Skip to content

Commit

Permalink
remove bash commands from markdown was causing DB to crash
Browse files Browse the repository at this point in the history
  • Loading branch information
taylorwalton committed Sep 11, 2024
1 parent c45f1ec commit 76469ee
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 55 deletions.
26 changes: 13 additions & 13 deletions .github/workflows/docker.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: Docker

on:
push:
branches: [main]
branches: [scoutsuite-gcp]

jobs:
build-backend:
Expand Down Expand Up @@ -31,12 +31,12 @@ jobs:
build-args: |
COPILOT_API_KEY=${{ secrets.COPILOT_API_KEY }}
- name: Notify Discord
uses: appleboy/discord-action@v1.0.0
with:
webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }}
webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}
message: "Docker image for backend has been updated."
# - name: Notify Discord
# uses: appleboy/discord-action@v1.0.0
# with:
# webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }}
# webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}
# message: "Docker image for backend has been updated."

build-frontend:
runs-on: ubuntu-latest
Expand All @@ -62,9 +62,9 @@ jobs:
push: true
tags: ghcr.io/socfortress/copilot-frontend:latest

- name: Notify Discord
uses: appleboy/discord-action@v1.0.0
with:
webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }}
webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}
message: "Docker image for frontend has been updated."
# - name: Notify Discord
# uses: appleboy/discord-action@v1.0.0
# with:
# webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }}
# webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}
# message: "Docker image for frontend has been updated."
43 changes: 1 addition & 42 deletions backend/app/integrations/markdown/bitdefender.md
Original file line number Diff line number Diff line change
Expand Up @@ -59,45 +59,4 @@ You should now see the container running.

## Test the Connector

[Helpful Doc](https://support.netenrich.com/hc/en-us/articles/10833633251869-Bitdefender-Gravity-Zone-Cloud-integration#:~:text=155.173,Configure%20Chronicle%20Forwarder)

Use the following cURL command to send the test payload to the collector service you have just configured:

Replace `YOUR_AUTH_HEADER` with the base64 (https://www.blitter.se/utils/basic-authentication-header-generator/) encoded string of `username:password` and `REPLACE_WITH_YOUR_WEBSERVER` with the public DNS name you configured.

### NOTE: This only tests that your endpoint is reachable and that the logs are being sent to the endpoint. You will need to verify that the logs are being sent to the Graylog server.

```bash
curl -k -H 'Authorization: Basic YOUR_AUTH_HEADER' -H "Content-Type: application/json" -d
'{"cef": "0","events":
["CEF:0|Bitdefender|GravityZone|6.4.08|70000|Registration|3|BitdefenderGZModule=registrationd
vchost=TEST_ENDPOINTasdadBitdefenderGZComputerFQDN=test.example.com
dvc=192.168.1.2","CEF:0|Bitdefender|GravityZone|6.4.0-8|35|
Product ModulesStatus|5|BitdefenderGZModule=modules
dvchost=TEST_ENDPOINTasdadBitdefenderGZComputerFQDN=test.example.com
dvc=192.168.1.2","CEF:0|Bitdefender|GravityZone|6.4.0-8|35|
Product ModulesStatus|5|BitdefenderGZModule=modules
dvchost=TEST_ENDPOINTasdadBitdefenderGZComputerFQDN=test.example.com dvc=192.168.1.2"]}'
https://REPLACE_WITH_YOUR_WEBSERVER:3200/api
```

Now that the HTTPS collector service is running and listening for messages, we can test the service by sending a test message to the BitDefender service. Use the following cURL command to send the test payload to the collector service you have just configured:

Replace `YOUR_BITDEFENDER_API_KEY` with the BitDefender API key with the base64 encoded string of `API_KEY` followed by a colon `:`. For example, if the API key is `test`, the value I would base64 encode would be `test:`. Replace `REPLACE_WITH_YOUR_WEBSERVER` with the public DNS name you configured.

```bash
$ curl --tlsv1.2 -sS -k -X POST \
https://cloud.gravityzone.bitdefender.com/api/v1.0/jsonrpc/push \
-H 'authorization: Basic YOUR_BITDEFENDER_API_KEY' \
-H 'cache-control: no-cache' \
-H 'content-type: application/json' \
-d '{"id":"1","jsonrpc":"2.0","method":"setPushEventSettings",
"params":{"serviceSettings":{"requireValidSslCertificate":false,"authorization":"Basic
dGVzdDp0ZXN0","url":"https://REPLACE_WITH_YOUR_WEBSERVER:3200/api"},"serviceType":"jsonRPC","status":1,
"subscribeToEventTypes":{"adcloudgz":true,"antiexploit":true,"aph":true,"av":true,"avc":true,"dp":true,
"endpoint-moved-in":true,"endpoint-moved-out":true,"exchange-malware":true,
"exchange-user-credentials":true,"fw":true,"hd":true,"hwid-change":true,"install":true,"modules":true,
"network-monitor":true,"network-sandboxing":true,"new-incident":true,"ransomware-mitigation":true,
"registration":true,"supa-update-status":true,"sva":true,"sva-load":true,"task-status":true,
"troubleshooting-activity":true,"uc":true,"uninstall":true}}}'
```
[Helpful Doc For Testing](https://support.netenrich.com/hc/en-us/articles/10833633251869-Bitdefender-Gravity-Zone-Cloud-integration#:~:text=155.173,Configure%20Chronicle%20Forwarder)

0 comments on commit 76469ee

Please sign in to comment.