Skip to content

Commit 9ad0d96

Browse files
authored
Merge branch 'main' into ruff_config
2 parents 66ef7fc + bf6fe08 commit 9ad0d96

File tree

12 files changed

+1005
-131
lines changed

12 files changed

+1005
-131
lines changed

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ This section is under active development. It will allow you to a [MITRE Map](ht
134134
Choose TYPE {detection, story} to create new content for the Content Pack. The tool will interactively ask a series of questions required for generating a basic piece of content and automatically add it to the Content Pack.
135135

136136
### contentctl inspect
137-
This section is under development. It will enable the user to perform an appinspect of the content pack in preparation for deployment onto a Splunk Instance or via Splunk Cloud.
137+
This section is under development. The inspect action performs a number of post-build validations. Primarily, it will enable the user to perform an appinspect of the content pack in preparation for deployment onto a Splunk Instance or via Splunk Cloud. It also compares detections in the new build against a prior build, confirming that any changed detections have had their versions incremented (this comparison happens at the savedsearch.conf level, which is why it must happen after the build). Please also note that new versions of contentctl may result in the generation of different savedsearches.conf files without any content changes in YML (new keys at the .conf level which will necessitate bumping of the version in the YML file).
138138

139139
### contentctl deploy
140140
The reason to build content is so that it can be deployed to your environment. However, deploying content to multiple servers and different types of infrastructure can be tricky and time-consuming. contentctl makes this easy by supporting a number of different deployment mechanisms. Deployment targets can be defined in [contentctl.yml](/contentctl/templates/contentctl_default.yml).

contentctl/actions/initialize.py

Lines changed: 28 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
import shutil
33
import os
44
import pathlib
5-
6-
from pydantic import RootModel
75
from contentctl.objects.config import test
86
from contentctl.output.yml_writer import YmlWriter
97

@@ -17,26 +15,44 @@ def execute(self, config: test) -> None:
1715

1816
YmlWriter.writeYmlFile(str(config.path/'contentctl.yml'), config.model_dump())
1917

18+
2019
#Create the following empty directories:
21-
for emptyDir in ['lookups', 'baselines', 'docs', 'reporting', 'investigations']:
20+
for emptyDir in ['lookups', 'baselines', 'data_sources', 'docs', 'reporting', 'investigations',
21+
'detections/application', 'detections/cloud', 'detections/endpoint',
22+
'detections/network', 'detections/web', 'macros', 'stories']:
2223
#Throw an error if this directory already exists
23-
(config.path/emptyDir).mkdir(exist_ok=False)
24+
(config.path/emptyDir).mkdir(exist_ok=False, parents=True)
25+
26+
# If this is not a bare config, then populate
27+
# a small amount of content into the directories
28+
if not config.bare:
29+
#copy the contents of all template directories
30+
for templateDir, targetDir in [
31+
('../templates/detections/', 'detections'),
32+
('../templates/data_sources/', 'data_sources'),
33+
('../templates/macros/', 'macros'),
34+
('../templates/stories/', 'stories'),
35+
]:
36+
source_directory = pathlib.Path(os.path.dirname(__file__))/templateDir
37+
target_directory = config.path/targetDir
38+
39+
# Do not throw an exception if the directory exists. In fact, it was
40+
# created above when the structure of the app was created.
41+
shutil.copytree(source_directory, target_directory, dirs_exist_ok=True)
2442

25-
26-
#copy the contents of all template directories
43+
# The contents of app_template must ALWAYS be copied because it contains
44+
# several special files.
45+
# For now, we also copy the deployments because the ability to create custom
46+
# deployment files is limited with built-in functionality.
2747
for templateDir, targetDir in [
2848
('../templates/app_template/', 'app_template'),
29-
('../templates/deployments/', 'deployments'),
30-
('../templates/detections/', 'detections'),
31-
('../templates/data_sources/', 'data_sources'),
32-
('../templates/macros/','macros'),
33-
('../templates/stories/', 'stories'),
49+
('../templates/deployments/', 'deployments')
3450
]:
3551
source_directory = pathlib.Path(os.path.dirname(__file__))/templateDir
3652
target_directory = config.path/targetDir
3753
#Throw an exception if the target exists
3854
shutil.copytree(source_directory, target_directory, dirs_exist_ok=False)
39-
55+
4056
# Create a README.md file. Note that this is the README.md for the repository, not the
4157
# one which will actually be packaged into the app. That is located in the app_template folder.
4258
shutil.copyfile(pathlib.Path(os.path.dirname(__file__))/'../templates/README.md','README.md')

0 commit comments

Comments
 (0)