Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[BUG] Custom Scheduling for detections

Open
  • Is something wrong?
#430 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
python
Domain
cli, tooling

Research direction

Start with contentctl's deployment configuration validation and compare its accepted fields with the linked wiki example, especially the tags.analytics_story field. Check how analytic-story tags are represented on detections and how deployment schedules are matched. Done means the documented configuration validates and applies its schedule to detections tagged "Credential Dumping", with coverage for the reported case.

Written by the indexing model from the issue text.

Description

bug
Describe the bug

According to the documentation. It is possible to define a custom scheduling based on an analytic story tag.
Link to the wiki doc: https://github.com/splunk/security_content/wiki/4.2-%E2%80%90-Customize-to-Your-Environment

Since it doesn't seem to be possible to define a custom scheduling for each detection (which sounds way more intuitive), the only solution for having more than 1 scheduling per type of detection is to use that analytic stories tag matching.

However, when adding the same config explained in your wiki, contentctl does not validate since it's not expecting a tag field.

I've found some reference about deprecating this field in your code but then I don't see how is this feature currently implemented.

Summary:

Expected behavior

When trying to create a custom deployment config like this

name: Schedule Credential Dumping Daily
id: bc91a8cd-35e7-4bb2-6140-e756cc46f214
date: '2020-04-27'
description: Schedule Credential Dumping Daily with Email notification to the SOC
author: Jose Hernandez
scheduling:
cron_schedule: '0 0 * * *'
earliest_time: -1d@d
latest_time: -10m@m
schedule_window: auto
alert_action:
email:
message: Splunk Alert $name$ triggered %fields%
subject: Splunk Alert $name$
to: [email protected]
tags:
analytics_story: Credential Dumping

Contentctl complains about having a non existing field called tags.
What should happen is that the detection that uses the analytic story called "Credential Dumping" should be using the custom deployment file with the same matching tag.

Screenshots
Image Image Image
contentctl Version:

v5.0.0

Additional context

Add any other context about the problem here.

Dominant language
Python
Stars
139
Forks
51
Avg merge
1h 16m
Merged PRs (30d)
3

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from splunk/contentctl

All issues in splunk/contentctl

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.