contentctl 5.6.0__tar.gz → 5.6.2__tar.gz

{contentctl-5.6.0 → contentctl-5.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: contentctl
-Version: 5.6.0
+Version: 5.6.2
 Summary: Splunk Content Control Tool
 License: Apache 2.0
 License-File: LICENSE.md
@@ -12,32 +12,34 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
-Requires-Dist: Jinja2 (>=3.1.4,<4.0.0)
-Requires-Dist: PyYAML (>=6.0.2,<7.0.0)
+Requires-Dist: Jinja2 (>=3.1.6,<4.0.0)
+Requires-Dist: PyYAML (>=6.0.3,<7.0.0)
 Requires-Dist: attackcti (>=0.5.4,<0.6)
 Requires-Dist: bottle (>=0.12.25,<0.14.0)
-Requires-Dist: docker (>=7.1.0,<8.0.0)
-Requires-Dist: gitpython (>=3.1.43,<4.0.0)
+Requires-Dist: docker (>=7.2.0,<8.0.0)
+Requires-Dist: gitpython (>=3.1.62,<4.0.0)
 Requires-Dist: pycvesearch (>=1.2,<2.0)
 Requires-Dist: pydantic (>=2.9.2,<2.10.0)
-Requires-Dist: pygit2 (>=1.15.1,<2.0.0)
-Requires-Dist: questionary (>=2.0.1,<3.0.0)
-Requires-Dist: requests (>=2.32.4)
-Requires-Dist: rich (>=14.0.0,<15.0.0)
+Requires-Dist: pygit2 (>=1.20.1,<2.0.0)
+Requires-Dist: questionary (>=2.1.1,<3.0.0)
+Requires-Dist: requests (>=2.34.2)
+Requires-Dist: rich (>=15.0.0,<16.0.0)
 Requires-Dist: semantic-version (>=2.10.0,<3.0.0)
-Requires-Dist: setuptools (<81)
-Requires-Dist: splunk-sdk (>=2.0.2,<3.0.0)
-Requires-Dist: tqdm (>=4.66.5,<5.0.0)
-Requires-Dist: tyro (>=0.9.2,<0.9.23)
-Requires-Dist: xmltodict (>=0.13,<0.15)
+Requires-Dist: setuptools (>=83.0.0,<84)
+Requires-Dist: splunk-sdk (>=2.1.1,<3.0.0)
+Requires-Dist: tqdm (>=4.70.1,<5.0.0)
+Requires-Dist: tyro (>=1.0.16,<2.0.0)
+Requires-Dist: xmltodict (>=1.0.4,<2.0.0)
 Description-Content-Type: text/markdown
 
 # contentctl
+> ## The Future of contentctl
+> We are shifting future investment from contentctl to Detection Studio as we work to bring this functionality into Splunk as an officially supported capability. This repository will remain publicly available for reference, but we are no longer accepting new pull requests or feature requests. Going forward, continued use of contentctl may require customer-managed customization to support specific environments and requirements. 
+
 <p align="center">
 <img src="https://raw.githubusercontent.com/splunk/contentctl/refs/heads/main/docs/contentctl_logo_white.png" title="In case you're wondering, it's a capybara" alt="the logo for the contentctl project, which depicts a doodled 4 legged animal that is supposed to represent a capybara, with the name of the project below it" width="250" height="250"></p>
 
-> [!NOTE]
-> Looking to migrate from an earlier release to the new contentctl v5+ ? Check out our migration guide [here](docs/contentctl_v5_migration_guide.md). 
+
 
 ## What is contentctl?
 `contentctl` is a tool developed by the Splunk Threat Research Team to help with managing the content living in [splunk/security_content](https://github.com/splunk/security_content) and producing the Enterprise Security Content Update app for Splunk. While its development is largely driven by STRT's needs, it has been somewhat genericized and can be used by customers and partners to package their own content. Simply put, `contentctl` is the workhorse that packages detections, macros, lookups, dashboards into a Splunk app that you can use, and that understands the YAML structure and project layout we've selected to keep development clean.

{contentctl-5.6.0 → contentctl-5.6.2}/README.md

@@ -1,9 +1,11 @@
 # contentctl
+> ## The Future of contentctl
+> We are shifting future investment from contentctl to Detection Studio as we work to bring this functionality into Splunk as an officially supported capability. This repository will remain publicly available for reference, but we are no longer accepting new pull requests or feature requests. Going forward, continued use of contentctl may require customer-managed customization to support specific environments and requirements. 
+
 <p align="center">
 <img src="https://raw.githubusercontent.com/splunk/contentctl/refs/heads/main/docs/contentctl_logo_white.png" title="In case you're wondering, it's a capybara" alt="the logo for the contentctl project, which depicts a doodled 4 legged animal that is supposed to represent a capybara, with the name of the project below it" width="250" height="250"></p>
 
-> [!NOTE]
-> Looking to migrate from an earlier release to the new contentctl v5+ ? Check out our migration guide [here](docs/contentctl_v5_migration_guide.md). 
+
 
 ## What is contentctl?
 `contentctl` is a tool developed by the Splunk Threat Research Team to help with managing the content living in [splunk/security_content](https://github.com/splunk/security_content) and producing the Enterprise Security Content Update app for Splunk. While its development is largely driven by STRT's needs, it has been somewhat genericized and can be used by customers and partners to package their own content. Simply put, `contentctl` is the workhorse that packages detections, macros, lookups, dashboards into a Splunk app that you can use, and that understands the YAML structure and project layout we've selected to keep development clean.

{contentctl-5.6.0 → contentctl-5.6.2}/contentctl/actions/detection_testing/GitService.py

@@ -147,11 +147,13 @@ class GitService(BaseModel):
                             # Filter to find the Lookup Object the references this CSV
                             matched = list(
                                 filter(
-                                    lambda x: isinstance(x, CSVLookup)
-                                    and not isinstance(
-                                        x, RuntimeCSV
-                                    )  # RuntimeCSV is not used directly by any content
-                                    and x.filename == decoded_path,
+                                    lambda x: (
+                                        isinstance(x, CSVLookup)
+                                        and not isinstance(
+                                            x, RuntimeCSV
+                                        )  # RuntimeCSV is not used directly by any content
+                                        and x.filename == decoded_path
+                                    ),
                                     self.director.lookups,
                                 )
                             )

{contentctl-5.6.0 → contentctl-5.6.2}/contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructure.py

@@ -149,7 +149,7 @@ class DetectionTestingInfrastructure(BaseModel, abc.ABC):
 
         # Init the list of setup functions we always need
         primary_setup_functions: list[
-            tuple[Callable[[], None | client.Service], str]
+            tuple[Callable[[], client.Service | None], str]
         ] = [
             (self.start, "Starting"),
             (self.get_conn, "Waiting for App Installation"),

{contentctl-5.6.0 → contentctl-5.6.2}/contentctl/enrichments/cve_enrichment.py

@@ -1,8 +1,27 @@
 from __future__ import annotations
 
+import sys
+import types
 from decimal import Decimal
 from typing import TYPE_CHECKING, Annotated, Union
 
+try:
+    import pkg_resources  # noqa: F401
+except ModuleNotFoundError:
+    # setuptools >= 82 no longer ships pkg_resources. pycvesearch (unmaintained,
+    # no newer release available) still does `import pkg_resources` just to read
+    # its own version for a User-Agent header. Stub out the single attribute it
+    # needs so the import succeeds, rather than pinning setuptools to a version
+    # with a known vulnerability.
+    def _get_distribution(name: str) -> types.SimpleNamespace:
+        from importlib.metadata import version
+
+        return types.SimpleNamespace(version=version(name))
+
+    _pkg_resources_shim = types.ModuleType("pkg_resources")
+    _pkg_resources_shim.get_distribution = _get_distribution  # type: ignore[attr-defined]
+    sys.modules["pkg_resources"] = _pkg_resources_shim
+
 from pycvesearch import CVESearch
 from pydantic import BaseModel, ConfigDict, Field, computed_field
 

{contentctl-5.6.0 → contentctl-5.6.2}/contentctl/objects/abstract_security_content_objects/detection_abstract.py

@@ -117,7 +117,7 @@ class Detection_Abstract(SecurityContentObject):
                 f"Error getting severity - risk_score must be between 0-100, but was actually {self.risk_score}"
             )
 
-    explanation: None | str = Field(
+    explanation: str | None = Field(
         default=None,
         exclude=True,  # Don't serialize this value when dumping the object
         description="Provide an explanation to be included "

{contentctl-5.6.0 → contentctl-5.6.2}/contentctl/objects/base_test.py

@@ -39,7 +39,7 @@ class BaseTest(BaseModel, ABC):
     latest_time: Union[str, None] = None
 
     # The test result
-    result: Union[None, BaseTestResult] = None
+    result: Union[BaseTestResult, None] = None
 
     @abstractmethod
     def skip(self, message: str) -> None:

{contentctl-5.6.0 → contentctl-5.6.2}/contentctl/objects/base_test_result.py

@@ -38,7 +38,7 @@ class BaseTestResult(BaseModel):
     """
 
     # Message for the result
-    message: Union[None, str] = None
+    message: Union[str, None] = None
 
     # Any exception that was raised (may be None)
     exception: Union[Exception, None] = None
@@ -53,7 +53,7 @@ class BaseTestResult(BaseModel):
     job_content: Union[Record, None] = None
 
     # The Splunk endpoint URL
-    sid_link: Union[None, str] = None
+    sid_link: Union[str, None] = None
 
     # Needed to allow for embedding of Exceptions in the model
     model_config = ConfigDict(validate_assignment=True, arbitrary_types_allowed=True)

{contentctl-5.6.0 → contentctl-5.6.2}/contentctl/objects/data_source.py

@@ -19,14 +19,14 @@ class DataSource(SecurityContentObject):
     source: str = Field(...)
     sourcetype: str = Field(...)
     separator: Optional[str] = None
-    separator_value: None | str = None
+    separator_value: str | None = None
     configuration: Optional[str] = None
     supported_TA: list[TA] = []
-    fields: None | list = None
-    field_mappings: None | list = None
+    fields: list | None = None
+    field_mappings: list | None = None
     mitre_components: list[str] = []
-    convert_to_log_source: None | list = None
-    example_log: None | str = None
+    convert_to_log_source: list | None = None
+    example_log: str | None = None
     output_fields: list[str] = []
     status: ContentStatus = ContentStatus.production
 

{contentctl-5.6.0 → contentctl-5.6.2}/contentctl/objects/drilldown.py

@@ -22,14 +22,14 @@ class Drilldown(BaseModel):
         description="The text of a drilldown search. This must be valid SPL.",
         min_length=1,
     )
-    earliest_offset: None | str = Field(
+    earliest_offset: str | None = Field(
         ...,
         description="Earliest offset time for the drilldown search. "
         f"The most common value for this field is '{EARLIEST_OFFSET}', "
         "but it is NOT the default value and must be supplied explicitly.",
         min_length=1,
     )
-    latest_offset: None | str = Field(
+    latest_offset: str | None = Field(
         ...,
         description="Latest offset time for the driolldown search. "
         f"The most common value for this field is '{LATEST_OFFSET}', "

{contentctl-5.6.0 → contentctl-5.6.2}/contentctl/objects/lookup.py

@@ -100,11 +100,11 @@ class Lookup(SecurityContentObject, abc.ABC):
     match_type: list[Annotated[str, Field(pattern=r"(^WILDCARD|CIDR)\(.+\)$")]] = Field(
         default=[]
     )
-    min_matches: None | NonNegativeInt = Field(default=None)
-    max_matches: None | Annotated[NonNegativeInt, Field(ge=1, le=1000)] = Field(
+    min_matches: NonNegativeInt | None = Field(default=None)
+    max_matches: Annotated[NonNegativeInt, Field(ge=1, le=1000)] | None = Field(
         default=None
     )
-    case_sensitive_match: None | bool = Field(default=None)
+    case_sensitive_match: bool | None = Field(default=None)
     status: ContentStatus = ContentStatus.production
 
     @field_validator("status", mode="after")

{contentctl-5.6.0 → contentctl-5.6.2}/contentctl/objects/mitre_attack_enrichment.py

@@ -41,9 +41,9 @@ class AttackGroupType(StrEnum):
 class MitreExternalReference(BaseModel):
     model_config = ConfigDict(extra="forbid")
     source_name: str
-    external_id: None | str = None
-    url: None | HttpUrl = None
-    description: None | str = None
+    external_id: str | None = None
+    url: HttpUrl | None = None
+    description: str | None = None
 
 
 class MitreAttackGroup(BaseModel):
@@ -58,7 +58,7 @@ class MitreAttackGroup(BaseModel):
     group_id: str
     id: str
     matrix: list[AttackGroupMatrix]
-    mitre_attack_spec_version: None | str
+    mitre_attack_spec_version: str | None
     mitre_version: str
     # assume that if the deprecated field is not present, then the group is not deprecated
     mitre_deprecated: bool

{contentctl-5.6.0 → contentctl-5.6.2}/pyproject.toml

@@ -1,7 +1,7 @@
 [tool.poetry]
 name = "contentctl"
 
-version = "5.6.0"
+version = "5.6.2"
 
 description = "Splunk Content Control Tool"
 authors = ["STRT <research@splunk.com>"]
@@ -14,31 +14,33 @@ contentctl = 'contentctl.contentctl:main'
 [tool.poetry.dependencies]
 
 python = "^3.11,<3.14"
+# Pinned to 2.9.2. Newer pydantic versions (tested through 2.13.5) fail to
+# resolve the forward reference from Story to Detection, raising
+# "`Story` is not fully defined; you should define `Detection`, then call
+# `Story.model_rebuild()`." during `contentctl validate`/`build`.
 pydantic = "~2.9.2"
-PyYAML = "^6.0.2"
-requests = ">=2.32.4"
+PyYAML = "^6.0.3"
+requests = ">=2.34.2"
 pycvesearch = "^1.2"
-xmltodict = ">=0.13,<0.15"
+xmltodict = "^1.0.4"
+# attackcti 0.6.x requires pydantic>=2.12.5, which conflicts with our
+# pydantic pin above, so this stays capped below 0.6.
 attackcti = ">=0.5.4,<0.6"
-Jinja2 = "^3.1.4"
-questionary = "^2.0.1"
-docker = "^7.1.0"
-splunk-sdk = "^2.0.2"
+Jinja2 = "^3.1.6"
+questionary = "^2.1.1"
+docker = "^7.2.0"
+splunk-sdk = "^2.1.1"
 semantic-version = "^2.10.0"
 bottle = ">=0.12.25,<0.14.0"
-tqdm = "^4.66.5"
-pygit2 = "^1.15.1"
-#We are pinned to this version of tyro because 0.9.23 and above
-#have an issue when parsing an extremely large number of files
-#(in our testing great than 130) when using the mode:selected
-#--mode.files command.
-tyro = "^0.9.2,<0.9.23"
-gitpython = "^3.1.43"
-setuptools = "<81"
-rich = "^14.0.0"
+tqdm = "^4.70.1"
+pygit2 = "^1.20.1"
+tyro = "^1.0.16"
+gitpython = "^3.1.62"
+setuptools = ">=83.0.0,<84"
+rich = "^15.0.0"
 
 [tool.poetry.group.dev.dependencies]
-ruff = "^0.12.10"
+ruff = "^0.16.8"
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]