Skip to content

Default Stanza to prevent issues post-search-removal #421

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 11 commits into
base: main
Choose a base branch
from
+6 −1
Open

Default Stanza to prevent issues post-search-removal #421

Changes from 9 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
0a0c5d9
Starting default stanza
ljstella Jun 25, 2025
f510a6b
Add search to default stanza
ljstella Jun 25, 2025
f0484c8
updated default search
ljstella Jul 1, 2025
52ffa50
Add default stanza for macro
ljstella Jul 16, 2025
870167f
Merge branch 'main' into default_search_stanza
ljstella Jul 16, 2025
760b26f
Update macro default
ljstella Jul 16, 2025
68d9b20
revert default macro change
ljstella Jul 16, 2025
5665b5f
Merge branch 'main' into default_search_stanza
ljstella Jul 17, 2025
d911d21
Merge branch 'main' into default_search_stanza
ljstella Aug 27, 2025
df936d1
change stanza name
ljstella Oct 6, 2025
0bbea43
Add default description
ljstella Oct 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion contentctl/output/templates/savedsearches_detections.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,14 @@
### {{app.label}} DETECTIONS ###

[ default ]
disabled = 1
search = | makeresults | eval text = "This search was removed in a previous release, or is otherwise not present."

{% for detection in objects %}
[{{ detection.get_conf_stanza_name(app) }}]
action.escu = 0
action.escu.enabled = 1
description = {{ detection.status_aware_description | escapeNewlines() }}
description = {{ detection.status_aware_description | escapeNewlines() }}
action.escu.mappings = {{ detection.mappings | tojson }}
action.escu.data_models = {{ detection.datamodel | tojson }}
action.escu.eli5 = {{ detection.status_aware_description | escapeNewlines() }}
Expand Down
Loading