chore(release): making a new release v6.0.0 #898

dvarasani-crest · 2025-02-05T10:00:24Z

contains below PRs:

Updated 2 fields in Network Resolution model. - Added expected values for reply_code_id which has corresponding reply_code. - Added expected values for reply_code.

Added cim models for v5.3.1 and v5.3.2 Created a runbook:https://docs.google.com/document/d/1sOG0FWM9StzgNJx4tYzsX4Tur33D91V59v3SObrXvks/edit

Added support for cim v5.3.2. - Updated data-models with new child data set in various models. - Updated required fields with updated values as per v5.3.2. - Added optional fields as per v5.3.2 Detailed comparison and analysis between v4.15.0 and v5.3.2 can be found here: https://docs.google.com/spreadsheets/d/1ZFDC0Efn-bHvcU1Qy78s95GCfWyxt6IUhTv94j3yagk/edit#gid=1147250948

Added new data models: - Compute_Inventory - Data_Access - Databases - Event_Signatures - Interprocess Messaging - JVM - Performance - Ticket_Management Updated version in requirement_test_datamodel_tag_constants.py file

This PR removes the feature of generating cim-field-report. ref: [ADDON-73385](https://splunk.atlassian.net/browse/ADDON-73385) NOTE: - moved unit test file (test_report.py) of cim-compliance report generation test from test_tools folder to test_utilities

Added changes based on CIM 6.0.0 and CIM 5.3.2 changes Added Session ID in Authentication Model: https://cd.splunkdev.com/EnterpriseSecurity/sa-commoninformationmodel/-/merge_requests/545 Signature field description change in Intrusion Detection Model: https://cd.splunkdev.com/EnterpriseSecurity/sa-commoninformationmodel/-/merge_requests/542 Protocol Version description change in Network Traffic Model: https://cd.splunkdev.com/EnterpriseSecurity/sa-commoninformationmodel/-/merge_requests/544 Power field description change in Performance Model: https://cd.splunkdev.com/EnterpriseSecurity/sa-commoninformationmodel/-/merge_requests/543

chore: Downgrading Ubuntu version as python 3.7 is no longer supported on latest

- Update datamodel definition for CIM v5.3.2 according to the [sheet](https://docs.google.com/spreadsheets/d/1ZFDC0Efn-bHvcU1Qy78s95GCfWyxt6IUhTv94j3yagk/edit?gid=1873743384#gid=1873743384) - Add datamodel definition for CIM v6.0.0 - Update copyright year

This PR fixes the issue with the token replacement for the fields defined under `other_mappings` for the sample event. - Updated the e2e tests to cover the token replacement scenario for `other_mappings`

justin-splunk · 2025-02-12T20:38:28Z

.github/workflows/build-test-release.yml

@@ -15,7 +15,7 @@ concurrency:

 jobs:
  meta:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04


tagging latest is not a great plan for compatibility so this is a good change.

justin-splunk · 2025-02-12T20:40:07Z

pytest_splunk_addon/CIM_Models/datamodel_definition.py

-                "dest_nt_domain",
-                "src_nt_domain",
-                "src_user",
-                "src_user_name",


why are we removing this? looks like it's still here https://docs.splunk.com/Documentation/CIM/6.0.2/User/Change

It was decided that the CIM datamodel jsons should be considered as single source of truth (reference) and the fields user_name and src_user_name are optional and not marked as recommended.

pytest_splunk_addon/CIM_Models/datamodel_definition.py

justin-splunk · 2025-02-12T20:43:24Z

pytest_splunk_addon/CIM_Models/datamodel_definition.py

 }
+
+datamodels["latest"] = datamodels["6.0.0"]


should we be using a latest tag?

latest tag is being used when the sample event does not define which cim version to use and we pin it to the latest version that we support in the PSA.

justin-splunk · 2025-02-12T20:47:22Z

pytest_splunk_addon/data_models/Change.json

-          "type": "optional",
-          "expected_values": ["lockout"],
+          "condition": "status=failure",
+          "type": "conditional",


what is the meaning of type= conditional

It means that the field is required under certain condition and the condition is also defined.

justin-splunk · 2025-02-12T20:50:56Z

pytest_splunk_addon/data_models/Endpoint.json

          "type": "optional",
+          "comment": "Original name of the file, not including path."


Original name of the file, not including path. Sometimes this field is similar to process name but the two do not always match, such as process_name=pwsh and original_file_name=powershell.exe to detect renamed instances of any process executing. per https://docs.splunk.com/Documentation/CIM/6.0.0/User/Endpoint

This align with the description here. Also, these comments are not being used anywhere in the PSA tests.

justin-splunk · 2025-02-12T20:52:03Z

pytest_splunk_addon/data_models/Endpoint.json

@@ -263,7 +329,7 @@
        },
        {
          "name": "file_size",
-          "type": "optional",
+          "type": "required",


recommended not required per https://docs.splunk.com/Documentation/CIM/6.0.0/User/Endpoint

It was decided here with alexei to keep this field for the "Filesystem" dataset as required

justin-splunk

a couple questions. also, 6.0.1 and 6.0.2 have been released, why aren't we working on that version?

pytest_splunk_addon/data_models/Change.json

pytest_splunk_addon/data_models/Network_Resolution.json

This PR updates the condition for the object_category field of the Change DataModel. Added e2e tests to cover this check.

props.conf had invalid syntax using line breakers (issue reported here: https://splunk.atlassian.net/browse/ADDON-72549 ). The incorrect format is causing warnings in the splunkd log, which could be easily prevented by correcting the props conf file like in this [example](https://github.com/splunk/splunk-add-on-for-microsoft-cloud-services/pull/1196/files). Related Jira: https://splunk.atlassian.net/browse/ADDON-77954 Example local run: <img width="1707" alt="image" src="https://github.com/user-attachments/assets/33e5247b-0f93-494c-9685-a48ddfb43a67" />

harshilgajera-crest and others added 7 commits February 5, 2025 15:20

feat: updating network resolution model (#844)

b6f4151

Updated 2 fields in Network Resolution model. - Added expected values for reply_code_id which has corresponding reply_code. - Added expected values for reply_code.

feat: updating cim model definitions (#856)

854f7b0

Added cim models for v5.3.1 and v5.3.2 Created a runbook:https://docs.google.com/document/d/1sOG0FWM9StzgNJx4tYzsX4Tur33D91V59v3SObrXvks/edit

feat: adding new data models (#863)

30f133b

Added new data models: - Compute_Inventory - Data_Access - Databases - Event_Signatures - Interprocess Messaging - JVM - Performance - Ticket_Management Updated version in requirement_test_datamodel_tag_constants.py file

chore: downgrade ubuntu version (#897)

26682ae

chore: Downgrading Ubuntu version as python 3.7 is no longer supported on latest

dvarasani-crest changed the title ~~chore(release): making a new release~~ chore(release): making a new release v6.0.0 Feb 5, 2025

renovate bot and others added 4 commits February 5, 2025 15:58

chore: update copyright year

d272719

chore: update copyright year

fb0a6d8

fix: token replacement for other mappings (#892)

5af628c

This PR fixes the issue with the token replacement for the fields defined under `other_mappings` for the sample event. - Updated the e2e tests to cover the token replacement scenario for `other_mappings`

dvarasani-crest requested review from siddharth-khatsuriya, harshilgajera-crest, alexeisuv and justin-splunk February 12, 2025 07:08

dvarasani-crest marked this pull request as ready for review February 12, 2025 07:08

dvarasani-crest requested a review from a team as a code owner February 12, 2025 07:08

justin-splunk reviewed Feb 12, 2025

View reviewed changes

pytest_splunk_addon/CIM_Models/datamodel_definition.py Show resolved Hide resolved

justin-splunk reviewed Feb 12, 2025

View reviewed changes

alexeisuv requested changes Feb 12, 2025

View reviewed changes

pytest_splunk_addon/data_models/Change.json Outdated Show resolved Hide resolved

pytest_splunk_addon/data_models/Network_Resolution.json Show resolved Hide resolved

alexeisuv previously approved these changes Feb 13, 2025

View reviewed changes

fix: update field validation condition (#900)

68f5330

This PR updates the condition for the object_category field of the Change DataModel. Added e2e tests to cover this check.

dvarasani-crest dismissed alexeisuv’s stale review via 68f5330 February 14, 2025 07:06

alexeisuv approved these changes Feb 19, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(release): making a new release v6.0.0 #898

chore(release): making a new release v6.0.0 #898

dvarasani-crest commented Feb 5, 2025 •

edited

Loading

justin-splunk Feb 12, 2025

justin-splunk Feb 12, 2025

dvarasani-crest Feb 13, 2025

justin-splunk Feb 12, 2025

dvarasani-crest Feb 13, 2025

justin-splunk Feb 12, 2025

dvarasani-crest Feb 13, 2025

justin-splunk Feb 12, 2025

dvarasani-crest Feb 13, 2025

justin-splunk Feb 12, 2025

dvarasani-crest Feb 13, 2025 •

edited

Loading

justin-splunk left a comment

		"type": "optional",
		"comment": "Original name of the file, not including path."

		}

		datamodels["latest"] = datamodels["6.0.0"]

chore(release): making a new release v6.0.0 #898

Are you sure you want to change the base?

chore(release): making a new release v6.0.0 #898

Conversation

dvarasani-crest commented Feb 5, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dvarasani-crest Feb 13, 2025 • edited Loading

Choose a reason for hiding this comment

justin-splunk left a comment

Choose a reason for hiding this comment

dvarasani-crest commented Feb 5, 2025 •

edited

Loading

dvarasani-crest Feb 13, 2025 •

edited

Loading