-
Notifications
You must be signed in to change notification settings - Fork 21
feat: add support for CIM v5.3.2 #853
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
| { | ||
| "name": "dest_type", | ||
| "type": "optional", | ||
| "comment": "The type of the destination object, such as instance, storage, firewall." | ||
| }, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you please double check if this is provided by A&I framework (similar to fields in https://github.com/splunk/pytest-splunk-addon/blob/3ee0404aa07cd56ee67063c4c86aaeaeb3dbb7be/pytest_splunk_addon/standard_lib/cim_tests/CommonFields.json)?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
dest_type is not provided by A&I framework, so all fields in https://github.com/splunk/pytest-splunk-addon/blob/3ee0404aa07cd56ee67063c4c86aaeaeb3dbb7be/pytest_splunk_addon/standard_lib/cim_tests/CommonFields.json have the same in description if they are provided by A&I or not.
pytest_splunk_addon/standard_lib/data_models/Network_Traffic.json
Outdated
Show resolved
Hide resolved
pytest_splunk_addon/standard_lib/data_models/Network_Traffic.json
Outdated
Show resolved
Hide resolved
pytest_splunk_addon/standard_lib/data_models/Network_Traffic.json
Outdated
Show resolved
Hide resolved
pytest_splunk_addon/standard_lib/data_models/Network_Traffic.json
Outdated
Show resolved
Hide resolved
| "name": "result", | ||
| "type": "optional", | ||
| "expected_values": ["lockout"], | ||
| "condition": "status=failure", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this is supposed to be the literal string the vendor uses in the log so there no constraint on what may be present.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So we mark it as optional? @justin-splunk
or keep it required but not keep the condition?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The result provides the reason of the action's failure, so I suggest:
- if the
status=failure, then theresultis required (yes it may not always be present in the raw, but it will prompt the SME to investigate why theactionfailed - directly from the raw or indirectly from the vendor docs). - if the
status=success, theresultis optional.
Is this the current logic?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@alexeisuv
So current condition is that if status=failure then result should be required, else it is optional
pytest_splunk_addon/standard_lib/data_models/Intrusion_Detection.json
Outdated
Show resolved
Hide resolved
pytest_splunk_addon/standard_lib/data_models/Network_Traffic.json
Outdated
Show resolved
Hide resolved
|
🎉 This PR is included in version 5.3.0-beta.6 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
|
🎉 This issue has been resolved in version 5.4.0-beta.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Added support for cim v5.3.2.
Detailed comparison and analysis between v4.15.0 and v5.3.2 can be found here: https://docs.google.com/spreadsheets/d/1ZFDC0Efn-bHvcU1Qy78s95GCfWyxt6IUhTv94j3yagk/edit#gid=1147250948