Skip to content

Commit 702e499

Browse files
jovancvetkovic3006github-actions[bot]
jovancvetkovic3006
authored and
github-actions[bot]
committed
Feature/detector navigation to findings and alerts #195 (#210)
* [FEATURE] Navigate from the Detector page to Alerts/Findings filtered by the detector #195 Signed-off-by: Jovan Cvetkovic <[email protected]> * [FEATURE] Navigate from the Detector page to Alerts/Findings filtered by the detector #195 Signed-off-by: Jovan Cvetkovic <[email protected]> * [FEATURE] Navigate from the Detector page to Alerts/Findings filtered by the detector #195 Signed-off-by: Jovan Cvetkovic <[email protected]> * Fixing jest tests for helper utilities Signed-off-by: Jovan Cvetkovic <[email protected]> * Feature/detector navigation to findings and alerts #195 #210 Signed-off-by: Jovan Cvetkovic <[email protected]> Signed-off-by: Jovan Cvetkovic <[email protected]> (cherry picked from commit d412ea6)
1 parent 21ae3de commit 702e499

File tree

20 files changed

+4588
-115
lines changed

20 files changed

+4588
-115
lines changed

‎cypress/fixtures/integration_tests/detector/create_dns_detector_data.json

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"type": "detector",
3+
"detector_type": "dns",
4+
"name": "Cypress DNS Detector",
5+
"enabled": true,
6+
"createdBy": "",
7+
"schedule": {
8+
"period": {
9+
"interval": 1,
10+
"unit": "MINUTES"
11+
}
12+
},
13+
"inputs": [
14+
{
15+
"detector_input": {
16+
"description": "Detects DNS names.",
17+
"indices": ["cypress-index-dns"],
18+
"pre_packaged_rules": [],
19+
"custom_rules": [
20+
{
21+
"id": "25b9c01c-350d-4b95-bed1-836d04a4f325"
22+
}
23+
]
24+
}
25+
}
26+
],
27+
"triggers": [
28+
{
29+
"name": "DNS name alert",
30+
"sev_levels": ["low"],
31+
"tags": ["dns.low"],
32+
"actions": [
33+
{
34+
"id": "",
35+
"name": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: Cypress DNS Detector",
36+
"destination_id": "",
37+
"subject_template": {
38+
"source": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: Cypress DNS Detector",
39+
"lang": "mustache"
40+
},
41+
"message_template": {
42+
"source": "Triggered alert condition: \nSeverity: 1 (Highest)\nThreat detector: Cypress DNS Detector\nDescription: Detects DNS names.\nDetector data sources:\n\tdns",
43+
"lang": "mustache"
44+
},
45+
"throttle_enabled": false,
46+
"throttle": {
47+
"value": 10,
48+
"unit": "MINUTES"
49+
}
50+
}
51+
],
52+
"types": ["dns"],
53+
"severity": "1",
54+
"ids": ["R1ng94QBbw8UQ2Cvqe6h"]
55+
}
56+
]
57+
}

‎cypress/fixtures/integration_tests/detector/create_dns_detector_mappings_data.json

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"properties": {
3+
"dns-answers-type": {
4+
"type": "alias",
5+
"path": "DnsAnswerType"
6+
},
7+
"dns-question-name": {
8+
"type": "alias",
9+
"path": "DnsQuestionName"
10+
},
11+
"dns-question-registered_domain": {
12+
"type": "alias",
13+
"path": "DnsQuestionRegisteredDomain"
14+
}
15+
}
16+
}

‎cypress/fixtures/integration_tests/detector/create_usb_detector_data.json

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"type": "detector",
3+
"detector_type": "windows",
4+
"name": "Cypress USB Detector",
5+
"enabled": true,
6+
"createdBy": "",
7+
"schedule": {
8+
"period": {
9+
"interval": 1,
10+
"unit": "MINUTES"
11+
}
12+
},
13+
"inputs": [
14+
{
15+
"detector_input": {
16+
"description": "Detect USB plugged in.",
17+
"indices": ["cypress-index-windows"],
18+
"pre_packaged_rules": [],
19+
"custom_rules": [
20+
{
21+
"id": "25b9c01c-350d-4b95-bed1-836d04a4f324"
22+
}
23+
]
24+
}
25+
}
26+
],
27+
"triggers": [
28+
{
29+
"name": "USB plugged in alert",
30+
"sev_levels": ["low"],
31+
"tags": ["windows.usb"],
32+
"actions": [
33+
{
34+
"id": "",
35+
"name": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: USB Detector",
36+
"destination_id": "",
37+
"subject_template": {
38+
"source": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: USB Detector",
39+
"lang": "mustache"
40+
},
41+
"message_template": {
42+
"source": "Triggered alert condition: \nSeverity: 1 (Highest)\nThreat detector: USB Detector\nDescription: Detect USB plugged in.\nDetector data sources:\n\twindows",
43+
"lang": "mustache"
44+
},
45+
"throttle_enabled": false,
46+
"throttle": {
47+
"value": 10,
48+
"unit": "MINUTES"
49+
}
50+
}
51+
],
52+
"types": ["windows"],
53+
"severity": "1",
54+
"ids": ["25b9c01c-350d-4b95-bed1-836d04a4f123"]
55+
}
56+
]
57+
}

‎cypress/fixtures/integration_tests/detector/create_usb_detector_mappings_data.json

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"properties": {
3+
"event_uid": {
4+
"type": "alias",
5+
"path": "EventID"
6+
},
7+
"windows-event_data-CommandLine": {
8+
"type": "alias",
9+
"path": "CommandLine"
10+
},
11+
"windows-hostname": {
12+
"type": "alias",
13+
"path": "HostName"
14+
},
15+
"windows-message": {
16+
"type": "alias",
17+
"path": "Message"
18+
},
19+
"windows-provider-name": {
20+
"type": "alias",
21+
"path": "Provider_Name"
22+
},
23+
"windows-servicename": {
24+
"type": "alias",
25+
"path": "ServiceName"
26+
}
27+
}
28+
}

‎cypress/fixtures/integration_tests/index/add_dns_index_data.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"DnsAnswerType": "QWE",
3+
"DnsQuestionRegisteredDomain": "EC2AMAZ-EPWO7HKA",
4+
"DnsQuestionName": "QWE"
5+
}

‎cypress/fixtures/integration_tests/index/add_windows_index_data.json

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"EventTime": "2020-02-04T14:59:39.343541+00:00",
3+
"HostName": "EC2AMAZ-EPO7HKA",
4+
"Keywords": "9223372036854775808",
5+
"SeverityValue": 2,
6+
"Severity": "ERROR",
7+
"EventID": 2003,
8+
"SourceName": "Microsoft-Windows-Sysmon",
9+
"ProviderGuid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
10+
"Version": 5,
11+
"TaskValue": 22,
12+
"OpcodeValue": 0,
13+
"RecordNumber": 9532,
14+
"ExecutionProcessID": 1996,
15+
"ExecutionThreadID": 2616,
16+
"Channel": "Microsoft-Windows-Sysmon/Operational",
17+
"Domain": "NT AUTHORITY",
18+
"AccountName": "SYSTEM",
19+
"UserID": "S-1-5-18",
20+
"AccountType": "User",
21+
"Message": "Dns query:\r\nRuleName: \r\nUtcTime: 2020-02-04 14:59:38.349\r\nProcessGuid: {b3c285a4-3cda-5dc0-0000-001077270b00}\r\nProcessId: 1904\r\nQueryName: EC2AMAZ-EPO7HKA\r\nQueryStatus: 0\r\nQueryResults: 172.31.46.38;\r\nImage: C:\\Program Files\\nxlog\\nxlog.exe",
22+
"Category": "Dns query (rule: DnsQuery)",
23+
"Opcode": "Info",
24+
"UtcTime": "2020-02-04 14:59:38.349",
25+
"ProcessGuid": "{b3c285a4-3cda-5dc0-0000-001077270b00}",
26+
"ProcessId": "1904",
27+
"QueryName": "EC2AMAZ-EPO7HKA",
28+
"QueryStatus": "0",
29+
"QueryResults": "172.31.46.38;",
30+
"Image": "C:\\Program Files\\nxlog\\regsvr32.exe",
31+
"EventReceivedTime": "2020-02-04T14:59:40.780905+00:00",
32+
"SourceModuleName": "in",
33+
"SourceModuleType": "im_msvistalog",
34+
"CommandLine": "eachtest",
35+
"Initiated": "true",
36+
"Provider_Name": "Service_ws_Control_ws_Manager",
37+
"TargetObject": "\\SOFTWARE\\Microsoft\\Office\\Outlook\\Security",
38+
"EventType": "SetValue"
39+
}

‎cypress/fixtures/integration_tests/index/create_dns_settings.json

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"mappings": {
3+
"properties": {
4+
"DnsAnswerType": {
5+
"type": "text"
6+
},
7+
"DnsQuestionRegisteredDomain": {
8+
"type": "text"
9+
},
10+
"DnsQuestionName": {
11+
"type": "text"
12+
}
13+
}
14+
},
15+
"settings": {
16+
"index": {
17+
"number_of_shards": "1",
18+
"number_of_replicas": "1"
19+
}
20+
}
21+
}

‎cypress/fixtures/integration_tests/index/create_windows_settings.json

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"mappings": {
3+
"properties": {
4+
"CommandLine": {
5+
"type": "text"
6+
},
7+
"EventID": {
8+
"type": "integer"
9+
},
10+
"HostName": {
11+
"type": "text"
12+
},
13+
"Message": {
14+
"type": "text"
15+
},
16+
"Provider_Name": {
17+
"type": "text"
18+
},
19+
"ServiceName": {
20+
"type": "text"
21+
}
22+
}
23+
},
24+
"settings": {
25+
"index": {
26+
"number_of_shards": "1",
27+
"number_of_replicas": "1"
28+
}
29+
}
30+
}

‎cypress/fixtures/integration_tests/rule/create_dns_rule.json

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{
2+
"id": "25b9c01c-350d-4b95-bed1-836d04a4f325",
3+
"category": "dns",
4+
"title": "Cypress DNS Rule",
5+
"description": "Detects DNS name as QWE",
6+
"status": "experimental",
7+
"author": "Cypress Tests",
8+
"references": [
9+
{
10+
"value": ""
11+
}
12+
],
13+
"tags": [
14+
{
15+
"value": "dns.low"
16+
}
17+
],
18+
"log_source": "",
19+
"detection": "selection:\n DnsQuestionName:\n - QWE\n - ASD\n - YXC\ncondition: selection",
20+
"level": "low",
21+
"false_positives": [
22+
{
23+
"value": ""
24+
}
25+
]
26+
}

‎cypress/fixtures/integration_tests/rule/create_windows_usb_rule.json

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{
2+
"id": "25b9c01c-350d-4b95-bed1-836d04a4f123",
3+
"category": "windows",
4+
"title": "Cypress USB Rule",
5+
"description": "USB plugged-in rule",
6+
"status": "experimental",
7+
"author": "Cypress Tests",
8+
"references": [
9+
{
10+
"value": ""
11+
}
12+
],
13+
"tags": [
14+
{
15+
"value": "windows.usb"
16+
}
17+
],
18+
"log_source": "",
19+
"detection": "selection:\n EventID:\n - 2003\n - 2100\n - 2102\ncondition: selection",
20+
"level": "low",
21+
"false_positives": [
22+
{
23+
"value": ""
24+
}
25+
]
26+
}

0 commit comments

Comments
 (0)