-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into fix-errorResponse
Signed-off-by: Riya <[email protected]>
- Loading branch information
Showing
137 changed files
with
3,236 additions
and
3,461 deletions.
There are no files selected for viewing
Validating CODEOWNERS rules …
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| * @amsiglan @AWSHurneyt @getsaurabh02 @lezzago @praveensameneni @sbcd90 @eirsep | ||
| * @amsiglan @AWSHurneyt @getsaurabh02 @lezzago @praveensameneni @sbcd90 @eirsep @riysaxen-amzn |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| name: 'Install Dashboards with Plugin via Binary' | ||
|
|
||
| on: [push, pull_request] | ||
| env: | ||
| OPENSEARCH_VERSION: '3.0.0' | ||
| CI: 1 | ||
| # avoid warnings like "tput: No value for $TERM and no -T specified" | ||
| TERM: xterm | ||
|
|
||
| jobs: | ||
| verify-binary-installation: | ||
| name: Run binary installation | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| os: [ubuntu-latest] | ||
| # TODO: add windows support when OSD core is stable on windows | ||
| runs-on: ${{ matrix.os }} | ||
| steps: | ||
| - name: Checkout Branch | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Set env | ||
| run: | | ||
| opensearch_version=$(node -p "require('./opensearch_dashboards.json').opensearchDashboardsVersion") | ||
| plugin_version=$(node -p "require('./opensearch_dashboards.json').version") | ||
| echo "OPENSEARCH_VERSION=$opensearch_version" >> $GITHUB_ENV | ||
| echo "PLUGIN_VERSION=$plugin_version" >> $GITHUB_ENV | ||
| shell: bash | ||
|
|
||
| - name: Run Opensearch | ||
| uses: derek-ho/start-opensearch@v2 | ||
| with: | ||
| opensearch-version: ${{ env.OPENSEARCH_VERSION }} | ||
| security-enabled: false | ||
|
|
||
| - name: Run Dashboard | ||
| id: setup-dashboards | ||
| uses: derek-ho/setup-opensearch-dashboards@v1 | ||
| with: | ||
| plugin_name: security-analytics-dashboards-plugin | ||
| built_plugin_name: security-analytics-dashboards | ||
| install_zip: true | ||
|
|
||
| - name: Start the binary | ||
| run: | | ||
| nohup ./bin/opensearch-dashboards & | ||
| working-directory: ${{ steps.setup-dashboards.outputs.dashboards-binary-directory }} | ||
| shell: bash | ||
|
|
||
| - name: Health check | ||
| run: | | ||
| timeout 300 bash -c 'while [[ "$(curl http://localhost:5601/api/status | jq -r '.status.overall.state')" != "green" ]]; do sleep 5; done' | ||
| shell: bash | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| export const DEFAULT_RULE_UUID = '25b9c01c-350d-4b95-bed1-836d04a4f324'; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| import _ from 'lodash'; | ||
| import { DEFAULT_METRICS_COUNTER } from '../server/utils/constants'; | ||
| import { MetricsCounter, PartialMetricsCounter } from '../types'; | ||
| import { SecurityAnalyticsPluginConfigType } from '../config'; | ||
|
|
||
| export function aggregateMetrics( | ||
| metrics: PartialMetricsCounter, | ||
| currentMetricsCounter: PartialMetricsCounter | ||
| ): MetricsCounter { | ||
| const partialMetrics: PartialMetricsCounter = { | ||
| ...currentMetricsCounter, | ||
| }; | ||
| Object.keys(metrics).forEach((w) => { | ||
| const workflow = w as keyof MetricsCounter; | ||
| const workFlowMetrics = metrics[workflow]; | ||
|
|
||
| if (workFlowMetrics) { | ||
| const counterToUpdate: any = | ||
| partialMetrics[workflow] || _.cloneDeep(DEFAULT_METRICS_COUNTER[workflow]); | ||
| Object.entries(workFlowMetrics).forEach(([metric, count]) => { | ||
| if (!counterToUpdate[metric]) { | ||
| counterToUpdate[metric] = 0; | ||
| } | ||
| counterToUpdate[metric] += count; | ||
| }); | ||
|
|
||
| partialMetrics[workflow] = counterToUpdate; | ||
| } | ||
| }); | ||
|
|
||
| return partialMetrics as MetricsCounter; | ||
| } | ||
|
|
||
| let securityAnalyticsPluginConfig: SecurityAnalyticsPluginConfigType; | ||
| export const setSecurityAnalyticsPluginConfig = (config: SecurityAnalyticsPluginConfigType) => { | ||
| securityAnalyticsPluginConfig = config; | ||
| }; | ||
|
|
||
| export const getSecurityAnalyticsPluginConfig = (): SecurityAnalyticsPluginConfigType | undefined => | ||
| securityAnalyticsPluginConfig; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| /* | ||
| * Copyright OpenSearch Contributors | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| import { schema, TypeOf } from '@osd/config-schema'; | ||
|
|
||
| export const configSchema = schema.object({ | ||
| enabled: schema.boolean({ defaultValue: true }), | ||
| // Interval in minutes at which the browser should emit the metrics to the Kibana server | ||
| // Setting this to "0" will disable the metrics | ||
| uxTelemetryInterval: schema.number({ defaultValue: 2 }), | ||
| }); | ||
|
|
||
| export type SecurityAnalyticsPluginConfigType = TypeOf<typeof configSchema>; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| title: Moriya Rootkit | ||
| id: 25b9c01c-350d-4b95-bed1-836d04a4f324 | ||
| description: Detects the use of Moriya rootkit as described in the securelist Operation TunnelSnake report | ||
| status: experimental | ||
| author: Bhabesh Raj | ||
| date: 2021/05/06 | ||
| modified: 2021/11/30 | ||
| references: | ||
| - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831 | ||
| tags: | ||
| - attack.persistence | ||
| - attack.privilege_escalation | ||
| - attack.t1543.003 | ||
| logsource: | ||
| product: d3 | ||
| category: s3 | ||
| service: azure | ||
| detection: | ||
| selection: | ||
| Provider_Name: 'Service Control Manager' | ||
| EventID: 2100 | ||
| ServiceName: ZzNetSvc | ||
| condition: selection | ||
| level: critical | ||
| falsepositives: | ||
| - Unknown |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.