From 7e0ace068928bf215c014f747016d3c628b0cb6e Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareib@splunk.com>
Date: Wed, 17 Mar 2021 11:38:33 +0100
Subject: [PATCH] improved contentctl

---
 bin/jinja2_templates/detection.j2 |  3 ++-
 bin/newcontent.py                 | 30 +++++++++++++++++++++++++++++-
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/bin/jinja2_templates/detection.j2 b/bin/jinja2_templates/detection.j2
index fe3cd6ce85..fa5e47448e 100644
--- a/bin/jinja2_templates/detection.j2
+++ b/bin/jinja2_templates/detection.j2
@@ -32,4 +32,5 @@ tags:
   - {{product}}
   {% endfor -%}
   required_fields:
-  - _time
\ No newline at end of file
+  - _time
+  security_domain: {{security_domain}}
\ No newline at end of file
diff --git a/bin/newcontent.py b/bin/newcontent.py
index 6a95f9c974..d5cc61f4cf 100644
--- a/bin/newcontent.py
+++ b/bin/newcontent.py
@@ -164,6 +164,34 @@ def detection_wizard(security_content_path,type,TEMPLATE_PATH):
                 },
             ],
         },
+        {
+            # get provider
+            'type': 'list',
+            'message': 'security_domain for detection',
+            'name': 'security_domain',
+            'choices': [
+                {
+                    'name': 'access'
+                },
+                {
+                    'name': 'endpoint'
+                },
+                {
+                    'name': 'network'
+                },
+                {
+                    'name': 'threat'
+                },
+                {
+                    'name': 'identity'
+                },
+                {
+                    'name': 'audit'
+                },
+
+            ],
+            'default': 'endpoint'
+        },
     ]
 
     answers = prompt(questions)
@@ -192,7 +220,7 @@ def detection_wizard(security_content_path,type,TEMPLATE_PATH):
     search= answers['detection_search'] + ' | `' + detection_file_name + '_filter`',
     type=answers['detection_type'], analytic_story_name='UPDATE_STORY_NAME', mitre_attack_id = answers['mitre_attack_ids'],
     kill_chain_phases=answers['kill_chain_phases'], dataset_url='UPDATE_DATASET_URL',
-    products=answers['products'])
+    products=answers['products'], security_domain=answers['security_domain'])
     with open(output_path, 'w', encoding="utf-8") as f:
         f.write(output)