Skip to content

v1.22.0-beta.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@simonsigre simonsigre released this 15 Mar 10:58
· 7 commits to main since this release
v1.22.0-beta.1
1f02e4f

GoCortex Spellbook

GoCortex Spellbook v1.22.0-beta.1 - Here Be Dragons + Summon the Templates!

A Python toolset for building, validating, and packaging Cortex Platform content packs.

Overview

GoCortex Spellbook is a toolset for building, validating, and packaging Cortex Platform content packs. It solves the problem of creating compliant content packs without needing to understand the intricacies of the demisto-sdk and Cortex Platform schema requirements.

  • Creates new content pack instances with correct structure
  • Generates XSIAM content templates (CorrelationRules, ParsingRules, ModelingRules)
  • Validates content against Cortex Platform schemas using demisto-sdk
  • Packages content into uploadable zip files
  • Uploads content directly to Cortex Platform instances

The demisto-sdk is powerful but complex. Spellbook wraps it in a simpler interface and provides working templates that have been verified to upload successfully.

New In This Release

Notes:

  • v1.22.0-beta.1 will not be be marked as the LATEST image in either DockerHub or GitHub Container Registry during the beta testing.

Beta Features:

  • Add summon template command for generating content pack artefacts from self-describing templates with %%TOKEN%% placeholders and interactive/non-interactive modes
  • Add built-in intel_retrohunt template shipped with the tool and copied to instance-level templates/ directory during init for user customisation
  • Add XSIAM validation engine (xsiam_validator.py) with rules for invalid INGEST fields, simple_schedule in correlation rules, parentheses in rule names, and problematic filename characters
  • Add --message (-m) flag to bump-version and set-version for writing commit messages directly into release notes files instead of the placeholder scaffold
  • Add automatic version history section in pack README.md using HTML comment markers, updated on --tag with the commit message (newest first)
  • Add set-version command now creates release notes files (previously only bump-version did)

Beta Improvements:

  • Add non-blocking XSIAM validation as a pre-step in build, upload, bump-version, and set-version (skippable with --no-validate / --skip-validation)
  • Conditionally preserve user_defined_severity and user_defined_category in correlation imports only when the corresponding field is set to "User Defined"
  • Add error handling for UnicodeDecodeError during template rendering with user-friendly messages
  • Update demisto-sdk pinned version from 1.38.18 to 1.38.20 across Dockerfile, pyproject.toml, and CLI

Workflow Guides

Choose your preferred method and follow the corresponding guide:

Method Best For Guide
Docker (Local) Most users. No Python setup required. README_LOCAL-DOCKER.md
Source (Local) Developers who want to modify Spellbook. README_SOURCE.md
CI/CD Automated builds triggered by Git tags. README_CICD.md

Quick Start (Docker)

# Pull from GitHub Container Registry (preferred)
docker pull ghcr.io/gocortexio/spellbook:1.22.0-beta.1

# Create a content instance
docker run --rm \
  -v $(pwd):/content \
  -v ~/.gitconfig:/home/spellbook/.gitconfig:ro \
  ghcr.io/gocortexio/spellbook:1.22.0-beta.1 init my-content --author "Your Organisation" --no-ci
  
# Initialise Git (required for validation)
cd my-content
git init
git add .
git commit -s -m "Initial commit"

Licence

This project is licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later). See the LICENSE file for the full licence text.

References

Assets 2
Loading