Add a pydantic validator to ensure observable names are unique in `detection.tags.observable`

Open
#249 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
python
Domain
tooling

Research direction

Start by locating the Pydantic model for detection.tags.observable and any existing validators. Check how detections are validated and how duplicate observable names are represented. Done means repeated observable names are rejected while the existing detections continue to validate.

Written by the indexing model from the issue text.

Description

bug
  • Currently, we do not enforce observable names be unique within a single detection
  • We should, as we should have no reason to repeat observables
  • At the time of writing we have two detections with a typo that repeats an observable twice
Dominant language
Python
Stars
139
Forks
52
Avg merge
1h 16m
Merged PRs (30d)
3

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from splunk/contentctl

All issues in splunk/contentctl

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.