contentctl 5.3.1__py3-none-any.whl → 5.3.2__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- contentctl/actions/inspect.py +15 -1
- contentctl/objects/errors.py +28 -2
- {contentctl-5.3.1.dist-info → contentctl-5.3.2.dist-info}/METADATA +1 -1
- {contentctl-5.3.1.dist-info → contentctl-5.3.2.dist-info}/RECORD +7 -7
- {contentctl-5.3.1.dist-info → contentctl-5.3.2.dist-info}/LICENSE.md +0 -0
- {contentctl-5.3.1.dist-info → contentctl-5.3.2.dist-info}/WHEEL +0 -0
- {contentctl-5.3.1.dist-info → contentctl-5.3.2.dist-info}/entry_points.txt +0 -0
contentctl/actions/inspect.py
CHANGED
|
@@ -16,6 +16,7 @@ from contentctl.objects.errors import (
|
|
|
16
16
|
DetectionMissingError,
|
|
17
17
|
MetadataValidationError,
|
|
18
18
|
VersionBumpingError,
|
|
19
|
+
VersionBumpingTooFarError,
|
|
19
20
|
VersionDecrementedError,
|
|
20
21
|
)
|
|
21
22
|
from contentctl.objects.savedsearches_conf import SavedsearchesConf
|
|
@@ -101,7 +102,7 @@ class Inspect:
|
|
|
101
102
|
-F "app_package=@<PATH/APP-PACKAGE>" \
|
|
102
103
|
-F "included_tags=cloud" \
|
|
103
104
|
--url "https://appinspect.splunk.com/v1/app/validate"
|
|
104
|
-
|
|
105
|
+
|
|
105
106
|
This is confirmed by the great resource:
|
|
106
107
|
https://curlconverter.com/
|
|
107
108
|
"""
|
|
@@ -429,6 +430,19 @@ class Inspect:
|
|
|
429
430
|
)
|
|
430
431
|
)
|
|
431
432
|
|
|
433
|
+
# Versions should never increase more than one version between releases
|
|
434
|
+
if (
|
|
435
|
+
current_stanza.metadata.detection_version
|
|
436
|
+
> previous_stanza.metadata.detection_version + 1
|
|
437
|
+
):
|
|
438
|
+
validation_errors[rule_name].append(
|
|
439
|
+
VersionBumpingTooFarError(
|
|
440
|
+
rule_name=rule_name,
|
|
441
|
+
current_version=current_stanza.metadata.detection_version,
|
|
442
|
+
previous_version=previous_stanza.metadata.detection_version,
|
|
443
|
+
)
|
|
444
|
+
)
|
|
445
|
+
|
|
432
446
|
# Convert our dict mapping to a flat list of errors for use in reporting
|
|
433
447
|
validation_error_list = [
|
|
434
448
|
x for inner_list in validation_errors.values() for x in inner_list
|
contentctl/objects/errors.py
CHANGED
|
@@ -185,7 +185,7 @@ class VersionBumpingError(VersioningError):
|
|
|
185
185
|
return (
|
|
186
186
|
f"Rule '{self.rule_name}' has changed in current build compared to previous "
|
|
187
187
|
"build (stanza hashes differ); the detection version should be bumped "
|
|
188
|
-
f"to
|
|
188
|
+
f"to {self.previous_version + 1}."
|
|
189
189
|
)
|
|
190
190
|
|
|
191
191
|
@property
|
|
@@ -194,4 +194,30 @@ class VersionBumpingError(VersioningError):
|
|
|
194
194
|
A short-form error message
|
|
195
195
|
:returns: a str, the message
|
|
196
196
|
"""
|
|
197
|
-
return f"Detection version in current build should be bumped to
|
|
197
|
+
return f"Detection version in current build should be bumped to {self.previous_version + 1}."
|
|
198
|
+
|
|
199
|
+
|
|
200
|
+
class VersionBumpingTooFarError(VersioningError):
|
|
201
|
+
"""
|
|
202
|
+
An error indicating the detection changed but its version was bumped too far
|
|
203
|
+
"""
|
|
204
|
+
|
|
205
|
+
@property
|
|
206
|
+
def long_message(self) -> str:
|
|
207
|
+
"""
|
|
208
|
+
A long-form error message
|
|
209
|
+
:returns: a str, the message
|
|
210
|
+
"""
|
|
211
|
+
return (
|
|
212
|
+
f"Rule '{self.rule_name}' has changed in current build compared to previous "
|
|
213
|
+
"build (stanza hashes differ); however the detection version increased too much"
|
|
214
|
+
f"The version should be reduced to {self.previous_version + 1}."
|
|
215
|
+
)
|
|
216
|
+
|
|
217
|
+
@property
|
|
218
|
+
def short_message(self) -> str:
|
|
219
|
+
"""
|
|
220
|
+
A short-form error message
|
|
221
|
+
:returns: a str, the message
|
|
222
|
+
"""
|
|
223
|
+
return f"Detection version in current build should be reduced to {self.previous_version + 1}."
|
|
@@ -14,7 +14,7 @@ contentctl/actions/detection_testing/views/DetectionTestingViewFile.py,sha256=G-
|
|
|
14
14
|
contentctl/actions/detection_testing/views/DetectionTestingViewWeb.py,sha256=CXV1fByf3J-Jc4D9U6jgWSaUhNzjcMpvEgRMuusF2vU,4740
|
|
15
15
|
contentctl/actions/doc_gen.py,sha256=P2-RYsJoW-QuhAkSpOQespDLJBC-4Cq3-XGTmadK8Ys,936
|
|
16
16
|
contentctl/actions/initialize.py,sha256=KXVUyjLMS7yE34wd2odyj5pVXyc_eOlvH_d7LzgR_Bc,4238
|
|
17
|
-
contentctl/actions/inspect.py,sha256=
|
|
17
|
+
contentctl/actions/inspect.py,sha256=ER1CJZk5ls4bithhDimXmBJepQ6ha1Ns-D2z-AZUdcQ,19991
|
|
18
18
|
contentctl/actions/new_content.py,sha256=xs0QvHzlrf0g-EgdUJTkdDdFaA-uEGmzMTixDt6NcTY,8212
|
|
19
19
|
contentctl/actions/release_notes.py,sha256=rrloomsLBfl53xpjqDez6RgHU5AE4Gb9ASrivGbYYVs,17122
|
|
20
20
|
contentctl/actions/reporting.py,sha256=GF32i7sHdc47bw-VWSW-nZ1QBaUl6Ni1JjV5_SOyiAU,1660
|
|
@@ -60,7 +60,7 @@ contentctl/objects/detection_stanza.py,sha256=-BRQNib5NNhY7Z2fILS5xkpjNkGSLF7qBc
|
|
|
60
60
|
contentctl/objects/detection_tags.py,sha256=j92t4TWlNNVdFi4_DoHvEyvJuURlBp5_o1xv2w2pAVk,10699
|
|
61
61
|
contentctl/objects/drilldown.py,sha256=Vinw6UYlOl0YzoRA_0oBCfHA5Gvgu5p-rEsfBIgMCdI,4186
|
|
62
62
|
contentctl/objects/enums.py,sha256=nWufu5YgzllBfDQBneIe_Hf_erNXouERciqU_di5DNo,13754
|
|
63
|
-
contentctl/objects/errors.py,sha256=
|
|
63
|
+
contentctl/objects/errors.py,sha256=7ebvjAR9W2Wj0a4ihdOakGPZRNr7rDDZe0X3rvhh_dE,6367
|
|
64
64
|
contentctl/objects/integration_test.py,sha256=TYjKyH4YinUnYXOse5BQGCa4-ez_5mtoMwvh1JJcb0o,1254
|
|
65
65
|
contentctl/objects/integration_test_result.py,sha256=_uUSgqgjFhEZM8UwOJI6Q9K-ekIrbKU6OPdqHZycl-s,279
|
|
66
66
|
contentctl/objects/investigation.py,sha256=GZsvhSZO7ZSmhg2ZeT-kPMqDG-GYpTXIvGBgV1H2lwQ,4030
|
|
@@ -163,8 +163,8 @@ contentctl/templates/detections/web/.gitkeep,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRk
|
|
|
163
163
|
contentctl/templates/macros/security_content_ctime.yml,sha256=Gg1YNllHVsX_YB716H1SJLWzxXZEfuJlnsgB2fuyoHU,159
|
|
164
164
|
contentctl/templates/macros/security_content_summariesonly.yml,sha256=9BYUxAl2E4Nwh8K19F3AJS8Ka7ceO6ZDBjFiO3l3LY0,162
|
|
165
165
|
contentctl/templates/stories/cobalt_strike.yml,sha256=uj8idtDNOAIqpZ9p8usQg6mop1CQkJ5TlB4Q7CJdTIE,3082
|
|
166
|
-
contentctl-5.3.
|
|
167
|
-
contentctl-5.3.
|
|
168
|
-
contentctl-5.3.
|
|
169
|
-
contentctl-5.3.
|
|
170
|
-
contentctl-5.3.
|
|
166
|
+
contentctl-5.3.2.dist-info/LICENSE.md,sha256=hQWUayRk-pAiOZbZnuy8djmoZkjKBx8MrCFpW-JiOgo,11344
|
|
167
|
+
contentctl-5.3.2.dist-info/METADATA,sha256=IrNFqGOQ4ARU0v_MS8jU-w9yNT6UTFYNrntU0LF1SFk,5134
|
|
168
|
+
contentctl-5.3.2.dist-info/WHEEL,sha256=fGIA9gx4Qxk2KDKeNJCbOEwSrmLtjWCwzBz351GyrPQ,88
|
|
169
|
+
contentctl-5.3.2.dist-info/entry_points.txt,sha256=5bjZ2NkbQfSwK47uOnA77yCtjgXhvgxnmCQiynRF_-U,57
|
|
170
|
+
contentctl-5.3.2.dist-info/RECORD,,
|
|
File without changes
|
|
File without changes
|
|
File without changes
|