Skip to content

Conversation

pyth0n1c
Copy link
Contributor

@pyth0n1c pyth0n1c commented May 28, 2025

This is for experimental purposes and visibility.
DO NOT MERGE

See the instructions below. It is not meant to work as a bash script since it uses poetry shell - which does not work when run in a script:

mkdir someNewDirectory
cd someNewDirectory
git clone https://github.com/splunk/security_content
git clone https://github.com/splunk/contentctl

echo "I suggest you install poetry to your global Python environment, but you can install it locally instead if you prefer:"
#python3.13 -m venv .venv
#source .venv/bin/activate
pipx install poetry
poetry self add poetry-plugin-shell
cd contentctl
git checkout include_tests_in_detections_json
poetry install
poetry shell
cd ../security_content
git clone --single-branch https://github.com/redcanaryco/atomic-red-team external_repos/atomic-red-team
git clone --single-branch https://github.com/mitre/cti external_repos/cti
contentctl build --enrichments
echo "Done - check in the file dist/api/detections_v2.json for the results."

in detections_v2.json for
experimental purposes
@pyth0n1c
Copy link
Contributor Author

Here is an example detections_v2.json file built from https://github.com/splunk/security_content with contentctl build --enrichments
detections_v2.json

@pyth0n1c pyth0n1c added the Draft label Jul 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant