-
Notifications
You must be signed in to change notification settings - Fork 33
Closed
Res260/contentctl
#2Description
When upgrading contentctl to 4.4.0 from 4.2.2, I got some new errors without changing my contentctl package. One of them is:
Verbose error logging is ENABLED.
The entire stack trace has been provided below (please include it if filing a bug report):
Traceback (most recent call last):
File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\contentctl.py", line 211, in main
test_common_func(config)
File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\contentctl.py", line 107, in test_common_func
director_output_dto = build_func(config)
^^^^^^^^^^^^^^^^^^
File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\contentctl.py", line 80, in build_func
return builder.execute(BuildInputDto(director_output_dto, config))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\actions\build.py", line 47, in execute
updated_conf_files.update(conf_output.writeObjects(input_dto.director_output_dto.detections, SecurityContentType.detections))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\output\conf_output.py", line 81, in writeObjects
written_files.add(ConfWriter.writeConfFile(pathlib.Path(output_app_path),
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\output\conf_writer.py", line 163, in writeConfFile
output = template.render(objects=objects, app=config.app)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\<user>\.virtualenvs\sigmastuff-YzDXeAfS\Lib\site-packages\jinja2\environment.py", line 1304, in render
self.environment.handle_exception()
File "C:\Users\<user>\.virtualenvs\sigmastuff-YzDXeAfS\Lib\site-packages\jinja2\environment.py", line 939, in handle_exception
raise rewrite_traceback_stack(source=source)
File "\\wsl.localhost\Ubuntu\home\<user>\sigmastuff\contentctl\contentctl\output\templates\analyticstories_detections.j2", line 8, in top-level template code
asset_type = {{ detection.tags.asset_type.value }}
^^^^^^^^^^^^^^^^^^^^^^^^^
jinja2.exceptions.UndefinedError: 'str object' has no attribute 'value'
When running contentctl test --enable-integration-testing --verbose mode:all
Here is my Detection
YAML:
author: Someone
data_sources: []
date: '2024-10-21'
description: "something"
drilldown_searches:
- earliest_offset: $info_min_time$
latest_offset: $info_max_time$
name: DummyDrilldown1
search: '%original_detection_search%'
- earliest_offset: $info_min_time$
latest_offset: $info_max_time$
name: DummyDrilldown2
search: '%original_detection_search%'
how_to_implement: Nothing
id: 8e7eeb73-69f4-48cf-b1f4-19c4872f68eb
known_false_positives: Nonee
name: Some detection
references: []
search: 'something=something
| `some_detection`'
status: production
tags:
analytic_story: []
asset_type: Account
confidence: 1
cve: []
impact: 60
message: N/A
mitre_attack_id:
- T1555
observable:
- name: ' '
role:
- Victim
type: Unknown
product:
- Splunk Enterprise Security
required_fields:
- nothing
risk_score: N/A
security_domain: access
tests:
- attack_data:
- data: ./tests/some_detection/shouldtrigger_1.test
source: N/A
sourcetype: N/A
name: shouldtrigger_1
test_type: unit
type: TTP
version: 1
When debugging, detection.tags.asset_type
has the value Account
and is a str
object, which does not have a .value
.
Metadata
Metadata
Assignees
Labels
No labels