From 507dd396d295132bdf71f11c67fbcdf00701f7d0 Mon Sep 17 00:00:00 2001 From: "Mahir Chavda (C)" Date: Tue, 2 Jun 2020 16:30:44 +0530 Subject: [PATCH] More mcafee epo sample events --- tests/test_mcafee_epo.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/tests/test_mcafee_epo.py b/tests/test_mcafee_epo.py index 69fab84..8d8df32 100644 --- a/tests/test_mcafee_epo.py +++ b/tests/test_mcafee_epo.py @@ -13,8 +13,12 @@ env = Environment() testdata = [ - '{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@4444 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] {0011aacc-eeee-0000-0000-000011223311}THEMBP1000011223311172.16.23.1231.1.1.103Windows 1024024224{{ iso }}POLICYAU6000040959Policy EnforcementN/AEPOAGENT3000N/AN/AN/A\n', - '{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@4444 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] {0011aacc-eeee-0000-0000-000011223311}THEMBP1000011223311172.16.23.1231.1.1.103Linux0GARY189050{{ iso }}Policy Auditor Vulnerability Assessment1.1.0Security020eJx1jjELgzAUhPf+ipCpBYWoS+smOHYQHEuR1xjKK+YZzEupiP+9j+7d7o7vuNs0gXe61l2jmhgd qxYYVG+BCOmprkjpo45N1/UnnemUcBS4NKIZvYsMPvyC0uSmyouLKqramLo8C7G4mCYeeA2ysGkI YUILjDMN8+PlLEsTyS7OO2KY9J6JfYuel3UY5ce/1u2+74cvff89lg==\n' + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.131Windows 10 Server%CTX_DOMAIN_USER%-330000011223311ENDP_GS_1060McAfee Endpoint Security10.6.1.1607DESKTOP-0000111200{{ iso }}_ops.update1none6', + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.83Windows 10 Server%CTX_DOMAIN_USER%-330000011223311ENDP_GS_1070McAfee Endpoint Security10.7.0.1285DESKTOP-0000111180{{ iso }}_ops.update.end1none6', + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.45Windows 10 WorkstationSYSTEM-330000011223311ENDP_WP_1060McAfee Endpoint Security10.6.1DESKTOP-00001URL navigation186003{{ iso }}wp.detect.url186002Web Control ViolationIDS_THREAT_TYPE_URL{{ iso }}ZblockedTrue213.211.198.58http://2222.aaaaa.org/download/eicarcom2.zipDESKTOP-00001\adminC:\Program Files\McAfee\Endpoint Security\Web Control\McChHost.exeDESKTOP-00001\adminIDS_BLADE_NAME_WPTrue03e33bcdd99853ea8c83407c3ab4599cC:\Program Files\Google\Chrome\Application\chrome.exea1902e39f3a1610751b707a6742082c3TrueGoogle LLC0FalseIDS_SECUIRTY_RATING_SA_REDIDS_SAE_CONTENT_MS1IDS_WC_NLD_URL_RATING|SourceURL=http://2222.aaaaa.org/download/eicarcom2.zip|SourceProcessName=C:\Program Files\McAfee\Endpoint Security\Web Control\McChHost.exe|SourceUserName=DESKTOP-00001\admin|ThreatActionTaken=blocked|AnalyzerName=McAfee Endpoint Security|SourceURLRatingCode=IDS_SECUIRTY_RATING_SA_RED186002222.aaaaa.orghttp://2222.aaaaa.org/download/eicarcom2.zip10413143444413000000100000000000000000011000000', + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] ?DESKTOP-000010011aacc-eeee-0000-0000-00001122331110.222.22.131Windows 10 ServerSYSTEM-330000011223311ENDP_AM_1060McAfee Endpoint Security10.6.1DESKTOP-000016010.8670On-Access Scan3811.012783{{ iso }}av.detect12782EICAR test filetest{{ iso }}ZIDS_ALERT_ACT_TAK_DELTrueDESKTOP-00001C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\Tops.exeDESKTOP-00001DESKTOP-00001\admin123C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\TEST_SAMPLES_MVS\Standard Test Set\eicarIDS_BLADE_NAME_SPB2019-08-25T02:22:00ZFalseTrueeicarC:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\TEST_SAMPLES_MVS\Standard Test Sete7e5fa40569514ec442bbdf755d89c2f702000-10-24T05:13:46Z2019-08-26T05:32:39Z2019-08-26T05:32:39ZFalseIDS_OAS_TASK_NAMEIDS_ALERT_THACT_ATT_CLEFalseIDS_ALERT_THACT_ATT_DELTrue410IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=eicar|TargetPath=C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\TEST_SAMPLES_MVS\Standard Test Set|ThreatName=EICAR test file|SourceProcessName=C:\Users\admin123.WIN-QFN79SPC5U4.000\Desktop\Tops.exe|ThreatType=test|TargetUserName=DESKTOP-00001\admin123IDS_OAS_DEFAULT_THREAT_MESSAGE3811.0', + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@4444 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] {0011aacc-eeee-0000-0000-000011223311}THEMBP1000011223311172.16.23.1231.1.1.103Windows 1024024224{{ iso }}POLICYAU6000040959Policy EnforcementN/AEPOAGENT3000N/AN/AN/A', + r'{{ mark }} {{ iso }}Z {{ host }} EPOEvents - EventFwd [agentInfo@4444 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] {0011aacc-eeee-0000-0000-000011223311}THEMBP1000011223311172.16.23.1231.1.1.103Linux0GARY189050{{ iso }}Policy Auditor Vulnerability Assessment1.1.0Security020eJx1jjELgzAUhPf+ipCpBYWoS+smOHYQHEuR1xjKK+YZzEupiP+9j+7d7o7vuNs0gXe61l2jmhgd qxYYVG+BCOmprkjpo45N1/UnnemUcBS4NKIZvYsMPvyC0uSmyouLKqramLo8C7G4mCYeeA2ysGkI YUILjDMN8+PlLEsTyS7OO2KY9J6JfYuel3UY5ce/1u2+74cvff89lg==', ] @pytest.mark.parametrize("event", testdata) def test_mcafee_epo_structured(record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s,event): @@ -27,7 +31,7 @@ def test_mcafee_epo_structured(record_property, setup_wordlist, get_host_key, se iso = dt.isoformat()[0:23] epoch = epoch[:-3] - mt = env.from_string(event) + mt = env.from_string(event + "\n") message = mt.render(mark="<29>1", iso=iso, host=host) sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])