but failing in CI/CD. I believe this is because
they are not being given enough time to finish
their data ingest completely. If a search fails,
wait some time and run it a few more times to
see if it will complete.
a single container. Same wait time
between containers when launching
multiple containers. This gets us
to startup much faster for the most
common testing case, a single
container.
due to CVESearch API failure, causing the
entire workflow to fail. Now, we will retry
enrichment up to a total of 3 times. This should
virtually eliminate all CVE Enrichment failures.
If they do still occur, we will receive a
descriptive message indicating why there was
a failure instead of the cryptic message
that we were getting before.
python code in contentctl so that
progress update are not output
when running in CICD environment.
Outputting all of this data
causes thousands of lines of output
logs to be generated in CICD.
This info is only relevant when
running locally in a tty.
contentctl tool. This can save a huge amount
of time when generating an app. Also
added a progress meter when the documentation
is being generated. Finally, correctly initialized
the default values of some class member fields
in order to get all the contentctl steps working.
the python code for generating the
default config. Also updated the
print behavior for when files are
downloaded.
App baseline is now current, and
files are hosted on S3, as
of 06/21/2022.
to denote the source of all the data
sets that we upload. This means that
we don't need hacks to get around
waiting for all of the data to finish
indexing.
to delete after a test in each attack_data
dataset in the test file. It is important to
have this level of control (per-dataset), not
just per test or per-file!
Splunk Add on for Microsoft Windows
Splunk Add on for Unix and Linux
Splunk Stream
Splunk Stream Knowledge Objects for Wire Data
Splunk Stream Add On
Splunk Add on for Microsoft Office 365
Splunk Common Information Model
pyth0n1c