contentctl 5.2.0__py3-none-any.whl → 5.3.0__py3-none-any.whl

contentctl/objects/rba.py

@@ -4,9 +4,7 @@ from abc import ABC
 from enum import Enum
 from typing import Annotated, Set
 
-from pydantic import BaseModel, Field, computed_field, model_serializer
-
-from contentctl.objects.enums import RiskSeverity
+from pydantic import BaseModel, Field, model_serializer
 
 RiskScoreValue_Type = Annotated[int, Field(ge=1, le=100)]
 
@@ -108,36 +106,6 @@ class RBAObject(BaseModel, ABC):
     risk_objects: Annotated[Set[RiskObject], Field(min_length=1)]
     threat_objects: Set[ThreatObject]
 
-    @computed_field
-    @property
-    def risk_score(self) -> RiskScoreValue_Type:
-        # First get the maximum score associated with
-        # a risk object. If there are no objects, then
-        # we should throw an exception.
-        if len(self.risk_objects) == 0:
-            raise Exception(
-                "There must be at least one Risk Object present to get Severity."
-            )
-        return max([risk_object.score for risk_object in self.risk_objects])
-
-    @computed_field
-    @property
-    def severity(self) -> RiskSeverity:
-        if 0 <= self.risk_score <= 20:
-            return RiskSeverity.INFORMATIONAL
-        elif 20 < self.risk_score <= 40:
-            return RiskSeverity.LOW
-        elif 40 < self.risk_score <= 60:
-            return RiskSeverity.MEDIUM
-        elif 60 < self.risk_score <= 80:
-            return RiskSeverity.HIGH
-        elif 80 < self.risk_score <= 100:
-            return RiskSeverity.CRITICAL
-        else:
-            raise Exception(
-                f"Error getting severity - risk_score must be between 0-100, but was actually {self.risk_score}"
-            )
-
     @model_serializer
     def serialize_rba(self) -> dict[str, str | list[dict[str, str | int]]]:
         return {

contentctl/objects/removed_security_content_object.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+import pathlib
+from functools import cached_property
+
+from pydantic import ConfigDict, HttpUrl, computed_field, field_validator
+
+from contentctl.objects.abstract_security_content_objects.security_content_object_abstract import (
+    SecurityContentObject_Abstract,
+)
+from contentctl.objects.enums import ContentStatus
+
+
+class SecurityContentObject(SecurityContentObject_Abstract):
+    pass
+
+
+class RemovedSecurityContentObject(SecurityContentObject):
+    # We MUST allow extra fields here because the python definitions of the underlying
+    # objects can change. We do not want to throw pasing errors on any of these, but we will
+    # only expose fields that are defined in the SecurityContentObject definiton directly
+    model_config = ConfigDict(validate_default=True, extra="ignore")
+    status: ContentStatus
+
+    @field_validator("status", mode="after")
+    @classmethod
+    def NarrowStatus(cls, status: ContentStatus) -> ContentStatus:
+        return cls.NarrowStatusTemplate(status, [ContentStatus.removed])
+
+    @computed_field
+    @cached_property
+    def migration_guide(self) -> HttpUrl:
+        """
+        A link to the research site containing a migration guide for the content
+
+        :returns: URL to the research site
+        :rtype: HTTPUrl
+        """
+        # this is split up so that we can explicilty ignore the warning on constructing
+        # the HttpUrl but catch other type issues
+        # link = f"https://research.splunk.com/migration_guide/{self.id}"
+        # This can likely be dynamically generated per detection, but for now we
+        # just make it static
+        link = "https://research.splunk.com/migration_guide/"
+
+        return HttpUrl(url=link)  # type: ignore
+
+    @classmethod
+    def containing_folder(cls) -> pathlib.Path:
+        return pathlib.Path("removed")

contentctl/objects/security_content_object.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+
 from contentctl.objects.abstract_security_content_objects.security_content_object_abstract import (
     SecurityContentObject_Abstract,
 )

contentctl/objects/story.py

@@ -1,9 +1,17 @@
 from __future__ import annotations
 
 import re
-from typing import TYPE_CHECKING, List, Literal
-
-from pydantic import Field, computed_field, model_serializer, model_validator
+from functools import cached_property
+from typing import TYPE_CHECKING, List
+
+from pydantic import (
+    Field,
+    HttpUrl,
+    computed_field,
+    field_validator,
+    model_serializer,
+    model_validator,
+)
 
 from contentctl.objects.story_tags import StoryTags
 
@@ -14,20 +22,40 @@ if TYPE_CHECKING:
     from contentctl.objects.detection import Detection
     from contentctl.objects.investigation import Investigation
 
-from contentctl.objects.enums import DetectionStatus
+import pathlib
+
+from contentctl.objects.enums import ContentStatus
 from contentctl.objects.security_content_object import SecurityContentObject
 
 
 class Story(SecurityContentObject):
     narrative: str = Field(...)
     tags: StoryTags = Field(...)
-    status: Literal[DetectionStatus.production, DetectionStatus.deprecated]
+    status: ContentStatus
     # These are updated when detection and investigation objects are created.
     # Specifically in the model_post_init functions
     detections: List[Detection] = []
     investigations: List[Investigation] = []
     baselines: List[Baseline] = []
 
+    @field_validator("status", mode="after")
+    @classmethod
+    def NarrowStatus(cls, status: ContentStatus) -> ContentStatus:
+        return cls.NarrowStatusTemplate(
+            status, [ContentStatus.production, ContentStatus.deprecated]
+        )
+
+    @classmethod
+    def containing_folder(cls) -> pathlib.Path:
+        return pathlib.Path("stories")
+
+    @computed_field
+    @cached_property
+    def researchSiteLink(self) -> HttpUrl:
+        return HttpUrl(
+            url=f"https://research.splunk.com/stories/{self.name.lower().replace(' ', '_')}"
+        )  # type:ignore
+
     @computed_field
     @property
     def data_sources(self) -> list[DataSource]:
@@ -145,3 +173,7 @@ class Story(SecurityContentObject):
     @property
     def baseline_names(self) -> List[str]:
         return [baseline.name for baseline in self.baselines]
+
+    @classmethod
+    def static_get_conf_stanza_name(cls, name: str, app: CustomApp) -> str:
+        return name

contentctl/output/api_json_output.py

@@ -1,14 +1,15 @@
 from __future__ import annotations
+
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
+    from contentctl.objects.baseline import Baseline
+    from contentctl.objects.deployment import Deployment
     from contentctl.objects.detection import Detection
+    from contentctl.objects.investigation import Investigation
     from contentctl.objects.lookup import Lookup
     from contentctl.objects.macro import Macro
     from contentctl.objects.story import Story
-    from contentctl.objects.baseline import Baseline
-    from contentctl.objects.investigation import Investigation
-    from contentctl.objects.deployment import Deployment
 
 import os
 import pathlib
@@ -42,6 +43,7 @@ class ApiJsonOutput:
                         "search",
                         "how_to_implement",
                         "known_false_positives",
+                        "rba",
                         "references",
                         "datamodel",
                         "macros",

contentctl/output/conf_output.py

@@ -93,6 +93,10 @@ class ConfOutput:
 
         return written_files
 
+    # TODO (#339): we could have a discrepancy between detections tested and those delivered
+    #   based on the jinja2 template
+    #   {% if (detection.type == 'TTP' or detection.type == 'Anomaly' or
+    #       detection.type == 'Hunting' or detection.type == 'Correlation') %}
     def writeDetections(self, objects: list[Detection]) -> set[pathlib.Path]:
         written_files: set[pathlib.Path] = set()
         for output_app_path, template_name in [
@@ -211,7 +215,11 @@ class ConfOutput:
             # even though the MLModel info was intentionally not written to the
             # transforms.conf file as noted above.
             if isinstance(lookup, FileBackedLookup):
-                shutil.copy(lookup.filename, lookup_folder / lookup.app_filename.name)
+                with (
+                    open(lookup_folder / lookup.app_filename.name, "w") as output_file,
+                    lookup.content_file_handle as output,
+                ):
+                    output_file.write(output.read())
         return written_files
 
     def writeMacros(self, objects: list[Macro]) -> set[pathlib.Path]:

contentctl/output/runtime_csv_writer.py

@@ -0,0 +1,111 @@
+from __future__ import annotations
+
+import csv
+from io import StringIO
+from typing import TYPE_CHECKING, List
+
+if TYPE_CHECKING:
+    from contentctl.input.director import DirectorOutputDto
+
+from contentctl.objects.config import CustomApp
+from contentctl.objects.data_source import DataSource
+
+
+class RuntimeCsvWriter:
+    @staticmethod
+    def generateDeprecationCSVContent(
+        director: DirectorOutputDto, app: CustomApp
+    ) -> str:
+        with StringIO() as output_buffer:
+            fieldNames = [
+                "Name",
+                "Content Type",
+                "Removed in Version",
+                "Reason",
+                "Replacement Content",
+                "Replacement Content Link",
+            ]
+
+            writer = csv.DictWriter(output_buffer, fieldnames=fieldNames)
+            writer.writeheader()
+
+            for content in director.name_to_content_map.values():
+                if content.deprecation_info is not None:
+                    try:
+                        writer.writerow(
+                            {
+                                "Name": content.deprecation_info.contentType.static_get_conf_stanza_name(
+                                    content.name, app
+                                ),
+                                "Content Type": content.deprecation_info.contentType.__name__,
+                                "Removed in Version": content.deprecation_info.removed_in_version,
+                                "Reason": content.deprecation_info.reason,
+                                "Replacement Content": "\n".join(
+                                    [
+                                        c.name
+                                        for c in content.deprecation_info.replacement_content
+                                    ]
+                                )
+                                or "No Replacement Content Available",
+                                "Replacement Content Link": "\n".join(
+                                    [
+                                        str(c.researchSiteLink)
+                                        for c in content.deprecation_info.replacement_content
+                                    ]
+                                )
+                                or "No Content Link Available",
+                            }
+                        )
+                    except Exception as e:
+                        print(e)
+                        import code
+
+                        code.interact(local=locals())
+            return output_buffer.getvalue()
+
+    @staticmethod
+    def generateDatasourceCSVContent(
+        data_source_objects: List[DataSource],
+    ) -> str:
+        with StringIO() as output_buffer:
+            writer = csv.writer(output_buffer)
+            # Write the header
+            writer.writerow(
+                [
+                    "name",
+                    "id",
+                    "author",
+                    "source",
+                    "sourcetype",
+                    "separator",
+                    "supported_TA_name",
+                    "supported_TA_version",
+                    "supported_TA_url",
+                    "description",
+                ]
+            )
+            # Write the data
+            for data_source in data_source_objects:
+                if len(data_source.supported_TA) > 0:
+                    supported_TA_name = data_source.supported_TA[0].name
+                    supported_TA_version = data_source.supported_TA[0].version
+                    supported_TA_url = data_source.supported_TA[0].url or ""
+                else:
+                    supported_TA_name = ""
+                    supported_TA_version = ""
+                    supported_TA_url = ""
+                writer.writerow(
+                    [
+                        data_source.name,
+                        data_source.id,
+                        data_source.author,
+                        data_source.source,
+                        data_source.sourcetype,
+                        data_source.separator,
+                        supported_TA_name,
+                        supported_TA_version,
+                        supported_TA_url,
+                        data_source.description,
+                    ]
+                )
+            return output_buffer.getvalue()

contentctl/output/svg_output.py

@@ -1,10 +1,9 @@
 import pathlib
-from typing import List, Any
+from typing import Any, List
 
-from contentctl.objects.enums import SecurityContentType
-from contentctl.output.jinja_writer import JinjaWriter
-from contentctl.objects.enums import DetectionStatus
 from contentctl.objects.detection import Detection
+from contentctl.objects.enums import ContentStatus, SecurityContentType
+from contentctl.output.jinja_writer import JinjaWriter
 
 
 class SvgOutput:
@@ -49,7 +48,7 @@ class SvgOutput:
             [
                 detection
                 for detection in detections
-                if detection.status == DetectionStatus.production
+                if detection.status == ContentStatus.production
             ],
         )
         # deprecated_dict = self.get_badge_dict("Deprecated", detections, [detection for detection in detections if detection.status == DetectionStatus.deprecated])

contentctl/output/templates/savedsearches_detections.j2

@@ -65,14 +65,10 @@ action.notable.param.nes_fields = {{ detection.nes_fields }}
 action.notable.param.rule_description = {{ detection.deployment.alert_action.notable.rule_description | custom_jinja2_enrichment_filter(detection) | escapeNewlines()}}
 action.notable.param.rule_title = {% if detection.type | lower == "correlation" %}RBA: {{ detection.deployment.alert_action.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}{% else %}{{ detection.deployment.alert_action.notable.rule_title | custom_jinja2_enrichment_filter(detection) }}{% endif +%}
 action.notable.param.security_domain = {{ detection.tags.security_domain }}
-{% if detection.rba %}
-action.notable.param.severity = {{ detection.rba.severity }}
-{% else %}
-{# Correlations do not have detection.rba defined, but should get a default severity #}
-action.notable.param.severity = high 
-{% endif %}
+action.notable.param.severity = {{ detection.severity }}
 {% endif %}
 {% if detection.deployment.alert_action.email %}
+action.email = 1
 action.email.subject.alert = {{ detection.deployment.alert_action.email.subject | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}
 action.email.to = {{ detection.deployment.alert_action.email.to }}
 action.email.message.alert = {{ detection.deployment.alert_action.email.message | custom_jinja2_enrichment_filter(detection) | escapeNewlines() }}

{contentctl-5.2.0.dist-info → contentctl-5.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: contentctl
-Version: 5.2.0
+Version: 5.3.0
 Summary: Splunk Content Control Tool
 License: Apache 2.0
 Author: STRT
@@ -13,7 +13,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Requires-Dist: Jinja2 (>=3.1.4,<4.0.0)
 Requires-Dist: PyYAML (>=6.0.2,<7.0.0)
-Requires-Dist: attackcti (>=0.4.0,<0.5.0)
+Requires-Dist: attackcti (>=0.5.4,<0.6)
 Requires-Dist: bottle (>=0.12.25,<0.14.0)
 Requires-Dist: docker (>=7.1.0,<8.0.0)
 Requires-Dist: gitpython (>=3.1.43,<4.0.0)
@@ -22,8 +22,9 @@ Requires-Dist: pydantic (>=2.9.2,<2.10.0)
 Requires-Dist: pygit2 (>=1.15.1,<2.0.0)
 Requires-Dist: questionary (>=2.0.1,<3.0.0)
 Requires-Dist: requests (>=2.32.3,<2.33.0)
+Requires-Dist: rich (>=14.0.0,<15.0.0)
 Requires-Dist: semantic-version (>=2.10.0,<3.0.0)
-Requires-Dist: setuptools (>=69.5.1,<76.0.0)
+Requires-Dist: setuptools (>=69.5.1,<79.0.0)
 Requires-Dist: splunk-sdk (>=2.0.2,<3.0.0)
 Requires-Dist: tqdm (>=4.66.5,<5.0.0)
 Requires-Dist: tyro (>=0.9.2,<0.10.0)

{contentctl-5.2.0.dist-info → contentctl-5.3.0.dist-info}/RECORD

@@ -1,25 +1,25 @@
 contentctl/__init__.py,sha256=kUR5RAFc7HCeiqdlX36dZOHkUI5wI6V_43RpEcD8b-0,22
-contentctl/actions/build.py,sha256=M68XubxTqI-LiW8P4eaNmb62pWNQtVE8cF3xKb6g44c,5669
+contentctl/actions/build.py,sha256=agpHT6QCCFdWTs4jU7v8xqvGy3DG_zgsZZT96j1gcW0,3965
 contentctl/actions/deploy_acs.py,sha256=w3OqO8GXzB_5zHrE8lDYbadAy4Etw7F2o84Gze74RY0,3264
-contentctl/actions/detection_testing/DetectionTestingManager.py,sha256=TWZpmDjMqWRWyzsLyiYol_jAovAr6ok9J_GzE9-kNN0,9079
+contentctl/actions/detection_testing/DetectionTestingManager.py,sha256=94apBwLkXWsgdLSvE9f_KqCfQSdmDChMncMcsEdY1A8,10974
 contentctl/actions/detection_testing/GitService.py,sha256=a6y7lqCgSL1KdSVEgJDxawea8ZgEkGNfOKEf9v_BgLo,11135
 contentctl/actions/detection_testing/generate_detection_coverage_badge.py,sha256=bGUVKjKv96lTw1GZ4Kw1JX-Yicu4aOJWm-IL524e9HI,2302
-contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructure.py,sha256=dus-8ANS0VgKq1HOdis4wVF5DKtdot6csbcpayxqXDo,57282
+contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructure.py,sha256=nJVo_L3Y4V0Uk7VCGHY58waGCBKcfujIFmxKC83oVgY,61082
 contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructureContainer.py,sha256=qYWgRW7uc-15jzwv5xSUF2xyLDmtyGyMfuXkQK9j-aM,7221
 contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructureServer.py,sha256=Q1ZfCYOp54O39bgTScZMInkmZiU-bGAM9Hiwr2mq5ms,370
 contentctl/actions/detection_testing/progress_bar.py,sha256=UrpNCqxTmQ4hfoRZgxPJ1xvDVwMrTq0UnotdryHN0gM,3232
-contentctl/actions/detection_testing/views/DetectionTestingView.py,sha256=E07v2VK-pyLMeTA6EtNI_04kt-T90SwSM4kN9yfp-2I,7475
-contentctl/actions/detection_testing/views/DetectionTestingViewCLI.py,sha256=-4yhxGJsafcRRAIebFZebUG_qSkASDLHajN9piAPlvM,2104
+contentctl/actions/detection_testing/views/DetectionTestingView.py,sha256=gSrLNR8Nz-YYsXunWLRn53UH7TeQugDKjnDLXy4cL6M,7466
+contentctl/actions/detection_testing/views/DetectionTestingViewCLI.py,sha256=kvMP4G2tLUZPM6AFHO6KrlkjWBNaHmEoke5qxS7XBws,2238
 contentctl/actions/detection_testing/views/DetectionTestingViewFile.py,sha256=G-6YqBtj0R1A9eiPrgHP2yvUMm7H8wopTBYjxIEIl8g,1090
 contentctl/actions/detection_testing/views/DetectionTestingViewWeb.py,sha256=CXV1fByf3J-Jc4D9U6jgWSaUhNzjcMpvEgRMuusF2vU,4740
 contentctl/actions/doc_gen.py,sha256=P2-RYsJoW-QuhAkSpOQespDLJBC-4Cq3-XGTmadK8Ys,936
-contentctl/actions/initialize.py,sha256=KaWSbrTaJA4vNSpKc_rwdlaaERnWw_hPlWwsPOA6Gy8,3191
+contentctl/actions/initialize.py,sha256=KXVUyjLMS7yE34wd2odyj5pVXyc_eOlvH_d7LzgR_Bc,4238
 contentctl/actions/inspect.py,sha256=zFNbDXY7Bi1xTBHirNyHpH1-2A1n3rsOsRvu8E0xUao,19375
 contentctl/actions/new_content.py,sha256=xs0QvHzlrf0g-EgdUJTkdDdFaA-uEGmzMTixDt6NcTY,8212
-contentctl/actions/release_notes.py,sha256=_Rdljg0tPSAFlw34LJ7dUsHLiH8tJTQ6B95X6MvxURo,17023
+contentctl/actions/release_notes.py,sha256=rrloomsLBfl53xpjqDez6RgHU5AE4Gb9ASrivGbYYVs,17122
 contentctl/actions/reporting.py,sha256=GF32i7sHdc47bw-VWSW-nZ1QBaUl6Ni1JjV5_SOyiAU,1660
-contentctl/actions/test.py,sha256=GTtvHi1yB5yDm1jPMyuc4WxczOq-O7f2N8LpTmMaWgU,6014
-contentctl/actions/validate.py,sha256=thnxanLj6mfw5g17C1FrzWlkpyIT_AjnDxv_wyNdspA,5837
+contentctl/actions/test.py,sha256=ftZazqoqv7bLNhyW23aRnDpetG9zltS8wr4Xq9Hls0k,6268
+contentctl/actions/validate.py,sha256=2AzxEhqtvq4QlkcMbzw1fPCCZKnnuO3XfBE5WEEnFrs,5879
 contentctl/api.py,sha256=6s17vNOW1E1EzQqOCXAa5uWuhwwShu-JkGSgrsOFEMs,6329
 contentctl/contentctl.py,sha256=nR8nHxXY0elvQogVHFqsyid7Ch5sMnIiNAOFbCa0yzI,11755
 contentctl/enrichments/attack_enrichment.py,sha256=68C9xQ8Q3YX-luRdK2hLnwWtRFpheFA2kE4v5GOLGEo,6358
@@ -28,58 +28,60 @@ contentctl/enrichments/splunk_app_enrichment.py,sha256=Xynxjjkqlw0_RtQ1thGSFwy1I
 contentctl/helper/link_validator.py,sha256=kzEi2GdncPWSi-UKNerXm2jtTJfFQ5goS9pqyAz5U5c,7427
 contentctl/helper/logger.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 contentctl/helper/splunk_app.py,sha256=Zq_C9rjNVqCjBNgm-5CWdBpXyeX5jSpbE-QTGptEZlk,14571
-contentctl/helper/utils.py,sha256=rigwZzCwWzn11sKTVWDkYEtLmRSf0yBbJ671OSRQnOM,19094
-contentctl/input/director.py,sha256=7mx93-k_8DUc4pwYjxwq39n8-BlDYZOvRBkdzdGA8Qc,10919
+contentctl/helper/utils.py,sha256=1_6cbvvbPXWxym3ZhRhL18ttmXLXiHbavpXAkROtGcg,21154
+contentctl/input/director.py,sha256=rThzfssOG4v52ClhVwUx-sU0MKWb_UaMy3MSANCrwmo,11999
 contentctl/input/new_content_questions.py,sha256=z2C4Mg7-EyxtiF2z9m4SnSbi6QO4CUPB3wg__JeMXIQ,4067
-contentctl/input/yml_reader.py,sha256=ymmAqsWsf9Oj56waDOhCh_E4SomkSCmu4dAx7iURFt8,2050
-contentctl/objects/abstract_security_content_objects/detection_abstract.py,sha256=VMt_0eA8eFa64DD2j96kIqfhREVNMPBeJAclsv0eFUw,43978
-contentctl/objects/abstract_security_content_objects/security_content_object_abstract.py,sha256=P1v5n8hM4XzJOjNZbJ5m3y4Bu-cQYaddLPdbE6K-4Xw,12164
+contentctl/input/yml_reader.py,sha256=L27b14_xXQYypUV1eAzZrfMtwtkzAZx--6nRo3RNZnE,2729
+contentctl/objects/abstract_security_content_objects/detection_abstract.py,sha256=dNkCXqlGVJw06tMWFS4r5a1LV10jxwKUslNG7iVL__s,46765
+contentctl/objects/abstract_security_content_objects/security_content_object_abstract.py,sha256=VzAkq-oJ05Y7Y2BzoUG8De8tVANV5X9ZvHbrDe65iRA,33282
 contentctl/objects/alert_action.py,sha256=iEvdEOT4TrTXT0z4rQ_W5v79hPJpPhFPSzo7TuHDxwA,1376
 contentctl/objects/annotated_types.py,sha256=xR4EKvdOpNDEt0doGs8XjxCzKK99J2NHZgHFAmt7p2c,424
 contentctl/objects/atomic.py,sha256=5nl-JhZnymadi8B8ZEJ8l80DnpvjG-OlRxUjVKR6ffY,7341
 contentctl/objects/base_test.py,sha256=JG6qlr7xe9P71n3CzKOro8_bsmDQGYDfTG9YooHQSIE,1105
 contentctl/objects/base_test_result.py,sha256=TYYzTPKWqp9rHTebWoid50uxAp_iALZouril4sFwIcA,5197
-contentctl/objects/baseline.py,sha256=grzM56KCpROjMnJQIan-fG0LCYfRGA2GHui4FwBwb8A,3172
+contentctl/objects/baseline.py,sha256=EMcuz_9sVgOFh3YCj871GSAA6v3FIkRTf90-LAHq-J0,3700
 contentctl/objects/baseline_tags.py,sha256=Eomy8y3HV-E6Lym5B5ZZTtsmQJYi6Jd4y8GZpTWGYgQ,1643
-contentctl/objects/config.py,sha256=3l8tFVwrBDpAnS7aBgj6to0Kc8_s4bxuZY5Bm5vel8k,48605
+contentctl/objects/config.py,sha256=8F_zpcnFyE_rSdGomm2qeVDG6tTpjhrVyK6BsNHM8js,49357
 contentctl/objects/constants.py,sha256=VwwQtJBGC_zb3ukjb3A7P0CwAlyhacWiXczwAW5Jiog,5466
-contentctl/objects/correlation_search.py,sha256=ab6v-0nbzujhTMpwaXynQiInWpRO1zB5KR4eZLCav_M,45234
-contentctl/objects/dashboard.py,sha256=9DiHP_Nx2XBQv4-zUaz6v9XH5yeTJhxaGDlaQqCsbIU,4468
-contentctl/objects/data_source.py,sha256=AtB6lAe43mx0GicphWTkmYupp8Fb1hmWgm_GpbX73wo,1567
-contentctl/objects/deployment.py,sha256=FRsgsX2T1gvA_0A44_sFPr22rsedxXVIhtO7o9F7eZM,2902
+contentctl/objects/content_versioning_service.py,sha256=BDk_TV1PTVoXpPcUxqTLa5_bjkfOs9PFYgqTuzOS9UI,20566
+contentctl/objects/correlation_search.py,sha256=Zui6GAtYSUnMUzJkKOQ5sSYDTYoAxODUICpHXwxNMwo,45147
+contentctl/objects/dashboard.py,sha256=owp-bYVagmSHUpVyOHgGtAEaKFSHAXN7kDhYqs09H_g,4998
+contentctl/objects/data_source.py,sha256=O58GArXVlflz3dCtVOn96Ubyi5_ekSC1N9LuveQNws4,2019
+contentctl/objects/deployment.py,sha256=OctNayxFPRvrQtTklAKgfjCXFKOspD19swLj0hi6dWE,3323
 contentctl/objects/deployment_email.py,sha256=_Sdr_BNjvXECiFonRHLkiOrIQp3slnUaERbptqRbD0Q,206
 contentctl/objects/deployment_notable.py,sha256=j5AniTRDcw32El5H91qKOXDVZvUYxnIuM4Zzlhrm9cM,258
 contentctl/objects/deployment_phantom.py,sha256=Qs9UH3pYe2M3evLLgn5FblTe28QH1QojVaBGM_Ydvjw,261
 contentctl/objects/deployment_rba.py,sha256=n_v79NhcLYHyABceKsI_iEziWhp3uNrqxIUrC8tdjD4,184
 contentctl/objects/deployment_scheduling.py,sha256=PbyAeIEV6ShHuwfzF4LtGrv6tNt1cwNdl-VDQLj0rE8,257
 contentctl/objects/deployment_slack.py,sha256=pC8-BB4qOD5fUqUi7Oj2Tre7-kKVqW2xEvCF7tZENQ4,194
-contentctl/objects/detection.py,sha256=GKjjhnwyFxm7139dOlPJ4c3vIW0675-NLCPWxEB5m-c,631
+contentctl/objects/detection.py,sha256=i-BCxTrP11fmxHLI1zv3XESF4R-f9BScl6FFOdUlHxY,641
 contentctl/objects/detection_metadata.py,sha256=JMz8rtcn5HfeEoaAx34kw2wXa35qsRIap_mXoY0Vbss,2237
 contentctl/objects/detection_stanza.py,sha256=-BRQNib5NNhY7Z2fILS5xkpjNkGSLF7qBciTmgOgLV8,3112
 contentctl/objects/detection_tags.py,sha256=j92t4TWlNNVdFi4_DoHvEyvJuURlBp5_o1xv2w2pAVk,10699
 contentctl/objects/drilldown.py,sha256=Vinw6UYlOl0YzoRA_0oBCfHA5Gvgu5p-rEsfBIgMCdI,4186
-contentctl/objects/enums.py,sha256=HdaSQgEQ_T38BIlVYk1xdqMm05YyhQb0720nzBorXQw,13554
+contentctl/objects/enums.py,sha256=nWufu5YgzllBfDQBneIe_Hf_erNXouERciqU_di5DNo,13754
 contentctl/objects/errors.py,sha256=xX_FDUaJbJiOWgjgrzjtYW5QsD41UZ2KWqH-yGkHaCU,5554
 contentctl/objects/integration_test.py,sha256=TYjKyH4YinUnYXOse5BQGCa4-ez_5mtoMwvh1JJcb0o,1254
 contentctl/objects/integration_test_result.py,sha256=_uUSgqgjFhEZM8UwOJI6Q9K-ekIrbKU6OPdqHZycl-s,279
-contentctl/objects/investigation.py,sha256=kmvQ0grCd1YVEW5wVF4-_Rx87PnOxPiNoN_ufTLc3ZM,3659
+contentctl/objects/investigation.py,sha256=GZsvhSZO7ZSmhg2ZeT-kPMqDG-GYpTXIvGBgV1H2lwQ,4030
 contentctl/objects/investigation_tags.py,sha256=qDGNusrWDvCX_GcBEzag2MydSV0LIhGxoXZGgxDXfHA,1317
-contentctl/objects/lookup.py,sha256=uP8N2Munu9vDGOzkC3mBlM93xkICyVBi62fAXAloI_I,13656
-contentctl/objects/macro.py,sha256=usbxyOPIRIJoDmvawfP2DxtFNf71GaDwffxiZsRkP5A,3594
+contentctl/objects/lookup.py,sha256=XDluqS9CumSP7ijbV9O2bbSaDGh0Beo4QaL-II_xC6U,15601
+contentctl/objects/macro.py,sha256=cMQ_frqJnX2NSy-21cbUnMRZZxBionQ2KOxuC9J9bp0,4051
 contentctl/objects/manual_test.py,sha256=cx_XAtQ8VG8Ui_F553Xnut75vFEOtRwm1dDIIWNpOaM,952
 contentctl/objects/manual_test_result.py,sha256=FyCVVf-f1DKs-qBkM4tbKfY6mkrW25NcIEBqyaDC2rE,156
 contentctl/objects/mitre_attack_enrichment.py,sha256=PCakRksW5qrTENIZ7JirEZplE9xpmvSvX2GKv7N8j_k,3683
 contentctl/objects/notable_action.py,sha256=sW5XlpGznMHqyBmGXtXrl22hWLiCoKkfGCasGtK3rGo,1607
 contentctl/objects/notable_event.py,sha256=2aOtmfnsdInTtN_fHAGIKmBTBritjHbS_Nc-pqL-GbY,689
-contentctl/objects/playbook.py,sha256=mgYbWsD3OW86u11MbIFKvmyFueSoMJ1WBJm_rNrFvAo,2425
+contentctl/objects/playbook.py,sha256=veG2luPfFrOMdzl99D8gsO85HYSJ8kZMYWj3GG64HKk,2879
 contentctl/objects/playbook_tags.py,sha256=O5obkQyb82YdJEii8ZJEQtrHtLOSnAvAkT1qIgpCK2s,1547
-contentctl/objects/rba.py,sha256=VudoJAqADAEflDqVDWlOIk8epRfg_rqvfCsyavjvcaU,4737
+contentctl/objects/rba.py,sha256=2xE_DXhQvG6tVLJTXYaFEBm9owePE4QG0NVgdcVgoiY,3547
+contentctl/objects/removed_security_content_object.py,sha256=bx-gVCqzT81E5jKncMD3-yKawTnl3tWsuzRBmsAqeqQ,1852
 contentctl/objects/risk_analysis_action.py,sha256=v-TQktXEEzbGzmTtqwEykXoSKdGnIlK_JojnqvvAE1s,4370
 contentctl/objects/risk_event.py,sha256=JQUmXriiwi5FetqVnhM0hf5cUp6LzLSNPuoecC2JKK0,12593
 contentctl/objects/risk_object.py,sha256=5iUKW_UwQLjjLWiD_vlE78uwH9bkaMNCHRNmKM25W1Q,905
 contentctl/objects/savedsearches_conf.py,sha256=Dn_Pxd9i3RT6DwNh6JrgmfxjsO3q15xzMksYr3wIGwQ,8624
-contentctl/objects/security_content_object.py,sha256=iDnhq81P7m6Qkmc_Yi-wOyFm9gZUYnPy1GJxxyCtonA,245
-contentctl/objects/story.py,sha256=jalNgK4yYGRr_yVkzuO_YHIrPhpWHF0Q79PkTJhcLzY,5048
+contentctl/objects/security_content_object.py,sha256=2mEf-wt3hMsLEyo4yatyK66jKjgUOVjJHIN9fgQB5nA,246
+contentctl/objects/story.py,sha256=1JCiF9D1EZeVcoMXXDoWkOqHXQn4TsQgl8EtUN59a2E,5796
 contentctl/objects/story_tags.py,sha256=IYumFuBF2Bt7HtW4lBfCRo2EUpjMYlnNjpx24jBErs4,2365
 contentctl/objects/test_attack_data.py,sha256=7p-kOJguTZtG9y5th5U3qfPFvpiAWLST_OBw8dwWl_4,488
 contentctl/objects/test_group.py,sha256=r-dXyddok4yslv8SIjwOpqylbN1rdjsRi-HIijvpWD0,2602
@@ -88,16 +90,16 @@ contentctl/objects/throttling.py,sha256=oupWmdtvwAXzLmD3MBJyAU18SD2L2ciEZWUcnL8M
 contentctl/objects/unit_test.py,sha256=-rtSmZ8N2UZ4NkDsfzNXzXiF6dTDwt_jsQ_14xp0hjs,1005
 contentctl/objects/unit_test_baseline.py,sha256=ezg8Ctih_3che2ln2tuVCAtRPHaf5tDMR3dGb34MqaA,287
 contentctl/objects/unit_test_result.py,sha256=gqHqYN5XGBKdV-mdKhAdwfOw4_PpN3i9z_b6ciByDSc,2928
-contentctl/output/api_json_output.py,sha256=QWe_KWlHHxE4Mhd3BHRfJbUJ4z2mLHZn_eMWfMVInik,8237
+contentctl/output/api_json_output.py,sha256=s07bD79qFyFQIzfsTpIoFVyGYWlC77J9DNAlVwZwaOs,8269
 contentctl/output/attack_nav_output.py,sha256=cbQNZkcNCKaQm7Ht70_tcmTvixtsuVDjQB4BpZ8s-Ts,2489
 contentctl/output/attack_nav_writer.py,sha256=AiQU3q8hzz_lJECI-sjyqOsWx64HUugg3aAHEeZl-qM,2750
-contentctl/output/conf_output.py,sha256=2_ofRqMro4xmFzf6ZmPRDd93pCG-LQhOiB_kE4owADc,10609
+contentctl/output/conf_output.py,sha256=OJ4u38FEkuBHvIiK_57HoxUJasWV2rkX2abVamKh3Qg,11045
 contentctl/output/conf_writer.py,sha256=9eqt2tm1xjs397pwWLz5oPJcMHbs62ejRG7KghGQQCI,15137
-contentctl/output/data_source_writer.py,sha256=hjr0b5zfJ2UHcDLbCkmTrqma1ngu8F5vWFPJEwOZwU8,1860
 contentctl/output/doc_md_output.py,sha256=wlgbzBD2hUbQNIW2zv5sdrq2UdAKhOZJUYSObnpWQfY,3552
 contentctl/output/jinja_writer.py,sha256=5PbFrc8KuLWrlNIHDvMTyvJ18u_mtjd5Led6-9sn2Eo,1204
 contentctl/output/json_writer.py,sha256=waw73wOmalSrUFcr2K1CWR-xz5oW8il10zDAn56mtMg,1041
-contentctl/output/svg_output.py,sha256=5s9fjmKullMV6cCCGwP7_xvQwg9EZLOKRKMw_IyO6hY,2988
+contentctl/output/runtime_csv_writer.py,sha256=ZlK3kDg6YwfR4Sj4xgJIhTHZ_GDVfDnQDHS0PqAnpt0,4336
+contentctl/output/svg_output.py,sha256=8KClwfUIoLXnns-jYFzvv5OMs0-uwTFI0oZw9DWjTg4,2948
 contentctl/output/templates/analyticstories_detections.j2,sha256=6ZiQO8np6KkX8skVoIB0BN9_s8SBW3qeo8IBA8r8GQk,923
 contentctl/output/templates/analyticstories_investigations.j2,sha256=kqy9lR6W3avqETCM2tSZ8WWOlfiyOtFv6G5N4SZWSaQ,527
 contentctl/output/templates/analyticstories_stories.j2,sha256=MxkmwsgW1oge2YJhbgAzXVcTplSr5JjKIDxX4SBZV0E,676
@@ -121,7 +123,7 @@ contentctl/output/templates/header.j2,sha256=3usV7jm1q6J-QNnQrZzII9cN0XEGQjg_eVK
 contentctl/output/templates/macros.j2,sha256=SLcQQ5X7TZS8j-2qP06BTXqdIcnwoYqTAaBLX2Dge7Y,390
 contentctl/output/templates/panel.j2,sha256=Cw_W6p-14n6UivVfpS75KKJiJ2VpdGsSBceYsUYe9gk,221
 contentctl/output/templates/savedsearches_baselines.j2,sha256=WHZB4e0vmeym8832VxRmuUfDJ-YRYt6emcYaJrghI58,1709
-contentctl/output/templates/savedsearches_detections.j2,sha256=B7_b8aBjEKAV7mJm0DxUS_HyCt63bQZtpacCQfDgDqc,6033
+contentctl/output/templates/savedsearches_detections.j2,sha256=mbOSSDoHwTfzpxQRVz03FvFNQJ26lWqcUtl6uW6tUZY,5874
 contentctl/output/templates/savedsearches_investigations.j2,sha256=KH2r8SgyAMiettSHypSbA2-1XmQ_8_8xzk3BkbZ1Re4,1196
 contentctl/output/templates/server.conf.j2,sha256=sPZUkiuJNGm9R8rpjfRKyuAvmmQb0C4w9Q6hpmvmPeU,127
 contentctl/output/templates/transforms.j2,sha256=TEKZi8DWpcCysRTNvuLEgAwx-g1SZ2E0CkLiu6v6AlU,1339
@@ -161,8 +163,8 @@ contentctl/templates/detections/web/.gitkeep,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRk
 contentctl/templates/macros/security_content_ctime.yml,sha256=Gg1YNllHVsX_YB716H1SJLWzxXZEfuJlnsgB2fuyoHU,159
 contentctl/templates/macros/security_content_summariesonly.yml,sha256=9BYUxAl2E4Nwh8K19F3AJS8Ka7ceO6ZDBjFiO3l3LY0,162
 contentctl/templates/stories/cobalt_strike.yml,sha256=uj8idtDNOAIqpZ9p8usQg6mop1CQkJ5TlB4Q7CJdTIE,3082
-contentctl-5.2.0.dist-info/LICENSE.md,sha256=hQWUayRk-pAiOZbZnuy8djmoZkjKBx8MrCFpW-JiOgo,11344
-contentctl-5.2.0.dist-info/METADATA,sha256=SxtNJ4XnhZzf7fFzZR3NWsl7hPwh3gX1lqwRTzQFaGc,5097
-contentctl-5.2.0.dist-info/WHEEL,sha256=XbeZDeTWKc1w7CSIyre5aMDU_-PohRwTQceYnisIYYY,88
-contentctl-5.2.0.dist-info/entry_points.txt,sha256=5bjZ2NkbQfSwK47uOnA77yCtjgXhvgxnmCQiynRF_-U,57
-contentctl-5.2.0.dist-info/RECORD,,
+contentctl-5.3.0.dist-info/LICENSE.md,sha256=hQWUayRk-pAiOZbZnuy8djmoZkjKBx8MrCFpW-JiOgo,11344
+contentctl-5.3.0.dist-info/METADATA,sha256=qnEm__g-PB2TIjTXm7DFPJWrdgj8vlXQlE-qrHjtLTA,5134
+contentctl-5.3.0.dist-info/WHEEL,sha256=fGIA9gx4Qxk2KDKeNJCbOEwSrmLtjWCwzBz351GyrPQ,88
+contentctl-5.3.0.dist-info/entry_points.txt,sha256=5bjZ2NkbQfSwK47uOnA77yCtjgXhvgxnmCQiynRF_-U,57
+contentctl-5.3.0.dist-info/RECORD,,

{contentctl-5.2.0.dist-info → contentctl-5.3.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: poetry-core 2.1.1
+Generator: poetry-core 2.1.2
 Root-Is-Purelib: true
 Tag: py3-none-any

contentctl/output/data_source_writer.py

@@ -1,52 +0,0 @@
-import csv
-from contentctl.objects.data_source import DataSource
-from typing import List
-import pathlib
-
-
-class DataSourceWriter:
-    @staticmethod
-    def writeDataSourceCsv(
-        data_source_objects: List[DataSource], file_path: pathlib.Path
-    ):
-        with open(file_path, mode="w", newline="") as file:
-            writer = csv.writer(file)
-            # Write the header
-            writer.writerow(
-                [
-                    "name",
-                    "id",
-                    "author",
-                    "source",
-                    "sourcetype",
-                    "separator",
-                    "supported_TA_name",
-                    "supported_TA_version",
-                    "supported_TA_url",
-                    "description",
-                ]
-            )
-            # Write the data
-            for data_source in data_source_objects:
-                if len(data_source.supported_TA) > 0:
-                    supported_TA_name = data_source.supported_TA[0].name
-                    supported_TA_version = data_source.supported_TA[0].version
-                    supported_TA_url = data_source.supported_TA[0].url or ""
-                else:
-                    supported_TA_name = ""
-                    supported_TA_version = ""
-                    supported_TA_url = ""
-                writer.writerow(
-                    [
-                        data_source.name,
-                        data_source.id,
-                        data_source.author,
-                        data_source.source,
-                        data_source.sourcetype,
-                        data_source.separator,
-                        supported_TA_name,
-                        supported_TA_version,
-                        supported_TA_url,
-                        data_source.description,
-                    ]
-                )