contentctl 4.4.4__py3-none-any.whl → 4.4.6__py3-none-any.whl

contentctl/actions/detection_testing/GitService.py

@@ -13,6 +13,7 @@ if TYPE_CHECKING:
 from contentctl.objects.macro import Macro
 from contentctl.objects.lookup import Lookup
 from contentctl.objects.detection import Detection
+from contentctl.objects.data_source import DataSource
 from contentctl.objects.security_content_object import SecurityContentObject
 from contentctl.objects.config import test_common, All, Changes, Selected
 
@@ -67,9 +68,12 @@ class GitService(BaseModel):
 
         #Make a filename to content map
         filepath_to_content_map = { obj.file_path:obj for (_,obj) in self.director.name_to_content_map.items()} 
-        updated_detections:set[Detection] = set()
-        updated_macros:set[Macro] = set()
-        updated_lookups:set[Lookup] = set()
+
+        updated_detections: set[Detection] = set()
+        updated_macros: set[Macro] = set()
+        updated_lookups: set[Lookup] = set()
+        updated_datasources: set[DataSource] = set()
+
 
         for diff in all_diffs:
             if type(diff) == pygit2.Patch:
@@ -90,6 +94,13 @@ class GitService(BaseModel):
                             updated_macros.add(macroObject)
                         else:
                             raise Exception(f"Error getting macro object for file {str(decoded_path)}")
+                        
+                    elif decoded_path.is_relative_to(self.config.path/"data_sources") and decoded_path.suffix == ".yml":
+                        datasourceObject = filepath_to_content_map.get(decoded_path, None)
+                        if isinstance(datasourceObject, DataSource):
+                            updated_datasources.add(datasourceObject)
+                        else:
+                            raise Exception(f"Error getting data source object for file {str(decoded_path)}")
 
                     elif decoded_path.is_relative_to(self.config.path/"lookups"):
                         # We need to convert this to a yml. This means we will catch
@@ -115,7 +126,6 @@ class GitService(BaseModel):
                             # Detected a changed .mlmodel file. However, since we do not have testing for these detections at 
                             # this time, we will ignore this change.
                             updatedLookup = None
-                            
 
                         else:
                             raise Exception(f"Detected a changed file in the lookups/ directory '{str(decoded_path)}'.\n"
@@ -136,7 +146,8 @@ class GitService(BaseModel):
 
         # If a detection has at least one dependency on changed content,
         # then we must test it again
-        changed_macros_and_lookups:set[SecurityContentObject] = updated_macros.union(updated_lookups)
+
+        changed_macros_and_lookups_and_datasources:set[SecurityContentObject] = updated_macros.union(updated_lookups, updated_datasources)
         
         for detection in self.director.detections:
             if detection in updated_detections:
@@ -144,7 +155,7 @@ class GitService(BaseModel):
                 # to add it again
                 continue
 
-            for obj in changed_macros_and_lookups:
+            for obj in changed_macros_and_lookups_and_datasources:
                 if obj in detection.get_content_dependencies():
                    updated_detections.add(detection)
                    break

contentctl/actions/new_content.py

@@ -29,8 +29,7 @@ class NewContent:
         answers['date'] = datetime.today().strftime('%Y-%m-%d')
         answers['author'] = answers['detection_author']
         del answers['detection_author']
-        answers['data_sources'] = answers['data_source']
-        del answers['data_source']
+        answers['data_source'] = answers['data_source']
         answers['type'] = answers['detection_type']
         del answers['detection_type']
         answers['status'] = "production" #start everything as production since that's what we INTEND the content to become   

contentctl/objects/abstract_security_content_objects/detection_abstract.py

@@ -689,6 +689,7 @@ class Detection_Abstract(SecurityContentObject):
         objects: list[SecurityContentObject] = []
         objects += self.macros
         objects += self.lookups
+        objects += self.data_source_objects
         return objects
 
     @field_validator("deployment", mode="before")

{contentctl-4.4.4.dist-info → contentctl-4.4.6.dist-info}/METADATA

@@ -1,16 +1,15 @@
 Metadata-Version: 2.1
 Name: contentctl
-Version: 4.4.4
+Version: 4.4.6
 Summary: Splunk Content Control Tool
 License: Apache 2.0
 Author: STRT
 Author-email: research@splunk.com
-Requires-Python: >=3.11,<4.0
+Requires-Python: >=3.11,<3.13
 Classifier: License :: Other/Proprietary License
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
 Requires-Dist: Jinja2 (>=3.1.4,<4.0.0)
 Requires-Dist: PyYAML (>=6.0.2,<7.0.0)
 Requires-Dist: attackcti (>=0.4.0,<0.5.0)

{contentctl-4.4.4.dist-info → contentctl-4.4.6.dist-info}/RECORD

@@ -2,7 +2,7 @@ contentctl/__init__.py,sha256=IMjkMO3twhQzluVTo8Z6rE7Eg-9U79_LGKMcsWLKBkY,22
 contentctl/actions/build.py,sha256=T1shTnBqJ2OfAL5RRDLBw1CdeV-Oqqp3uJ8ObEEKTIM,5201
 contentctl/actions/deploy_acs.py,sha256=4mD3wEgudi8UWpTW9mB5n65Bcs1w4g5cG2yflj-uEck,3259
 contentctl/actions/detection_testing/DetectionTestingManager.py,sha256=zg8JasDjCpSC-yhseEyUwO8qbDJIUJbhlus9Li9ZAnA,8818
-contentctl/actions/detection_testing/GitService.py,sha256=cofi7yilcaq_5fugSbRpSmQjFRKFcB8nJmOdUfHVRzc,9045
+contentctl/actions/detection_testing/GitService.py,sha256=HcyuPrW6zBeCNu2l2JJgB_wTyvdWeK3Ii32pUf3vs08,9698
 contentctl/actions/detection_testing/generate_detection_coverage_badge.py,sha256=N5mznaeErVak3mOBwsd0RDBFJO3bku0EZvpayCyU-uk,2259
 contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructure.py,sha256=mcdLt3tZr-xF5xaYnD0q7JQx9qrbRIzPNl6D9MeeB5k,56999
 contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructureContainer.py,sha256=WCtyyMKTA17JzPIb10rV8C6vdG-cBzHtFC9T2CuYY2o,7047
@@ -16,7 +16,7 @@ contentctl/actions/doc_gen.py,sha256=YNc1VYA0ikL1hWDHYjfEOmUkfhy8PEIdvTyC4ZLxQRY
 contentctl/actions/initialize.py,sha256=wEO3u8vJYP8Xh2OSJ_HxfMV6mqOdkPyWbUzNGEqMTNA,3055
 contentctl/actions/initialize_old.py,sha256=0qXbW_fNDvkcnEeL6Zpte8d-hpTu1REyzHsXOCY-YB8,9333
 contentctl/actions/inspect.py,sha256=dXV020g_GwwspSgiS6jQxW0JEVr_nublJBevwZ79mZo,17424
-contentctl/actions/new_content.py,sha256=Mz70StFt0bbuUYUHzQ1NINAbPqPsM4deUdlxgQ5S7-k,6481
+contentctl/actions/new_content.py,sha256=3ZKSQ_O7GUTflEg2bqo2iGK65EaL96c4MEqGJPanXWg,6445
 contentctl/actions/release_notes.py,sha256=0K7zHQyVHVYK_whiv4PvxOKS4_0s1Ya_RDCrrcT3FW4,13319
 contentctl/actions/reporting.py,sha256=MJEmvmoA1WnSFZEU9QM6daL_W94oOX0WXAcX1qAM2As,1583
 contentctl/actions/test.py,sha256=jv12UO_PTjZwvo4G-Dr8fE2gsuWvuvAmO2QQM4q7TL0,5917
@@ -33,7 +33,7 @@ contentctl/helper/utils.py,sha256=8ICRvE7DUiNL9BK4Hw71hCLFbd3R2u86OwKeDOdaBTY,19
 contentctl/input/director.py,sha256=U7jrhqP7IbfaSLXGIVtKrVvGTwIrmI1roW2X1jmZZ8Q,10841
 contentctl/input/new_content_questions.py,sha256=p-rop4YpCjyg0RYKQ7Cvk9-7uaa5GDELNVeeUlxk6ks,4191
 contentctl/input/yml_reader.py,sha256=hyVUYhx4Ka8C618kP2D_E3sDUKEQGC6ty_QZQArHKd4,1489
-contentctl/objects/abstract_security_content_objects/detection_abstract.py,sha256=L9ePzkwjkN2wfAM4su-fXJusIeryK7RqKgdqT4ViZwc,45722
+contentctl/objects/abstract_security_content_objects/detection_abstract.py,sha256=QnLfNK4fa-Y-LmdPVfEJMa8WDzDsKz-bwpixbCLJKNo,45766
 contentctl/objects/abstract_security_content_objects/security_content_object_abstract.py,sha256=VUTNG6LvYf5D1L8UA5uciBBI0VfB432-6TCe2hP-_YE,10324
 contentctl/objects/alert_action.py,sha256=E9gjCn5C31h0sN7k90KNe4agRxFFSnMW_Z-Ri_3YQss,1335
 contentctl/objects/annotated_types.py,sha256=jnX02BQT4dHbd_DCIjik0PNN3kgsvb7sxAz_1Jy8TOY,259
@@ -166,8 +166,8 @@ contentctl/templates/detections/web/.gitkeep,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRk
 contentctl/templates/macros/security_content_ctime.yml,sha256=Gg1YNllHVsX_YB716H1SJLWzxXZEfuJlnsgB2fuyoHU,159
 contentctl/templates/macros/security_content_summariesonly.yml,sha256=9BYUxAl2E4Nwh8K19F3AJS8Ka7ceO6ZDBjFiO3l3LY0,162
 contentctl/templates/stories/cobalt_strike.yml,sha256=rlaXxMN-5k8LnKBLPafBoksyMtlmsPMHPJOjTiMiZ-M,3063
-contentctl-4.4.4.dist-info/LICENSE.md,sha256=hQWUayRk-pAiOZbZnuy8djmoZkjKBx8MrCFpW-JiOgo,11344
-contentctl-4.4.4.dist-info/METADATA,sha256=3zRhuCBmek4vTGSvBroXV4tHTIfmEpPugsxFRu4XBlY,21536
-contentctl-4.4.4.dist-info/WHEEL,sha256=Nq82e9rUAnEjt98J6MlVmMCZb-t9cYE2Ir1kpBmnWfs,88
-contentctl-4.4.4.dist-info/entry_points.txt,sha256=5bjZ2NkbQfSwK47uOnA77yCtjgXhvgxnmCQiynRF_-U,57
-contentctl-4.4.4.dist-info/RECORD,,
+contentctl-4.4.6.dist-info/LICENSE.md,sha256=hQWUayRk-pAiOZbZnuy8djmoZkjKBx8MrCFpW-JiOgo,11344
+contentctl-4.4.6.dist-info/METADATA,sha256=1Pm1dJSU9fg8yNPt0dknhmoq_xdt5vXN3m--qV3fMiM,21486
+contentctl-4.4.6.dist-info/WHEEL,sha256=Nq82e9rUAnEjt98J6MlVmMCZb-t9cYE2Ir1kpBmnWfs,88
+contentctl-4.4.6.dist-info/entry_points.txt,sha256=5bjZ2NkbQfSwK47uOnA77yCtjgXhvgxnmCQiynRF_-U,57
+contentctl-4.4.6.dist-info/RECORD,,