diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py index 183b404d6e..0e6dce1880 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py @@ -36,7 +36,6 @@ class ObjToJsonAdapter(Adapter): obj_array.append(story.dict(exclude_none=True, exclude = { - "detections": True, "investigations": True } )) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py index 1518b69f31..6358830596 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py @@ -41,7 +41,20 @@ class SecurityContentStoryBuilder(StoryBuilder): for detection_analytic_story in detection.tags.analytic_story: if detection_analytic_story == self.story.name: matched_detection_names.append(str('ESCU - ' + detection.name + ' - Rule')) - matched_detections.append(detection) + # SSE-638: detections object should at least contain the name attribute. + # We also need a minimal set of the following attributes to satisfy docgen (doc_stories.j2): + # name, source, type, tags.mitre_attack_enrichments.mitre_attack_technique + mitre_attack_enrichments_list = [] + if (detection.tags.mitre_attack_enrichments): + for attack in detection.tags.mitre_attack_enrichments: + mitre_attack_enrichments_list.append({"mitre_attack_technique": attack.mitre_attack_technique}) + tags_obj = {"mitre_attack_enrichments": mitre_attack_enrichments_list} + matched_detections.append({ + "name": detection.name, + "source": detection.source, + "type": detection.type, + "tags": tags_obj + }) datamodels.update(detection.datamodel) if detection.tags.kill_chain_phases: kill_chain_phases.update(detection.tags.kill_chain_phases)