsAnswerType": "QWE", | ||
| "DnsQuestionRegisteredDomain": "EC2AMAZ-EPWO7HKA", | ||
| "DnsQuestionName": "QWE" | ||
| } |
39 changes: 39 additions & 0 deletions
39
cypress/fixtures/integration_tests/index/add_windows_index_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| { | ||
| "EventTime": "2020-02-04T14:59:39.343541+00:00", | ||
| "HostName": "EC2AMAZ-EPO7HKA", | ||
| "Keywords": "9223372036854775808", | ||
| "SeverityValue": 2, | ||
| "Severity": "ERROR", | ||
| "EventID": 2003, | ||
| "SourceName": "Microsoft-Windows-Sysmon", | ||
| "ProviderGuid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", | ||
| "Version": 5, | ||
| "TaskValue": 22, | ||
| "OpcodeValue": 0, | ||
| "RecordNumber": 9532, | ||
| "ExecutionProcessID": 1996, | ||
| "ExecutionThreadID": 2616, | ||
| "Channel": "Microsoft-Windows-Sysmon/Operational", | ||
| "Domain": "NT AUTHORITY", | ||
| "AccountName": "SYSTEM", | ||
| "UserID": "S-1-5-18", | ||
| "AccountType": "User", | ||
| "Message": "Dns query:\r\nRuleName: \r\nUtcTime: 2020-02-04 14:59:38.349\r\nProcessGuid: {b3c285a4-3cda-5dc0-0000-001077270b00}\r\nProcessId: 1904\r\nQueryName: EC2AMAZ-EPO7HKA\r\nQueryStatus: 0\r\nQueryResults: 172.31.46.38;\r\nImage: C:\\Program Files\\nxlog\\nxlog.exe", | ||
| "Category": "Dns query (rule: DnsQuery)", | ||
| "Opcode": "Info", | ||
| "UtcTime": "2020-02-04 14:59:38.349", | ||
| "ProcessGuid": "{b3c285a4-3cda-5dc0-0000-001077270b00}", | ||
| "ProcessId": "1904", | ||
| "QueryName": "EC2AMAZ-EPO7HKA", | ||
| "QueryStatus": "0", | ||
| "QueryResults": "172.31.46.38;", | ||
| "Image": "C:\\Program Files\\nxlog\\regsvr32.exe", | ||
| "EventReceivedTime": "2020-02-04T14:59:40.780905+00:00", | ||
| "SourceModuleName": "in", | ||
| "SourceModuleType": "im_msvistalog", | ||
| "CommandLine": "eachtest", | ||
| "Initiated": "true", | ||
| "Provider_Name": "Service_ws_Control_ws_Manager", | ||
| "TargetObject": "\\SOFTWARE\\Microsoft\\Office\\Outlook\\Security", | ||
| "EventType": "SetValue" | ||
| } |
21 changes: 21 additions & 0 deletions
21
cypress/fixtures/integration_tests/index/create_dns_settings.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| { | ||
| "mappings": { | ||
| "properties": { | ||
| "DnsAnswerType": { | ||
| "type": "text" | ||
| }, | ||
| "DnsQuestionRegisteredDomain": { | ||
| "type": "text" | ||
| }, | ||
| "DnsQuestionName": { | ||
| "type": "text" | ||
| } | ||
| } | ||
| }, | ||
| "settings": { | ||
| "index": { | ||
| "number_of_shards": "1", | ||
| "number_of_replicas": "1" | ||
| } | ||
| } | ||
| } |
30 changes: 30 additions & 0 deletions
30
cypress/fixtures/integration_tests/index/create_windows_settings.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| { | ||
| "mappings": { | ||
| "properties": { | ||
| "CommandLine": { | ||
| "type": "text" | ||
| }, | ||
| "EventID": { | ||
| "type": "integer" | ||
| }, | ||
| "HostName": { | ||
| "type": "text" | ||
| }, | ||
| "Message": { | ||
| "type": "text" | ||
| }, | ||
| "Provider_Name": { | ||
| "type": "text" | ||
| }, | ||
| "ServiceName": { | ||
| "type": "text" | ||
| } | ||
| } | ||
| }, | ||
| "settings": { | ||
| "index": { | ||
| "number_of_shards": "1", | ||
| "number_of_replicas": "1" | ||
| } | ||
| } | ||
| } |
26 changes: 26 additions & 0 deletions
26
cypress/fixtures/integration_tests/rule/create_dns_rule.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| { | ||
| "id": "25b9c01c-350d-4b95-bed1-836d04a4f325", | ||
| "category": "dns", | ||
| "title": "Cypress DNS Rule", | ||
| "description": "Detects DNS name as QWE", | ||
| "status": "experimental", | ||
| "author": "Cypress Tests", | ||
| "references": [ | ||
| { | ||
| "value": "" | ||
| } | ||
| ], | ||
| "tags": [ | ||
| { | ||
| "value": "dns.low" | ||
| } | ||
| ], | ||
| "log_source": "", | ||
| "detection": "selection:\n DnsQuestionName:\n - QWE\n - ASD\n - YXC\ncondition: selection", | ||
| "level": "low", | ||
| "false_positives": [ | ||
| { | ||
| "value": "" | ||
| } | ||
| ] | ||
| } |
26 changes: 26 additions & 0 deletions
26
cypress/fixtures/integration_tests/rule/create_windows_usb_rule.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| { | ||
| "id": "25b9c01c-350d-4b95-bed1-836d04a4f123", | ||
| "category": "windows", | ||
| "title": "Cypress USB Rule", | ||
| "description": "USB plugged-in rule", | ||
| "status": "experimental", | ||
| "author": "Cypress Tests", | ||
| "references": [ | ||
| { | ||
| "value": "" | ||
| } | ||
| ], | ||
| "tags": [ | ||
| { | ||
| "value": "windows.usb" | ||
| } | ||
| ], | ||
| "log_source": "", | ||
| "detection": "selection:\n EventID:\n - 2003\n - 2100\n - 2102\ncondition: selection", | ||
| "level": "low", | ||
| "false_positives": [ | ||
| { | ||
| "value": "" | ||
| } | ||
| ] | ||
| } |
Oops, something went wrong.