Branch was auto-updated.

.circleci/config.yml

@@ -125,23 +125,23 @@ jobs:
             cd security-content
             source venv/bin/activate
             python contentctl.py --path . --verbose generate --product ESCU --output dist/escu
-            python contentctl.py --path . --verbose generate --product MUSTANG --output dist/mustang
+            python contentctl.py --path . --verbose generate --product SAAWS --output dist/saaws
             # make a copy of use_case_lib in order to have ES work :-(
             cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf
-            cp dist/mustang/default/use_case_library.conf dist/mustang/default/analyticstories.conf
+            cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf
       - run:
           name: copy lookups .csv files
           command: |
             cd security-content
             # clean up current lookups
             rm -rf dist/escu/lookups
-            rm -rf dist/mustang/lookups
+            rm -rf dist/saaws/lookups
             mkdir dist/escu/lookups
-            mkdir dist/mustang/lookups
+            mkdir dist/saaws/lookups
             # copy over lookups
             cd lookups
             cp -rv *.csv ../dist/escu/lookups
-            cp -rv *.csv ../dist/mustang/lookups
+            cp -rv *.csv ../dist/saaws/lookups
       - run:
           name: update version and build number
           command: |
@@ -160,18 +160,18 @@ jobs:
             sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/escu/app.manifest
             sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/content-version.conf
             tar -czf content-pack-build-escu.tar.gz dist/escu/*
-            # update build number and version for MUSTANG
-            sed -i "s/build = .*$/build = $CIRCLE_BUILD_NUM/g" dist/mustang/default/app.conf
-            sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/mustang/default/app.conf
-            sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/mustang/app.manifest
-            sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/mustang/default/content-version.conf
-            tar -czf content-pack-build-mustang.tar.gz dist/mustang/*
+            # update build number and version for saaws
+            sed -i "s/build = .*$/build = $CIRCLE_BUILD_NUM/g" dist/saaws/default/app.conf
+            sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/app.conf
+            sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/saaws/app.manifest
+            sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/content-version.conf
+            tar -czf content-pack-build-saaws.tar.gz dist/saaws/*
 
       - persist_to_workspace:
           root: security-content/
           paths:
               - content-pack-build-escu.tar.gz
-              - content-pack-build-mustang.tar.gz
+              - content-pack-build-saaws.tar.gz
 
   build-package:
     executor: content-executor
@@ -200,13 +200,13 @@ jobs:
               source ~/slim-latest/venv/bin/activate
               cd ~/build
               tar -zxf content-pack-build-escu.tar.gz
-              tar -zxf content-pack-build-mustang.tar.gz
+              tar -zxf content-pack-build-saaws.tar.gz
               mv dist/escu DA-ESS-ContentUpdate
-              mv dist/mustang DA-ESS-ContentUpdateMustang
+              mv dist/saaws Splunk_DA-ESS_AmazonWebServices_Content
               slim package -o upload DA-ESS-ContentUpdate
-              slim package -o upload DA-ESS-ContentUpdateMustang
+              slim package -o upload Splunk_DA-ESS_AmazonWebServices_Content
               cp upload/DA-ESS-ContentUpdate-*.tar.gz DA-ESS-ContentUpdate-latest.tar.gz
-              cp upload/DA-ESS-ContentUpdateMustang-*tar.gz DA-ESS-ContentUpdateMustang-latest.tar.gz
+              cp upload/Splunk_DA-ESS_AmazonWebServices_Content-*tar.gz Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz
       - store_artifacts:
           path: ~/build/upload
           destination: package/
@@ -214,7 +214,7 @@ jobs:
           root: ~/build
           paths:
              - DA-ESS-ContentUpdate-latest.tar.gz
-             - DA-ESS-ContentUpdateMustang-latest.tar.gz
+             - Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz
 
   run-appinspect:
     executor: content-executor
@@ -241,10 +241,10 @@ jobs:
             cd security-content/bin
             ./appinspect.sh ~/ DA-ESS-ContentUpdate-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD
       - run:
-          name: submit MUSTANG package to appinspect API
+          name: submit saaws package to appinspect API
           command: |
             cd security-content/bin
-            ./appinspect.sh ~/ DA-ESS-ContentUpdateMustang-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD            
+            ./appinspect.sh ~/ Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz $APPINSPECT_USERNAME $APPINSPECT_PASSWORD            
       - store_artifacts:
           path: ~/report
           destination: report/
@@ -252,7 +252,7 @@ jobs:
           root: ~/
           paths:
              - DA-ESS-ContentUpdate-latest.tar.gz
-             - DA-ESS-ContentUpdateMustang-latest.tar.gz
+             - Splunk_DA-ESS_AmazonWebServices_Content-latest.tar.gz
   update-sources-github:
     executor: content-executor
     steps:

bin/generate.py

@@ -124,7 +124,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
             detection['risk_score'] = detection['tags']['risk_score']
         if 'product' in detection['tags']:
             detection['product'] = detection['tags']['product']
-        if (OUTPUT_PATH) == 'dist/mustang':
+        if (OUTPUT_PATH) == 'dist/saaws':
             detection['disabled'] = 'false'
             
 
@@ -133,7 +133,7 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
         data_model = parse_data_models_from_search(baseline['search'])
         if data_model:
             baseline['data_model'] = data_model
-        if (OUTPUT_PATH) == 'dist/mustang':
+        if (OUTPUT_PATH) == 'dist/saaws':
             baseline['disabled'] = 'false'
 
         matched_deployment = get_deployments(baseline, deployments)
@@ -625,7 +625,7 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
     detections = load_objects("detections/*/*.yml", VERBOSE, REPO_PATH)
     detections.extend(load_objects("detections/*/*/*.yml", VERBOSE, REPO_PATH))
 
-    if PRODUCT == "MUSTANG": 
+    if PRODUCT == "SAAWS": 
         detections = [object for object in detections if 'Splunk Security Analytics for AWS' in object['tags']['product']]
         stories = [object for object in stories if 'Splunk Security Analytics for AWS' in object['tags']['product']]
         baselines = [object for object in baselines if 'Splunk Security Analytics for AWS' in object['tags']['product']]
@@ -693,4 +693,4 @@ if __name__ == "__main__":
     VERBOSE = args.verbose
     PRODUCT = args.product
 
-    main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
+    main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)

contentctl.py

@@ -112,7 +112,7 @@ def main(args):
     generate_parser.add_argument("-o", "--output", required=False, type=str, default="dist/escu",
                                      help="Path where to store the deployment package, defaults to `dist/escu`")
     generate_parser.add_argument("--product", required=False, type=str, default="ESCU",
-                                 help="Type of package to create, choose between `ESCU`, or `MUSTANG`. Defaults to `ESCU`")                            
+                                 help="Type of package to create, choose between `ESCU`, or `SAAWS`. Defaults to `ESCU`")                            
     generate_parser.set_defaults(func=generate)
 
     # # parse them

dist/saaws/app.manifest

@@ -4,7 +4,7 @@
     "title": "Splunk Security Analytics for AWS Content", 
     "id": {
       "group": null, 
-      "name": "DA-ESS-ContentUpdateMustang", 
+      "name": "Splunk_DA-ESS_AmazonWebServices_Content", 
       "version": "3.18.0"
     }, 
     "author": [

dist/saaws/default/app.conf

@@ -27,4 +27,4 @@ is_visible = true
 label      = Splunk Security Analytics for AWS Content
 
 [package]
-id = DA-ESS-ContentUpdateMustang
+id = Splunk_DA-ESS_AmazonWebServices_Content