Skip to content

Conversation

ljstella
Copy link
Contributor

splunk/security_content#3287 <- PR to add fields to the datasource object.

At the moment, I've typed these incredibly naively with separator_value as an Optional[str], and mitre_components as list[str]. I think separator_value may stay that way, but there's a chance with mitre_components to leverage some of the work we've done elsewhere on MITRE enrichment.

@pyth0n1c
Copy link
Contributor

Minor feedback - in line with latest PEP guidance, we should use
variable_name: None | TypeA
rather than
variable_name: Optional[None]

@pyth0n1c pyth0n1c added 5.0 Targeted for ESCU 5.0 Release Draft and removed 5.0 Targeted for ESCU 5.0 Release labels Jan 27, 2025
@ljstella ljstella added WIP and removed Draft labels Feb 11, 2025
@ljstella
Copy link
Contributor Author

After conversation w/ the folks that caused this PR to kickoff, looks like we should add some validation around the mitre_component portion to ensure that its name matches one of the x-mitre-data-component entities from ATT&CK. Validating that the field matches should prevent issues with bad data leaking downstream.

@ljstella
Copy link
Contributor Author

After conversation this week, this should now be good to land in association with splunk/security_content#3287

Validations for it can come later when we have a better idea of how we might want to use it (likely on research.splunk.com)

@ljstella ljstella removed the WIP label Feb 18, 2025
@ljstella ljstella requested a review from pyth0n1c February 18, 2025 21:22
Copy link
Contributor

@pyth0n1c pyth0n1c left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good. I agree with the PR owner that we can build additional validations for these fields, as necessary, when we have some content ready to use it.

@pyth0n1c pyth0n1c merged commit fa60068 into main Mar 10, 2025
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants