Rule: 'Config' object has no attribute 'detection_configuration'
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 139
- Forks
- 52
- Avg merge
- 1h 16m
- Merged PRs (30d)
- 3
Description
Hi team I am unable to deploy any content pack via api_deploy command. contentctl api_deploy will produces the following errors below. If I do contentctl build command and manually upload the output of dist it does installed on the splunk instance. Any reason for this error? Tested this on both splunk installed on windows machine and linux machine
Error deploying saved search ContentPack - Investigate Failed Logins for Multiple Destinations - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Network Traffic From src ip - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Okta Activity by app - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Okta Activity by IP Address - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Pass the Hash Attempts - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Pass the Ticket Attempts - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Previous Unseen User - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Successful Remote Desktop Authentications - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Suspicious Strings in HTTP Header - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate User Activities In Okta - Response Task: 'Config' object has no attribute 'detection_configuration'
Error deploying saved search ContentPack - Investigate Web POSTs From src - Response Task: 'Config' object has no attribute 'detection_configuration'
Splunk Version
Config file
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the contentctl api_deploy command and the reported Config object error; compare its behavior with the successful contentctl build path and the supplied config file. Reproduce the deployment on the stated Windows and Linux Splunk setups, with completion meaning the content pack installs without the detection_configuration error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100