Ensure detections show up in the ES app

linuxdaemon · linuxdaemon · commit 5384b05db22d · 2023-10-11T12:44:52.000-04:00
This ensures that detections show up as
content in the Enterprise Security UI in Splunk
diff --git a/contentctl/actions/api_deploy.py b/contentctl/actions/api_deploy.py
@@ -47,7 +47,7 @@ def execute(self, input_dto: API_DeployInputDto) -> None:
                 "username": target.username,
                 "password": target.password,
                 "owner": "nobody",
-                "app": "search",
+                "app": "SplunkEnterpriseSecuritySuite",
             }
             print("Warning - we are currently deploying all content into the 'search' app. "
                   "At this time, this means the user does not have to install the app "

Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ def execute(self, input_dto: API_DeployInputDto) -> None:`
`47`	`47`	`"username": target.username,`
`48`	`48`	`"password": target.password,`
`49`	`49`	`"owner": "nobody",`
`50`		`- "app": "search",`
	`50`	`+ "app": "SplunkEnterpriseSecuritySuite",`
`51`	`51`	`}`
`52`	`52`	`print("Warning - we are currently deploying all content into the 'search' app. "`
`53`	`53`	`"At this time, this means the user does not have to install the app "`