Merge develop branch to main for version 4.0.3

CHANGELOG.md

@@ -1,3 +1,11 @@
+# Version 4.0.3
+* Fix - problem loading some inputs on Windows system. [Issue #8](https://github.com/splunk/splunk-add-on-microsoft-azure/issues/8) and [Issue #12](https://github.com/splunk/splunk-add-on-microsoft-azure/issues/12)
+* Added `name` parameter to the `[id]` stanza in `default/app.conf`
+* Bumped `splunktaucclib` to version `6.0.6` to address potential credential corruption issues
+* Fix - errant newline in `eventtypes.conf` for `azure_vuln` stanza. [Issue #19](https://github.com/splunk/splunk-add-on-microsoft-azure/issues/19)
+* Fix - nextLink parameter is different for consumption input causing limited results. [Issue #20](https://github.com/splunk/splunk-add-on-microsoft-azure/issues/20)
+* Increase REST request timeout to 60 seconds
+
 # Version 4.0.2
 * Bug fix - Problem creating new AAD Audit Input - [Issue #3](https://github.com/splunk/splunk-add-on-microsoft-azure/issues/3)
 * Bug fix - Azure AD User and Group pagination issue

README.md

@@ -12,7 +12,7 @@ This add-on is built with Splunk's [UCC Generator](https://github.com/splunk/add
 
 Example:
 
-    ucc-gen --ta-version=4.0.2
+    ucc-gen --ta-version=4.0.3
 
 The add-on will be built in an `output` directory in the root of the repository.
 

globalConfig.json

@@ -2,7 +2,7 @@
     "meta": {
         "name": "TA-MS-AAD",
         "displayName": "Splunk Add-on for Microsoft Azure",
-        "version": "4.0.2",
+        "version": "4.0.3",
         "apiVersion": "3.0.0",
         "restRoot": "TA_MS_AAD",
         "schemaVersion": "0.0.3"

package/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null,
       "name": "TA-MS-AAD",
-      "version": "4.0.2"
+      "version": "4.0.3"
     },
     "author": [
       {

package/bin/azure_consumption.py

@@ -52,7 +52,7 @@ def get_start_date(helper, check_point_key):
         start_date = helper.get_arg("start_date")
         if (start_date not in [None,'']):
             d = dateutil.parser.parse(start_date)
-            helper.log_debug("_Splunk_ input_name=%s Getting start date. input_name=%s Start date in stanza: %s" % (input_name, start_date))
+            helper.log_debug("_Splunk_ input_name=%s Getting start date. input_name=%s Start date in stanza: %s" % (input_name, input_name, start_date))
             return d.strftime('%Y-%m-%d')
         else:
             # If there was no start date specified, default to 90 day ago

package/bin/import_declare_test.py

@@ -17,7 +17,6 @@
 
 '''
 import os
-import pwd
 import sys
 
 import warnings

package/bin/ta_azure_utils/utils.py

@@ -26,7 +26,7 @@
 from requests.packages.urllib3.util.retry import Retry
 import six
 
-TIMEOUT = 5 #seconds
+TIMEOUT = 60 #seconds
 
 def handle_nextLink(helper=None, response=None, session=None):
     if '@odata.nextLink' in response:
@@ -74,14 +74,19 @@ def get_items(helper, access_token, url, items=[]):
         response_json = json.loads(r.content)
         items += response_json['value']
 
+        nextLink = None
         if '@odata.nextLink' in response_json:
             nextLink = response_json['@odata.nextLink']
 
+        if 'nextLink' in response_json:
+            nextLink = response_json['nextLink']
+
+        if nextLink:
             # This should never happen, but just in case...
             if not is_https(nextLink):
                 raise ValueError("nextLink scheme is not HTTPS. nextLink URL: %s" % nextLink)
 
-            helper.log_debug("_Splunk_ nextLink URL (@odata.nextLink): %s" % nextLink)
+            helper.log_debug("_Splunk_ nextLink URL: %s" % nextLink)
             get_items(helper, access_token, nextLink, items)
 
     except Exception as e:
@@ -123,11 +128,11 @@ def get_items_batch_session(helper=None, url=None, session=None):
 
     return response_json
 
-def post_items_batch_session(helper=None, url=None, headers=None, data=None, session=None):
+def post_items_batch_session(helper=None, url=None, headers=None, data=None, session=None, verify=False):
 
     t0 = time.time()
     try:
-        r = requests_retry_session(session=session).post(url=url, headers=headers, data=data, timeout=TIMEOUT)
+        r = requests_retry_session(session=session).post(url=url, headers=headers, data=data, timeout=TIMEOUT, verify=verify)
         r.raise_for_status()
         response_json = None
         response_json = json.loads(r.content)

package/default/app.conf

@@ -21,3 +21,5 @@ reload.ta_ms_aad_account = simple
 reload.ta_ms_aad_settings = simple
 reload.passwords = simple
 
+[id]
+name = TA-MS-AAD

package/default/eventtypes.conf

@@ -36,5 +36,4 @@ search = sourcetype="azure:vm:stop"
 search = sourcetype="m365:group:member:add"
 
 [azure_vuln]
-search = (sourcetype=azure:resourcegraph type="microsoft.security/assessments/subAssessments" "properties.additionalData.assessedResourceType"=ServerVulnerability 
-properties.additionalData.cve{}.title=*)
+search = (sourcetype=azure:resourcegraph type="microsoft.security/assessments/subAssessments" "properties.additionalData.assessedResourceType"=ServerVulnerability properties.additionalData.cve{}.title=*)

package/lib/requirements.txt

@@ -1,3 +1,3 @@
-splunktaucclib>=4.1.0
+splunktaucclib>=6.0.6
 python-dateutil>=2.8.2
 six>=1.16.0