Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Additions to DataSource model #353

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

ljstella
Copy link
Contributor

splunk/security_content#3287 <- PR to add fields to the datasource object.

At the moment, I've typed these incredibly naively with separator_value as an Optional[str], and mitre_components as list[str]. I think separator_value may stay that way, but there's a chance with mitre_components to leverage some of the work we've done elsewhere on MITRE enrichment.

@pyth0n1c
Copy link
Contributor

Minor feedback - in line with latest PEP guidance, we should use
variable_name: None | TypeA
rather than
variable_name: Optional[None]

@pyth0n1c pyth0n1c added 5.0 Targeted for ESCU 5.0 Release Draft and removed 5.0 Targeted for ESCU 5.0 Release labels Jan 27, 2025
@ljstella ljstella added WIP and removed Draft labels Feb 11, 2025
@ljstella
Copy link
Contributor Author

After conversation w/ the folks that caused this PR to kickoff, looks like we should add some validation around the mitre_component portion to ensure that its name matches one of the x-mitre-data-component entities from ATT&CK. Validating that the field matches should prevent issues with bad data leaking downstream.

@ljstella
Copy link
Contributor Author

After conversation this week, this should now be good to land in association with splunk/security_content#3287

Validations for it can come later when we have a better idea of how we might want to use it (likely on research.splunk.com)

@ljstella ljstella removed the WIP label Feb 18, 2025
@ljstella ljstella requested a review from pyth0n1c February 18, 2025 21:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants