contentctl 4.3.2__py3-none-any.whl → 4.3.3__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (29) hide show
  1. contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructure.py +35 -21
  2. contentctl/actions/detection_testing/views/DetectionTestingView.py +64 -38
  3. contentctl/actions/detection_testing/views/DetectionTestingViewCLI.py +1 -0
  4. contentctl/actions/detection_testing/views/DetectionTestingViewFile.py +3 -5
  5. contentctl/actions/test.py +55 -32
  6. contentctl/contentctl.py +3 -6
  7. contentctl/objects/abstract_security_content_objects/detection_abstract.py +180 -88
  8. contentctl/objects/abstract_security_content_objects/security_content_object_abstract.py +1 -0
  9. contentctl/objects/base_test.py +1 -0
  10. contentctl/objects/base_test_result.py +1 -0
  11. contentctl/objects/config.py +24 -9
  12. contentctl/objects/detection_tags.py +3 -0
  13. contentctl/objects/integration_test.py +3 -5
  14. contentctl/objects/integration_test_result.py +1 -5
  15. contentctl/objects/investigation.py +1 -0
  16. contentctl/objects/manual_test.py +32 -0
  17. contentctl/objects/manual_test_result.py +8 -0
  18. contentctl/objects/mitre_attack_enrichment.py +1 -0
  19. contentctl/objects/ssa_detection.py +1 -0
  20. contentctl/objects/story_tags.py +2 -0
  21. contentctl/objects/{unit_test_attack_data.py → test_attack_data.py} +4 -5
  22. contentctl/objects/test_group.py +3 -3
  23. contentctl/objects/unit_test.py +4 -11
  24. contentctl/output/templates/savedsearches_detections.j2 +1 -1
  25. {contentctl-4.3.2.dist-info → contentctl-4.3.3.dist-info}/METADATA +7 -7
  26. {contentctl-4.3.2.dist-info → contentctl-4.3.3.dist-info}/RECORD +29 -27
  27. {contentctl-4.3.2.dist-info → contentctl-4.3.3.dist-info}/LICENSE.md +0 -0
  28. {contentctl-4.3.2.dist-info → contentctl-4.3.3.dist-info}/WHEEL +0 -0
  29. {contentctl-4.3.2.dist-info → contentctl-4.3.3.dist-info}/entry_points.txt +0 -0
contentctl/objects/ssa_detection.py CHANGED
@@ -59,6 +59,7 @@ class SSADetection(BaseModel):
59
59
  # raise ValueError('name is longer then 67 chars: ' + v)
60
60
  # return v
61
61
 
62
+ # TODO (#266): disable the use_enum_values configuration
62
63
  class Config:
63
64
  use_enum_values = True
64
65
 
contentctl/objects/story_tags.py CHANGED
@@ -17,6 +17,8 @@ class StoryUseCase(str,Enum):
17
17
  INSIDER_THREAT = "Insider Threat"
18
18
  OTHER = "Other"
19
19
 
20
+
21
+ # TODO (#266): disable the use_enum_values configuration
20
22
  class StoryTags(BaseModel):
21
23
  model_config = ConfigDict(extra='forbid', use_enum_values=True)
22
24
  category: List[StoryCategory] = Field(...,min_length=1)
contentctl/objects/{unit_test_attack_data.py → test_attack_data.py} RENAMED
@@ -1,13 +1,12 @@
1
1
  from __future__ import annotations
2
2
  from pydantic import BaseModel, HttpUrl, FilePath, Field
3
- from typing import Union, Optional
4
3
 
5
4
 
6
- class UnitTestAttackData(BaseModel):
7
- data: Union[HttpUrl, FilePath] = Field(...)
5
+ class TestAttackData(BaseModel):
6
+ data: HttpUrl | FilePath = Field(...)
8
7
  # TODO - should source and sourcetype should be mapped to a list
9
8
  # of supported source and sourcetypes in a given environment?
10
9
  source: str = Field(...)
11
10
  sourcetype: str = Field(...)
12
- custom_index: Optional[str] = None
13
- host: Optional[str] = None
11
+ custom_index: str | None = None
12
+ host: str | None = None
contentctl/objects/test_group.py CHANGED
@@ -2,14 +2,14 @@ from pydantic import BaseModel
2
2
 
3
3
  from contentctl.objects.unit_test import UnitTest
4
4
  from contentctl.objects.integration_test import IntegrationTest
5
- from contentctl.objects.unit_test_attack_data import UnitTestAttackData
5
+ from contentctl.objects.test_attack_data import TestAttackData
6
6
  from contentctl.objects.base_test_result import TestResultStatus
7
7
 
8
8
 
9
9
  class TestGroup(BaseModel):
10
10
  """
11
11
  Groups of different types of tests relying on the same attack data
12
- :param name: Name of the TestGroup (typically derived from a unit test as
12
+ :param name: Name of the TestGroup (typically derived from a unit test as
13
13
  "{detection.name}:{test.name}")
14
14
  :param unit_test: a UnitTest
15
15
  :param integration_test: an IntegrationTest
@@ -18,7 +18,7 @@ class TestGroup(BaseModel):
18
18
  name: str
19
19
  unit_test: UnitTest
20
20
  integration_test: IntegrationTest
21
- attack_data: list[UnitTestAttackData]
21
+ attack_data: list[TestAttackData]
22
22
 
23
23
  @classmethod
24
24
  def derive_from_unit_test(cls, unit_test: UnitTest, name_prefix: str) -> "TestGroup":
contentctl/objects/unit_test.py CHANGED
@@ -1,10 +1,9 @@
1
1
  from __future__ import annotations
2
- from typing import Union
3
2
 
4
3
  from pydantic import Field
5
4
 
6
5
  from contentctl.objects.unit_test_baseline import UnitTestBaseline
7
- from contentctl.objects.unit_test_attack_data import UnitTestAttackData
6
+ from contentctl.objects.test_attack_data import TestAttackData
8
7
  from contentctl.objects.unit_test_result import UnitTestResult
9
8
  from contentctl.objects.base_test import BaseTest, TestType
10
9
  from contentctl.objects.base_test_result import TestResultStatus
@@ -17,19 +16,13 @@ class UnitTest(BaseTest):
17
16
  # contentType: SecurityContentType = SecurityContentType.unit_tests
18
17
 
19
18
  # The test type (unit)
20
- test_type: TestType = Field(TestType.UNIT)
21
-
22
- # The condition to check if the search was successful
23
- pass_condition: Union[str, None] = None
24
-
25
- # Baselines to be run before a unit test
26
- baselines: list[UnitTestBaseline] = []
19
+ test_type: TestType = Field(default=TestType.UNIT)
27
20
 
28
21
  # The attack data to be ingested for the unit test
29
- attack_data: list[UnitTestAttackData]
22
+ attack_data: list[TestAttackData]
30
23
 
31
24
  # The result of the unit test
32
- result: Union[None, UnitTestResult] = None
25
+ result: UnitTestResult | None = None
33
26
 
34
27
  def skip(self, message: str) -> None:
35
28
  """
contentctl/output/templates/savedsearches_detections.j2 CHANGED
@@ -59,7 +59,7 @@ dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }}
59
59
  action.correlationsearch.enabled = 1
60
60
  action.correlationsearch.label = {{APP_NAME}} - {{ detection.name }} - Rule
61
61
  action.correlationsearch.annotations = {{ detection.annotations | tojson }}
62
- action.correlationsearch.metadata = {{ detection.getMetadata() | tojson }}
62
+ action.correlationsearch.metadata = {{ detection.metadata | tojson }}
63
63
  {% if detection.deployment.scheduling.schedule_window is defined %}
64
64
  schedule_window = {{ detection.deployment.scheduling.schedule_window }}
65
65
  {% endif %}
{contentctl-4.3.2.dist-info → contentctl-4.3.3.dist-info}/METADATA RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.1
2
2
  Name: contentctl
3
- Version: 4.3.2
3
+ Version: 4.3.3
4
4
  Summary: Splunk Content Control Tool
5
5
  License: Apache 2.0
6
6
  Author: STRT
@@ -41,13 +41,13 @@ If you are already familiar with contentctl, the following common commands may b
41
41
  |-----------|---------|
42
42
  | Create a repository | `contentctl init` |
43
43
  | Validate Your Content | `contentctl validate` |
44
- | Validate Your Content, performing MITRE Enrichments | `contentctl validate –-enrichments`|
44
+ | Validate Your Content, performing MITRE Enrichments | `contentctl validate --enrichments`|
45
45
  | Build Your App | `contentctl build` |
46
- | Test All the content in your app, pausing so that you can debug a search if it fails | `contentctl test –-post-test-behavior pause_on_failure mode:all` |
47
- | Test All the content in your app, pausing after every detection to allow debugging | `contentctl test –-post-test-behavior always_pause mode:all` |
48
- | Test 1 or more specified detections. If you are testing more than one detection, the paths are space-separated. You may also use shell-expanded regexes | `contentctl test –-post-test-behavior always_pause mode:selected --mode.files detections/endpoint/7zip_commandline_to_smb_share_path.yml detections/cloud/aws_multi_factor_authentication_disabled.yml detections/application/okta*` |
49
- | Diff your current branch with a target_branch and test detections that have been updated. Your current branch **must be DIFFERENT** than the target_branch | `contentctl test –-post-test-behavior always_pause mode:changes –-mode.target_branch develop` |
50
- | Perform Integration Testing of all content. Note that Enterprise Security MUST be listed as an app in your contentctl.yml folder, otherwise all tests will subsequently fail | `contentctl test –-enable-integration-testing --post-test-behavior never_pause mode:all` |
46
+ | Test All the content in your app, pausing so that you can debug a search if it fails | `contentctl test --post-test-behavior pause_on_failure mode:all` |
47
+ | Test All the content in your app, pausing after every detection to allow debugging | `contentctl test --post-test-behavior always_pause mode:all` |
48
+ | Test 1 or more specified detections. If you are testing more than one detection, the paths are space-separated. You may also use shell-expanded regexes | `contentctl test --post-test-behavior always_pause mode:selected --mode.files detections/endpoint/7zip_commandline_to_smb_share_path.yml detections/cloud/aws_multi_factor_authentication_disabled.yml detections/application/okta*` |
49
+ | Diff your current branch with a target_branch and test detections that have been updated. Your current branch **must be DIFFERENT** than the target_branch | `contentctl test --post-test-behavior always_pause mode:changes --mode.target_branch develop` |
50
+ | Perform Integration Testing of all content. Note that Enterprise Security MUST be listed as an app in your contentctl.yml folder, otherwise all tests will subsequently fail | `contentctl test --enable-integration-testing --post-test-behavior never_pause mode:all` |
51
51
 
52
52
  # Introduction
53
53
  #### Security Is Hard
{contentctl-4.3.2.dist-info → contentctl-4.3.3.dist-info}/RECORD RENAMED
@@ -4,13 +4,13 @@ contentctl/actions/deploy_acs.py,sha256=mf3uk495H1EU_LNN-TiOsYCo18HMGoEBMb6ojeTr
4
4
  contentctl/actions/detection_testing/DetectionTestingManager.py,sha256=zg8JasDjCpSC-yhseEyUwO8qbDJIUJbhlus9Li9ZAnA,8818
5
5
  contentctl/actions/detection_testing/GitService.py,sha256=W1vnDDt8JvIL7Z1Lve3D3RS7h8qwMxrW0BMXVGuDZDM,9007
6
6
  contentctl/actions/detection_testing/generate_detection_coverage_badge.py,sha256=N5mznaeErVak3mOBwsd0RDBFJO3bku0EZvpayCyU-uk,2259
7
- contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructure.py,sha256=1PxEnhWSFgiOtIlqRD10gRShjB65i9vLiFEnwHSGf4o,55139
7
+ contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructure.py,sha256=w_ULKp-RqE7HXMSzWZ-a4ha0_45GwAG7RLixJjv_gKQ,55718
8
8
  contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructureContainer.py,sha256=REM3WB-DQAczeknGAKMzJhnvHgnt-u9yDG2UKGVj2vM,6854
9
9
  contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructureServer.py,sha256=Q1ZfCYOp54O39bgTScZMInkmZiU-bGAM9Hiwr2mq5ms,370
10
10
  contentctl/actions/detection_testing/progress_bar.py,sha256=OK9oRnPlzPAswt9KZNYID-YLHxqaYPY821kIE4-rCeA,3244
11
- contentctl/actions/detection_testing/views/DetectionTestingView.py,sha256=4UIA3BqjGpR-N4c03en1Iu5sHaiFBzfrPsnUVPaBM7A,6725
12
- contentctl/actions/detection_testing/views/DetectionTestingViewCLI.py,sha256=Mos0VV2CTSHtIqMPLwtEJlMEU7LE7TXFjM6GUA1G6hM,2050
13
- contentctl/actions/detection_testing/views/DetectionTestingViewFile.py,sha256=OJgmQgoVnzy7p1MN9bDyKGUhFWKzQc6ejc4F87uZG1I,1123
11
+ contentctl/actions/detection_testing/views/DetectionTestingView.py,sha256=nh9-gBSy-7FFBU71v4K5rwJmPzX2swFivbNfzDOpH-U,7674
12
+ contentctl/actions/detection_testing/views/DetectionTestingViewCLI.py,sha256=v5F3heZ3ZD0ik_-a_zDYSEz6oc5VdVj3e5rSSZ-tK00,2149
13
+ contentctl/actions/detection_testing/views/DetectionTestingViewFile.py,sha256=3mBCQy3hYuX8bNqh3al0nANlMwq9sxbQjkhwA1V5LOA,1090
14
14
  contentctl/actions/detection_testing/views/DetectionTestingViewWeb.py,sha256=6mecacXFoTJxcHiRZSnlHos5Hca1jdedEEZfiIAhaJg,4706
15
15
  contentctl/actions/doc_gen.py,sha256=YNc1VYA0ikL1hWDHYjfEOmUkfhy8PEIdvTyC4ZLxQRY,863
16
16
  contentctl/actions/initialize.py,sha256=Ifi13REBwQyUfCHma6IzjM_Z8uYEZ3Qz8kmP0WIFbJQ,1975
@@ -19,10 +19,10 @@ contentctl/actions/inspect.py,sha256=6gVVKmV5CUUYOkNNVTMPKj9bM1uXVthgGCoFKZGDeS8
19
19
  contentctl/actions/new_content.py,sha256=o5ZYBQ216RN6TnW_wRxVGJybx2SsJ7ht4PAi1dw45Yg,6076
20
20
  contentctl/actions/release_notes.py,sha256=akkFfLhsJuaPUyjsb6dLlKt9cUM-JApAjTFQMbYoXeM,13115
21
21
  contentctl/actions/reporting.py,sha256=MJEmvmoA1WnSFZEU9QM6daL_W94oOX0WXAcX1qAM2As,1583
22
- contentctl/actions/test.py,sha256=dx7f750_MrlvysxOmOdIro1bH0iVKF4K54TSwhvU2MU,5146
22
+ contentctl/actions/test.py,sha256=jv12UO_PTjZwvo4G-Dr8fE2gsuWvuvAmO2QQM4q7TL0,5917
23
23
  contentctl/actions/validate.py,sha256=2MQ8yumCKj7zD8iUuA5gfFEMcE-GPRzYqkvuOexn0JA,5633
24
24
  contentctl/api.py,sha256=FBOpRhbBCBdjORmwe_8MPQ3PRZ6T0KrrFcfKovVFkug,6343
25
- contentctl/contentctl.py,sha256=SxWFMYquSYQAATrTBpvfj4j5DRedsOF2xO96ASs74wA,10505
25
+ contentctl/contentctl.py,sha256=JXbUD5l1PziRRJxUc1UHrveM33CHryZPmc0RxudDpIs,10328
26
26
  contentctl/enrichments/attack_enrichment.py,sha256=HsfHfcrRmsHT6pILN457jmCGOCdAhOlRBGfAP8aZY78,7834
27
27
  contentctl/enrichments/cve_enrichment.py,sha256=SjiytaZktVNbfICXcZ2vZzBiQpOkug5taPtiJK-S1OE,2313
28
28
  contentctl/enrichments/splunk_app_enrichment.py,sha256=zDNHFLZTi2dJ1gdnh0sHkD6F1VtkblqFnhacFcCMBfc,3418
@@ -33,15 +33,15 @@ contentctl/helper/utils.py,sha256=8ICRvE7DUiNL9BK4Hw71hCLFbd3R2u86OwKeDOdaBTY,19
33
33
  contentctl/input/director.py,sha256=kTqdN_rCzRMn4dR32hPaVyx2llhAxyhJgoGjowhsHzs,10887
34
34
  contentctl/input/new_content_questions.py,sha256=o4prlBoUhEMxqpZukquI9WKbzfFJfYhEF7a8m2q_BEE,5565
35
35
  contentctl/input/yml_reader.py,sha256=hyVUYhx4Ka8C618kP2D_E3sDUKEQGC6ty_QZQArHKd4,1489
36
- contentctl/objects/abstract_security_content_objects/detection_abstract.py,sha256=V3pglFS5HYdPURIQFdNlHQfXYYr7-xLClrXiMUsb9rw,34745
37
- contentctl/objects/abstract_security_content_objects/security_content_object_abstract.py,sha256=7tv-WEiUUOvZkao272J9l1IvL0y12kJ6SWLsMeWv9VE,9820
36
+ contentctl/objects/abstract_security_content_objects/detection_abstract.py,sha256=OD0QFdBDtAlPt3vUpozeS6F0fs2iTKg6ovKJc6F-Se4,38721
37
+ contentctl/objects/abstract_security_content_objects/security_content_object_abstract.py,sha256=vdZvybF34Zlxf6XOjw400gYbpkPUkOtlu-JiWlAof40,9877
38
38
  contentctl/objects/alert_action.py,sha256=E9gjCn5C31h0sN7k90KNe4agRxFFSnMW_Z-Ri_3YQss,1335
39
39
  contentctl/objects/atomic.py,sha256=BP27gP8KHeODp6UazhVFxwDQ64wuJCARGsLfIH34h7U,8768
40
- contentctl/objects/base_test.py,sha256=7kAV0njoXaasA-Mt3Zxeq-NFwFF5Z9U85k5cEYW1iY8,1023
41
- contentctl/objects/base_test_result.py,sha256=ZEAC2IUwUrW_-zHoaS7zp-uBBKIVTS8TcMXjkMByjF4,5006
40
+ contentctl/objects/base_test.py,sha256=qUtKQJrqCto_fwCBdiH68_tXqokhcv9ceu2fQlBxsjA,1045
41
+ contentctl/objects/base_test_result.py,sha256=jVroyGLb9GD6Wm2QzvgIEA3SWCZqxPsHp9PzxSvpyIs,5101
42
42
  contentctl/objects/baseline.py,sha256=Lb1vJKtDdlDrzWgrdkC9oQao_TnRrOxSwOWHf4trtaU,2150
43
43
  contentctl/objects/baseline_tags.py,sha256=fVhLF-NmisavybB_idu3N0Con0Ymj8clKfRMkWzBB-k,1762
44
- contentctl/objects/config.py,sha256=XpCjYIoU4XTM6RL4Nt-YjMX342FJz4R-ATDXJWexHNs,43615
44
+ contentctl/objects/config.py,sha256=8oP68b_wnPLXBMdvemmWFazaBssASW4jFZjFbTNrboY,44507
45
45
  contentctl/objects/constants.py,sha256=lfCcr1DsTZvANHj4Ee1_sEV-SebHwAn41-5EvmoEX2E,3537
46
46
  contentctl/objects/correlation_search.py,sha256=QZp1u-dwTZl9hkUOlJdHQ9h4Hp2bDHWWCKtrp3mvIUY,48310
47
47
  contentctl/objects/data_source.py,sha256=aRr6lHu-EtGmi6J2nXKD7i2ozUPtp7X-vDkQiutvD3I,1545
@@ -53,17 +53,19 @@ contentctl/objects/deployment_rba.py,sha256=YFLSKzLU7s8Bt1cJkSBWlfCsc_2MfgiwyaDi
53
53
  contentctl/objects/deployment_scheduling.py,sha256=bQjbJHNaUGdU1VAGV8-nFOHzHutbIlt7FZpUvR1CV4Y,198
54
54
  contentctl/objects/deployment_slack.py,sha256=P6z8OLHDKcDWx7nbKWasqBc3dFRatGcpO2GtmxzVV8I,135
55
55
  contentctl/objects/detection.py,sha256=3W41cXf3ECjWuPqWrseqSLC3PAA7O5_nENWWM6MPK0Y,620
56
- contentctl/objects/detection_tags.py,sha256=b9dav1KJMkGXDtQLn2S7jVwnjOiMz2G5_GPd1PkGI6c,10788
56
+ contentctl/objects/detection_tags.py,sha256=esJF7Uvblynm0uJj03EV9Hkr6Jko1LobSnJK2keJXUE,10913
57
57
  contentctl/objects/enums.py,sha256=37v7w8xCg5j5hxP3kod0S3HQ9BY-CqZulPiwhnTtEvs,14052
58
58
  contentctl/objects/errors.py,sha256=gnD99z4O00EBbMerUjt4368q8mohm3Zb9HByG3CP_A0,525
59
59
  contentctl/objects/event_source.py,sha256=G9P7rtcN5hcBNQx6DG37mR3QyQufx--T6kgQGNqQuKk,415
60
- contentctl/objects/integration_test.py,sha256=W_VksBN_cRo7DTXdr1aLujjS9mgkEp0uvoNpmL0dVnQ,1273
61
- contentctl/objects/integration_test_result.py,sha256=DrIZRRlILSHGcsK_Rlm3KJLnbKPtIen8uEPFi4ZdJ8s,370
62
- contentctl/objects/investigation.py,sha256=JRoZxc_qi1fu_VFTRaxOc3B7zzSzCfEURsNzWPUCrtY,2620
60
+ contentctl/objects/integration_test.py,sha256=UBBx85f517MpQXOM7-iEasACEQ0-Ia7W4rDChOHZfno,1319
61
+ contentctl/objects/integration_test_result.py,sha256=9oVWka57alIVPiCDbNgy-OmJcBicyYbrr6anL52Wgks,278
62
+ contentctl/objects/investigation.py,sha256=MrID5n9jnoHNKyZW0UszbiPdX4uc6tQWK-1wkns2rXA,2677
63
63
  contentctl/objects/investigation_tags.py,sha256=nFpMRKBVBsW21YW_vy2G1lXaSARX-kfFyrPoCyE77Q8,1280
64
64
  contentctl/objects/lookup.py,sha256=oZwBiHfRRrv2ZXdGyWIJWSWZMpuUbsXydaDDfpenk-4,7219
65
65
  contentctl/objects/macro.py,sha256=9nE-bxkFhtaltHOUCr0luU8jCCthmglHjhKs6Q2YzLU,2684
66
- contentctl/objects/mitre_attack_enrichment.py,sha256=vhoB0oHlmPs-aDcEYT19BWrylO_hiDxOo5IWP4LBlNk,3293
66
+ contentctl/objects/manual_test.py,sha256=YNquEQ0UCzZGJ0uvHBgJ3Efho-F80ZG885ABLtqB7TI,1022
67
+ contentctl/objects/manual_test_result.py,sha256=C4AYW3jlMsxVzCPzCA5dpAcbKgCpmDO43JmptFm--Q4,155
68
+ contentctl/objects/mitre_attack_enrichment.py,sha256=4c5zapPm1Dpmcg_bgUAjZRY5zS3yPFKYzz5zllb-u1o,3350
67
69
  contentctl/objects/notable_action.py,sha256=ValkblBaG-60TF19y_vSnNzoNZ3eg48wIfr0qZxyKTA,1605
68
70
  contentctl/objects/notable_event.py,sha256=ITcwLzeatSGpe8267PYN-EhgqOSoWTfciCBVu8zjOXE,682
69
71
  contentctl/objects/observable.py,sha256=pw0Ehi_KMb7nXzw2kuw1FnCknpD8zDkCAqBTa-M_F28,1313
@@ -73,14 +75,14 @@ contentctl/objects/risk_analysis_action.py,sha256=Glzcq99DAqqOJ2eZYCkUI3R5hA5cZG
73
75
  contentctl/objects/risk_event.py,sha256=LnFg0BKnt7rMJvzxZoaFeInKP4w5onvJwOUxMWWDk6w,14303
74
76
  contentctl/objects/risk_object.py,sha256=yY4NmEwEKaRl4sLzCRZb1n8kdpV3HzYbQVQ1ClQWYHw,904
75
77
  contentctl/objects/security_content_object.py,sha256=j8KNDwSMfZsSIzJucC3NuZo0SlFVpqHfDc6y3-YHjHI,234
76
- contentctl/objects/ssa_detection.py,sha256=-G6tXfVVlZgPWS64hIIy3M-aMePANAuQvdpXPlgUyUs,5873
78
+ contentctl/objects/ssa_detection.py,sha256=ud0T6lq-5XUlmeK8Jzw_aNLe6podVcA1o7THDYvWbik,5934
77
79
  contentctl/objects/ssa_detection_tags.py,sha256=9aRwbpQHi79NIS9rofjgxDJpw7cWXqG534_kSbvHJh8,5220
78
80
  contentctl/objects/story.py,sha256=FXe11LV19xJTtCgx7DKdvV9cL0gKeryUnE3yjpnDmrU,4957
79
- contentctl/objects/story_tags.py,sha256=puF-g61YA6eGZy9eLjp4l-5IblMrekcYtQX8EYFOvk0,2221
80
- contentctl/objects/test_group.py,sha256=Yb1sqGom6SkVL8B3czPndz8w3CK8WdwZ39V_cn0_JZQ,2600
81
+ contentctl/objects/story_tags.py,sha256=qIVCEk3Vr-63tjq3PKapMUUUL6jNCHyp2AqGzDAE-tk,2279
82
+ contentctl/objects/test_attack_data.py,sha256=9OgErjdPR4S-SJpQePt0uwBLPYHYPtqKDd-auhjz7Uc,430
83
+ contentctl/objects/test_group.py,sha256=DCtm4ChGYksOwZQVHsioaweOvI37CSlTZJzKvBX-jbY,2586
81
84
  contentctl/objects/threat_object.py,sha256=S8B7RQFfLxN_g7yKPrDTuYhIy9JvQH3YwJ_T5LUZIa4,711
82
- contentctl/objects/unit_test.py,sha256=AQcGdi4zEMl9PqZTRnBI87_VU7ySaHrPiBHOlquoxrM,1372
83
- contentctl/objects/unit_test_attack_data.py,sha256=ZmHA83O8i9VZveDAliNp_XVKOuH5ytGN9l3X8v8jm4o,480
85
+ contentctl/objects/unit_test.py,sha256=eMFehpHhmZA5WYBqhWUNRF_LpxuLM9VooAxjXeNbrxY,1144
84
86
  contentctl/objects/unit_test_baseline.py,sha256=XHvOm7qLYfqrP6uC5U_pfgw_pf8-S2RojuNmbo6lXlM,227
85
87
  contentctl/objects/unit_test_old.py,sha256=IfvytHG4ZnUhsvXgdczECZbiwv6YLViYdsk9AqeDBjQ,199
86
88
  contentctl/objects/unit_test_result.py,sha256=POQfvvPpSw-jQzINBz1_IszUMJ4Wbopu8HRS1Qe6P2M,2940
@@ -121,7 +123,7 @@ contentctl/output/templates/header.j2,sha256=3usV7jm1q6J-QNnQrZzII9cN0XEGQjg_eVK
121
123
  contentctl/output/templates/macros.j2,sha256=SLcQQ5X7TZS8j-2qP06BTXqdIcnwoYqTAaBLX2Dge7Y,390
122
124
  contentctl/output/templates/panel.j2,sha256=Cw_W6p-14n6UivVfpS75KKJiJ2VpdGsSBceYsUYe9gk,221
123
125
  contentctl/output/templates/savedsearches_baselines.j2,sha256=xr05J9WJSVdwpiBoPWEejZ1hmeqInyDKyDH4kjzHP6U,1743
124
- contentctl/output/templates/savedsearches_detections.j2,sha256=ZEY2oxn1NXrx28OR46azAs9coX_PhK7UGfyiLZh8g2c,6381
126
+ contentctl/output/templates/savedsearches_detections.j2,sha256=Y-yrvikFG7zQx6bJ-AkVFdZR8P6kRE-gQHyHc1aEyvs,6376
125
127
  contentctl/output/templates/savedsearches_investigations.j2,sha256=aFIDK4NqtsZr3fb4F_tv9UQTQ2Z-n9pkP5rIocPA65Q,1259
126
128
  contentctl/output/templates/transforms.j2,sha256=-cSoie0LgJwibtW-GMhc9BQlmS6h1s1Vykm9O2M0f9Y,1456
127
129
  contentctl/output/templates/workflow_actions.j2,sha256=DFoZVnCa8dMRHjW2AdpoydBC0THgiH_W-Nx7WI4-uR4,925
@@ -163,8 +165,8 @@ contentctl/templates/detections/web/.gitkeep,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRk
163
165
  contentctl/templates/macros/security_content_ctime.yml,sha256=Gg1YNllHVsX_YB716H1SJLWzxXZEfuJlnsgB2fuyoHU,159
164
166
  contentctl/templates/macros/security_content_summariesonly.yml,sha256=9BYUxAl2E4Nwh8K19F3AJS8Ka7ceO6ZDBjFiO3l3LY0,162
165
167
  contentctl/templates/stories/cobalt_strike.yml,sha256=rlaXxMN-5k8LnKBLPafBoksyMtlmsPMHPJOjTiMiZ-M,3063
166
- contentctl-4.3.2.dist-info/LICENSE.md,sha256=hQWUayRk-pAiOZbZnuy8djmoZkjKBx8MrCFpW-JiOgo,11344
167
- contentctl-4.3.2.dist-info/METADATA,sha256=AkxYjJ2zP-wRhoyOVMq5cGNJDmA8QFRkRy6FQaIKCbY,20939
168
- contentctl-4.3.2.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
169
- contentctl-4.3.2.dist-info/entry_points.txt,sha256=5bjZ2NkbQfSwK47uOnA77yCtjgXhvgxnmCQiynRF_-U,57
170
- contentctl-4.3.2.dist-info/RECORD,,
168
+ contentctl-4.3.3.dist-info/LICENSE.md,sha256=hQWUayRk-pAiOZbZnuy8djmoZkjKBx8MrCFpW-JiOgo,11344
169
+ contentctl-4.3.3.dist-info/METADATA,sha256=utrc_z9xKTEuH2CQrudSeb6J4BQZloMvVxkb6y17pvA,20925
170
+ contentctl-4.3.3.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
171
+ contentctl-4.3.3.dist-info/entry_points.txt,sha256=5bjZ2NkbQfSwK47uOnA77yCtjgXhvgxnmCQiynRF_-U,57
172
+ contentctl-4.3.3.dist-info/RECORD,,