some testing. This will break the contentctl build
functionality as it still requires slim. A user can
install splunk-packaging-toolkit separately,
but it is not currently compatible with Python3.10.
files into single requirements.txt in
the root of security_content.
Removed explicit calls to python3
in CI/CD workflows and inside of
the docker_detection_testing tool.
These are not required and in fact
should not be done since python
interpreters started by the
detection tester inherit the
venv the parent was run under.
but failing in CI/CD. I believe this is because
they are not being given enough time to finish
their data ingest completely. If a search fails,
wait some time and run it a few more times to
see if it will complete.
a single container. Same wait time
between containers when launching
multiple containers. This gets us
to startup much faster for the most
common testing case, a single
container.
the python code for generating the
default config. Also updated the
print behavior for when files are
downloaded.
App baseline is now current, and
files are hosted on S3, as
of 06/21/2022.
to denote the source of all the data
sets that we upload. This means that
we don't need hacks to get around
waiting for all of the data to finish
indexing.
to delete after a test in each attack_data
dataset in the test file. It is important to
have this level of control (per-dataset), not
just per test or per-file!
Updated the following apps to the latest versions:
Splunk Add on for Microsoft Windows
Splunk Add on for Unix and Linux
Splunk Stream
Splunk Stream Knowledge Objects for Wire Data
Splunk Stream Add On
Splunk Add on for Microsoft Office 365
Splunk Common Information Model
Splunk Add on for Microsoft Windows
Splunk Add on for Unix and Linux
Splunk Stream
Splunk Stream Knowledge Objects for Wire Data
Splunk Stream Add On
Splunk Add on for Microsoft Office 365
Splunk Common Information Model
pyth0n1c