Skip to content

v1.20.0

Choose a tag to compare

View all tags
@simonsigre simonsigre released this 09 Feb 02:43
· 11 commits to main since this release
v1.20.0
98b2313

GoCortex Spellbook

GoCortex Spellbook v1.20

A Python toolset for building, validating, and packaging Cortex Platform content packs.

Screenshot 2026-02-09 at 13 41 26

Overview

GoCortex Spellbook is a toolset for building, validating, and packaging Cortex Platform content packs. It solves the problem of creating compliant content packs without needing to understand the intricacies of the demisto-sdk and Cortex Platform schema requirements.

  • Creates new content pack instances with correct structure
  • Generates XSIAM content templates (CorrelationRules, ParsingRules, ModelingRules)
  • Validates content against Cortex Platform schemas using demisto-sdk
  • Packages content into uploadable zip files
  • Uploads content directly to Cortex Platform instances

The demisto-sdk is powerful but complex. Spellbook wraps it in a simpler interface and provides working templates that have been verified to upload successfully.

New In This Release

Features:

  • Add summon correlation command for importing correlation rules from Cortex Platform JSON exports,
  • Add --message (-m) flag for custom commit messages when using --tag supporting CI/CD integration (e.g. auto-closing issues)
  • Add Git repository check before tag creation to prevent errors in uninitialised repositories
  • Add trigger playbook template

Improvements:

  • Standardise all CLI output to grepable format with status tags at column 0 ([OK], [ERROR], [WARN], [INFO], [PASS], [FAIL], [MISSING])
  • Add gitconfig volume mount to all Docker examples in Windows README

Disabled:

  • Temporarily disable rename-content command pending further review

Workflow Guides

Choose your preferred method and follow the corresponding guide:

Method Best For Guide
Docker (Local) Most users. No Python setup required. README_LOCAL-DOCKER.md
Source (Local) Developers who want to modify Spellbook. README_SOURCE.md
CI/CD Automated builds triggered by Git tags. README_CICD.md

Quick Start (Docker)

# Pull from GitHub Container Registry (preferred)
docker pull ghcr.io/gocortexio/spellbook:latest

# Or build locally from source
docker build -t ghcr.io/gocortexio/spellbook .

# Create a content instance
docker run --rm \
  -v $(pwd):/content \
  -v ~/.gitconfig:/home/spellbook/.gitconfig:ro \
  ghcr.io/gocortexio/spellbook init my-content --author "Your Organisation" --no-ci
  
# Initialise Git (required for validation)
cd my-content
git init
git add .
git commit -s -m "Initial commit"

Licence

This project is licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later). See the LICENSE file for the full licence text.

References

Assets 2
Loading