contentctl 4.2.1__tar.gz → 4.2.2__tar.gz

{contentctl-4.2.1 → contentctl-4.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: contentctl
-Version: 4.2.1
+Version: 4.2.2
 Summary: Splunk Content Control Tool
 License: Apache 2.0
 Author: STRT

{contentctl-4.2.1 → contentctl-4.2.2}/contentctl/objects/lookup.py

@@ -8,13 +8,14 @@ if TYPE_CHECKING:
     from contentctl.objects.config import validate
 from contentctl.objects.security_content_object import SecurityContentObject
 
-
+# This section is used to ignore lookups that are NOT  shipped with ESCU app but are used in the detections. Adding exclusions here will so that contentctl builds will not fail.
 LOOKUPS_TO_IGNORE = set(["outputlookup"])
 LOOKUPS_TO_IGNORE.add("ut_shannon_lookup") #In the URL toolbox app which is recommended for ESCU
 LOOKUPS_TO_IGNORE.add("identity_lookup_expanded") #Shipped with the Asset and Identity Framework
 LOOKUPS_TO_IGNORE.add("cim_corporate_web_domain_lookup") #Shipped with the Asset and Identity Framework
 LOOKUPS_TO_IGNORE.add("alexa_lookup_by_str") #Shipped with the Asset and Identity Framework
 LOOKUPS_TO_IGNORE.add("interesting_ports_lookup") #Shipped with the Asset and Identity Framework
+LOOKUPS_TO_IGNORE.add("admon_groups_def") #Shipped with the SA-admon addon
 
 #Special case for the Detection "Exploit Public Facing Application via Apache Commons Text"
 LOOKUPS_TO_IGNORE.add("=") 

{contentctl-4.2.1 → contentctl-4.2.2}/contentctl/output/templates/savedsearches_detections.j2

@@ -57,15 +57,7 @@ cron_schedule = {{ detection.deployment.scheduling.cron_schedule }}
 dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }}
 dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
 action.correlationsearch.enabled = 1
-{% if detection.status == "deprecated" %}
-action.correlationsearch.label = {{APP_NAME}} - Deprecated - {{ detection.name }} - Rule
-{% elif detection.status == "experimental" %}
-action.correlationsearch.label = {{APP_NAME}} - Experimental - {{ detection.name }} - Rule
-{% elif detection.type | lower == "correlation" %}
-action.correlationsearch.label = {{APP_NAME}} - RIR - {{ detection.name }} - Rule
-{% else %}
 action.correlationsearch.label = {{APP_NAME}} - {{ detection.name }} - Rule
-{% endif %}
 action.correlationsearch.annotations = {{ detection.annotations | tojson }}
 action.correlationsearch.metadata = {{ detection.getMetadata() | tojson }}
 {% if detection.deployment.scheduling.schedule_window is defined %}

{contentctl-4.2.1 → contentctl-4.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "contentctl"
-version = "4.2.1"
+version = "4.2.2"
 description = "Splunk Content Control Tool"
 authors = ["STRT <research@splunk.com>"]
 license = "Apache 2.0"