From f7bf3de4a1c42c29207b8c9c03ffb8a0856cd966 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 4 Feb 2020 18:12:34 -0500 Subject: [PATCH] updates --- tests/docker-compose.yml | 2 +- tests/sendmessage.py | 4 ++-- tests/test_checkpoint.py | 2 +- tests/test_juniper_legacy.py | 2 +- tests/test_pfsense.py | 4 ++-- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml index d30f959..ea5d212 100644 --- a/tests/docker-compose.yml +++ b/tests/docker-compose.yml @@ -38,7 +38,7 @@ services: links: - splunk environment: - - SPLUNK_HEC_URL=${SPLUNK_HEC_URL} + - SPLUNK_HEC_URL=https://splunk:8088 - SPLUNK_HEC_TOKEN=${SPLUNK_HEC_TOKEN} - SC4S_SOURCE_TLS_ENABLE=no - SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no diff --git a/tests/sendmessage.py b/tests/sendmessage.py index 122381f..7618b97 100644 --- a/tests/sendmessage.py +++ b/tests/sendmessage.py @@ -9,8 +9,8 @@ import os def sendsingle(message, - host=os.getenv('SYSLOG_HOST', "sc4s"), - port=514): + host, + port): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server_address = (host, port) diff --git a/tests/test_checkpoint.py b/tests/test_checkpoint.py index bd5e13f..9e1a9a0 100644 --- a/tests/test_checkpoint.py +++ b/tests/test_checkpoint.py @@ -21,7 +21,7 @@ def test_checkpoint_splunk_ips(record_property, setup_wordlist, setup_splunk, se "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} time={% now 'utc', '%s' %}|hostname={{ host }}|severity=Informational|confidence_level=Unknown|product=IPS|action=Drop|ifdir=inbound|ifname=bond2|loguid={0x5d9cdcc9,0x8d159f,0x5f19f392,0x1897a828}|origin=1.1.1.1|time={% now 'utc', '%s' %}|version=1|attack=Streaming Engine: TCP Segment Limit Enforcement|attack_info=TCP segment out of maximum allowed sequence. Packet dropped.|chassis_bladed_system=[ 1_3 ]|dst=10.10.10.10|origin_sic_name=CN=something_03_local,O=devicename.domain.com.p7fdbt|performance_impact=0|protection_id=tcp_segment_limit|protection_name=TCP Segment Limit Enforcement|protection_type=settings_tcp|proto=6|rule=393|rule_name=10.384_..|rule_uid={9F77F944-8DD5-4ADF-803A-785D03B3A2E8}|s_port=46455|service=443|smartdefense_profile=Recommended_Protection_ded9e8d8ee89d|src=1.1.1.2|\n") message = mt.render(mark="<111>", host=host) - sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][514]) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][514]) st = env.from_string("search index=netids host=\"{{ host }}\" sourcetype=\"cp_log\" | head 2") search = st.render(host=host) diff --git a/tests/test_juniper_legacy.py b/tests/test_juniper_legacy.py index afe147e..f9696d9 100644 --- a/tests/test_juniper_legacy.py +++ b/tests/test_juniper_legacy.py @@ -111,7 +111,7 @@ def test_juniper_netscreen_fw_singleport(record_property, setup_wordlist, get_ho "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} ns204: NetScreen device_id=netscreen2 [Root]system-notification-00257(traffic): start_time=\"2009-03-18 16:07:06\" duration=0 policy_id=320001 service=msrpc Endpoint Mapper(tcp) proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=16384 src=21.10.90.125 dst=23.16.1.1 singleport=5000\n") message = mt.render(mark="<23>", host=host) - sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][5000]) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][5000]) st = env.from_string("search index=netfw host=\"{{ host }}\" sourcetype=\"netscreen:firewall\" | head 2") search = st.render(host=host) diff --git a/tests/test_pfsense.py b/tests/test_pfsense.py index e2d027b..2f8ee6a 100644 --- a/tests/test_pfsense.py +++ b/tests/test_pfsense.py @@ -18,7 +18,7 @@ def test_pfsense_filterlog(record_property, setup_wordlist, setup_splunk, setup_ mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} filterlog: 82,,,1000002666,mvneta2,match,pass,out,6,0x00,0x00000,64,ICMPv6,58,8,{{key}},\n") message = mt.render(mark="<27>", key=host) - sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][5006]) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][5006]) st = env.from_string("search index=netfw sourcetype=pfsense:filterlog \"{{key}}\" earliest=-2m | head 2") search = st.render(key=host) @@ -58,7 +58,7 @@ def test_pfsense_syslogd(record_property, setup_wordlist, setup_splunk, setup_sc mt = env.from_string( "{{mark}}{% now 'utc', '%b %d %H:%M:%S' %} syslogd: restart {{key}}\n") message = mt.render(mark="<27>", key=host) - sendsingle(message, host=setup_sc4s[0], port=setup_sc4s[1][5006]) + sendsingle(message, setup_sc4s[0], setup_sc4s[1][5006]) st = env.from_string("search index=netops sourcetype=pfsense:syslogd \"{{key}}\" earliest=-2m | head 2") search = st.render(key=host)