From 51edd7950a1655e6260ef3ff0774fc9c788e17df Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Wed, 20 Jul 2022 15:53:20 -0700
Subject: [PATCH 01/15] Condensed multiple requirements.txt files into single
 requirements.txt in the root of security_content. Removed explicit calls to
 python3 in CI/CD workflows and inside of the docker_detection_testing tool.
 These are not required and in fact should not be done since python
 interpreters started by the detection tester inherit the venv the parent was
 run under.

---
 .github/workflows/build-and-validate.yml      | 32 +++++++-------
 .github/workflows/code-testing.yml            |  8 ++--
 .github/workflows/detection-testing.yml       | 18 ++++----
 bin/docker_detection_tester/Dockerfile        | 16 -------
 .../detection_testing_execution.py            | 44 +++----------------
 bin/docker_detection_tester/requirements.txt  | 17 -------
 requirements.txt                              | 10 ++++-
 7 files changed, 45 insertions(+), 100 deletions(-)
 delete mode 100644 bin/docker_detection_tester/Dockerfile
 delete mode 100644 bin/docker_detection_tester/requirements.txt

diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml
index cf3bf42fba..923a4a9f09 100644
--- a/.github/workflows/build-and-validate.yml
+++ b/.github/workflows/build-and-validate.yml
@@ -283,16 +283,16 @@ jobs:
         run: |
           #Get the virtualenv set up
           rm -rf venv
-          python3 -m venv --clear venv
+          python -m venv --clear venv
           source venv/bin/activate
-          python3 -m pip install --upgrade pip
-          python3 -m pip install wheel
-          python3 -m pip install -q -r requirements.txt
+          python -m pip install --upgrade pip
+          python -m pip install wheel
+          python -m pip install -q -r requirements.txt
       
       - name: run reporting
         run: |
           source venv/bin/activate
-          python3 contentctl.py -p . reporting
+          python contentctl.py -p . reporting
       
       #Official, Verified Amazon-AWS Github Account Provided Action
       - uses: aws-actions/configure-aws-credentials@v1
@@ -339,11 +339,11 @@ jobs:
         run: |
           #Get the virtualenv set up
           rm -rf venv
-          python3 -m venv --clear venv
+          python -m venv --clear venv
           source venv/bin/activate
-          python3 -m pip install --upgrade pip
-          python3 -m pip install wheel
-          python3 -m pip install -q -r requirements.txt
+          python -m pip install --upgrade pip
+          python -m pip install wheel
+          python -m pip install -q -r requirements.txt
 
       - name: Get branch and PR required for detection testing main.py
         id: vars
@@ -353,12 +353,12 @@ jobs:
       - name: Run doc-gen
         run: |
           source venv/bin/activate
-          python3 contentctl.py -p . docgen -o docs
+          python contentctl.py -p . docgen -o docs
 
       - name: Run reporting
         run: |
           source venv/bin/activate
-          python3 contentctl.py -p . reporting
+          python contentctl.py -p . reporting
 
       - name: Update github with new docs and package bits
         run: |
@@ -467,16 +467,16 @@ jobs:
         run: |
           #Get the virtualenv set up
           rm -rf venv
-          python3 -m venv --clear venv
+          python -m venv --clear venv
           source venv/bin/activate
-          python3 -m pip install --upgrade pip
-          python3 -m pip install wheel
-          python3 -m pip install -q -r requirements.txt
+          python -m pip install --upgrade pip
+          python -m pip install wheel
+          python -m pip install -q -r requirements.txt
 
       - name: Create YML to JSON Folder
         run: |
           source venv/bin/activate
-          python3 contentctl.py --path . generate --product API --output dist/api
+          python contentctl.py --path . generate --product API --output dist/api
 
       - name: Generate content version and timestamp JSON
         run : |
diff --git a/.github/workflows/code-testing.yml b/.github/workflows/code-testing.yml
index 70776ee534..2e565fd0c5 100644
--- a/.github/workflows/code-testing.yml
+++ b/.github/workflows/code-testing.yml
@@ -23,11 +23,11 @@ jobs:
         run: |
           #Get the virtualenv set up
           rm -rf venv
-          python3 -m venv --clear venv
+          python -m venv --clear venv
           source venv/bin/activate
-          python3 -m pip install --upgrade pip
-          python3 -m pip install wheel
-          python3 -m pip install -q -r requirements.txt
+          python -m pip install --upgrade pip
+          python -m pip install wheel
+          python -m pip install -q -r requirements.txt
       
       - name: test code with pytest
         run: |
diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index a2bba1b154..7566d8b737 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -63,10 +63,10 @@ jobs:
         - name: Install Python Dependencies
           run: |
             cd bin/docker_detection_tester
-            python3 -m venv .venv
+            python -m venv .venv
             source .venv/bin/activate
-            python3 -m pip install wheel
-            python3 -m pip install -r requirements.txt
+            python -m pip install wheel
+            python -m pip install -r requirements.txt
         
         - name: Run the CI
           run: |
@@ -157,10 +157,10 @@ jobs:
         - name: Install Python Dependencies
           run: |
             cd bin/docker_detection_tester
-            python3 -m venv .venv
+            python -m venv .venv
             source .venv/bin/activate
-            python3 -m pip install wheel
-            python3 -m pip install -r requirements.txt
+            python -m pip install wheel
+            python -m pip install -r requirements.txt
         
         - name: Run the CI
           run: |
@@ -260,10 +260,10 @@ jobs:
         - name: Install Python Dependencies
           run: |
             cd bin/docker_detection_tester
-            python3 -m venv .venv
+            python -m venv .venv
             source .venv/bin/activate
-            python3 -m pip install wheel
-            python3 -m pip install -r requirements.txt
+            python -m pip install wheel
+            python -m pip install -r requirements.txt
 
         - name: Merge Detections into single File
           run: |
diff --git a/bin/docker_detection_tester/Dockerfile b/bin/docker_detection_tester/Dockerfile
deleted file mode 100644
index 1ed762dde5..0000000000
--- a/bin/docker_detection_tester/Dockerfile
+++ /dev/null
@@ -1,16 +0,0 @@
-FROM ubuntu:18.04
-
-RUN apt-get update
-RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata
-RUN apt-get install -y python3-dev git python-dev unzip python3-pip awscli
-RUN apt-get install -y python-gitdb
-RUN apt-get install -y wget unzip
-RUN apt-get install -y git
-
-ADD . /app
-
-WORKDIR /app
-RUN pip3 install -r requirements.txt
-
-ENTRYPOINT ["python3", "detection_testing_execution.py"]
-CMD ["-b", "automated_detections_testing_2"]
diff --git a/bin/docker_detection_tester/detection_testing_execution.py b/bin/docker_detection_tester/detection_testing_execution.py
index 01a457ae11..4df19e5037 100644
--- a/bin/docker_detection_tester/detection_testing_execution.py
+++ b/bin/docker_detection_tester/detection_testing_execution.py
@@ -173,14 +173,9 @@ def generate_escu_app(persist_security_content: bool = False) -> str:
     print("****GENERATING ESCU APP****")
     os.chdir("security_content")
     if persist_security_content is False:
-        commands = ["python3 -m venv .venv",
-                    ". ./.venv/bin/activate",
-                    "python -m pip install wheel",
-                    "python -m pip install -r requirements.txt",
-                    "python3 ../../../contentctl.py --path . --skip_enrichment generate --product ESCU --output dist/escu"]
+        commands = ["python ../../../contentctl.py --path . --skip_enrichment generate --product ESCU --output dist/escu"]
     else:
-        commands = [". ./.venv/bin/activate",
-                    "python3 ../../../contentctl.py --path . --skip_enrichment generate --product ESCU --output dist/escu"]
+        commands = ["python ../../../contentctl.py --path . --skip_enrichment generate --product ESCU --output dist/escu"]
     ret = subprocess.run("; ".join(commands),
                          shell=True, capture_output=True)
     if ret.returncode != 0:
@@ -199,7 +194,7 @@ def generate_escu_app(persist_security_content: bool = False) -> str:
     output_file_path_from_slim_latest = os.path.join(
         "upload", output_file_name)
     output_file_path_from_security_content = os.path.join(
-        "slim_packaging", "slim_latest", output_file_path_from_slim_latest)
+        "slim_packaging", output_file_path_from_slim_latest)
     output_file_path_from_root = os.path.join(
         "security_content", output_file_path_from_security_content)
 
@@ -215,42 +210,17 @@ def generate_escu_app(persist_security_content: bool = False) -> str:
             sys.exit(1)
 
         # There remove the latest file if it exists
-        commands = ["cd slim_packaging/slim_latest",
-                    ". ./.venv/bin/activate",
-                    "cp -R ../../dist/escu DA-ESS-ContentUpdate",
+        commands = ["cd slim_packaging",
+                    "cp -R ../dist/escu DA-ESS-ContentUpdate",
                     "slim package -o upload DA-ESS-ContentUpdate",
                     "cp upload/DA-ESS-ContentUpdate*.tar.gz %s" % (output_file_path_from_slim_latest)]
 
     else:
         os.mkdir("slim_packaging")
-        
-        try:
-            SPLUNK_PACKAGING_TOOLKIT_URL = "https://download.splunk.com/misc/packaging-toolkit/splunk-packaging-toolkit-0.9.0.tar.gz"
-            SPLUNK_PACKAGING_TOOLKIT_FILENAME = 'splunk-packaging-toolkit-latest.tar.gz'
-            print("Downloading the Splunk Packaging Toolkit from %s..." %
-                  (SPLUNK_PACKAGING_TOOLKIT_URL), end='')
-            response = get(SPLUNK_PACKAGING_TOOLKIT_URL)
-            response.raise_for_status()
-            with open(SPLUNK_PACKAGING_TOOLKIT_FILENAME, 'wb') as slim_file:
-                slim_file.write(response.content)
-            print("Done")
-        except Exception as e:
-            print("Error downloading the Splunk Packaging Toolkit: [%s].\n\tQuitting..." %
-                  (str(e)), file=sys.stderr)
-            sys.exit(1)
-        
         commands = ["rm -rf slim_packaging/slim_latest",
-                    "mkdir slim_packaging/slim_latest",
+                    "mkdir slim_packaging",
                     "cd slim_packaging",
-                    "tar -zxf ../splunk-packaging-toolkit-latest.tar.gz -C slim_latest --strip-components=1",
-                    "cd slim_latest",
-                    "python3 -m venv .venv",
-                    ". ./.venv/bin/activate",
-                    "python -m pip install --upgrade pip",
-                    "python -m pip install wheel",
-                    "python -m pip install semantic_version",
-                    "python -m pip install .",
-                    "cp -R ../../dist/escu DA-ESS-ContentUpdate",
+                    "cp -R ../dist/escu DA-ESS-ContentUpdate",
                     "slim package -o upload DA-ESS-ContentUpdate",
                     "cp upload/DA-ESS-ContentUpdate*.tar.gz %s" % (output_file_path_from_slim_latest)]
 
diff --git a/bin/docker_detection_tester/requirements.txt b/bin/docker_detection_tester/requirements.txt
deleted file mode 100644
index 6986ae3ee8..0000000000
--- a/bin/docker_detection_tester/requirements.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-psutil==5.8.0
-attackcti==0.3.4.3
-GitPython==3.1.14
-Jinja2==3.0.0
-PyYAML==5.4
-requests==2.25.1
-six==1.16.0
-
-splunk-sdk==1.6.12
-splunk-packaging-toolkit==1.0.1
-#newest version of docker for managing the splunk containers
-#we will freeze at a specific version later
-docker==5.0.3
-
-#For help getting and parsing the configuration
-jsonschema==4.2.1
-wrapt_timeout_decorator==1.3.1
diff --git a/requirements.txt b/requirements.txt
index db54162106..3df0071ae1 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,10 +1,18 @@
 attackcti
+docker
+gitpython
 jinja2
+jsonschema
 mock
+psutil
 pycvesearch
 pydantic
 pytest
-PyYAML
+pyyaml
 questionary
 requests
+six
+splunk-packaging-toolkit
+splunk-sdk
+wrapt_timeout_decorator
 xmltodict

From 02930ad9740d0183d2420dc0e326970b935c6e26 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Thu, 21 Jul 2022 12:38:15 -0700
Subject: [PATCH 02/15] Change from ResultsReader to JSONResultsReader since
 ResultsReader was deprecated in the latest Splunk SDK.

---
 .../modules/splunk_sdk.py                     | 71 ++++---------------
 1 file changed, 12 insertions(+), 59 deletions(-)

diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py
index f930e7531b..cdca4f0995 100644
--- a/bin/docker_detection_tester/modules/splunk_sdk.py
+++ b/bin/docker_detection_tester/modules/splunk_sdk.py
@@ -80,15 +80,18 @@ def get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, inde
         search = f'''search index="{index}" host="{event_host}" | stats count'''
     kwargs = {"exec_mode":"blocking"}
     try:
-        search_result = service.jobs.create(search, **kwargs)
+        job = service.jobs.create(search, **kwargs)
   
         #This returns the count in string form, not as an int. For example:
         #OrderedDict([('count', '59630')])
-        search_results = list(results.ResultsReader(search_result.results()))
-        if len(search_results) != 1:
+        results_stream = job.results(output_mode='json')
+        count = None
+        for res in results.JSONResultsReader(results_stream):
+            if 'count' in res:
+                count = int(res['count'],10)
+        if count is None:
             raise Exception(f"Expected the get_number_of_indexed_events search to only return 1 count, but got {len(search_results)} instead.")
         
-        count = int(search_results[0]['count'])
         return count    
 
     except Exception as e:
@@ -122,59 +125,6 @@ def wait_for_indexing_to_complete(splunk_host, splunk_port, splunk_password, sou
             time.sleep(check_interval_seconds)
         
 
-'''
-def wait_for_indexing_to_complete(splunk_host, splunk_port, splunk_password, sourcetype:str, index:str, check_interval_seconds:int=10):
-    
-    startTime = timeit.default_timer()
-    previous_count = -1
-    time.sleep(check_interval_seconds/2)
-    while True:
-        #print("waiting for search...")
-        try:
-            service = client.connect(
-                host=splunk_host,
-                port=splunk_port,
-                username='admin',
-                password=splunk_password
-            )
-        except Exception as e:
-            raise(Exception("Unable to connect to Splunk instance: " + str(e)))
-
-        search = 'search index="%s" sourcetype="%s" | stats count'%(index,sourcetype)
-        kwargs = {"exec_mode":"blocking"}
-        try:
-            search_result = service.jobs.create(search, **kwargs)
-        except Exception as e:
-            print("Error while waiting for indexing of data to complete: %s"%(str(e)))
-            #return False
-        
-        #This returns the count in string form, not as an int. For example:
-        #OrderedDict([('count', '59630')])
-        try:
-            for result in results.ResultsReader(search_result.results()):
-                count = int(result['count'])
-                print("count is %d, previous count is %d"%(count,previous_count))
-                if previous_count == -1:
-                    if count == 0:
-                        pass
-                    else:
-                        previous_count = count
-                else:
-                    if count == previous_count:
-                        #After waiting for the check interval, we return the same number of results.  The indexing must be complete 
-                        stopTime = timeit.default_timer()
-                        #print("Indexing completed after: %s "%(datetime.timedelta(seconds=stopTime-startTime)))
-                        return True
-                    else:
-                        previous_count = count
-    
-        except Exception as e:
-            print("Error trying to get the count while waiting for indexing to complete: %s"%(str(e)))
-            #return False
-        time.sleep(check_interval_seconds)
-'''
-
-
 def test_baseline_search(splunk_host, splunk_port, splunk_password, search, pass_condition, baseline_name, baseline_file, earliest_time, latest_time)->dict:
     try:
         service = client.connect(
@@ -280,6 +230,8 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str,
 
     try:
         job = service.jobs.create(splunk_search, **kwargs)
+        results_stream = job.results(output_mode='json')
+
     except Exception as e:
         
         error_message = "Unable to execute detection: %s"%(str(e))
@@ -301,7 +253,7 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str,
     if int(job['resultCount']) != 1:
         #print("Test failed for detection: " + detection_name)
         if attempts_remaining > 0:
-            print(f"Execution of test failed for [{detection_name}]. Sleeping for [{failure_sleep_interval_seconds} seconds] and trying again...")
+            print(f"Execution of test failed for [{detection_name}]. Sleeping for [{failure_sleep_interval_seconds} seconds] and trying up to {attempts_remaining} more times...")
             time.sleep(failure_sleep_interval_seconds)
             return test_detection_search(splunk_host, splunk_port, splunk_password, search, pass_condition, detection_name, detection_file, 
                                          earliest_time, latest_time, attempts_remaining=attempts_remaining, 
@@ -347,7 +299,8 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa
             try:
                 
                 job = service.jobs.create(splunk_search, **kwargs)
-                reader = results.ResultsReader(job)
+                results_stream = job.results(output_mode='json')
+                reader = results.JSONResultsReader(results_stream)
 
 
             except Exception as e:

From 21adea0c76eb4143c35d25dd362bb2e8d7e90a7f Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 22 Jul 2022 11:14:34 -0700
Subject: [PATCH 03/15] Job to test contentctl and slim on different platforms
 with different python versions.

---
 .../contentctl_python_platforms_test.yml      | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 .github/workflows/contentctl_python_platforms_test.yml

diff --git a/.github/workflows/contentctl_python_platforms_test.yml b/.github/workflows/contentctl_python_platforms_test.yml
new file mode 100644
index 0000000000..e2f8d40f25
--- /dev/null
+++ b/.github/workflows/contentctl_python_platforms_test.yml
@@ -0,0 +1,42 @@
+name: contentctl_python_platforms_test
+on:
+  push:
+jobs:
+
+  check-python-versions:
+    strategy:
+      matrix:
+        os: [ubuntu-18.04, ubuntu-20.04, ubuntu22.04, macos-12, windows-2022]
+        python-version: [3.9, 3.10]
+    runs-on: ${{ matrix.os }}
+
+    steps:  
+        - name: Checkout Repo
+          uses: actions/checkout@v2
+
+        - uses: actions/setup-python@v2
+          with:
+            python-version: ${{ matrix.python-version }} #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
+            architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified          
+        
+        - name: Install Python Dependencies
+          run: |
+            python -m venv .venv
+            source .venv/bin/activate
+            python -m pip install wheel
+            python -m pip install -r requirements.txt
+        
+        - name: Run contentctl to make sure it works on each contentctl_python_platforms_test
+          run: |
+            # Validate
+            python contentctl.py -p . --skip_enrichment generate validate -pr ESCU 
+            python contentctl.py -p . --skip_enrichment generate validate -pr SSA 
+            # Generate
+            python contentctl.py --path . --skip_enrichment generate --product ESCU --output dist/escu
+            python contentctl.py --path . --skip_enrichment generate --product SSA --output dist/ssa
+
+            #Test slim as well
+            mv dist/escu      DA-ESS-ContentUpdate
+            slim package -o upload DA-ESS-ContentUpdate
+            
+        
\ No newline at end of file

From 085635715401ddceacd948e5c269e1ced0e7d086 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 22 Jul 2022 11:16:46 -0700
Subject: [PATCH 04/15] Need to quote python versions. Also added 3.11 because
 why not.

---
 .github/workflows/contentctl_python_platforms_test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/contentctl_python_platforms_test.yml b/.github/workflows/contentctl_python_platforms_test.yml
index e2f8d40f25..8d1fcff3dc 100644
--- a/.github/workflows/contentctl_python_platforms_test.yml
+++ b/.github/workflows/contentctl_python_platforms_test.yml
@@ -7,7 +7,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-18.04, ubuntu-20.04, ubuntu22.04, macos-12, windows-2022]
-        python-version: [3.9, 3.10]
+        python-version: ['3.9', '3.10', '3.11']
     runs-on: ${{ matrix.os }}
 
     steps:  

From ba5e73e6a7bc6cf9679334e1260faf56fc85577a Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 22 Jul 2022 11:20:30 -0700
Subject: [PATCH 05/15] Updated name for 3.11 to 3.11-dev

---
 .github/workflows/contentctl_python_platforms_test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/contentctl_python_platforms_test.yml b/.github/workflows/contentctl_python_platforms_test.yml
index 8d1fcff3dc..61f53a79cf 100644
--- a/.github/workflows/contentctl_python_platforms_test.yml
+++ b/.github/workflows/contentctl_python_platforms_test.yml
@@ -7,7 +7,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-18.04, ubuntu-20.04, ubuntu22.04, macos-12, windows-2022]
-        python-version: ['3.9', '3.10', '3.11']
+        python-version: ['3.9', '3.10', '3.11-dev']
     runs-on: ${{ matrix.os }}
 
     steps:  

From a21962823557b409eb0f3ba9d8aa246ff6b9cf03 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 22 Jul 2022 11:22:24 -0700
Subject: [PATCH 06/15] Disable fail-fast behavior

---
 .github/workflows/contentctl_python_platforms_test.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/contentctl_python_platforms_test.yml b/.github/workflows/contentctl_python_platforms_test.yml
index 61f53a79cf..60afe6e9a0 100644
--- a/.github/workflows/contentctl_python_platforms_test.yml
+++ b/.github/workflows/contentctl_python_platforms_test.yml
@@ -5,6 +5,7 @@ jobs:
 
   check-python-versions:
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-18.04, ubuntu-20.04, ubuntu22.04, macos-12, windows-2022]
         python-version: ['3.9', '3.10', '3.11-dev']

From c2141acaf113e7cc6f5e4ff929b9111dce305b21 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 22 Jul 2022 11:29:50 -0700
Subject: [PATCH 07/15] Forgot to activate virtualenv in next step after
 installing requirements.

---
 .github/workflows/contentctl_python_platforms_test.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/contentctl_python_platforms_test.yml b/.github/workflows/contentctl_python_platforms_test.yml
index 60afe6e9a0..f78a0adf95 100644
--- a/.github/workflows/contentctl_python_platforms_test.yml
+++ b/.github/workflows/contentctl_python_platforms_test.yml
@@ -27,9 +27,10 @@ jobs:
             python -m pip install wheel
             python -m pip install -r requirements.txt
         
-        - name: Run contentctl to make sure it works on each contentctl_python_platforms_test
+        - name: Run contentctl and slim to make sure they work on each platform and python version
           run: |
             # Validate
+            source .venv/bin/activate
             python contentctl.py -p . --skip_enrichment generate validate -pr ESCU 
             python contentctl.py -p . --skip_enrichment generate validate -pr SSA 
             # Generate

From cfe48391364b2cc6f14466892396453d1f691ef9 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 22 Jul 2022 11:31:37 -0700
Subject: [PATCH 08/15] typo in contentctl

---
 .github/workflows/contentctl_python_platforms_test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/contentctl_python_platforms_test.yml b/.github/workflows/contentctl_python_platforms_test.yml
index f78a0adf95..7ba14d51d0 100644
--- a/.github/workflows/contentctl_python_platforms_test.yml
+++ b/.github/workflows/contentctl_python_platforms_test.yml
@@ -31,8 +31,8 @@ jobs:
           run: |
             # Validate
             source .venv/bin/activate
-            python contentctl.py -p . --skip_enrichment generate validate -pr ESCU 
-            python contentctl.py -p . --skip_enrichment generate validate -pr SSA 
+            python contentctl.py -p . --skip_enrichment validate -pr ESCU 
+            python contentctl.py -p . --skip_enrichment validate -pr SSA 
             # Generate
             python contentctl.py --path . --skip_enrichment generate --product ESCU --output dist/escu
             python contentctl.py --path . --skip_enrichment generate --product SSA --output dist/ssa

From 0e1e6a2798b29acaff112287e103a489b6166834 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 22 Jul 2022 11:42:45 -0700
Subject: [PATCH 09/15] trying to use pip cache and auto install of
 requirements

---
 .../contentctl_python_platforms_test.yml        | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/contentctl_python_platforms_test.yml b/.github/workflows/contentctl_python_platforms_test.yml
index 7ba14d51d0..50bbe5c78a 100644
--- a/.github/workflows/contentctl_python_platforms_test.yml
+++ b/.github/workflows/contentctl_python_platforms_test.yml
@@ -18,19 +18,22 @@ jobs:
         - uses: actions/setup-python@v2
           with:
             python-version: ${{ matrix.python-version }} #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
+            cache: 'pip'
+            cache-dependency-path: 'requirements.txt'
             architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified          
         
-        - name: Install Python Dependencies
-          run: |
-            python -m venv .venv
-            source .venv/bin/activate
-            python -m pip install wheel
-            python -m pip install -r requirements.txt
+        #- name: Install Python Dependencies
+        #  run: |
+        #    python -m venv .venv
+
+        #    source .venv/bin/activate
+        #    python -m pip install wheel
+        #    python -m pip install -r requirements.txt
         
         - name: Run contentctl and slim to make sure they work on each platform and python version
           run: |
             # Validate
-            source .venv/bin/activate
+            #source .venv/bin/activate
             python contentctl.py -p . --skip_enrichment validate -pr ESCU 
             python contentctl.py -p . --skip_enrichment validate -pr SSA 
             # Generate

From 609d151e1688ea5be5f9e739936daf2d59dba5c8 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 22 Jul 2022 11:45:02 -0700
Subject: [PATCH 10/15] removing venv

---
 .../workflows/contentctl_python_platforms_test.yml   | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/contentctl_python_platforms_test.yml b/.github/workflows/contentctl_python_platforms_test.yml
index 50bbe5c78a..24260a8eb5 100644
--- a/.github/workflows/contentctl_python_platforms_test.yml
+++ b/.github/workflows/contentctl_python_platforms_test.yml
@@ -22,18 +22,14 @@ jobs:
             cache-dependency-path: 'requirements.txt'
             architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified          
         
-        #- name: Install Python Dependencies
-        #  run: |
-        #    python -m venv .venv
-
-        #    source .venv/bin/activate
-        #    python -m pip install wheel
-        #    python -m pip install -r requirements.txt
+        - name: Install Python Dependencies
+          run: |
+            python -m pip install wheel
+            python -m pip install -r requirements.txt
         
         - name: Run contentctl and slim to make sure they work on each platform and python version
           run: |
             # Validate
-            #source .venv/bin/activate
             python contentctl.py -p . --skip_enrichment validate -pr ESCU 
             python contentctl.py -p . --skip_enrichment validate -pr SSA 
             # Generate

From e5962ef678d94022726f823046b05d5cb138758e Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 26 Aug 2022 12:22:18 -0700
Subject: [PATCH 11/15] Update contentctl_python_platforms_test.yml

Reduce platforms we are testing
against for now until we can further
improve support.
---
 .github/workflows/contentctl_python_platforms_test.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/contentctl_python_platforms_test.yml b/.github/workflows/contentctl_python_platforms_test.yml
index 24260a8eb5..6169cb9eba 100644
--- a/.github/workflows/contentctl_python_platforms_test.yml
+++ b/.github/workflows/contentctl_python_platforms_test.yml
@@ -7,8 +7,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-18.04, ubuntu-20.04, ubuntu22.04, macos-12, windows-2022]
-        python-version: ['3.9', '3.10', '3.11-dev']
+        #os: [ubuntu-18.04, ubuntu-20.04, ubuntu22.04, macos-12, windows-2022]
+        #python-version: ['3.9', '3.10', '3.11-dev']
+        os: [ubuntu-18.04, ubuntu-20.04, macos-12]
+        python-version: ['3.9']
     runs-on: ${{ matrix.os }}
 
     steps:  
@@ -40,4 +42,4 @@ jobs:
             mv dist/escu      DA-ESS-ContentUpdate
             slim package -o upload DA-ESS-ContentUpdate
             
-        
\ No newline at end of file
+        

From 305a672f51d25a50b0970646555e8e78e592b1c2 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 26 Aug 2022 13:27:01 -0700
Subject: [PATCH 12/15] Delete contentctl_python_platforms_test.yml

Removed extra testing workflow. This logic will
be integrated into a separate repo at a later time.
---
 .../contentctl_python_platforms_test.yml      | 45 -------------------
 1 file changed, 45 deletions(-)
 delete mode 100644 .github/workflows/contentctl_python_platforms_test.yml

diff --git a/.github/workflows/contentctl_python_platforms_test.yml b/.github/workflows/contentctl_python_platforms_test.yml
deleted file mode 100644
index 6169cb9eba..0000000000
--- a/.github/workflows/contentctl_python_platforms_test.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: contentctl_python_platforms_test
-on:
-  push:
-jobs:
-
-  check-python-versions:
-    strategy:
-      fail-fast: false
-      matrix:
-        #os: [ubuntu-18.04, ubuntu-20.04, ubuntu22.04, macos-12, windows-2022]
-        #python-version: ['3.9', '3.10', '3.11-dev']
-        os: [ubuntu-18.04, ubuntu-20.04, macos-12]
-        python-version: ['3.9']
-    runs-on: ${{ matrix.os }}
-
-    steps:  
-        - name: Checkout Repo
-          uses: actions/checkout@v2
-
-        - uses: actions/setup-python@v2
-          with:
-            python-version: ${{ matrix.python-version }} #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
-            cache: 'pip'
-            cache-dependency-path: 'requirements.txt'
-            architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified          
-        
-        - name: Install Python Dependencies
-          run: |
-            python -m pip install wheel
-            python -m pip install -r requirements.txt
-        
-        - name: Run contentctl and slim to make sure they work on each platform and python version
-          run: |
-            # Validate
-            python contentctl.py -p . --skip_enrichment validate -pr ESCU 
-            python contentctl.py -p . --skip_enrichment validate -pr SSA 
-            # Generate
-            python contentctl.py --path . --skip_enrichment generate --product ESCU --output dist/escu
-            python contentctl.py --path . --skip_enrichment generate --product SSA --output dist/ssa
-
-            #Test slim as well
-            mv dist/escu      DA-ESS-ContentUpdate
-            slim package -o upload DA-ESS-ContentUpdate
-            
-        

From baeba5b31930770ba9bbfc09439ebccccc55902a Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 26 Aug 2022 13:34:37 -0700
Subject: [PATCH 13/15] Fixed pathing

Fixed pathing to venv and
requirements.txt files.
---
 .github/workflows/detection-testing.yml | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index ab67dcf835..c03502c953 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -62,7 +62,6 @@ jobs:
         
         - name: Install Python Dependencies
           run: |
-            cd bin/docker_detection_tester
             python -m venv .venv
             source .venv/bin/activate
             python -m pip install wheel
@@ -70,8 +69,8 @@ jobs:
         
         - name: Run the CI
           run: |
-            cd bin/docker_detection_tester
             source .venv/bin/activate
+            cd bin/docker_detection_tester
             echo "github.event.issue.pull_request    : [${{ github.event.issue.pull_request }}]"
             echo "github.event.pull_request.number   : [${{ github.event.pull_request.number }}]"
             echo "steps.vars.outputs.branch          : [${{ steps.vars.outputs.branch }}]"
@@ -156,7 +155,6 @@ jobs:
         
         - name: Install Python Dependencies
           run: |
-            cd bin/docker_detection_tester
             python -m venv .venv
             source .venv/bin/activate
             python -m pip install wheel
@@ -164,10 +162,11 @@ jobs:
         
         - name: Run the CI
           run: |
-            cd bin/docker_detection_tester
             source .venv/bin/activate
+            cd bin/docker_detection_tester
             
-            python3 detection_testing_execution.py run -c prior_config/${{ matrix.manifest_filename}} 
+            
+            python detection_testing_execution.py run -c prior_config/${{ matrix.manifest_filename}} 
                     
         
         - name: Upload Test Results Files
@@ -259,7 +258,6 @@ jobs:
         
         - name: Install Python Dependencies
           run: |
-            cd bin/docker_detection_tester
             python -m venv .venv
             source .venv/bin/activate
             python -m pip install wheel
@@ -267,8 +265,8 @@ jobs:
 
         - name: Merge Detections into single File
           run: |
-            cd bin/docker_detection_tester
             source .venv/bin/activate
+            cd bin/docker_detection_tester
             python summarize_json.py --files results_*/summary.json --output_filename summary_test_results.json
             
             
@@ -340,4 +338,4 @@ jobs:
 
 
 
-      
\ No newline at end of file
+      

From 8d611bb54683f283a7bf5a498f4e7c64c5513e61 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 26 Aug 2022 13:50:57 -0700
Subject: [PATCH 14/15] Update detection-testing.yml

Updated to use pip cache
---
 .github/workflows/detection-testing.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index c03502c953..050f37aefb 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -58,7 +58,8 @@ jobs:
         - uses: actions/setup-python@v2
           with:
             python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
-            architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified          
+            architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
+            cache: 'pip'
         
         - name: Install Python Dependencies
           run: |
@@ -151,7 +152,8 @@ jobs:
         - uses: actions/setup-python@v2
           with:
             python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
-            architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified          
+            architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
+            cache: 'pip'
         
         - name: Install Python Dependencies
           run: |
@@ -254,7 +256,8 @@ jobs:
         - uses: actions/setup-python@v2
           with:
             python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
-            architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified    
+            architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
+            cache: 'pip
         
         - name: Install Python Dependencies
           run: |

From 92e2d97588f1154aa254c62dfdd6d36af917933e Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 26 Aug 2022 13:52:30 -0700
Subject: [PATCH 15/15] Update detection-testing.yml

For a quotation mark
---
 .github/workflows/detection-testing.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 050f37aefb..087821ac77 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -257,7 +257,7 @@ jobs:
           with:
             python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
             architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
-            cache: 'pip
+            cache: 'pip'
         
         - name: Install Python Dependencies
           run: |