contentctl 5.5.4__tar.gz → 5.5.6__tar.gz

{contentctl-5.5.4 → contentctl-5.5.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: contentctl
-Version: 5.5.4
+Version: 5.5.6
 Summary: Splunk Content Control Tool
 License: Apache 2.0
 Author: STRT
@@ -27,7 +27,7 @@ Requires-Dist: semantic-version (>=2.10.0,<3.0.0)
 Requires-Dist: setuptools (>=69.5.1,<81.0.0)
 Requires-Dist: splunk-sdk (>=2.0.2,<3.0.0)
 Requires-Dist: tqdm (>=4.66.5,<5.0.0)
-Requires-Dist: tyro (>=0.9.2,<0.10.0)
+Requires-Dist: tyro (>=0.9.2,<0.9.23)
 Requires-Dist: xmltodict (>=0.13,<0.15)
 Description-Content-Type: text/markdown
 

{contentctl-5.5.4 → contentctl-5.5.6}/contentctl/objects/lookup.py

@@ -65,6 +65,13 @@ LOOKUPS_TO_IGNORE.add(
 # Special case for the Detection "Exploit Public Facing Application via Apache Commons Text"
 LOOKUPS_TO_IGNORE.add("=")
 LOOKUPS_TO_IGNORE.add("other_lookups")
+LOOKUPS_TO_IGNORE.add(
+    "asn_lookup_by_cidr"
+)  # Provided by SA-ThreatIntelligence, part of Enterprise Security
+
+LOOKUPS_TO_IGNORE.add(
+    "mitre_attack_lookup"
+)  # KVStore provided by SA-ThreatIntelligence, part of Enterprise Security
 
 
 class Lookup_Type(StrEnum):

{contentctl-5.5.4 → contentctl-5.5.6}/contentctl/objects/macro.py

@@ -26,6 +26,7 @@ MACROS_TO_IGNORE.add(
 )  # SA-ThreatIntelligence, part of Enterprise Security
 MACROS_TO_IGNORE.add("cim_corporate_web_domain_search")  # Part of CIM/Splunk_SA_CIM
 # MACROS_TO_IGNORE.add("prohibited_processes")
+MACROS_TO_IGNORE.add("globedistance")  # Part of SA-Utils, part of Enterprise Security
 
 
 class Macro(SecurityContentObject):

{contentctl-5.5.4 → contentctl-5.5.6}/contentctl/output/attack_nav_output.py

@@ -88,7 +88,7 @@ class AttackNavOutput:
         layer: LayerData = {
             "name": self.layer_name,
             "versions": {
-                "attack": "14",  # Update as needed
+                "attack": "17",  # Update as needed
                 "navigator": "5.1.0",
                 "layer": "4.5",
             },

{contentctl-5.5.4 → contentctl-5.5.6}/pyproject.toml

@@ -1,7 +1,7 @@
 [tool.poetry]
 name = "contentctl"
 
-version = "5.5.4"
+version = "5.5.6"
 
 description = "Splunk Content Control Tool"
 authors = ["STRT <research@splunk.com>"]
@@ -28,7 +28,11 @@ semantic-version = "^2.10.0"
 bottle = ">=0.12.25,<0.14.0"
 tqdm = "^4.66.5"
 pygit2 = "^1.15.1"
-tyro = "^0.9.2"
+#We are pinned to this version of tyro because 0.9.23 and above
+#have an issue when parsing an extremely large number of files
+#(in our testing great than 130) when using the mode:selected 
+#--mode.files command.
+tyro = "^0.9.2,<0.9.23"
 gitpython = "^3.1.43"
 setuptools = ">=69.5.1,<81.0.0"
 rich = "^14.0.0"