diff --git a/bin/jinja2_templates/analyticstories.j2 b/bin/jinja2_templates/analyticstories.j2 index e889cb5d3c..c6a3dd7af0 100644 --- a/bin/jinja2_templates/analyticstories.j2 +++ b/bin/jinja2_templates/analyticstories.j2 @@ -38,7 +38,7 @@ how_to_implement = {{ detection.how_to_implement }} {% else %} how_to_implement = none {% endif %} -annotations = {{ detection.mappings | tojson }} +annotations = {{ detection.savedsearch_annotations | tojson }} known_false_positives = {{ detection.known_false_positives }} providing_technologies = [] diff --git a/bin/validate.py b/bin/validate.py index 987cae2ed9..c26c3f65b5 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -73,7 +73,7 @@ def validate_objects(REPO_PATH, objects, verbose): for lookup in objects['lookups']: errors = errors + validate_lookups_content(REPO_PATH, "lookups/%s", lookup) - objects_array = objects['stories'] + objects['detections'] + objects['response_tasks'] + objects['responses'] + objects_array = objects['stories'] + objects['detections'] for object in objects_array: validation_errors, uuids = validate_standard_fields(object, uuids) errors = errors + validation_errors @@ -244,7 +244,7 @@ def validate_tests(REPO_PATH, object): def main(REPO_PATH, verbose): - validation_objects = ['macros','lookups','stories','detections','response_tasks','responses','deployments', 'tests'] + validation_objects = ['macros','lookups','stories','detections','deployments', 'tests'] objects = {} schema_error = False @@ -272,8 +272,7 @@ def main(REPO_PATH, verbose): if __name__ == "__main__": # grab arguments parser = argparse.ArgumentParser(description="validates security content manifest files", epilog=""" - Validates security manifest for correctness, adhering to spec and other common items. - VALIDATE DOES NOT PROCESS RESPONSES SPEC for the moment.""") + Validates security manifest for correctness, adhering to spec and other common items.""") parser.add_argument("-p", "--path", required=True, help="path to security-security content repo") parser.add_argument("-v", "--verbose", required=False, action='store_true', help="prints verbose output") # parse them diff --git a/dist/escu/default/data/ui/nav/default.xml b/dist/escu/default/data/ui/nav/default.xml index 4a57b74606..a56d143e02 100644 --- a/dist/escu/default/data/ui/nav/default.xml +++ b/dist/escu/default/data/ui/nav/default.xml @@ -2,6 +2,5 @@ - Docs \ No newline at end of file diff --git a/dist/escu/default/data/ui/views/analytic_story_details.xml b/dist/escu/default/data/ui/views/analytic_story_details.xml deleted file mode 100644 index 4d6d8ceab6..0000000000 --- a/dist/escu/default/data/ui/views/analytic_story_details.xml +++ /dev/null @@ -1,21 +0,0 @@ -
- -
- - - - | rest /services/configs/conf-analytic_stories splunk_server=local count=0 | fields title | sort title - - title - title - -
- - - -
-
- - - -
diff --git a/dist/escu/default/data/ui/views/escu_usage.xml b/dist/escu/default/data/ui/views/escu_usage.xml deleted file mode 100644 index bfe5d7a189..0000000000 --- a/dist/escu/default/data/ui/views/escu_usage.xml +++ /dev/null @@ -1,152 +0,0 @@ -
- - - $field1.earliest$ - $field1.latest$ - -
- - - - -7d - now - - -
- - - - - | stats sum(search_count) - - - - - - - - - - - - | stats dc(savedsearch_name) - - - - - - - - - - - - | stats sum(search_count) by savedsearch_name | sort -sum(search_count) | head 1 | table savedsearch_name - - - - - - - - - - - - - - - | stats sum(search_count) AS sum_search_count by usage| search usage=adhoc | table sum_search_count - - - - - - - - - - - - | stats sum(search_count) AS sum_search_count by usage| search usage=scheduled | table sum_search_count - - - - - - - - - - - - | stats sum(search_count) AS search_count by user | sort -search_count | head 1 | table user - - - - - - - - - - - - | stats dc(user) - - - - - - - - - - - - - - | stats sum(search_total_run_time) - - - - - - - - - - - - | stats avg(search_total_run_time) - - - - - - - - - - - - |sort -search_total_run_time | head 1| table search_total_run_time - - - - - - - - - - - - - - | table savedsearch_name search_count last_run first_run search_avg_run_time search_total_run_time search_total_results - -
- - -