contentctl new command to accept more parameters or load from a template
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 139
- Forks
- 52
- Avg merge
- 1h 16m
- Merged PRs (30d)
- 3
Description
Is your feature request related to a problem? Please describe.
contentctl new command currently accepts basic parameters like app.appid, path etc.
But it does NOT accept parameters like name, search etc, which is still prompted which makes handsfree automation hard
Describe the solution you'd like
Currently the contentctl new option accepts basic options
contentctl new --path content --type detection --app.title TEST --app.appid DA-ESS-TEST-detections --app.prefix TEST --app.label TESTLABEL
But it doesnt accept options below in its parameters
- detection_name
- detection_type
- detection_author
- security_domain
- mitre_attack_ids
- data_sources
Describe alternatives you've considered
Alternatively is to use prompt automation and then manipulate the file produced which is more hardwork
Additional context
The code below makes it prompt like
https://github.com/splunk/contentctl/blob/main/contentctl/actions/new_content.py#L133
Instead of this, provide ANOTHER option to ensure it can accept the skeleton from a file or parameter. Ideally an option to load a yaml/json file with those options would be ideal and then have something like
contentctl new --load user_inputs.yaml
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in contentctl/actions/new_content.py around line 133, where the interactive prompts are created, and trace how the existing contentctl new options are parsed. Define how the listed detection fields and a YAML or JSON input file should be accepted without prompts, then verify the example command and --load user_inputs.yaml flow produce the requested content.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100