Currently, the code of this add-on for Splunk is Python v2.7, and not compatible with Python v3.
We need to convert the code to be working using Python v3.7 greater. It would also be great that we actually test most of the code without needing Splunk (or even TIE).
Why
Splunk Enterprise v8 rightfully does not support Python v2.7 since EoL.
What
Code should be running with Python v3 (this is minimal work)
Most code should be testable without Splunk, as most functionality is within the script fetching IoCs.
Extend functionality so that upgrading or installing the new version of the add-on is less of a pain.
Revamp the README with more goodies.
This is unconditional, and we need to move on to future. We should not support Python v2.7 any longer, or keep two code bases or keep one compatible with 2 major versions
How
[x] Python code made Python v3 (2to3 to the rescue)
[x] Get rid of requirements.txt: none of the listed packages is needed
[x] Support configuring the Sequence Number in when setting up the add-on
[x] Better naming of the AddOn
[x] Make distributing less a pain, and make sure the filename says what it is, and what version is contained
[x] Logging to file or stderr: painful to use now
[x] Improve more the help when setting the add-on, and also explain in the README.
Currently, the code of this add-on for Splunk is Python v2.7, and not compatible with Python v3. We need to convert the code to be working using Python v3.7 greater. It would also be great that we actually test most of the code without needing Splunk (or even TIE).
Why
Splunk Enterprise v8 rightfully does not support Python v2.7 since EoL.
What
This is unconditional, and we need to move on to future. We should not support Python v2.7 any longer, or keep two code bases or keep one compatible with 2 major versions
How