Merge pull request #466 from splunk/hotfix/cms-filter-fbd

Hotfix: filtering FBDs from CMS validation

Looks great! Merge in prep for release

Author: pyth0n1c

contentctl/objects/content_versioning_service.py

@@ -7,13 +7,7 @@
 from typing import Any, Callable
 
 import splunklib.client as splunklib  # type: ignore
-from pydantic import (
-    BaseModel,
-    Field,
-    PrivateAttr,
-    computed_field,
-    model_validator,
-)
+from pydantic import BaseModel, Field, PrivateAttr, computed_field, model_validator
 from semantic_version import Version
 from splunklib.binding import HTTPError, ResponseReader  # type: ignore
 from splunklib.data import Record  # type: ignore
@@ -422,12 +416,14 @@ def _query_cms_main(self, use_cache: bool = False) -> splunklib.Job:
         if self.kvstore_content_versioning:
             query = (
                 f"| inputlookup cms_content_lookup | search app_name={self.global_config.app.appid}"
-                f"| fields content"
+                "| fields content | spath input=content "
+                "| search action.correlationsearch.detection_type=ebd | fields content"
             )
         elif self.indexbased_content_versioning:
             query = (
-                f"search index=cms_main sourcetype=stash_common_detection_model "
-                f'app_name="{self.global_config.app.appid}" | fields _raw'
+                "search index=cms_main sourcetype=stash_common_detection_model "
+                f'app_name="{self.global_config.app.appid}" '
+                "action.correlationsearch.detection_type=ebd | fields _raw"
             )
         else:
             if self.kvstore_content_versioning:

pyproject.toml

@@ -1,7 +1,7 @@
 [tool.poetry]
 name = "contentctl"
 
-version = "5.5.12"
+version = "5.5.13"
 
 description = "Splunk Content Control Tool"
 authors = ["STRT <research@splunk.com>"]