splunk / contentctl

Splunk Content Control Tool
Apache License 2.0
80 stars 20 forks source link

Small Model Tweak #188

Closed ljstella closed 1 month ago

ljstella commented 1 month ago

Adding the mitre_attack_id field back to the detection tags model so that SSE doesn't break- Their move to support the new API did not include support for the tag.mitre_attack_enrichments[] object, so sometimes our content just doesn't show up as mapped without this.

Also tweaked the regex in mitre_attack_id because I was getting runtime errors on the use of \d to grab digits.