Refactor and re-enable per-field validation of risk events

Open
#252 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Refactor
Clarity
Needs clarification
Activity status
Stale
Tech stack
python
Domain
tooling

Research direction

Start by examining the per-field validation behavior and the two named risk-event examples: “Windows Steal Authentication Certificates - ESC1 Abuse” and “Windows Unusual Count Of Disabled Users Failed Auth Using Kerbero.” Determine whether sparse or computed fields should be accepted, and whether validation should be re-enabled or the issue closed without a fix.

Written by the indexing model from the issue text.

Description

  • Originally, we tried to enforce that every field seen in an observable must be an attribute in every single risk event
  • In practice this does not seem to be the case, for two different reasons
    • Sparsely populated fields (some returned search results don't have all fields, and thus those fields don't exist in some risk objects); see the 'dest' field in Windows Steal Authentication Certificates - ESC1 Abuse for an example
    • Certain computed fields, (e.g. when user is computed) may not be vailable in the risk event; see Windows Unusual Count Of Disabled Users Failed Auth Using Kerbero for an example
  • The former of these possibilities is more confusing and the solution is less clear
  • Resolution of this issue may involve closing it w/o fixing
Dominant language
Python
Stars
139
Forks
52
Avg merge
1h 16m
Merged PRs (30d)
3

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from splunk/contentctl

All issues in splunk/contentctl

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.