Merge branch 'obs_to_rba' of https://github.com/splunk/contentctl into obs_to_rba

Author: pyth0n1c

contentctl/objects/abstract_security_content_objects/detection_abstract.py

@@ -36,7 +36,7 @@
 from contentctl.objects.integration_test import IntegrationTest
 from contentctl.objects.data_source import DataSource
 
-from contentctl.objects.rba import rba_object
+from contentctl.objects.rba import RBAObject
 
 from contentctl.objects.base_test_result import TestResultStatus
 from contentctl.objects.drilldown import Drilldown, DRILLDOWN_SEARCH_PLACEHOLDER
@@ -68,7 +68,7 @@ class Detection_Abstract(SecurityContentObject):
     search: str = Field(...)
     how_to_implement: str = Field(..., min_length=4)
     known_false_positives: str = Field(..., min_length=4)
-    rba: Optional[rba_object] = Field(default=None)
+    rba: Optional[RBAObject] = Field(default=None)
     explanation: None | str = Field(
         default=None,
         exclude=True, #Don't serialize this value when dumping the object

contentctl/objects/rba.py

@@ -40,25 +40,25 @@ class ThreatObjectType(str, Enum):
     TLS_HASH = "tls_hash"
     URL = "url"
 
-class risk_object(BaseModel):
+class RiskObject(BaseModel):
     field: str
     type: RiskObjectType
     score: RiskScoreValue_Type
 
     def __hash__(self):
         return hash((self.field, self.type, self.score))
 
-class threat_object(BaseModel):
+class ThreatObject(BaseModel):
     field: str
     type: ThreatObjectType
 
     def __hash__(self):
         return hash((self.field, self.type))
 
-class rba_object(BaseModel, ABC):
+class RBAObject(BaseModel, ABC):
     message: str
-    risk_objects: Annotated[Set[risk_object], Field(min_length=1)]
-    threat_objects: Set[threat_object]
+    risk_objects: Annotated[Set[RiskObject], Field(min_length=1)]
+    threat_objects: Set[ThreatObject]