Skip to content

DO NOT MERGE: include tests and their info in detections_v2.json #412

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

pyth0n1c
Copy link
Contributor

@pyth0n1c pyth0n1c commented May 28, 2025

This is for experimental purposes and visibility.
DO NOT MERGE

See the instructions below. It is not meant to work as a bash script since it uses poetry shell - which does not work when run in a script:

mkdir someNewDirectory
cd someNewDirectory
git clone https://github.com/splunk/security_content
git clone https://github.com/splunk/contentctl

echo "I suggest you install poetry to your global Python environment, but you can install it locally instead if you prefer:"
#python3.13 -m venv .venv
#source .venv/bin/activate
pipx install poetry
poetry self add poetry-plugin-shell
cd contentctl
git checkout include_tests_in_detections_json
poetry install
poetry shell
cd ../security_content
git clone --single-branch https://github.com/redcanaryco/atomic-red-team external_repos/atomic-red-team
git clone --single-branch https://github.com/mitre/cti external_repos/cti
contentctl build --enrichments
echo "Done - check in the file dist/api/detections_v2.json for the results."

in detections_v2.json for
experimental purposes
@pyth0n1c
Copy link
Contributor Author

Here is an example detections_v2.json file built from https://github.com/splunk/security_content with contentctl build --enrichments
detections_v2.json

@pyth0n1c pyth0n1c added the Draft label Jul 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant