admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
srv-rr-gh-researchbt
2023-06-22 15:00:25 -07:00
committed by GitHub
parent 84d37926f8 934b509c85
commit ffb59f19c2
1 changed files with 27 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py
+27 -6
View File
@@ -1,4 +1,5 @@
import os
import json
from bin.contentctl_project.contentctl_core.application.adapter.adapter import Adapter
@@ -29,6 +30,30 @@ class ObjToJsonAdapter(Adapter):
))
JsonWriter.writeJsonObject(os.path.join(output_path, 'detections.json'), {'detections': obj_array })
### Code to be added to contentctl to ship filter macros to macros.json
obj_array = []
for detection in objects:
detection_dict = detection.dict()
if "macros" in detection_dict:
for macro in detection_dict["macros"]:
obj_array.append(macro)
uniques:set[str] = set()
for obj in obj_array:
if obj.get("arguments",None) != None:
uniques.add(json.dumps(obj,sort_keys=True))
else:
obj.pop("arguments")
uniques.add(json.dumps(obj, sort_keys=True))
obj_array = []
for item in uniques:
obj_array.append(json.loads(item))
JsonWriter.writeJsonObject(os.path.join(output_path, 'macros.json'), {'macros': obj_array})
elif type == SecurityContentType.stories:
obj_array = []
@@ -64,16 +89,12 @@ class ObjToJsonAdapter(Adapter):
elif type == SecurityContentType.lookups:
obj_array = []
for lookup in objects:
obj_array.append(lookup.dict(exclude_none=True))
JsonWriter.writeJsonObject(os.path.join(output_path, 'lookups.json'), {'lookups': obj_array })
elif type == SecurityContentType.macros:
obj_array = []
for macro in objects:
obj_array.append(macro.dict(exclude_none=True))
JsonWriter.writeJsonObject(os.path.join(output_path, 'macros.json'), {'macros': obj_array })
elif type == SecurityContentType.deployments:
obj_array = []