diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 7003bdeae..3c127037c 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -2,7 +2,7 @@ name: Docker on: push: - branches: [main] + branches: [scoutsuite-gcp] jobs: build-backend: @@ -31,12 +31,12 @@ jobs: build-args: | COPILOT_API_KEY=${{ secrets.COPILOT_API_KEY }} - - name: Notify Discord - uses: appleboy/discord-action@v1.0.0 - with: - webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }} - webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }} - message: "Docker image for backend has been updated." + # - name: Notify Discord + # uses: appleboy/discord-action@v1.0.0 + # with: + # webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }} + # webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }} + # message: "Docker image for backend has been updated." build-frontend: runs-on: ubuntu-latest @@ -62,9 +62,9 @@ jobs: push: true tags: ghcr.io/socfortress/copilot-frontend:latest - - name: Notify Discord - uses: appleboy/discord-action@v1.0.0 - with: - webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }} - webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }} - message: "Docker image for frontend has been updated." + # - name: Notify Discord + # uses: appleboy/discord-action@v1.0.0 + # with: + # webhook_id: ${{ secrets.DISCORD_WEBHOOK_ID }} + # webhook_token: ${{ secrets.DISCORD_WEBHOOK_TOKEN }} + # message: "Docker image for frontend has been updated." diff --git a/backend/app/integrations/markdown/bitdefender.md b/backend/app/integrations/markdown/bitdefender.md index 1dfe620ed..6a5106de9 100644 --- a/backend/app/integrations/markdown/bitdefender.md +++ b/backend/app/integrations/markdown/bitdefender.md @@ -59,45 +59,4 @@ You should now see the container running. ## Test the Connector -[Helpful Doc](https://support.netenrich.com/hc/en-us/articles/10833633251869-Bitdefender-Gravity-Zone-Cloud-integration#:~:text=155.173,Configure%20Chronicle%20Forwarder) - -Use the following cURL command to send the test payload to the collector service you have just configured: - -Replace `YOUR_AUTH_HEADER` with the base64 (https://www.blitter.se/utils/basic-authentication-header-generator/) encoded string of `username:password` and `REPLACE_WITH_YOUR_WEBSERVER` with the public DNS name you configured. - -### NOTE: This only tests that your endpoint is reachable and that the logs are being sent to the endpoint. You will need to verify that the logs are being sent to the Graylog server. - -```bash -curl -k -H 'Authorization: Basic YOUR_AUTH_HEADER' -H "Content-Type: application/json" -d -'{"cef": "0","events": -["CEF:0|Bitdefender|GravityZone|6.4.08|70000|Registration|3|BitdefenderGZModule=registrationd -vchost=TEST_ENDPOINTasdadBitdefenderGZComputerFQDN=test.example.com -dvc=192.168.1.2","CEF:0|Bitdefender|GravityZone|6.4.0-8|35| -Product ModulesStatus|5|BitdefenderGZModule=modules -dvchost=TEST_ENDPOINTasdadBitdefenderGZComputerFQDN=test.example.com -dvc=192.168.1.2","CEF:0|Bitdefender|GravityZone|6.4.0-8|35| -Product ModulesStatus|5|BitdefenderGZModule=modules -dvchost=TEST_ENDPOINTasdadBitdefenderGZComputerFQDN=test.example.com dvc=192.168.1.2"]}' -https://REPLACE_WITH_YOUR_WEBSERVER:3200/api -``` - -Now that the HTTPS collector service is running and listening for messages, we can test the service by sending a test message to the BitDefender service. Use the following cURL command to send the test payload to the collector service you have just configured: - -Replace `YOUR_BITDEFENDER_API_KEY` with the BitDefender API key with the base64 encoded string of `API_KEY` followed by a colon `:`. For example, if the API key is `test`, the value I would base64 encode would be `test:`. Replace `REPLACE_WITH_YOUR_WEBSERVER` with the public DNS name you configured. - -```bash -$ curl --tlsv1.2 -sS -k -X POST \ -https://cloud.gravityzone.bitdefender.com/api/v1.0/jsonrpc/push \ --H 'authorization: Basic YOUR_BITDEFENDER_API_KEY' \ --H 'cache-control: no-cache' \ --H 'content-type: application/json' \ --d '{"id":"1","jsonrpc":"2.0","method":"setPushEventSettings", -"params":{"serviceSettings":{"requireValidSslCertificate":false,"authorization":"Basic -dGVzdDp0ZXN0","url":"https://REPLACE_WITH_YOUR_WEBSERVER:3200/api"},"serviceType":"jsonRPC","status":1, -"subscribeToEventTypes":{"adcloudgz":true,"antiexploit":true,"aph":true,"av":true,"avc":true,"dp":true, -"endpoint-moved-in":true,"endpoint-moved-out":true,"exchange-malware":true, -"exchange-user-credentials":true,"fw":true,"hd":true,"hwid-change":true,"install":true,"modules":true, -"network-monitor":true,"network-sandboxing":true,"new-incident":true,"ransomware-mitigation":true, -"registration":true,"supa-update-status":true,"sva":true,"sva-load":true,"task-status":true, -"troubleshooting-activity":true,"uc":true,"uninstall":true}}}' -``` +[Helpful Doc For Testing](https://support.netenrich.com/hc/en-us/articles/10833633251869-Bitdefender-Gravity-Zone-Cloud-integration#:~:text=155.173,Configure%20Chronicle%20Forwarder)