import React, { useEffect, useState } from 'react'; import { toast } from 'react-toastify'; import { Button, ButtonGroup, CircularProgress, Tooltip, } from "@mui/material"; import { Check as CheckIcon, OpenInNew as OpenInNewIcon, } from "@mui/icons-material"; import { green, yellow, red } from '../views/AngularWorkflow.jsx' const RunDetectionTest = (props) => { const { globalUrl, pipelines, workflows, ticketWebhook, detectionWorkflowId, changePipelineState, submitPipelineWrapper, } = props const [executions, setExecutions] = React.useState([]); const [detectionTestRunning, setDetectionTestRunning] = React.useState(false); const [detectionTestExecutionId, setDetectionTestExecutionId] = React.useState(""); useEffect(() => { if (detectionWorkflowId !== "") { handleLoadExecutions(detectionWorkflowId) } }, [detectionWorkflowId]) if (workflows === undefined || workflows === null || workflows.length === 0) { return null } const handleLoadExecutions = (workflowId, detectionTestRunning) => { const url = `${globalUrl}/api/v2/workflows/${workflowId}/executions` fetch(url, { method: "GET", headers: { "Content-Type": "application/json", Accept: "application/json", }, credentials: "include", }).then((response) => { if (response.status !== 200) { console.log("Status not 200 for getting all executions"); } return response.json(); }) .then((responseJson) => { if (responseJson.success !== false && responseJson?.executions?.length > 0) { if (detectionTestRunning === true) { console.log("Checking executions in workflow: ", workflowId, responseJson.executions) for (var executionKey in responseJson.executions) { const curExec = responseJson.executions[executionKey] if (curExec.execution_id === detectionTestExecutionId) { continue } // started_at = unix timestamp // check within the last 60 seconds const datecomparison = (Date.now() / 1000) - 60 if (curExec.started_at >= datecomparison) { if (curExec?.execution_argument?.includes("rule") && curExec?.execution_argument?.includes("Test Notepad Event")) { setDetectionTestRunning(false) setDetectionTestExecutionId(curExec.execution_id) } break; } } } else { setExecutions(responseJson.executions || []) } } }) .catch((error) => { toast(error.toString()); }) } const runDetectionTest = () => { setDetectionTestRunning(true) if (ticketWebhook === "") { setDetectionTestRunning(false) toast.error("No ticketing webhook found. Please enable the ticketing workflow first.") return } if (detectionWorkflowId === "") { setDetectionTestRunning(false) toast.error("No ticketing workflow found. Please enable the ticketing workflow first.") return } if (haveDetectionPipelines() === false) { setDetectionTestRunning(false) toast.error("No detection pipelines found. Please deploy the Syslog (TCP) & Sigma pipelines first.") return } // 1. Run a new pipeline which exits. const detectionTest = `from {message: "<165>1 2025-10-06T12:34:56.789Z myhost.example.com myapp 1234 ID47 [huh eventSource=\\\"App\\\" EventID=\\\"4688\\\" NewProcessName=\\\"notepad.exe\\\" Context=\\\"Testing\\\"] This is a test log message"} | this = message.parse_syslog() | import` for (var pipelineKey in pipelines) { const curPipeline = pipelines[pipelineKey] if (curPipeline.definition === detectionTest && changePipelineState !== undefined) { changePipelineState(curPipeline, "stop"); } } // 1. Submit it to run // 2. Check executions if they happened recently~ if (submitPipelineWrapper !== undefined) { submitPipelineWrapper(detectionTest) } for (var i = 0; i < 10; i++) { setTimeout(() => { handleLoadExecutions(detectionWorkflowId, true) }, i * 5000) } setTimeout(() => { setDetectionTestRunning(false) }, 60000) } const haveDetectionPipelines = () => { if (pipelines === undefined) { toast.warn("No pipelines found. Please create the Syslog (TCP) & Sigma pipelines first.") return false } var foundCorrect = 0 for (var pipelineKey in pipelines) { const curPipeline = pipelines[pipelineKey] //if (curPipeline?.definition?.includes("load_tcp") && curPipeline?.definition?.includes("import")) { // foundCorrect += 1 //} if (curPipeline?.definition?.includes("sigma") && curPipeline?.definition?.includes("export")) { foundCorrect += 1 } } if (foundCorrect >= 1) { return true } return false } return (
{detectionTestRunning === false && detectionTestExecutionId !== "" && detectionTestExecutionId !== undefined ? : null}
{window?.location?.href?.includes("/detections/") === true ? null : }
) } export default RunDetectionTest