contentctl
contentctl copied to clipboard
Add import command
This PR adds support for importing updated searches from an existing savedsearches.conf.
contentctl -p <path_to_content> import -c <path_to_savedsearches.conf>
For the sake of simplicity I opted to read the detection rules, update the search string and write the updated yml back. Whilst it's not perfect, at the very least it's idempotent and only updates detections with updated searches.
I'd value any feedback or contributions (from Splunk and customers) for the next round of updates to this feature branch 🙂