Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix a bug where the jinja template for analyticstories_detection cra… #318

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

Res260
Copy link
Contributor

@Res260 Res260 commented Oct 24, 2024

Fix a bug where the jinja template for analyticstories_detection crashed when specifying a detection.tags.asset_type. Fixes #313.

…shed when specifying a `detection.tags.asset_type`. Fixes splunk#313.
@Res260 Res260 changed the title Fix a bug where the jinja template for analyticsories_detection cra… Fix a bug where the jinja template for analyticstories_detection cra… Oct 24, 2024
@pyth0n1c pyth0n1c changed the base branch from main to splunkbase_download_updates_courtext_res260 November 4, 2024 23:29
@pyth0n1c pyth0n1c changed the base branch from splunkbase_download_updates_courtext_res260 to main November 4, 2024 23:31
@pyth0n1c
Copy link
Contributor

Hi @Res260 - I am having trouble replicating this bug, even using the example Detection you provided.
When I poke around at the value of detection.tags.asset_type, it is showing me it is enum 'AssetType'
This is with the latest version of contentctl in main
Did you make any other changes in your fork, potential around the use_enum_values configDict Pydantic setting?

image

@Res260
Copy link
Contributor Author

Res260 commented Nov 13, 2024

I have not. I'm using Python 3.12, are you using the same version?

@Res260
Copy link
Contributor Author

Res260 commented Nov 14, 2024

Specifically, I'm running Python 3.12.6 on Windows 11.

Here is a snippet of my pip freeze:

annotated-types==0.7.0
antlr4-python3-runtime==4.9.3
arrow==1.3.0
artifacts-keyring==0.3.6
attackcti==0.4.4
attrs==24.2.0
azure-common==1.1.28
azure-core==1.31.0
azure-identity==1.14.0
azure-mgmt-core==1.4.0
azure-mgmt-securityinsight==1.0.0
beautifulsoup4==4.12.2
bottle==0.12.25
certifi==2024.8.30
cffi==1.17.1
charset-normalizer==3.3.2
click==8.1.7
colorama==0.4.6
colour==0.1.5
contentctl==20241107.21.54
cpe==1.3.0
cryptography==43.0.1
cybox==2.1.0.21
deepdiff==8.0.1
deprecation==2.1.0
distlib==0.3.8
docker==7.1.0
docstring_parser==0.16
drawsvg==2.4.0
et-xmlfile==1.1.0
fancycompleter==0.9.1
filelock==3.16.1
fqdn==1.5.1
gitdb==4.0.11
GitPython==3.1.43
idna==3.10
iniconfig==2.0.0
isodate==0.6.1
isoduration==20.11.0
jaraco.classes==3.4.0
jaraco.context==6.0.1
jaraco.functools==4.0.2
Jinja2==3.1.4
jsonpointer==3.0.0
jsonschema==4.23.0
jsonschema-specifications==2023.12.1
keyring==25.4.1
loguru==0.7.2
lxml==5.3.0
maec==4.1.0.17
Markdown==3.7
markdown-it-py==3.0.0
MarkupSafe==2.1.5
mdurl==0.1.2
mitreattack-python==3.0.6
mixbox==1.0.5
more-itertools==10.5.0
msal==1.31.0
msal-extensions==1.2.0
msrest==0.7.1
netaddr==1.3.0
numpy==2.1.1
oauthlib==3.2.2
openpyxl==3.1.5
ordered-set==4.1.0
orderly-set==5.2.2
packaging==24.1
pandas==2.2.3
pdbpp==0.10.3
pillow==10.4.0
pipenv==2024.0.3
platformdirs==4.3.6
pluggy==1.5.0
pluralizer==1.2.0
pooch==1.8.2
portalocker==2.10.1
prettytable==3.10.0
prompt-toolkit==3.0.36
pycountry==24.6.1
pycparser==2.22
pycvesearch==1.2
pydantic==2.9.2
pydantic_core==2.23.4
pygit2==1.15.1
Pygments==2.18.0
PyJWT==2.9.0
pyparsing==3.1.4
pyreadline3==3.5.4
pyrepl==0.9.0
pySigma==0.11.17
pytest==8.3.3
python-certifi-win32==1.6.1
python-dateutil==2.9.0.post0
pytz==2024.2
pywin32==306
pywin32-ctypes==0.2.3
PyYAML==6.0.2
questionary==2.0.1
referencing==0.35.1
requests==2.32.3
requests-oauthlib==2.0.0
rfc3339-validator==0.1.4
rfc3986-validator==0.1.1
rich==13.8.1
rpds-py==0.20.0
semantic-version==2.10.0
setuptools==70.3.0
setuptools-scm==8.1.0
shellingham==1.5.4
shtab==1.7.1
sigma-cli==1.0.4
simplejson==3.19.3
six==1.16.0
smmap==5.0.1
soupsieve==2.6
splunk-sdk==2.0.2
stix==1.2.0.11
stix2==3.0.1
stix2-elevator==4.1.7
stix2-patterns==2.0.0
stix2-validator==3.2.0
stixmarx==1.0.8
tabulate==0.9.0
taxii2-client==2.3.0
tqdm==4.66.5
typer==0.12.5
types-python-dateutil==2.9.0.20240906
typing_extensions==4.12.2
tyro==0.8.11
tzdata==2024.2
uri-template==1.3.0
urllib3==2.2.3
virtualenv==20.26.5
wcwidth==0.2.13
weakrefmethod==1.0.3
webcolors==24.8.0
win32-setctime==1.1.0
wmctrl==0.5
wrapt==1.16.0
XlsxWriter==3.2.0
xmltodict==0.13.0

@pyth0n1c
Copy link
Contributor

Thanks for the more specific debug info @Res260 - I will try to replicate this exact config and try to debug more locally 😄

We also have an issue to remove the widespread use of use_enum_values which leads to lots of.... weird requirements to use the enum or enum.value in different types of comparisons/serializations:
#266

@pyth0n1c
Copy link
Contributor

pyth0n1c commented Dec 12, 2024

All the enums in our codebase have been updated to either StrEnum or IntEnum which has allowed us to remove the weird, seemingly pseudo-random usages of enumName.value all over the codebase. This was done in the following PR: #335 which has been merged into our next big update, the contentctl_5 PR: #334

I believe that this will fix the issue at it's source, but I will need to do some testing to ensure that is the case.
This also include removing the .value from the specific line you have provided in this PR asset_type = {{ detection.tags.asset_type.value }}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Error: jinja2.exceptions.UndefinedError: 'str object' has no attribute 'value'
2 participants