search

splunk / contentctl

Splunk Content Control Tool
Apache License 2.0
91 stars 25 forks source link

Exception on extra fields #325

Open pyth0n1c opened 1 week ago

pyth0n1c commented 1 week ago

Throw an exception is extra fields are included in YML files. This results is much cleaner files and catching typos in field names. Note that this removed datamodel field frmo some files in favor of making it a computed_field, as it has been for some time for detections.

The following security_content PR fixes outstanding issues with content and should be merged first: https://github.com/splunk/security_content/pull/3202

This PR also pins to Pydantic ~2.9.2. Pydantic >= 2.10, which was released 11-20-2024, throws an exception that we will resolve in a future release.

ljstella commented 6 days ago

Just updated this with main- if you want to temporarily run the smoketest_escu job on all the platforms, on all the versions, I made a slight temporary tweak in the RBA migration branch that you might want to do something similar to: https://github.com/splunk/contentctl/pull/263/files#diff-48a325cafd3c5cd9f969b09790dff0ab3d3c0b2acd656c90ad4647ee35aa9214R39

Just pass it your security_content branch, and then after a full run of green, feel free to take it out.