Skip to content

Commit b1ee015

Browse files
mkolasinski-splunkmkolasinski-splunk
committed
chore: convert submodules to direct deps
1 parent 518b9c7 commit b1ee015

File tree

154 files changed

+42627
-8
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

154 files changed

+42627
-8
lines changed

‎.gitmodules‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +0,0 @@
1-
[submodule "deps/build/addonfactory_test_matrix_splunk"]
2-
path = deps/build/addonfactory_test_matrix_splunk
3-
url = https://github.com/splunk/addonfactory_test_matrix_splunk.git
4-
[submodule "deps/apps/Splunk_SA_CIM"]
5-
path = deps/apps/Splunk_SA_CIM
6-
url = [email protected]:splunk/addonfactory-splunk_sa_cim.git

‎deps/apps/Splunk_SA_CIM‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎deps/apps/Splunk_SA_CIM/README.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
ReadMe
2+
Splunk Common Information Model 4.20.0
3+
4+
Copyright (C) 2005-2018 Splunk Inc. All rights reserved.
5+
6+
* For the Release Notes, What's New, and Getting Started documentation for this
7+
release see:
8+
http://docs.splunk.com/Documentation/CIM/
9+
10+

‎deps/apps/Splunk_SA_CIM/README/alert_actions.conf.example‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
2+
[my_action]
3+
4+
...
5+
6+
param._cam = {\
7+
"category": ["Information Gathering"],\
8+
"task": ["create"],\
9+
"subject": ["network.capture"],\
10+
"technology": [{"vendor": "Splunk", "product": "Splunk App for Stream"}],\
11+
"supports_adhoc": true,\
12+
"drilldown_uri": "my_view?form.orig_sid=$sid$&form.orig_rid=$rid$"\
13+
}
14+
15+
16+
[my_action2]
17+
18+
...
19+
20+
param._cam = {\
21+
"category": ["Information Gathering"],\
22+
"task": ["scan"],\
23+
"subject": ["process.reputation-service"],\
24+
"technology": [{"vendor": "myvendor", "product": "myproduct", "version": "1.0"}],\
25+
"supports_adhoc": true,\
26+
"drilldown_uri": "../my_app/my_view?form.orig_sid=$sid$&form.orig_rid=$rid$",\
27+
"field_name_params": ["param.host_field"]\
28+
}

‎deps/apps/Splunk_SA_CIM/README/alert_actions.conf.spec‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
2+
param._cam = <json>
3+
* Json specification for classifying response actions.
4+
* See Appendix A.
5+
* Optional.
6+
* Defaults to None.
7+
8+
param._cam_workers = <json>
9+
* Json specification for defining remote workers.
10+
* See Appendix B.
11+
* Optional.
12+
* Defaults to None.
13+
14+
15+
###### Appendix A: Common Action Model Specification #######
16+
## category: The category or categories the modular action belongs to.
17+
## Required.
18+
## For instance, "Information Gathering".
19+
## See cam_categories.csv for recommended values.
20+
## task: The function or functions performed by the modular action.
21+
## Required.
22+
## For instance, "create".
23+
## See cam_tasks.csv for recommended values.
24+
## subject: The object or objects that the modular action's task(s)
25+
## can be performed on (i.e. "endpoint.file").
26+
## Required.
27+
## See cam_subjects.csv for recommended values.
28+
## technology: The technology or technologies that the modular action supports.
29+
## Required.
30+
## vendor: The vendor of the technology.
31+
## Required.
32+
## For instance, "Splunk".
33+
## product: The product of the technology.
34+
## Required.
35+
## For instance, "Enterprise".
36+
## version: The version or versions of the technology.
37+
## Optional.
38+
## For instance, "6.4".
39+
## drilldown_uri: Specifies a custom target for viewing the events
40+
## outputted as a result of the action.
41+
## Custom target can specify app and/or view depending on syntax.
42+
## Optional.
43+
## For instance, "my_view?form.orig_sid=$sid$&form.orig_rid=$rid$"
44+
## For instance, "../my_app/my_view?form.orig_sid=$sid$&form.orig_rid=$rid$"
45+
## field_name_params: The param or params which represent the name of a result field.
46+
## Optional.
47+
## For instance, ["param.search_field"] indicates that the value of "param.search_field"
48+
## should be present as a field in the result or results being operated on.
49+
## required_params: Parameter(s) required for successful action execution.
50+
## Indicated by "*" in the custom alert action user interface.
51+
## For instance, ["param.search_field"] indicates that "param.search_field"
52+
## should be specified when submitting the action on the custom alert action
53+
## user interface.
54+
## Optional.
55+
## supports_adhoc: Specifies if the modular action supports adhoc invocations.
56+
## Optional.
57+
## Defaults to False.
58+
## supports_cloud: Specifies if the modular actions supports the "cloud" model.
59+
## For instance, does the action function properly when the search head does not have access
60+
## to the local network.
61+
## Optional.
62+
## Defaults to True.
63+
## supports_workers: Specifies if the modular actions supports remote workers.
64+
## supports_workers==True implies supports_cloud==True
65+
## Optional.
66+
## Defaults to False.
67+
#{
68+
# "category": ["<category>", ..., "<category">],
69+
# "task": ["<task>", ..., "<task>"],
70+
# "subject": ["<subject>", ..., "<subject>"],
71+
# "technology": [{ "vendor": "<vendor>",
72+
# "product": "<product>",
73+
# "version": ["<version>", ..., "<version>"]
74+
# },
75+
# ...,
76+
# { "vendor": "<vendor>",
77+
# "product": "<product>",
78+
# "version": ["<version>", ..., "<version>"]
79+
# }
80+
# ],
81+
# "drilldown_uri": "<uri>",
82+
# "field_name_params": ["<param.param1>", ..., "<param.paramN>"],
83+
# "required_params": ["<param.param1>", ..., "<param.paramN>"]
84+
# "supports_adhoc": true | false,
85+
# "supports_cloud": true | false,
86+
# "supports_workers": true | false
87+
#}
88+
89+
90+
###### Appendix B: Common Action Model Remote Workers Specification #######
91+
## List of Splunk "serverName" values as advertised by /server/info
92+
##
93+
## Special "serverName" values:
94+
## * "local" - action script will continue doing work locally in addition to
95+
## queueing work for additional workers (if specified).
96+
##
97+
##
98+
## [ "local"?, "worker1", "worker2", ..., "workern" ]

‎deps/apps/Splunk_SA_CIM/README/commands.conf.spec‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
2+
[<STANZA_NAME>]
3+
python.version = {default|python|python2|python3}
4+
* Optional setting. Requires 8.0+
5+
* For Python scripts only, selects which Python version to use.
6+
* Set to either "default" or "python" to use the system-wide default Python
7+
version.
8+
* Optional.
9+
* Default: Not set; uses the system-wide Python version.

‎deps/apps/Splunk_SA_CIM/README/inputs.conf.example‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[relaymodaction://master]
2+
uri = https://master:8089
3+
description = splunk cloud search head
4+
username = username
5+
verify = True
6+
client_cert = client_cert.pem

‎deps/apps/Splunk_SA_CIM/README/inputs.conf.spec‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
2+
python.version = {default|python|python2|python3}
3+
* Optional setting. Requires 8.0+
4+
* For Python scripts only, selects which Python version to use.
5+
* Set to either "default" or "python" to use the system-wide default Python
6+
version.
7+
* Optional.
8+
* Default: Not set; uses the system-wide Python version.
9+
10+
[relaymodaction://<name>]
11+
uri = <string>
12+
* Remote splunk instance management URI.
13+
* Format should be protocol://host:port
14+
15+
description = <string>
16+
* Description for the remote Splunk instance.
17+
18+
username = <string>
19+
* Label pertaining to the API key stored in secure storage, must be unique.
20+
* Realm is "cam_queue".
21+
22+
verify = <string>
23+
* Specifies if SSL verification is needed between worker and remote search head.
24+
* Defaults to True
25+
26+
client_cert = <string>
27+
* Filename of client certificate.
28+
* Specify when SSL verification is needed, leave empty otherwise.
29+
* Certificate should be put in $splunk_home/etc/apps/Splunk_SA_CIM/auth

‎deps/apps/Splunk_SA_CIM/README/restmap.conf.spec‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
2+
[script:<uniqueName>]
3+
python.version={default|python|python2|python3}
4+
* Optional setting. Requires 8.0+
5+
* For Python scripts only, selects which Python version to use.
6+
* Set to either "default" or "python" to use the system-wide default Python
7+
version.
8+
* Optional.
9+
* Default: Not set; uses the system-wide Python version.

‎deps/apps/Splunk_SA_CIM/README/transforms.conf.spec‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[<unique_transform_stanza_name>]
2+
reverse_lookup_honor_case_sensitive_match = {default|true|false}
3+
* Optional setting.
4+
* This setting does not apply to KV Store lookups.
5+
* Default: true
6+
* When set to true, and case_sensitive_match is true Splunk software performs case-sensitive matching for
7+
all fields in a reverse lookup.
8+
* When set to true, and case_sensitive_match is false Splunk software performs case-insensitive matching for
9+
all fields in a reverse lookup.
10+
* When set to false, Splunk software performs case-insensitive matching for
11+
all fields in a reverse lookup.

0 commit comments

Comments
 (0)