Skip to content

Developing Content

Jump to bottom
jzsplunk edited this page Sep 2, 2020 · 8 revisions

Writing Content

Pre-Requisites

Before you begin, follow the steps to install dependencies and pre-commit hooks

  1. Create virtualenv and install requirements: virtualenv venv && source venv/bin/activate && pip install -r requirements.txt.
  2. Install pre-commit install.

Writing Content

  1. Select the content piece you want to write.
  2. Copy an example and edit it to suit your needs. At a minimum, you must write a detection search.
  3. Make a pull request.

Testing New Content

  1. Run python bin/validate.py --path . --verbose
  2. For modifications to schema/tags related to detections run python bin/generate.py -p . -o package

The pull request will trigger a CircleCI, a continuous-integration app that integrates with a VCS and automatically runs a series of steps every time that it detects a change to your repository. A CircleCI build consists of a series of steps, usually validation, generation and deployment. If your tests pass, you're good to go! A repository maintainer will make sure the PR makes it into the next release. Which will be deployed in the ESCU app and our API. If the CircleCI check fails, refer to troubleshooting first, some problems are easily described by CI. If not do not worry, our team will work with you in the PR to make sure your content passes validation and its part of our next release!

Testing and Validating Spec Changes

Changes to spec along with validation of the fields described in the spec can be accomplished by modifying two files located in:

  1. github/security-content/spec
  2. github/security-content/docs/spec

A markdown generation tool for testing changes to the spec needs to be manually installed and run against the relevant json. The tool can be installed from: jsonschema2md

For a more detailed explanation on how to contribute to the project, please see "Contributing"

Clone this wiki locally