contentctl v4.4.0 #179

pyth0n1c · 2024-07-02T19:29:32Z

~~Prep for release v4.2~~
This branch has been remapped to ~~4.3.~~ 4.4.0

4.2 ~~will~~ contained only the release version of the data_source implementation

This means a failed container will no longer hang the test command

This is consistent with the validation check that allows no tests if status=experimental

Updated validator for "tests" so that it always runs, even if no tests are provided. without adding always=True, it fails to catch missing tests. Also, ensure that we run against the .value of the enumeration, not the enum object itself. This is required since The Pydantic config use_enum_values = True

Allow absent tests for experimental detections

Update new content generator with new formats

Handle stopped containers in testing

templates. Write the proper name of the app into the request.ui_dispatch_app values of savedsearches detections, baselines, and investigations. Other jinja2 changes are to cope with passing in the entire app object, not just the APP_NAME (which was actually the app.label field).

dashboards as first-class SecurityContentObjects.

ui_dispatch_app as SplunkEnterpriseSecuritySuite

Resolve some merge conflicts.

that the description and name fields, if present in the YML, are identical to those which MUST be included in ther JSON object.

Note that some of these fixes have already been made separately.

Customer prs 1

es is not installed and we are not doing an es integration test

it is now calculated using the risk score

Fix error on missing roles

Add fields as requested Internal testing has confirmed that these changes are correct.

incorrectly. Change from throttling to alert_suppression since that is the name used in splunk+documentation. Update template to output the field if it is defined.

contentctl/objects/deployment.py

contentctl/objects/detection_tags.py

contentctl/objects/enums.py

contentctl/objects/investigation.py

contentctl/objects/lookup.py

contentctl/objects/macro.py

contentctl/output/conf_output.py

contentctl/output/conf_writer.py

contentctl/output/templates/analyticstories_detections.j2

contentctl/output/templates/finding_report.j2

contentctl/output/templates/savedsearches_detections.j2

…into release_v4.2.0

ljstella

Reviewed w/ @pyth0n1c, comments inline + todo list created

ljstella · 2024-09-19T17:35:27Z

contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructure.py

            self.get_conn().roles.post(
                self.infrastructure.splunk_app_username,
-                imported_roles=imported_roles + enterprise_security_roles,
+                imported_roles=roles,


contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructureContainer.py

contentctl/actions/new_content.py

contentctl/actions/validate.py

contentctl/objects/abstract_security_content_objects/detection_abstract.py

contentctl/output/conf_output.py

contentctl/output/templates/analyticstories_detections.j2

contentctl/output/conf_writer.py

contentctl/output/templates/savedsearches_detections.j2

with colleague.

of Detections, Baselines, and Investigations/Response Tasks Properly written to the conf files.

pyth0n1c · 2024-09-25T21:29:45Z

With the latest pushes, I have manually DIFFED the conf files and the API JSON files and believe they are correct.
Diffing some of the API JSON files is challenging because some of the fields come out in a different order. In the future, we should consider applying SORTS to these fields so that their order is deterministic.

fix bug with informational searches having wrong output (info) written to savedsearches.conf

ljstella

LGTM

ljstella

Still LGTM

linuxdaemon and others added 15 commits August 14, 2023 12:05

Handle stopped containers in testing

104e71c

This means a failed container will no longer hang the test command

Update new content generator with new formats

bb910f8

Allow absent tests for experimental detections

74874e2

This is consistent with the validation check that allows no tests if status=experimental

Merge pull request #36 from linuxdaemon/allow-no-tests

9efa110

Allow absent tests for experimental detections

Merge pull request #44 from linuxdaemon/generator-update

6d9ffef

Update new content generator with new formats

Merge pull request #42 from linuxdaemon/docker-failure

a15e39c

Handle stopped containers in testing

Clean up messy object definitions in prep to update jinja2 templates

350c992

Merge branch 'main' into add_ui_dispatch_app

1fcfe09

Add experimental support for

133af6f

dashboards as first-class SecurityContentObjects.

Change to always set

3aa669b

ui_dispatch_app as SplunkEnterpriseSecuritySuite

Merge branch 'main' into add_ui_dispatch_app

e1662ce

Add fields as requested

c6aa99d

bump version in contentctl.yml

b56b808

pyth0n1c added the Draft label Jul 2, 2024

pyth0n1c and others added 14 commits July 2, 2024 13:02

Merge branch 'main' into dashboard_support.

51e863d

Resolve some merge conflicts.

Some improvements to make sure

10d3355

that the description and name fields, if present in the YML, are identical to those which MUST be included in ther JSON object.

Merge in latest changes.

d9f92bf

Note that some of these fixes have already been made separately.

remove newline

52973c2

Merge pull request #86 from splunk/customer_prs_1

70d518c

Customer prs 1

Merge branch 'main' into improve_ssa_fr

704e0b3

Merge branch 'main' into release_v4.2.0

1ac4623

Merge branch 'main' into improve_ssa_fr

24276c1

Merge branch 'release_v4.2.0' into improve_ssa_fr

34a873a

Fix error on missing roles if

1021111

es is not installed and we are not doing an es integration test

improve output of risk severity field.

eaf87f2

it is now calculated using the risk score

Merge pull request #190 from splunk/fix_imported_roles

4fa2878

Fix error on missing roles

Merge pull request #169 from splunk/improve_ssa_fr

2fdd58b

Add fields as requested Internal testing has confirmed that these changes are correct.

Improve annotated strings that were defined

9547940

incorrectly. Change from throttling to alert_suppression since that is the name used in splunk+documentation. Update template to output the field if it is defined.