v5.3.0
There are a number of new changes in 5.3.0. Most notably, we have now included formal support for content deprecation and removal via the new command line argument (to contentctl validate/build/test/inspect) --enable_deprecation_mapping_requirement. This new argument allows fine-grained control and validations of what detections have been marked as deprecated/removed and scheduling for when that content MUST be removed from your app. You can see an example of that file here: https://github.com/splunk/security_content/blob/develop/removed/deprecation_mapping.YML
It is used in the https://github.com/splunk/security_content/ repo and ES Content Update App to power the Deprecation Assistant Dashboard. As part of this, it will automatically generate a deprecation_mapping_DDDDMMDD.csv file and corresponding lookup deprecation_mapping to expose this deprecation information in your app.
If you do not explicitly pass the --enable_deprecation_mapping_requirement argument on the command line (or in your contentctl.yml), you should not notice any new behavior or requirments.
Other notable improvements include improved testing of ESCU content when using Splunk Enterprise Security 8 Content Versioning, better errors when attempting to parse malformed or empty YML files, and updated structure for detections in the detections.json api objects.
What's Changed
- Ruff updates by @ljstella in #381
- Update attackcti requirement from ^0.4.0 to >=0.4,<0.6 by @dependabot in #343
- Update setuptools requirement from >=69.5.1,<76.0.0 to >=69.5.1,<79.0.0 by @dependabot in #386
- Feature: validation of detections against cms_main by @cmcginley-splunk in #303
- Improve YML parsing error output by @pyth0n1c in #389
- Fix pathing issue on Windows and Cleanup Typing by @pyth0n1c in #393
- fixes #394, adds action.email to email output by @ljstella in #395
- Bumping to ruff v0.11.2 by @ljstella in #388
- Issue template update by @ljstella in #396
- update detections.json output with new rba structure by @pyth0n1c in #390
- D assistant take 2 by @pyth0n1c in #355
Full Changelog: v5.2.0...v5.3.0
