microsoft / msticpy

Microsoft Threat Intelligence Security Tools
Other
1.76k stars 318 forks source link

Add jwt auth token expire check and modify some messages when connecting Splunk #770

Closed Tatsuya-hasegawa closed 5 months ago

Tatsuya-hasegawa commented 5 months ago

Hello,

I have some additional things to SplunkDriver.

The biggest one is that JWT bear_token's expiration check was implemented by using pyjwt which is already in requirement.txt. In addition, I put some distinguish messages for each auth method when connecting Splunk. And then modify an error in Splunk QueryProvider doc.

Local code check has been succeeded as following.

 % git commit -m "add jwt auth token expire check and modify some messages when connecting Splunk"
Check Yaml...........................................(no files to check)Skipped
Check JSON...........................................(no files to check)Skipped
Trim Trailing Whitespace.................................................Passed
black....................................................................Passed
pylint...................................................................Passed
flake8...................................................................Passed
isort (python)...........................................................Passed
pydocstyle...............................................................Passed
check_reqs_all...........................................................Passed
[add_token_expire_check_to_splunk_driver a4627c6f] add jwt auth token expire check and modify some messages when connecting Splunk
 3 files changed, 110 insertions(+), 39 deletions(-)

The JWT expiration time is shown by this commit.

image

This is an expire message, in this case, I modified the current time to over the expiration date forcely in order to appear this message. image

Thank you. Best regards,

Tatsuya-hasegawa commented 5 months ago

Oops, I noticed pulled my folk repository's main instead of microsoft:main before this commit. So This PR's Files Changes diff includes the previous PR #731 . The correct diff to microsoft:main is only the area of "This branch has conflicts that must be resolved" below.

I'm sorry. Kind regards,

Tatsuya-hasegawa commented 5 months ago

Got it, I have completely fixed. This PR's Files Changes diff is correct now. Best regards,

Thank you in advance for your eye, @ianhelle

Tatsuya-hasegawa commented 5 months ago

@ianhelle

Thanks for your check and the advices. I fixed them by this commit.

% git commit -m "small changes for exceptional messages"
Check Yaml...........................................(no files to check)Skipped
Check JSON...........................................(no files to check)Skipped
Trim Trailing Whitespace.................................................Passed
black....................................................................Passed
pylint...................................................................Passed
flake8...................................................................Passed
isort (python)...........................................................Passed
pydocstyle...............................................................Passed
check_reqs_all...........................................................Passed
[add_token_expire_check_to_splunk_driver eeb9df46] small changes for exceptional messages
 2 files changed, 8 insertions(+), 7 deletions(-)

Would you kindly check them again? Best regards,

Tatsuya-hasegawa commented 5 months ago

Thanks for your approval and merge.

ianhelle commented 5 months ago

@Tatsuya-hasegawa - thank you, once again for the contribution. It's awesome to have someone actively working on the Splunk support!