Skip to content

v3.2.0

Compare
Choose a tag to compare
@pyth0n1c pyth0n1c released this 16 Feb 18:28
· 826 commits to main since this release
a93e097

Improve content development/testing performance

This release adds two new features.
First is the --skip_enrichment command which can be used as follows:

contentctl --skip_enrichment validate
contentctl --skip_enrichment build
contentctl --skip_enrichment test

This command line switch overrides the enrichments values contained in contentctl.yml, enabling contentctl commands to run MUCH faster by optionally disabling enrichment. Enrichment should still be used for final testing and release builds of content.

Second, since test environments take so long to be configured, by default they will be re-used for subsequent tests. This means that a container test environment, once it has been created, will remain running until it is manually terminated. This behavior can be overwritten by setting the option contentctl_test.yml ---> infrastructure_config ---> persist_and_reuse_container = True.
Note that if a test container does not exist when a test begins, it will be created. Finally, the presence of additional messages on the command line when running contentctl test indicates that this feature is active:

Container [splunk_contentctl_0] has NOT been terminated because 'contentctl_test.yml ---> infrastructure_config ---> persist_and_reuse_container = True'
To remove it, please manually run the following at the command line: `docker container rm -fv splunk_contentctl_0`

If you have made changes to your environment since it was built, such as adding new apps/TAs, OR you have updated any content that is NOT a detection (such as a macro or lookup), then please terminate your container and rerun contentctl test. At this time, those artifacts are not reflected into the persistent test environment.