Strict yml fields #3202
Open
Strict yml fields #3202
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
detections. this is a calculated field and should not be included
fields that should not be in YMLs
|
These changes to the yamls look good. Also tested the associated contentctl PR to check for potential validation errors created - looking good!
Also confirmed that the removed fields are not used in the product. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Update content to begin enforcing STRICT YML fields in contentctl.
This means that we will throw errors when fields that are not defined in contentctl Pydantic Objects are included in YML files.
This reduces the chance that optional field names will be typo'd and cleans up a large number of YML files.
Note that the corresponding contentctl PR is here: splunk/contentctl#325
To summarize the fields that have been removed:
Detection Tags:
risk_scoreis no longer included in the YMLs. This is calculated fromconfidenceandimpactfieldsrequired_fieldshave been removedcontexthas been removedgrouphas been removedBaseline:
datamodelhas been removedrequired_fieldshas been removedInvestigation
datamodelhas been removedMany other unused fields have been removed (or, if they were misnamed, correctly to the proper name)