splunk / contentctl

Splunk Content Control Tool
Apache License 2.0
91 stars 23 forks source link

Error: jinja2.exceptions.UndefinedError: 'str object' has no attribute 'value' #313

Closed Res260 closed 3 weeks ago

Res260 commented 3 weeks ago

When upgrading contentctl to 4.4.0 from 4.2.2, I got some new errors without changing my contentctl package. One of them is:

Verbose error logging is ENABLED.
The entire stack trace has been provided below (please include it if filing a bug report):

Traceback (most recent call last):
  File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\contentctl.py", line 211, in main
    test_common_func(config)
  File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\contentctl.py", line 107, in test_common_func
    director_output_dto = build_func(config)
                          ^^^^^^^^^^^^^^^^^^
  File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\contentctl.py", line 80, in build_func
    return builder.execute(BuildInputDto(director_output_dto, config))
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\actions\build.py", line 47, in execute
    updated_conf_files.update(conf_output.writeObjects(input_dto.director_output_dto.detections, SecurityContentType.detections))
                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\output\conf_output.py", line 81, in writeObjects
    written_files.add(ConfWriter.writeConfFile(pathlib.Path(output_app_path),
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\output\conf_writer.py", line 163, in writeConfFile
    output = template.render(objects=objects, app=config.app)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\<user>\.virtualenvs\sigmastuff-YzDXeAfS\Lib\site-packages\jinja2\environment.py", line 1304, in render
    self.environment.handle_exception()
  File "C:\Users\<user>\.virtualenvs\sigmastuff-YzDXeAfS\Lib\site-packages\jinja2\environment.py", line 939, in handle_exception
    raise rewrite_traceback_stack(source=source)
  File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\output\templates\analyticstories_detections.j2", line 8, in top-level template code
    asset_type = {{ detection.tags.asset_type.value }}
    ^^^^^^^^^^^^^^^^^^^^^^^^^
jinja2.exceptions.UndefinedError: 'str object' has no attribute 'value'

When running contentctl test --enable-integration-testing --verbose mode:all

Here is my Detection YAML:

author: Someone
data_sources: []
date: '2024-10-21'
description: "something"
drilldown_searches:
- earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
  name: DummyDrilldown1
  search: '%original_detection_search%'
- earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
  name: DummyDrilldown2
  search: '%original_detection_search%'
how_to_implement: Nothing
id: 8e7eeb73-69f4-48cf-b1f4-19c4872f68eb
known_false_positives: Nonee
name: Some detection
references: []
search: 'something=something

  | `some_detection`'
status: production
tags:
  analytic_story: []
  asset_type: Account
  confidence: 1
  cve: []
  impact: 60
  message: N/A
  mitre_attack_id:
  - T1555
  observable:
  - name: ' '
    role:
    - Victim
    type: Unknown
  product:
  - Splunk Enterprise Security
  required_fields:
  - nothing
  risk_score: N/A
  security_domain: access
tests:
- attack_data:
  - data: ./tests/some_detection/shouldtrigger_1.test
    source: N/A
    sourcetype: N/A
  name: shouldtrigger_1
  test_type: unit
type: TTP
version: 1

When debugging, detection.tags.asset_type has the value Account and is a str object, which does not have a .value.

Res260 commented 3 weeks ago

I have opened #318 to fix the problem.