better data source handling

splunk / contentctl

Splunk Content Control Tool

Apache License 2.0

80 stars 20 forks source link

better data source handling #193

Closed P4T12ICK closed 1 month ago

P4T12ICK commented 1 month ago

This PR will improve the data source handling.

Changes:

data source and event source schema changes
add data source field to annotations
create data_source and event_source lookup during build command

Need to be merged before the corresponding security_content PR

pyth0n1c commented 1 month ago

There is a chicken 🐔 and egg 🥚 situation where new contentctl updates are required for security_content to pass and security_content passing requires new contentctl updates. We have performed local testing agains the new security_content updates and they pass - so we accept the CICD failures in contentctl. See the screenshot below for evidence of success: