Generic EDR Add-On for Splunk

こんにちわ！

Some notes

• Built without referencing a running Splunk or EDR platform.
• Only tested ad-hoc requests with simple FastAPI listener (see other folder.)
• Learned about some new/changed libraries
  • solnlib is now open source!
  • dataclasses are great, JSONWizard is a lifesaver.

Components

• genedr: Python library for Generic EDR
• TA-generic_edr: Implements genedr to query and index alerts in Splunk
• Various libs as seen in pyproject.toml

The Future

Assuming the TA is in working order and pulling in alerts fine...

• TESTS
• Packaging build/release (ksconf, slim)