contentctl 4.4.7__py3-none-any.whl → 5.0.0__py3-none-any.whl

contentctl/input/new_content_questions.py

@@ -3,9 +3,8 @@ from contentctl.objects.enums import DataSource
 
 
 class NewContentQuestions:
-
     @classmethod
-    def get_questions_detection(cls) -> list[dict[str,Any]]:
+    def get_questions_detection(cls) -> list[dict[str, Any]]:
         questions = [
             {
                 "type": "text",
@@ -14,22 +13,16 @@ class NewContentQuestions:
                 "default": "Powershell Encoded Command",
             },
             {
-                'type': 'select',
-                'message': 'what kind of detection is this',
-                'name': 'detection_kind',
-                'choices': [
-                    'endpoint',
-                    'cloud',
-                    'application',
-                    'network',
-                    'web'
-                ],
-                'default': 'endpoint'
+                "type": "select",
+                "message": "what kind of detection is this",
+                "name": "detection_kind",
+                "choices": ["endpoint", "cloud", "application", "network", "web"],
+                "default": "endpoint",
             },
             {
-                'type': 'text',
-                'message': 'enter author name',
-                'name': 'detection_author',
+                "type": "text",
+                "message": "enter author name",
+                "name": "detection_author",
             },
             {
                 "type": "select",
@@ -46,18 +39,17 @@ class NewContentQuestions:
                 "default": "TTP",
             },
             {
-                'type': 'checkbox',
-                'message': 'Your data source',
-                'name': 'data_source',
-                #In the future, we should dynamically populate this from the DataSource Objects we have parsed from the data_sources directory
-                'choices': sorted(DataSource._value2member_map_ )
-                
+                "type": "checkbox",
+                "message": "Your data source",
+                "name": "data_sources",
+                # In the future, we should dynamically populate this from the DataSource Objects we have parsed from the data_sources directory
+                "choices": sorted(DataSource._value2member_map_),
             },
             {
                 "type": "text",
                 "message": "enter search (spl)",
                 "name": "detection_search",
-                "default": "| UPDATE_SPL",
+                "default": "| __UPDATE__ SPL",
             },
             {
                 "type": "text",
@@ -66,24 +58,24 @@ class NewContentQuestions:
                 "default": "T1003.002",
             },
             {
-                'type': 'select',
-                'message': 'security_domain for detection',
-                'name': 'security_domain',
-                'choices': [
-                    'access',
-                    'endpoint',
-                    'network',
-                    'threat',
-                    'identity',
-                    'audit'
+                "type": "select",
+                "message": "security_domain for detection",
+                "name": "security_domain",
+                "choices": [
+                    "access",
+                    "endpoint",
+                    "network",
+                    "threat",
+                    "identity",
+                    "audit",
                 ],
-                'default': 'endpoint'
+                "default": "endpoint",
             },
         ]
         return questions
 
     @classmethod
-    def get_questions_story(cls)-> list[dict[str,Any]]:
+    def get_questions_story(cls) -> list[dict[str, Any]]:
         questions = [
             {
                 "type": "text",

contentctl/input/yml_reader.py

@@ -1,34 +1,46 @@
 from typing import Dict, Any
-
 import yaml
-
-
 import sys
 import pathlib
 
-class YmlReader():
 
+class YmlReader:
     @staticmethod
-    def load_file(file_path: pathlib.Path, add_fields=True, STRICT_YML_CHECKING=False) -> Dict[str,Any]:
+    def load_file(
+        file_path: pathlib.Path,
+        add_fields: bool = True,
+        STRICT_YML_CHECKING: bool = False,
+    ) -> Dict[str, Any]:
         try:
-            file_handler = open(file_path, 'r', encoding="utf-8")
-            
-            # The following code can help diagnose issues with duplicate keys or 
+            file_handler = open(file_path, "r", encoding="utf-8")
+
+            # The following code can help diagnose issues with duplicate keys or
             # poorly-formatted but still "compliant" YML.  This code should be
-            # enabled manually for debugging purposes. As such, strictyaml 
+            # enabled manually for debugging purposes. As such, strictyaml
             # library is intentionally excluded from the contentctl requirements
 
             if STRICT_YML_CHECKING:
                 import strictyaml
+
                 try:
-                    strictyaml.dirty_load(file_handler.read(), allow_flow_style = True)
+                    strictyaml.dirty_load(file_handler.read(), allow_flow_style=True)
                     file_handler.seek(0)
                 except Exception as e:
                     print(f"Error loading YML file {file_path}: {str(e)}")
                     sys.exit(1)
             try:
-                #yml_obj = list(yaml.safe_load_all(file_handler))[0]
-                yml_obj = yaml.load(file_handler, Loader=yaml.CSafeLoader)
+                # Ideally we should use
+                # from contentctl.actions.new_content import NewContent
+                # and use NewContent.UPDATE_PREFIX,
+                # but there is a circular dependency right now which makes that difficult.
+                # We have instead hardcoded UPDATE_PREFIX
+                UPDATE_PREFIX = "__UPDATE__"
+                data = file_handler.read()
+                if UPDATE_PREFIX in data:
+                    raise Exception(
+                        f"The file {file_path} contains the value '{UPDATE_PREFIX}'. Please fill out any unpopulated fields as required."
+                    )
+                yml_obj = yaml.load(data, Loader=yaml.CSafeLoader)
             except yaml.YAMLError as exc:
                 print(exc)
                 sys.exit(1)
@@ -36,12 +48,10 @@ class YmlReader():
         except OSError as exc:
             print(exc)
             sys.exit(1)
-        
-        if add_fields == False:
+
+        if add_fields is False:
             return yml_obj
-        
-        
-        yml_obj['file_path'] = str(file_path)
-    
+
+        yml_obj["file_path"] = str(file_path)
 
         return yml_obj