admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-03-02 20:59:49 +00:00
committed by GitHub
parent ab7a3a4d15 ea36d1969a
commit 8243a67f46
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/newcontent.py
+2 -2
View File
@@ -249,7 +249,7 @@ def detection_wizard(security_content_path,type,TEMPLATE_PATH):
output_path = path.join(security_content_path, 'tests/' + detection_kind + '/' + test_name)
output = template.render(name=detection_name + ' Unit Test',
detection_name=detection_name,
detection_path='detections/' + detection_kind + '/' + detection_file_name + '.yml', pass_condition='| stats count | where count > 0',
detection_path=detection_kind + '/' + detection_file_name + '.yml', pass_condition='| stats count | where count > 0',
earliest_time='-24h', latest_time='now',file_name='UPDATE_FILE_NAME', splunk_source='UPDATE_SPLUNK_SOURCE',
splunk_sourcetype='UPDATE_SPLUNK_SOURCETYPE', dataset_url='UPDATE_DATASET_URL' )
with open(output_path, 'w', encoding="utf-8") as f:
@@ -399,7 +399,7 @@ def create_example(security_content_path,type, TEMPLATE_PATH):
output_path = path.join(security_content_path, 'tests/endpoint/' + test_name)
output = template.render(name=getpass.getuser().capitalize() + ' ' + type.capitalize() + ' Unit Test',
detection_name=getpass.getuser().capitalize() + ' ' + type.capitalize(),
detection_path='detections/endpoint/' + detection_name, pass_condition='| stats count | where count > 0',
detection_path='endpoint/' + detection_name, pass_condition='| stats count | where count > 0',
earliest_time='-24h', latest_time='now', file_name='UPDATE_FILE_NAME', splunk_source='UPDATE_SPLUNK_SOURCE',
splunk_sourcetype='UPDATE_SPLUNK_SOURCETYPE',dataset_url='UPDATE_DATASET_URL')
with open(output_path, 'w', encoding="utf-8") as f: