splunk / splunk/contentctl

contentctl new command to accept more parameters or load from a template

Open
#407 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
139
Forks
52
Avg merge
1h 16m
Merged PRs (30d)
3

Description

Is your feature request related to a problem? Please describe.
contentctl new command currently accepts basic parameters like app.appid, path etc.
But it does NOT accept parameters like name, search etc, which is still prompted which makes handsfree automation hard

Describe the solution you'd like

Currently the contentctl new option accepts basic options

contentctl new --path content --type detection --app.title TEST --app.appid DA-ESS-TEST-detections --app.prefix TEST --app.label TESTLABEL

But it doesnt accept options below in its parameters

  • detection_name
  • detection_type
  • detection_author
  • security_domain
  • mitre_attack_ids
  • data_sources

Describe alternatives you've considered
Alternatively is to use prompt automation and then manipulate the file produced which is more hardwork

Additional context
The code below makes it prompt like
https://github.com/splunk/contentctl/blob/main/contentctl/actions/new_content.py#L133

Instead of this, provide ANOTHER option to ensure it can accept the skeleton from a file or parameter. Ideally an option to load a yaml/json file with those options would be ideal and then have something like

contentctl new --load user_inputs.yaml

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in contentctl/actions/new_content.py around line 133, where the interactive prompts are created, and trace how the existing contentctl new options are parsed. Define how the listed detection fields and a YAML or JSON input file should be accepted without prompts, then verify the example command and --load user_inputs.yaml flow produce the requested content.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.