grapl-security / grapl

Graph platform for Detection and Response
https://www.graplsecurity.com
Apache License 2.0
686 stars 78 forks source link

A number of debug-ability improvements for analyzers, and a few bugfixes here and there #2106

Closed wimax-grapl closed 2 years ago

wimax-grapl commented 2 years ago

I've been trying to figure out why suspicious_svchost doesn't work. I still don't know why it fails.

But: I've found a few errors along the way and wanted to get this work in.

  1. def into_graph_query(self) -> GraphQuery: was failing because we didn't include the neighbor queries.
  2. sometimes we'd get timeouts waiting for analyzer/generators to work, so I bumped their timeouts.
  3. some work on propagating trace ids
codecov[bot] commented 2 years ago

Codecov Report

Base: 35.85% // Head: 41.27% // Increases project coverage by +5.41% :tada:

Coverage data is based on head (2e6c4e5) compared to base (637ea1c). Patch coverage: 0.00% of modified lines in pull request are covered.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #2106 +/- ## ========================================== + Coverage 35.85% 41.27% +5.41% ========================================== Files 301 408 +107 Lines 5430 9939 +4509 ========================================== + Hits 1947 4102 +2155 - Misses 3483 5837 +2354 ``` | [Impacted Files](https://codecov.io/gh/grapl-security/grapl/pull/2106?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security) | Coverage Δ | | |---|---|---| | [...n-sdk/grapl\_plugin\_sdk/analyzer/query\_and\_views.py](https://codecov.io/gh/grapl-security/grapl/pull/2106/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security#diff-c3JjL3B5dGhvbi9ncmFwbC1wbHVnaW4tc2RrL2dyYXBsX3BsdWdpbl9zZGsvYW5hbHl6ZXIvcXVlcnlfYW5kX3ZpZXdzLnB5) | `0.00% <0.00%> (ø)` | | | [...ugin-sdk/grapl\_plugin\_sdk/analyzer/service\_impl.py](https://codecov.io/gh/grapl-security/grapl/pull/2106/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security#diff-c3JjL3B5dGhvbi9ncmFwbC1wbHVnaW4tc2RrL2dyYXBsX3BsdWdpbl9zZGsvYW5hbHl6ZXIvc2VydmljZV9pbXBsLnB5) | `0.00% <0.00%> (ø)` | | | [...thon\_proto/api/graph\_query\_proxy/v1beta1/client.py](https://codecov.io/gh/grapl-security/grapl/pull/2106/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security#diff-c3JjL3B5dGhvbi9weXRob24tcHJvdG8vcHl0aG9uX3Byb3RvL2FwaS9ncmFwaF9xdWVyeV9wcm94eS92MWJldGExL2NsaWVudC5weQ==) | `0.00% <0.00%> (ø)` | | | [...n\_proto/api/plugin\_sdk/analyzers/v1beta1/server.py](https://codecov.io/gh/grapl-security/grapl/pull/2106/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security#diff-c3JjL3B5dGhvbi9weXRob24tcHJvdG8vcHl0aG9uX3Byb3RvL2FwaS9wbHVnaW5fc2RrL2FuYWx5emVycy92MWJldGExL3NlcnZlci5weQ==) | `0.00% <ø> (ø)` | | | [src/python/python-proto/python\_proto/metadata.py](https://codecov.io/gh/grapl-security/grapl/pull/2106/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security#diff-c3JjL3B5dGhvbi9weXRob24tcHJvdG8vcHl0aG9uX3Byb3RvL21ldGFkYXRhLnB5) | `0.00% <0.00%> (ø)` | | | [src/rust/graph-query/src/node\_query.rs](https://codecov.io/gh/grapl-security/grapl/pull/2106/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security#diff-c3JjL3J1c3QvZ3JhcGgtcXVlcnkvc3JjL25vZGVfcXVlcnkucnM=) | `0.00% <0.00%> (ø)` | | | [src/rust/graph-query/src/property\_query.rs](https://codecov.io/gh/grapl-security/grapl/pull/2106/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security#diff-c3JjL3J1c3QvZ3JhcGgtcXVlcnkvc3JjL3Byb3BlcnR5X3F1ZXJ5LnJz) | `0.00% <ø> (ø)` | | | [...c/graplinc/grapl/api/graph\_query/v1beta1/server.rs](https://codecov.io/gh/grapl-security/grapl/pull/2106/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security#diff-c3JjL3J1c3QvcnVzdC1wcm90by9zcmMvZ3JhcGxpbmMvZ3JhcGwvYXBpL2dyYXBoX3F1ZXJ5L3YxYmV0YTEvc2VydmVyLnJz) | `0.00% <0.00%> (ø)` | | | [...linc/grapl/api/graph\_query\_proxy/v1beta1/server.rs](https://codecov.io/gh/grapl-security/grapl/pull/2106/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security#diff-c3JjL3J1c3QvcnVzdC1wcm90by9zcmMvZ3JhcGxpbmMvZ3JhcGwvYXBpL2dyYXBoX3F1ZXJ5X3Byb3h5L3YxYmV0YTEvc2VydmVyLnJz) | `0.00% <0.00%> (ø)` | | | [...rust-proto/src/graplinc/grapl/api/graph/v1beta1.rs](https://codecov.io/gh/grapl-security/grapl/pull/2106/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security#diff-c3JjL3J1c3QvcnVzdC1wcm90by9zcmMvZ3JhcGxpbmMvZ3JhcGwvYXBpL2dyYXBoL3YxYmV0YTEucnM=) | `51.14% <0.00%> (ø)` | | | ... and [107 more](https://codecov.io/gh/grapl-security/grapl/pull/2106/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security) | | Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=grapl-security)

:umbrella: View full report at Codecov.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.