Add custom annotation for versioning about security_content HOT 4 CLOSED

We do have a detection version, we can pass this I believe as an annotation into the Splunk savedsearches.conf file will this help?

from security_content.

For example: https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml#L3

from security_content.

@josehelps Yeah, the version in the .yml is great, but please make it an annotation! Would love to be able to update the ESCU app, then have a scheduled search to compare the ESCU version vs the cloned custom version in my own app (to see if I need to update how I cloned it).

from security_content.

Hi @TheLawsOfChaos ! This was just added as an annotation in contentctl:
splunk/contentctl#132

It should now be available if you install contentctl via source from poetry. We will do a new contentctl release in the coming days.
Because it is in contentctl, it will also make it into the savedsearches.conf file in the next release of ESCU.

As such, I am closing this issue, but feel free to reopen if you have any questions/thoughts!

from security_content.