contentctl 4.1.0__py3-none-any.whl → 4.1.2__py3-none-any.whl

contentctl/actions/detection_testing/GitService.py

@@ -76,33 +76,28 @@ class GitService(BaseModel):
                 if diff.delta.status in (DeltaStatus.ADDED, DeltaStatus.MODIFIED, DeltaStatus.RENAMED):
                     #print(f"{DeltaStatus(diff.delta.status).name:<8}:{diff.delta.new_file.raw_path}")
                     decoded_path = pathlib.Path(diff.delta.new_file.raw_path.decode('utf-8'))
-                    if 'app_template/' in str(decoded_path) or 'ssa_detections' in str(decoded_path) or str(self.config.getBuildDir()) in str(decoded_path):
-                        #Ignore anything that is embedded in the app template.
-                        #Also ignore ssa detections
-                        pass
-                    elif 'detections/' in str(decoded_path) and decoded_path.suffix == ".yml":
+                    # Note that we only handle updates to detections, lookups, and macros at this time. All other changes are ignored.
+                    if decoded_path.is_relative_to(self.config.path/"detections") and decoded_path.suffix == ".yml":
                         detectionObject = filepath_to_content_map.get(decoded_path, None)
                         if isinstance(detectionObject, Detection):
                             updated_detections.append(detectionObject)
                         else:
                             raise Exception(f"Error getting detection object for file {str(decoded_path)}")
                         
-                    elif 'macros/' in str(decoded_path) and decoded_path.suffix == ".yml":
+                    elif decoded_path.is_relative_to(self.config.path/"macros") and decoded_path.suffix == ".yml":
                         macroObject = filepath_to_content_map.get(decoded_path, None)
                         if isinstance(macroObject, Macro):
                             updated_macros.append(macroObject)
                         else:
                             raise Exception(f"Error getting macro object for file {str(decoded_path)}")
 
-                    elif 'lookups/' in str(decoded_path):
+                    elif decoded_path.is_relative_to(self.config.path/"lookups"):
                         # We need to convert this to a yml. This means we will catch
                         # both changes to a csv AND changes to the YML that uses it
-                        
-                        
                         if decoded_path.suffix == ".yml":
                             updatedLookup = filepath_to_content_map.get(decoded_path, None)
                             if not isinstance(updatedLookup,Lookup):
-                                raise Exception(f"Expected {decoded_path} to be type {type(Lookup)}, but instead if was {(type(lookupObject))}")
+                                raise Exception(f"Expected {decoded_path} to be type {type(Lookup)}, but instead if was {(type(updatedLookup))}")
                             updated_lookups.append(updatedLookup)
 
                         elif decoded_path.suffix == ".csv":
@@ -127,12 +122,8 @@ class GitService(BaseModel):
                     else:
                         pass
                         #print(f"Ignore changes to file {decoded_path} since it is not a detection, macro, or lookup.")
-                
-                # else:
-                #     print(f"{diff.delta.new_file.raw_path}:{DeltaStatus(diff.delta.status).name} (IGNORED)")
-                #     pass
             else:
-                raise Exception(f"Unrecognized type {type(diff)}")
+                raise Exception(f"Unrecognized diff type {type(diff)}")
 
 
         # If a detection has at least one dependency on changed content,
@@ -153,7 +144,7 @@ class GitService(BaseModel):
         #Print out the names of all modified/new content
         modifiedAndNewContentString = "\n - ".join(sorted([d.name for d in updated_detections]))
 
-        print(f"[{len(updated_detections)}] Pieces of modifed and new content to test:\n - {modifiedAndNewContentString}")
+        print(f"[{len(updated_detections)}] Pieces of modifed and new content (this may include experimental/deprecated/manual_test content):\n - {modifiedAndNewContentString}")
         return updated_detections
 
     def getSelected(self, detectionFilenames:List[FilePath])->List[Detection]:

contentctl/actions/test.py

@@ -90,6 +90,9 @@ class Test:
         
         if len(input_dto.detections) == 0:
             print(f"With Detection Testing Mode '{input_dto.config.getModeName()}', there were [0] detections found to test.\nAs such, we will quit immediately.")
+            # Directly call stop so that the summary.yml will be generated. Of course it will not have any test results, but we still want it to contain
+            # a summary showing that now detections were tested.
+            file.stop()
         else:
             print(f"MODE: [{input_dto.config.getModeName()}] - Test [{len(input_dto.detections)}] detections")
             if input_dto.config.mode in [DetectionTestingMode.changes, DetectionTestingMode.selected]:
@@ -98,7 +101,7 @@ class Test:
 
             manager.setup()
             manager.execute()
-
+        
         try:
             summary_results = file.getSummaryObject()
             summary = summary_results.get("summary", {})

contentctl/actions/validate.py

@@ -6,33 +6,47 @@ from pydantic import ValidationError
 from typing import Union
 
 from contentctl.objects.enums import SecurityContentProduct
-from contentctl.objects.abstract_security_content_objects.security_content_object_abstract import SecurityContentObject_Abstract
-from contentctl.input.director import (
-    Director,
-    DirectorOutputDto
+from contentctl.objects.abstract_security_content_objects.security_content_object_abstract import (
+    SecurityContentObject_Abstract,
 )
+from contentctl.input.director import Director, DirectorOutputDto
 
 from contentctl.objects.config import validate
 from contentctl.enrichments.attack_enrichment import AttackEnrichment
 from contentctl.enrichments.cve_enrichment import CveEnrichment
 from contentctl.objects.atomic import AtomicTest
 
+
 class Validate:
     def execute(self, input_dto: validate) -> DirectorOutputDto:
-        
-        director_output_dto = DirectorOutputDto(AtomicTest.getAtomicTestsFromArtRepo(repo_path=input_dto.getAtomicRedTeamRepoPath(), 
-                                                                                     enabled=input_dto.enrichments),
-                                                AttackEnrichment.getAttackEnrichment(input_dto),
-                                                CveEnrichment.getCveEnrichment(input_dto),
-                                                [],[],[],[],[],[],[],[],[])
-
-        
+
+        director_output_dto = DirectorOutputDto(
+            AtomicTest.getAtomicTestsFromArtRepo(
+                repo_path=input_dto.getAtomicRedTeamRepoPath(),
+                enabled=input_dto.enrichments,
+            ),
+            AttackEnrichment.getAttackEnrichment(input_dto),
+            CveEnrichment.getCveEnrichment(input_dto),
+            [],
+            [],
+            [],
+            [],
+            [],
+            [],
+            [],
+            [],
+            [],
+            [],
+            [],
+        )
+
         director = Director(director_output_dto)
         director.execute(input_dto)
-
         return director_output_dto
 
-    def validate_duplicate_uuids(self, security_content_objects:list[SecurityContentObject_Abstract]):
+    def validate_duplicate_uuids(
+        self, security_content_objects: list[SecurityContentObject_Abstract]
+    ):
         all_uuids = set()
         duplicate_uuids = set()
         for elem in security_content_objects:
@@ -45,14 +59,20 @@ class Validate:
 
         if len(duplicate_uuids) == 0:
             return
-        
+
         # At least once duplicate uuid has been found. Enumerate all
         # the pieces of content that use duplicate uuids
         duplicate_messages = []
         for uuid in duplicate_uuids:
-            duplicate_uuid_content = [str(content.file_path) for content in security_content_objects if content.id in duplicate_uuids]
-            duplicate_messages.append(f"Duplicate UUID [{uuid}] in {duplicate_uuid_content}")
-        
+            duplicate_uuid_content = [
+                str(content.file_path)
+                for content in security_content_objects
+                if content.id in duplicate_uuids
+            ]
+            duplicate_messages.append(
+                f"Duplicate UUID [{uuid}] in {duplicate_uuid_content}"
+            )
+
         raise ValueError(
             "ERROR: Duplicate ID(s) found in objects:\n"
             + "\n - ".join(duplicate_messages)

contentctl/helper/utils.py

@@ -25,6 +25,9 @@ class Utils:
     @staticmethod
     def get_all_yml_files_from_directory(path: str) -> list[pathlib.Path]:
         listOfFiles:list[pathlib.Path] = []
+        base_path = pathlib.Path(path)
+        if not base_path.exists():
+            return listOfFiles
         for (dirpath, dirnames, filenames) in os.walk(path):
             for file in filenames:
                 if file.endswith(".yml"):
@@ -32,6 +35,24 @@ class Utils:
     
         return sorted(listOfFiles)
 
+    @staticmethod
+    def get_all_yml_files_from_directory_one_layer_deep(path: str) -> list[pathlib.Path]:
+        listOfFiles: list[pathlib.Path] = []
+        base_path = pathlib.Path(path)
+        if not base_path.exists():
+            return listOfFiles
+        # Check the base directory
+        for item in base_path.iterdir():
+            if item.is_file() and item.suffix == '.yml':
+                listOfFiles.append(item)
+        # Check one subfolder level deep
+        for subfolder in base_path.iterdir():
+            if subfolder.is_dir() and subfolder.name != "cim":
+                for item in subfolder.iterdir():
+                    if item.is_file() and item.suffix == '.yml':
+                        listOfFiles.append(item)
+        return sorted(listOfFiles)
+
 
     @staticmethod
     def add_id(id_dict:dict[str, list[pathlib.Path]], obj:SecurityContentObject, path:pathlib.Path) -> None:     

contentctl/input/director.py

@@ -1,5 +1,6 @@
 import os
 import sys
+import pathlib
 from typing import Union
 from dataclasses import dataclass, field
 from pydantic import ValidationError
@@ -20,11 +21,24 @@ from contentctl.objects.lookup import Lookup
 from contentctl.objects.ssa_detection import SSADetection
 from contentctl.objects.atomic import AtomicTest
 from contentctl.objects.security_content_object import SecurityContentObject
+from contentctl.objects.data_source import DataSource
+from contentctl.objects.event_source import EventSource
 
 from contentctl.enrichments.attack_enrichment import AttackEnrichment
 from contentctl.enrichments.cve_enrichment import CveEnrichment
 
 from contentctl.objects.config import validate
+from contentctl.input.ssa_detection_builder import SSADetectionBuilder
+from contentctl.objects.enums import SecurityContentType
+
+from contentctl.objects.enums import DetectionStatus
+from contentctl.helper.utils import Utils
+
+from contentctl.input.ssa_detection_builder import SSADetectionBuilder
+from contentctl.objects.enums import SecurityContentType
+
+from contentctl.objects.enums import DetectionStatus 
+from contentctl.helper.utils import Utils
 
 
 @dataclass
@@ -43,7 +57,8 @@ class DirectorOutputDto:
     lookups: list[Lookup]
     deployments: list[Deployment]
     ssa_detections: list[SSADetection]
-
+    data_sources: list[DataSource]
+    event_sources: list[EventSource]
     name_to_content_map: dict[str, SecurityContentObject] = field(default_factory=dict)
     uuid_to_content_map: dict[UUID, SecurityContentObject] = field(default_factory=dict)
 
@@ -92,66 +107,84 @@ class DirectorOutputDto:
         self.uuid_to_content_map[content.id] = content
 
 
-from contentctl.input.ssa_detection_builder import SSADetectionBuilder
-from contentctl.objects.enums import SecurityContentType
-
-from contentctl.objects.enums import DetectionStatus 
-from contentctl.helper.utils import Utils
-
-
 class Director():
     input_dto: validate
     output_dto: DirectorOutputDto
     ssa_detection_builder: SSADetectionBuilder
-    
-
 
     def __init__(self, output_dto: DirectorOutputDto) -> None:
         self.output_dto = output_dto
         self.ssa_detection_builder = SSADetectionBuilder()
-        
+
     def execute(self, input_dto: validate) -> None:
         self.input_dto = input_dto
-
-        
         self.createSecurityContent(SecurityContentType.deployments)
         self.createSecurityContent(SecurityContentType.lookups)
         self.createSecurityContent(SecurityContentType.macros)
         self.createSecurityContent(SecurityContentType.stories)
         self.createSecurityContent(SecurityContentType.baselines)
         self.createSecurityContent(SecurityContentType.investigations)
+        self.createSecurityContent(SecurityContentType.event_sources)
+        self.createSecurityContent(SecurityContentType.data_sources)
         self.createSecurityContent(SecurityContentType.playbooks)
         self.createSecurityContent(SecurityContentType.detections)
-
-
         self.createSecurityContent(SecurityContentType.ssa_detections)
-        
 
     def createSecurityContent(self, contentType: SecurityContentType) -> None:
         if contentType == SecurityContentType.ssa_detections:
-            files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.path, 'ssa_detections'))
-            security_content_files = [f for f in files if f.name.startswith('ssa___')]
-            
-        elif contentType in [SecurityContentType.deployments, 
-                             SecurityContentType.lookups, 
-                             SecurityContentType.macros, 
-                             SecurityContentType.stories,
-                             SecurityContentType.baselines,
-                             SecurityContentType.investigations,
-                             SecurityContentType.playbooks,
-                             SecurityContentType.detections]:
-            files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.path, str(contentType.name)))
-            security_content_files = [f for f in files if not f.name.startswith('ssa___')]
+            files = Utils.get_all_yml_files_from_directory(
+                os.path.join(self.input_dto.path, "ssa_detections")
+            )
+            security_content_files = [f for f in files if f.name.startswith("ssa___")]
+
+        elif contentType == SecurityContentType.data_sources:
+            security_content_files = (
+                Utils.get_all_yml_files_from_directory_one_layer_deep(
+                    os.path.join(self.input_dto.path, "data_sources")
+                )
+            )
+
+        elif contentType == SecurityContentType.event_sources:
+            security_content_files = Utils.get_all_yml_files_from_directory(
+                os.path.join(self.input_dto.path, "data_sources", "cloud", "event_sources")
+            )
+            security_content_files.extend(
+                Utils.get_all_yml_files_from_directory(
+                    os.path.join(self.input_dto.path, "data_sources", "endpoint", "event_sources")
+                )
+            )
+            security_content_files.extend(
+                Utils.get_all_yml_files_from_directory(
+                    os.path.join(self.input_dto.path, "data_sources", "network", "event_sources")
+                )
+            )
+
+        elif contentType in [
+            SecurityContentType.deployments,
+            SecurityContentType.lookups,
+            SecurityContentType.macros,
+            SecurityContentType.stories,
+            SecurityContentType.baselines,
+            SecurityContentType.investigations,
+            SecurityContentType.playbooks,
+            SecurityContentType.detections,
+        ]:
+            files = Utils.get_all_yml_files_from_directory(
+                os.path.join(self.input_dto.path, str(contentType.name))
+            )
+            security_content_files = [
+                f for f in files if not f.name.startswith("ssa___")
+            ]
         else:
-             raise(Exception(f"Cannot createSecurityContent for unknown product."))
+            raise (Exception(f"Cannot createSecurityContent for unknown product."))
 
         validation_errors = []
-                
+
         already_ran = False
         progress_percent = 0
-        
-        for index,file in enumerate(security_content_files):
-            progress_percent = ((index+1)/len(security_content_files)) * 100
+
+        for index, file in enumerate(security_content_files):
+            progress_percent = ((index + 1) / len(security_content_files)) * 100
             try:
                 type_string = contentType.name.upper()
                 modelDict = YmlReader.load_file(file)
@@ -167,7 +200,7 @@ class Director():
                 elif contentType == SecurityContentType.deployments:
                         deployment = Deployment.model_validate(modelDict,context={"output_dto":self.output_dto})
                         self.output_dto.addContentToDictMappings(deployment)
-                
+
                 elif contentType == SecurityContentType.playbooks:
                         playbook = Playbook.model_validate(modelDict,context={"output_dto":self.output_dto})
                         self.output_dto.addContentToDictMappings(playbook)                  
@@ -193,36 +226,67 @@ class Director():
                         ssa_detection = self.ssa_detection_builder.getObject()
                         if ssa_detection.status in [DetectionStatus.production.value, DetectionStatus.validation.value]:
                             self.output_dto.addContentToDictMappings(ssa_detection)
+                
+                elif contentType == SecurityContentType.data_sources:
+                    data_source = DataSource.model_validate(
+                        modelDict, context={"output_dto": self.output_dto}
+                    )
+                    self.output_dto.data_sources.append(data_source)
+
+                elif contentType == SecurityContentType.event_sources:
+                    event_source = EventSource.model_validate(
+                        modelDict, context={"output_dto": self.output_dto}
+                    )
+                    self.output_dto.event_sources.append(event_source)
 
                 else:
-                        raise Exception(f"Unsupported type: [{contentType}]")
-                
-                if (sys.stdout.isatty() and sys.stdin.isatty() and sys.stderr.isatty()) or not already_ran:
-                        already_ran = True
-                        print(f"\r{f'{type_string} Progress'.rjust(23)}: [{progress_percent:3.0f}%]...", end="", flush=True)
-            
-            except (ValidationError, ValueError) as e:
-                relative_path = file.absolute().relative_to(self.input_dto.path.absolute())
-                validation_errors.append((relative_path,e))
-                
+                    raise Exception(f"Unsupported type: [{contentType}]")
+
+                if (
+                    sys.stdout.isatty() and sys.stdin.isatty() and sys.stderr.isatty()
+                ) or not already_ran:
+                    already_ran = True
+                    print(
+                        f"\r{f'{type_string} Progress'.rjust(23)}: [{progress_percent:3.0f}%]...",
+                        end="",
+                        flush=True,
+                    )
 
-        print(f"\r{f'{contentType.name.upper()} Progress'.rjust(23)}: [{progress_percent:3.0f}%]...", end="", flush=True)
+            except (ValidationError, ValueError) as e:
+                relative_path = file.absolute().relative_to(
+                    self.input_dto.path.absolute()
+                )
+                validation_errors.append((relative_path, e))
+
+        print(
+            f"\r{f'{contentType.name.upper()} Progress'.rjust(23)}: [{progress_percent:3.0f}%]...",
+            end="",
+            flush=True,
+        )
         print("Done!")
 
         if len(validation_errors) > 0:
-            errors_string = '\n\n'.join([f"File: {e_tuple[0]}\nError: {str(e_tuple[1])}" for e_tuple in validation_errors])
-            #print(f"The following {len(validation_errors)} error(s) were found during validation:\n\n{errors_string}\n\nVALIDATION FAILED")
+            errors_string = "\n\n".join(
+                [
+                    f"File: {e_tuple[0]}\nError: {str(e_tuple[1])}"
+                    for e_tuple in validation_errors
+                ]
+            )
+            # print(f"The following {len(validation_errors)} error(s) were found during validation:\n\n{errors_string}\n\nVALIDATION FAILED")
             # We quit after validation a single type/group of content because it can cause significant cascading errors in subsequent
             # types of content (since they may import or otherwise use it)
-            raise Exception(f"The following {len(validation_errors)} error(s) were found during validation:\n\n{errors_string}\n\nVALIDATION FAILED")
-
-
-    
-    
+            raise Exception(
+                f"The following {len(validation_errors)} error(s) were found during validation:\n\n{errors_string}\n\nVALIDATION FAILED"
+            )
 
-    def constructSSADetection(self, builder: SSADetectionBuilder, directorOutput:DirectorOutputDto, file_path: str) -> None:
+    def constructSSADetection(
+        self,
+        builder: SSADetectionBuilder,
+        directorOutput: DirectorOutputDto,
+        file_path: str,
+    ) -> None:
         builder.reset()
-        builder.setObject(file_path,self.output_dto)
+        builder.setObject(file_path)
         builder.addMitreAttackEnrichmentNew(directorOutput.attack_enrichment)
         builder.addKillChainPhase()
         builder.addCIS()

contentctl/input/ssa_detection_builder.py

@@ -13,17 +13,14 @@ from contentctl.enrichments.cve_enrichment import CveEnrichment
 from contentctl.enrichments.splunk_app_enrichment import SplunkAppEnrichment
 from contentctl.objects.ssa_detection import SSADetection
 from contentctl.objects.constants import *
-from contentctl.input.director import DirectorOutputDto
 from contentctl.enrichments.attack_enrichment import AttackEnrichment
 
 class SSADetectionBuilder():
     security_content_obj : SSADetection
 
 
-    def setObject(self, path: str,
-                  output_dto:DirectorOutputDto ) -> None:
-        yml_dict = YmlReader.load_file(path)
-        #self.security_content_obj = SSADetection.model_validate(yml_dict, context={"output_dto":output_dto})     
+    def setObject(self, path: str) -> None:
+        yml_dict = YmlReader.load_file(path)  
         self.security_content_obj = SSADetection.parse_obj(yml_dict)
         self.security_content_obj.source = os.path.split(os.path.dirname(self.security_content_obj.file_path))[-1]
 

contentctl/objects/abstract_security_content_objects/detection_abstract.py

@@ -40,7 +40,7 @@ class Detection_Abstract(SecurityContentObject):
     search: Union[str, dict[str,Any]] = Field(...)
     how_to_implement: str = Field(..., min_length=4)
     known_false_positives: str = Field(..., min_length=4)
-    #data_source: Optional[List[DataSource]] = None
+    data_source_objects: Optional[List[DataSource]] = None
 
     enabled_by_default: bool = False
     file_path: FilePath = Field(...)
@@ -369,8 +369,6 @@ class Detection_Abstract(SecurityContentObject):
         # if not isinstance(director,DirectorOutputDto):
         #     raise ValueError("DirectorOutputDto was not passed in context of Detection model_post_init")
         director: Optional[DirectorOutputDto] = ctx.get("output_dto",None)
-        for story in self.tags.analytic_story:
-            story.detections.append(self)
         
         #Ensure that all baselines link to this detection
         for baseline in self.baselines:
@@ -385,10 +383,25 @@ class Detection_Abstract(SecurityContentObject):
             if replaced is False:
                 raise ValueError(f"Error, failed to replace detection reference in Baseline '{baseline.name}' to detection '{self.name}'")             
             baseline.tags.detections = new_detections
-        
-        return self
 
+        self.data_source_objects = []
+        for data_source_obj in director.data_sources:
+            for detection_data_source in self.data_source:
+                if data_source_obj.name in detection_data_source:
+                    self.data_source_objects.append(data_source_obj)
+
+        # Remove duplicate data source objects based on their 'name' property
+        unique_data_sources = {}
+        for data_source_obj in self.data_source_objects:
+            if data_source_obj.name not in unique_data_sources:
+                unique_data_sources[data_source_obj.name] = data_source_obj
+        self.data_source_objects = list(unique_data_sources.values())
 
+        for story in self.tags.analytic_story:
+            story.detections.append(self)
+            story.data_sources.extend(self.data_source_objects)
+
+        return self
 
     
     @field_validator('lookups',mode="before")

contentctl/objects/data_source.py

@@ -2,20 +2,27 @@ from __future__ import annotations
 from pydantic import BaseModel
 
 
-
 class DataSource(BaseModel):
     name: str
     id: str
-    date: str
     author: str
-    type: str
     source: str
     sourcetype: str
-    category: str = None
-    product: str
-    service: str = None
-    supported_TA: list
-    references: list
-    raw_fields: list
-    field_mappings: list = None
-    convert_to_log_source: list = None
+    separator: str = None
+    configuration: str = None
+    supported_TA: dict
+    event_names: list = None
+    event_sources: list = None
+    fields: list = None
+    example_log: str = None
+
+    def model_post_init(self, ctx:dict[str,Any]):
+        context = ctx.get("output_dto")
+        
+        if self.event_names:
+            self.event_sources = []
+            for event_source in context.event_sources:
+                if any(event['event_name'] == event_source.event_name for event in self.event_names):
+                    self.event_sources.append(event_source)
+
+        return self

contentctl/objects/enums.py

@@ -55,6 +55,8 @@ class SecurityContentType(enum.Enum):
     investigations = 8
     unit_tests = 9
     ssa_detections = 10
+    data_sources = 11
+    event_sources = 12
 
 # Bringing these changes back in line will take some time after
 # the initial merge is complete

contentctl/objects/event_source.py

@@ -0,0 +1,10 @@
+from __future__ import annotations
+from pydantic import BaseModel
+
+
+class EventSource(BaseModel):
+    event_name: str
+    fields: list[str]
+    field_mappings: list[dict] = None
+    convert_to_log_source: list[dict] = None
+    example_log: str = None

contentctl/objects/story.py

@@ -7,7 +7,7 @@ if TYPE_CHECKING:
     from contentctl.objects.detection import Detection
     from contentctl.objects.investigation import Investigation
     from contentctl.objects.baseline import Baseline
-    
+    from contentctl.objects.data_source import DataSource
 
 from contentctl.objects.security_content_object import SecurityContentObject
 
@@ -33,7 +33,7 @@ class Story(SecurityContentObject):
     detections:List[Detection] = []
     investigations: List[Investigation] = []
     baselines: List[Baseline] = []
-
+    data_sources: List[DataSource] = []
 
     def storyAndInvestigationNamesWithApp(self, app_name:str)->List[str]:
         return [f"{app_name} - {name} - Rule" for name in self.detection_names] + \

{contentctl-4.1.0.dist-info → contentctl-4.1.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: contentctl
-Version: 4.1.0
+Version: 4.1.2
 Summary: Splunk Content Control Tool
 License: Apache 2.0
 Author: STRT

{contentctl-4.1.0.dist-info → contentctl-4.1.2.dist-info}/RECORD

@@ -3,7 +3,7 @@ contentctl/actions/build.py,sha256=BVc-1E63zeUQ9wWAHTC_fLNvfEK5YT3Z6_QLiE72TQs,4
 contentctl/actions/convert.py,sha256=0KBWLxvP1hSPXpExePqpOQPRvlQLamvPLyQqeTIWNbk,704
 contentctl/actions/deploy_acs.py,sha256=mf3uk495H1EU_LNN-TiOsYCo18HMGoEBMb6ojeTr0zw,1418
 contentctl/actions/detection_testing/DetectionTestingManager.py,sha256=zg8JasDjCpSC-yhseEyUwO8qbDJIUJbhlus9Li9ZAnA,8818
-contentctl/actions/detection_testing/GitService.py,sha256=Rm5Usc0EZk87rk1W8eKyED6b5CdD0YUQZMjkPfk3ztU,8666
+contentctl/actions/detection_testing/GitService.py,sha256=FY_JtMi3qL-uC31Yyf7CTWZ5kLQhAMAvcj-8QXtkfPM,8386
 contentctl/actions/detection_testing/generate_detection_coverage_badge.py,sha256=N5mznaeErVak3mOBwsd0RDBFJO3bku0EZvpayCyU-uk,2259
 contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructure.py,sha256=VFhSHdw_0N6ol668hDkaj7yFjPsZqBoFNC8FKzWKICc,53141
 contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructureContainer.py,sha256=HVGWCXy0GQeBqu2cVJn5H-I8GY8rwgkkc53ilO1TfZA,6846
@@ -20,8 +20,8 @@ contentctl/actions/inspect.py,sha256=6gVVKmV5CUUYOkNNVTMPKj9bM1uXVthgGCoFKZGDeS8
 contentctl/actions/new_content.py,sha256=4gTlxV0fmdsSETPX4T9uQPpIAm--Jf2vc6Vm3w-RkfI,6128
 contentctl/actions/release_notes.py,sha256=akkFfLhsJuaPUyjsb6dLlKt9cUM-JApAjTFQMbYoXeM,13115
 contentctl/actions/reporting.py,sha256=MJEmvmoA1WnSFZEU9QM6daL_W94oOX0WXAcX1qAM2As,1583
-contentctl/actions/test.py,sha256=JXW1CR-tTM2kJ-U5NRG8quY3JlnOb4OmCBgX24XYWJ0,4896
-contentctl/actions/validate.py,sha256=6_M5IMi68Pv4CNw69balQTkfRdjMTurUUv7z8BpGh3Y,2454
+contentctl/actions/test.py,sha256=dx7f750_MrlvysxOmOdIro1bH0iVKF4K54TSwhvU2MU,5146
+contentctl/actions/validate.py,sha256=HnmB_qsluYr0BFHQzg0HvXGLHM4M1taBtsWt774esf8,2537
 contentctl/api.py,sha256=FBOpRhbBCBdjORmwe_8MPQ3PRZ6T0KrrFcfKovVFkug,6343
 contentctl/contentctl.py,sha256=Vr2cuvaPjpJpYvD9kVoYq7iD6rhLQEpTKmcGoq4emhA,10470
 contentctl/enrichments/attack_enrichment.py,sha256=EkEloG3hMmPTloPyYiVkhq3iT_BieXaJmprJ5stfyRw,6732
@@ -29,14 +29,14 @@ contentctl/enrichments/cve_enrichment.py,sha256=IzkKSdnQi3JrAUUyLpcGA_Y2g_B7latq
 contentctl/enrichments/splunk_app_enrichment.py,sha256=zDNHFLZTi2dJ1gdnh0sHkD6F1VtkblqFnhacFcCMBfc,3418
 contentctl/helper/link_validator.py,sha256=-XorhxfGtjLynEL1X4hcpRMiyemogf2JEnvLwhHq80c,7139
 contentctl/helper/logger.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-contentctl/helper/utils.py,sha256=iZ6keMdTCs1XySiDVoGIGkMSxD_eDUphwEW-VUYA6vM,15659
+contentctl/helper/utils.py,sha256=THV4ZuaeEHG6PK5JeZUkTLBmvN4fUV0Ar6opH1zXxKs,16545
 contentctl/input/backend_splunk_ba.py,sha256=Y70tJqgaUM0nzfm2SiGMof4HkhY84feqf-xnRx1xPb4,5861
-contentctl/input/director.py,sha256=JsmN35xamnMNl3Wug7KGVLFbVfa5F7jf0ToHEwXFcqM,10965
+contentctl/input/director.py,sha256=BR1RvBD0U_JtHtrM3jM_FpcvaaNlME7nc-gNO4RJLM8,13323
 contentctl/input/new_content_questions.py,sha256=o4prlBoUhEMxqpZukquI9WKbzfFJfYhEF7a8m2q_BEE,5565
 contentctl/input/sigma_converter.py,sha256=ATFNW7boNngp5dmWM7Gr4rMZrUKjvKW2_qu28--FdiU,19391
-contentctl/input/ssa_detection_builder.py,sha256=43B7q4A8MEMjUU-FR7UapO80deW6BooV9WYzZWxcvgI,8377
+contentctl/input/ssa_detection_builder.py,sha256=dke9mPn2VQVSpYiaGWjZn3PkqVJTe58gcT2Vifv9_yc,8159
 contentctl/input/yml_reader.py,sha256=oaal24UP8rDXkCmN5I3GnIheZrsgkhbKOlzXtyhB474,1475
-contentctl/objects/abstract_security_content_objects/detection_abstract.py,sha256=BPY0D_evVu4n3xGE7uGJRP5RKOtPbNKNPnZqvo0qC1A,33311
+contentctl/objects/abstract_security_content_objects/detection_abstract.py,sha256=XhyMpghvizU37sOHKE009la1wo__EZqGdemXt9En5wc,34039
 contentctl/objects/abstract_security_content_objects/security_content_object_abstract.py,sha256=IVr26xFrIlTvsqQoqwYl4cmcfaP9BeYt9I0QTriKmwE,8451
 contentctl/objects/alert_action.py,sha256=E9gjCn5C31h0sN7k90KNe4agRxFFSnMW_Z-Ri_3YQss,1335
 contentctl/objects/atomic.py,sha256=a_G_iliAm86BunpAAG86aAL3LAEGpd9Crp7t7-PxYvI,8979
@@ -47,7 +47,7 @@ contentctl/objects/baseline_tags.py,sha256=JLdlCUc_DEccMQD6f-sa2qD8pcxYiwMUT_sRZ
 contentctl/objects/config.py,sha256=tK0BY4A9Go5jp8tpOSwgczuOAyu9dMPvC0nyOHeO-74,43642
 contentctl/objects/constants.py,sha256=1LjiK9A7t0aHHkJz2mrW-DImdW1P98GPssTwmwNNI_M,3468
 contentctl/objects/correlation_search.py,sha256=B97vCt2Ew7PGgqd5Y9l6RD3DJdy51Eh7Gzkxxs2xqZ0,36891
-contentctl/objects/data_source.py,sha256=ELNsNsarVHJgytPTcaGZOoWgub2v_-Q0xtc_-xUM8yg,405
+contentctl/objects/data_source.py,sha256=UoI1zLyrwwTtKqvXf_K-TifJEY5HaVBItR3vR4J43iw,768
 contentctl/objects/deployment.py,sha256=Qc6M4yeOvxjqFKR8sfjd4CG06AbVheTOqP1mwqo4t8s,2651
 contentctl/objects/deployment_email.py,sha256=Zu9cXZdfOP6noa_mZpiK1GrYCTgi3Mim94iLGjE674c,147
 contentctl/objects/deployment_notable.py,sha256=QhOI7HEkUuuqk0fum9SD8IpYBlbwIsJUff8s3kCKKj4,198
@@ -57,7 +57,8 @@ contentctl/objects/deployment_scheduling.py,sha256=bQjbJHNaUGdU1VAGV8-nFOHzHutbI
 contentctl/objects/deployment_slack.py,sha256=P6z8OLHDKcDWx7nbKWasqBc3dFRatGcpO2GtmxzVV8I,135
 contentctl/objects/detection.py,sha256=3W41cXf3ECjWuPqWrseqSLC3PAA7O5_nENWWM6MPK0Y,620
 contentctl/objects/detection_tags.py,sha256=QR906JN8cf5et5aPf-AluEEyP3IvdUQ_KzxKffMSjrc,10261
-contentctl/objects/enums.py,sha256=2gLRtJ-dHW_xMFdbjOp0LaX_fEV0V-YAZn2JY9gUzJ8,14030
+contentctl/objects/enums.py,sha256=cW-orYfVBgMdZKVS8ANAkSZ-zygbrhJZX6FP4TxNGgg,14075
+contentctl/objects/event_source.py,sha256=oOCCSQpfpSbYw6_v103I4VxwqjpXP4gsTbds06qiEa0,251
 contentctl/objects/integration_test.py,sha256=W_VksBN_cRo7DTXdr1aLujjS9mgkEp0uvoNpmL0dVnQ,1273
 contentctl/objects/integration_test_result.py,sha256=DrIZRRlILSHGcsK_Rlm3KJLnbKPtIen8uEPFi4ZdJ8s,370
 contentctl/objects/investigation.py,sha256=JRoZxc_qi1fu_VFTRaxOc3B7zzSzCfEURsNzWPUCrtY,2620
@@ -74,7 +75,7 @@ contentctl/objects/risk_object.py,sha256=yY4NmEwEKaRl4sLzCRZb1n8kdpV3HzYbQVQ1ClQ
 contentctl/objects/security_content_object.py,sha256=j8KNDwSMfZsSIzJucC3NuZo0SlFVpqHfDc6y3-YHjHI,234
 contentctl/objects/ssa_detection.py,sha256=-G6tXfVVlZgPWS64hIIy3M-aMePANAuQvdpXPlgUyUs,5873
 contentctl/objects/ssa_detection_tags.py,sha256=u8annjzo3MYZ-16wyFnuR8qJJzRa4LEhdprMIrQ47G0,5224
-contentctl/objects/story.py,sha256=LQLCCK_3DkP2x8fQOzcnV0d18_gsVFeS06DEK-qaBUE,4526
+contentctl/objects/story.py,sha256=GMcMAaDcX16B2mbSAzrzpVD8IMyOILAyIo2rR8jySto,4618
 contentctl/objects/story_tags.py,sha256=0oF1OePLBxa-RQPb438tXrrfosa939CP8UbNV0_S8XY,2225
 contentctl/objects/test_group.py,sha256=Yb1sqGom6SkVL8B3czPndz8w3CK8WdwZ39V_cn0_JZQ,2600
 contentctl/objects/threat_object.py,sha256=S8B7RQFfLxN_g7yKPrDTuYhIy9JvQH3YwJ_T5LUZIa4,711
@@ -163,8 +164,8 @@ contentctl/templates/detections/web/.gitkeep,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRk
 contentctl/templates/macros/security_content_ctime.yml,sha256=Gg1YNllHVsX_YB716H1SJLWzxXZEfuJlnsgB2fuyoHU,159
 contentctl/templates/macros/security_content_summariesonly.yml,sha256=9BYUxAl2E4Nwh8K19F3AJS8Ka7ceO6ZDBjFiO3l3LY0,162
 contentctl/templates/stories/cobalt_strike.yml,sha256=rlaXxMN-5k8LnKBLPafBoksyMtlmsPMHPJOjTiMiZ-M,3063
-contentctl-4.1.0.dist-info/LICENSE.md,sha256=hQWUayRk-pAiOZbZnuy8djmoZkjKBx8MrCFpW-JiOgo,11344
-contentctl-4.1.0.dist-info/METADATA,sha256=AXM-iaprX65-e2JRJCjSFS4yr315R3uAbh80e5KJp20,19706
-contentctl-4.1.0.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
-contentctl-4.1.0.dist-info/entry_points.txt,sha256=5bjZ2NkbQfSwK47uOnA77yCtjgXhvgxnmCQiynRF_-U,57
-contentctl-4.1.0.dist-info/RECORD,,
+contentctl-4.1.2.dist-info/LICENSE.md,sha256=hQWUayRk-pAiOZbZnuy8djmoZkjKBx8MrCFpW-JiOgo,11344
+contentctl-4.1.2.dist-info/METADATA,sha256=FJsw6lsgRLBq0oHaLRtL_BoJdhe4W2xwzcMu1PZei5A,19706
+contentctl-4.1.2.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
+contentctl-4.1.2.dist-info/entry_points.txt,sha256=5bjZ2NkbQfSwK47uOnA77yCtjgXhvgxnmCQiynRF_-U,57
+contentctl-4.1.2.dist-info/RECORD,,