Improve typing and output for

lookup default_match field.
splunk · Feb 13, 2025 · a796dbf · a796dbf
1 parent 32ced32
commit a796dbf
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 5 deletions.
diff --git a/contentctl/objects/abstract_security_content_objects/detection_abstract.py b/contentctl/objects/abstract_security_content_objects/detection_abstract.py
@@ -476,7 +476,7 @@ def serialize_model(self):
                         "name": lookup.name,
                         "description": lookup.description,
                         "filename": lookup.filename.name,
-                        "default_match": "true" if lookup.default_match else "false",
+                        "default_match": lookup.default_match,
                         "case_sensitive_match": "true"
                         if lookup.case_sensitive_match
                         else "false",

diff --git a/contentctl/objects/lookup.py b/contentctl/objects/lookup.py
@@ -69,7 +69,10 @@ class Lookup_Type(StrEnum):
 
 # TODO (#220): Split Lookup into 2 classes
 class Lookup(SecurityContentObject, abc.ABC):
-    default_match: Optional[bool] = None
+    default_match: str = Field(default='', description="This field is given a default value of ''"
+                                "because it is the default value specified in the transforms.conf "
+                                "docs. Giving it a type of str rather than str | None simplifies "
+                                "the typing for the field.")
     # Per the documentation for transforms.conf, EXACT should not be specified in this list,
     # so we include only WILDCARD and CIDR
     match_type: list[Annotated[str, Field(pattern=r"(^WILDCARD|CIDR)\(.+\)$")]] = Field(
@@ -88,7 +91,7 @@ def serialize_model(self):
 
         # All fields custom to this model
         model = {
-            "default_match": "true" if self.default_match is True else "false",
+            "default_match": self.default_match,
             "match_type": self.match_type_to_conf_format,
             "min_matches": self.min_matches,
             "max_matches": self.max_matches,

diff --git a/contentctl/output/templates/transforms.j2 b/contentctl/output/templates/transforms.j2
@@ -7,8 +7,8 @@ filename = {{ lookup.app_filename.name  }}
 collection = {{ lookup.collection }}
 external_type = kvstore
 {% endif %}
-{% if lookup.default_match is defined and lookup.default_match != None  %}
-default_match = {{ lookup.default_match | lower }}
+{% if lookup.default_match != '' %}
+default_match = {{ lookup.default_match }}
 {% endif %}
 {% if lookup.case_sensitive_match is defined and lookup.case_sensitive_match != None %}
 case_sensitive_match = {{ lookup.case_sensitive_match | lower }}