p20319658
/
monkey
forked from p34709852/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Made some findings aggregate findings to improve readability of Findings table.

This commit is contained in:
Shay Nehmad 2019-09-01 11:44:08 +03:00
parent 1d5a4d20ce
commit 1fddd4abbf
3 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
monkey/monkey_island/cc/services/telemetry/zero_trust_tests/antivirus_existence.py
View File

@ -3,8 +3,8 @@ import json
from common.data.zero_trust_consts import EVENT_TYPE_MONKEY_LOCAL, EVENT_TYPE_ISLAND, \ from common.data.zero_trust_consts import EVENT_TYPE_MONKEY_LOCAL, EVENT_TYPE_ISLAND, \
STATUS_PASSED, STATUS_FAILED, TEST_ENDPOINT_SECURITY_EXISTS STATUS_PASSED, STATUS_FAILED, TEST_ENDPOINT_SECURITY_EXISTS
from monkey_island.cc.models import Monkey from monkey_island.cc.models import Monkey
from monkey_island.cc.models.zero_trust.aggregate_finding import AggregateFinding
from monkey_island.cc.models.zero_trust.event import Event from monkey_island.cc.models.zero_trust.event import Event
from monkey_island.cc.models.zero_trust.finding import Finding
from monkey_island.cc.services.telemetry.zero_trust_tests.known_anti_viruses import ANTI_VIRUS_KNOWN_PROCESS_NAMES from monkey_island.cc.services.telemetry.zero_trust_tests.known_anti_viruses import ANTI_VIRUS_KNOWN_PROCESS_NAMES
@ -31,7 +31,9 @@ def test_antivirus_existence(telemetry_json):
test_status = STATUS_PASSED test_status = STATUS_PASSED
else: else:
test_status = STATUS_FAILED test_status = STATUS_FAILED
Finding.save_finding(test=TEST_ENDPOINT_SECURITY_EXISTS, status=test_status, events=events) AggregateFinding.create_or_add_to_existing(
test=TEST_ENDPOINT_SECURITY_EXISTS, status=test_status, events=events
)
def filter_av_processes(telemetry_json): def filter_av_processes(telemetry_json):

8
monkey/monkey_island/cc/services/telemetry/zero_trust_tests/data_endpoints.py
View File

@ -2,8 +2,8 @@ import json
from common.data.zero_trust_consts import * from common.data.zero_trust_consts import *
from monkey_island.cc.models import Monkey from monkey_island.cc.models import Monkey
from monkey_island.cc.models.zero_trust.aggregate_finding import AggregateFinding
from monkey_island.cc.models.zero_trust.event import Event from monkey_island.cc.models.zero_trust.event import Event
from monkey_island.cc.models.zero_trust.finding import Finding
HTTP_SERVERS_SERVICES_NAMES = ['tcp-80'] HTTP_SERVERS_SERVICES_NAMES = ['tcp-80']
@ -54,19 +54,19 @@ def test_open_data_endpoints(telemetry_json):
event_type=EVENT_TYPE_ISLAND event_type=EVENT_TYPE_ISLAND
)) ))
Finding.save_finding( AggregateFinding.create_or_add_to_existing(
test=TEST_DATA_ENDPOINT_HTTP, test=TEST_DATA_ENDPOINT_HTTP,
status=found_http_server_status, status=found_http_server_status,
events=events events=events
) )
Finding.save_finding( AggregateFinding.create_or_add_to_existing(
test=TEST_DATA_ENDPOINT_ELASTIC, test=TEST_DATA_ENDPOINT_ELASTIC,
status=found_elastic_search_server, status=found_elastic_search_server,
events=events events=events
) )
Finding.save_finding( AggregateFinding.create_or_add_to_existing(
test=TEST_MALICIOUS_ACTIVITY_TIMELINE, test=TEST_MALICIOUS_ACTIVITY_TIMELINE,
status=STATUS_INCONCLUSIVE, status=STATUS_INCONCLUSIVE,
events=events events=events

3
monkey/monkey_island/cc/services/telemetry/zero_trust_tests/machine_exploited.py
View File

@ -1,5 +1,6 @@
from common.data.zero_trust_consts import * from common.data.zero_trust_consts import *
from monkey_island.cc.models import Monkey from monkey_island.cc.models import Monkey
from monkey_island.cc.models.zero_trust.aggregate_finding import AggregateFinding
from monkey_island.cc.models.zero_trust.event import Event from monkey_island.cc.models.zero_trust.event import Event
from monkey_island.cc.models.zero_trust.finding import Finding from monkey_island.cc.models.zero_trust.finding import Finding
@ -39,7 +40,7 @@ def test_machine_exploited(telemetry_json):
events=events events=events
) )
Finding.save_finding( AggregateFinding.create_or_add_to_existing(
test=TEST_MALICIOUS_ACTIVITY_TIMELINE, test=TEST_MALICIOUS_ACTIVITY_TIMELINE,
status=STATUS_INCONCLUSIVE, status=STATUS_INCONCLUSIVE,
events=events events=events