Repository navigation
Fix Failing Integration Tests - #4338
Conversation
referneced in findings/intermediate findings. caused integration tests to fail
pyth0n1c
changed the title
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 893481728c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…//github.com/splunk/security_content into fix_missing_fields_failing_integration_tests
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e8b4e1be6c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
2 participants
Thanks to @tjgeorgen for finding these fixes!
This PR will track a number of integration test failures that have been exposed by the new testing subsystem.
Errors (which require STRT Feedback)
The following detection has a Threat Object whose value in the raw event is literally:
Is this intended? Do we want to use this field as a threat object, generate new data where this field IS populated, or choose something else?
Detection:
security_content/detections/cloud/asl_aws_ecr_container_upload_unknown_user.yml
Line 43 in c653da7
Raw Data Link: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/asl_ocsf_cloudtrail.json
Raw Data Value:
src_endpoint.ip renamed as src in the search itselfError Message:
Errors (with proposed fixes)
These two detections use the field
Imagein an Intermediate Finding Entity Message, but this field is not exposed by the search:This Detection references the field
userin an Intermediate Finding Entity Message, but this field is not exposed by the search:Do not merge yet, as other fixes are incoming and will be documented per-file in the PR.