secureworks / atomic-harness Goto Github PK

If we have a web app that has access to the criteria CSV files and atomic YAML files (perhaps in a docker container), we can provide a method to select a test and view the criteria. We can edit the criteria in a text box, and the web-app can save to the CSV file.

Make it easy to click Next and go through many similar tests to add/edit criteria.

We need tool(s) to help quickly generate expected telemetry criteria from the atomic test scripts.

• read in atomic YAML files
• For tests that don't have criteria, should at least be able to determine which process events are expected to be present. Ideally, using the input_arguments in the matching.
• perhaps for input arguments that contain file_name or file_path we can determine if there is a file modification event as well
• tests that contain curl or wget or rsync or ssh or scp, we can probably determine the netflow host and port

We followed Invoke-Atomic's lead when referencing atomic tests using their index in the YAML file. However, recent commits have inserted new tests inside the files, changing the indices. Thus we need to switch to reference by partial SHA (8 chars?), with a fallback to index.
redcanaryco/atomic-red-team#2416

Currently the atomic-validation-criteria for MacOS and Windows is close to nothing. We need a way to show coverage percentage of the number of atomic tests that have criteria.

coverage

• read in atomics/Index CSV files
• read in criteria CSV files and generate a list of platform N/M test criteria coverage.