diff --git a/.circleci/config.yml b/.circleci/config.yml index 43e9974..cc1a202 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -130,7 +130,7 @@ jobs: done - run: - name: Wait for build results + name: Post the build results command: | ## Recording the build results STATUS=$(cat /tmp/status) diff --git a/Packer/scripts/vm-guest-tools.bat b/Packer/scripts/vm-guest-tools.bat index c27f16c..aa6e261 100755 --- a/Packer/scripts/vm-guest-tools.bat +++ b/Packer/scripts/vm-guest-tools.bat @@ -17,7 +17,7 @@ if exist "C:\Users\vagrant\windows.iso" ( ) if not exist "C:\Windows\Temp\windows.iso" ( - powershell -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object System.Net.WebClient).DownloadFile('https://softwareupdate.vmware.com/cds/vmw-desktop/ws/15.0.4/12990004/windows/packages/tools-windows.tar', 'C:\Windows\Temp\vmware-tools.tar')" /opt/splunk/etc/apps/user-prefs/local/user-prefs.conf + showWhatsNew = 0' > /opt/splunk/etc/system/local/user-prefs.conf # Enable SSL Login for Splunk echo -e "[settings]\nenableSplunkWebSSL = true" > /opt/splunk/etc/system/local/web.conf diff --git a/Vagrant/resources/splunk_forwarder/inputs.conf b/Vagrant/resources/splunk_forwarder/inputs.conf index d64de6b..cf1d39f 100755 --- a/Vagrant/resources/splunk_forwarder/inputs.conf +++ b/Vagrant/resources/splunk_forwarder/inputs.conf @@ -3,27 +3,27 @@ index = sysmon disabled = false renderXml = true -[monitor://c:\programdata\osquery\log\osqueryd.results.log] +[monitor://c:\Program Files\osquery\log\osqueryd.results.log] index = osquery disabled = false sourcetype = osquery:json -[monitor://c:\programdata\osquery\log\osqueryd.snapshots.log] +[monitor://c:\Program Files\osquery\log\osqueryd.snapshots.log] index = osquery disabled = false sourcetype = osquery:json -[monitor://c:\programdata\osquery\log\osqueryd.INFO.*] +[monitor://c:\Program Files\osquery\log\osqueryd.INFO.*] index = osquery-status disabled = false sourcetype = osquery-info:syslog -[monitor://c:\programdata\osquery\log\osqueryd.WARNING.*] +[monitor://c:\Program Files\osquery\log\osqueryd.WARNING.*] index = osquery-status disabled = false sourcetype = osquery-warn:syslog -[monitor://c:\programdata\osquery\log\osqueryd.ERROR.*] +[monitor://c:\Program Files\osquery\log\osqueryd.ERROR.*] index = osquery-status disabled = false sourcetype = osquery-error:syslog diff --git a/Vagrant/resources/splunk_server/lookup-file-editor_305.tgz b/Vagrant/resources/splunk_server/lookup-file-editor_305.tgz deleted file mode 100644 index 8158830..0000000 Binary files a/Vagrant/resources/splunk_server/lookup-file-editor_305.tgz and /dev/null differ diff --git a/Vagrant/resources/splunk_server/macros.conf b/Vagrant/resources/splunk_server/macros.conf index a029ed7..60b99d6 100644 --- a/Vagrant/resources/splunk_server/macros.conf +++ b/Vagrant/resources/splunk_server/macros.conf @@ -69,3 +69,7 @@ iseval = 0 [remote_thread_whitelist] definition = search NOT [| inputlookup threathunting_remote_thread_whitelist.csv | fields mitre_technique_id host_fqdn process_name target_process_path target_process_address] iseval = 0 + +[indextime] +definition = _index_earliest=-15m@m AND _index_latest=now +iseval = 0 diff --git a/ci/README.md b/ci/README.md index 1ca5122..28c9061 100644 --- a/ci/README.md +++ b/ci/README.md @@ -5,100 +5,4 @@ for continuous integration testing by installing the prerequisites needed for Detection Lab. After the prerequisites are installed, the build script is called and the build will begin in a tmux session. -## Understanding the build process - -Once a PR is created, the contents of that PR will be copied to a CircleCI worker to be tested. -The CircleCI worker will evaluate which files have been modified and set environment variables accordingly. There are 4 possible options and 3 different tests: - -1. Code in both the Packer and Vagrant directories was modified - * In this case, the CircleCI worker will execute `ci/circle_workflows/packer_and_vagrant_changes.sh` -2. Code in neither the Packer and Vagrant directories was modified - * In this case, the CircleCI worker will execute the default test `ci/circle_worker/vagrant_changes.sh` -3. Code in only the Packer directory was modified - * In this case, the CircleCI worker will execute `ci/circle_worker/packer_changes.sh` -4. Code in only the Vagrant directory was modified - * In this case, the CircleCI worker will execute `ci/circle_worker/vagrant_changes.sh` - -## Test Case Walkthroughs - -### packer_and_vagrant_changes.sh -1. Spins up a single Packet server -2. Bootstraps the Packet server by calling `ci/build_machine_bootstrap.sh` with no arguments -3. Builds the Windows10 and Windows2016 images one at a time -4. Moves the resulting boxes to the Boxes directory -5. Brings each Vagrant host online one-by-one -6. CircleCI records the build results from the Packet server - -### vagrant_changes.sh -1. Spins up a single Packet server -2. Bootstraps the Packet server by calling `ci/build_machine_bootstrap.sh` with the `--vagrant-only` argument -3. Downloads the pre-build Windows10 and Windows2016 boxes from Vagrant Cloud -4. Brings each Vagrant host online one-by-one -5. CircleCI records the build results from the Packet server - - -### packer_changes.sh -1. Spins up two separate Packet servers to allow the Packer boxes to be built in parallel -2. Bootstraps each packet Server by calling `ci/build_machine_bootstrap.sh` with the `--packer-only` argument -3. Starts the Packer build process on each server -4. CircleCI records the build result from each Packet server - -``` - +------------+ - | | - | | - | | - | Github | - | | - | | - +------+-----+ - | - | - | Pull Request - | - v - +------+-----+ - | | - | | - | Circle | - +----------------------------->| Worker | - | | | - | | | - | | | - | +------+-----+ - | | - | | Code changes are evaluated - | | to determine which test suite - | | to run - | | - | v - | +----------------+--------------+ -Circle Worker | | packer_and_vagrant_changes.sh | -queries for | | vagrant_changes.sh | -build results | | packer_changes.sh | - | +----------------+--------------+ - | | - | | - | | - | | - | | - | | - | | - | | 1. Provision Packet server(s) - | | 2. Copy repo to server - | | 3. Run server bootstrap - | | 4. Bootstrap calls build.sh with - | | the appropriate arguments - | | - | | - | +---------v---------+ - | | | - | | | - | | | - +-------------------------->| Packet Server | - | | - | | - | | - +-------------------+ - -``` +![DetectionLab](../img/build.png) diff --git a/ci/manual_machine_bootstrap_vmware.sh b/ci/manual_machine_bootstrap_vmware.sh index a0e56ac..c116aaa 100644 --- a/ci/manual_machine_bootstrap_vmware.sh +++ b/ci/manual_machine_bootstrap_vmware.sh @@ -6,7 +6,7 @@ export DEBIAN_FRONTEND=noninteractive export SERIALNUMBER="SECRET" export LICENSEFILE="SECRET" -sed -i 's/archive.ubuntu.com/us.archive.ubuntu.com/g' /etc/apt/sources.list +sed -i 's#http://archive.ubuntu.com#http://us.archive.ubuntu.com#g' /etc/apt/sources.list # Install VMWare Workstation 15 apt-get update