splunk/contentctl

View on GitHub

Splunk Content Control Tool

Stars: 139
Forks: 52
Open beginner issues: 0
Indexed issues: 86
Avg merge: 1h 16m
Merged PRs (30d): 3

Dominant language: Python
License: Apache-2.0
Last GitHub push: Sep 16, 2026
Latest indexed: Sep 20, 2026
Contributing guide: No contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

86 open issues indexed

Add digest mode setting Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 45/100

splunk/contentctl#468 · 1 comment · Opened Feb 5, 2026
Built-in validation logic for Response Plans Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 38/100

splunk/contentctl#461 · Opened Jan 13, 2026
[BUG] alert.suppress parameter is locked in by the Splunk GUI (ES Content Management) Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

splunk/contentctl#452 · Opened Nov 10, 2025
[BUG] Discrepancy for parameters with JSON values Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 35/100

splunk/contentctl#464 · 3 comments · Opened Nov 10, 2025
ServiceNow Incident Integration as an alert action Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

splunk/contentctl#451 · Opened Nov 7, 2025
Include sendcsv parameter for email alert action Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 38/100

splunk/contentctl#447 · Opened Oct 23, 2025
[BUG] alert.digest_mode should be dynamic in savedsearches_detections.j2 Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

splunk/contentctl#445 · Opened Oct 20, 2025
[BUG] Custom Scheduling for detections Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

splunk/contentctl#430 · 4 comments · Opened Jul 24, 2025
contentctl new command to accept more parameters or load from a template Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

splunk/contentctl#407 · Opened May 9, 2025
Validation Rules/Tuning & CICD Output Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

splunk/contentctl#364 · 2 comments · 1 reaction · Opened Feb 5, 2025
Enforce that field names are not repeated across risk objects as part of build/validate Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

splunk/contentctl#347 · Opened Jan 16, 2025
Expand risk message validation to ensure appropriate field values are present Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

splunk/contentctl#346 · Opened Jan 16, 2025
Victoria-aware Lookup File Naming should be detected Open

enhancement

splunk/contentctl#342 · 2 comments · 1 assignee · Opened Dec 18, 2024
[Refactor proposal] streamline filtering of detection types across all code and Jinja templates Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

splunk/contentctl#339 · Opened Dec 10, 2024
[Bug] resolve one off error in CLI reporting Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

splunk/contentctl#338 · Opened Dec 10, 2024
[Refactor proposal] futures can be hard to maintain/debug; let's consider alternatives Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

splunk/contentctl#337 · 1 reaction · Opened Dec 10, 2024
[bug] Apps built on Windows cannot be deployed using ACS Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

splunk/contentctl#331 · Opened Nov 21, 2024
[Feature proposal] Allow for a "should not trigger" test type Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

splunk/contentctl#326 · 3 comments · 1 reaction · Opened Nov 14, 2024
[Feature Request] Ability to add specific NIST mappings Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

splunk/contentctl#323 · 1 reaction · Opened Nov 6, 2024
Allow splunk_api_username and splunk_api_password to be specified as environment variables Open

splunk/contentctl#321 · 1 comment · 1 assignee · Opened Nov 4, 2024
TestApp.hardcoded_path is required even if not needed Open

splunk/contentctl#319 · 1 comment · 1 assignee · Opened Oct 24, 2024
Value error, Error, there must be AT LEAST 1 Observable with the role 'Victim' declared in Detection.tags.observables. However, none were found. Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

splunk/contentctl#315 · 1 comment · Opened Oct 22, 2024
Error: This detection is required to have 2 drilldown_searches, but only has [0] Open

Difficulty 3/5 1-2 days Newbie friendliness 30/100

splunk/contentctl#312 · 1 comment · Opened Oct 21, 2024
2x New CICD Checks for Detection Validation Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

splunk/contentctl#310 · Opened Oct 16, 2024
test & release_notes assume repo location Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

splunk/contentctl#306 · Opened Oct 10, 2024
Error validating test apps: 'version' Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

splunk/contentctl#295 · 3 comments · Opened Sep 25, 2024
Allow for "Next Steps". Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

splunk/contentctl#294 · Opened Sep 25, 2024
content_test.yml is gone, can not set new docker ports Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

splunk/contentctl#292 · Opened Sep 18, 2024
Add `inspect` to the CI/CD jobs Open

enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

splunk/contentctl#287 · Opened Sep 12, 2024
Consider deploying sphinx for autodocs Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

splunk/contentctl#286 · 1 comment · Opened Sep 11, 2024
Extend Conf Parsing to KV Parsing Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 20/100

splunk/contentctl#285 · Opened Sep 10, 2024
Move app downloads to common directory Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

splunk/contentctl#284 · Opened Sep 10, 2024
Allow Splunkbase or Private Apps in Versioning Checking Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

splunk/contentctl#283 · Opened Sep 10, 2024
Refactor to allow consistent inspect and testing of the build produced in earlier stages Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 20/100

splunk/contentctl#282 · 1 comment · Opened Sep 10, 2024
improve validation of risk_message fields Open

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

splunk/contentctl#279 · Opened Sep 7, 2024
Import content from conf files Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

splunk/contentctl#275 · 1 comment · 1 reaction · Opened Aug 30, 2024
Webhook action support Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

splunk/contentctl#273 · 1 reaction · Opened Aug 29, 2024
Email action support Open

Difficulty 3/5 1-2 days Newbie friendliness 42/100

splunk/contentctl#272 · 1 comment · 1 reaction · Opened Aug 29, 2024
Actively Test Baselines Open

Difficulty 4/5 3-5 days Newbie friendliness 38/100

splunk/contentctl#269 · Opened Aug 27, 2024
Validate `manual_test` has length > 0 if not `None` Open

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

splunk/contentctl#268 · Opened Aug 27, 2024
Align test reporting more closely w/ status enums (as it related to "untested") Open

Difficulty 4/5 3-5 days Newbie friendliness 38/100

splunk/contentctl#267 · Opened Aug 27, 2024
Disable `use_enum_values` Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

splunk/contentctl#266 · Opened Aug 27, 2024
Example config stanzas and YML templates Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

splunk/contentctl#262 · Opened Aug 27, 2024
Document how to include lookups in contentctl content packs Open

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

splunk/contentctl#258 · Opened Aug 23, 2024
Refactor and re-enable per-field validation of risk events Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

splunk/contentctl#252 · Opened Aug 20, 2024
Add validation and matching of threat objects to observables Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

splunk/contentctl#251 · Opened Aug 20, 2024
Re-enable and refactor code that validates the specific counts of each risk event matched to each observable Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

splunk/contentctl#250 · Opened Aug 20, 2024
Add a pydantic validator to ensure observable names are unique in `detection.tags.observable` Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

splunk/contentctl#249 · Opened Aug 20, 2024
Refactor risk/notable querying to pin to a single savedsearch ID Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

splunk/contentctl#248 · Opened Aug 20, 2024
Refactor the `risk` property of `detection_abstract` to handle observable/risk/threat mappings more transparently Open

bug

Difficulty 5/5 Over a week Newbie friendliness 35/100

splunk/contentctl#247 · 1 comment · Opened Aug 20, 2024

splunk/contentctl

Get new issues in your inbox