search

splunk / contentctl

Splunk Content Control Tool
Apache License 2.0
80 stars 20 forks source link

Forbid extra fields in YMLs #208

Open pyth0n1c opened 1 month ago

pyth0n1c commented 1 month ago

Add an extra, missing field to the lookup.py model called max_matches that was accidentally dropped. set extra='forbid' for SecurityContentObject

pyth0n1c commented 1 month ago

Note that the groups and context fields were temporarily added to the detection_tags object and will require some discussion. We may also need to update the contentctl new command to make sure no erroneous fields are written, like risk_score.