splunk/contentctl

Add a pydantic validator to ensure observable names are unique in `detection.tags.observable`

cmcginley-splunk opened this issue · 0 comments

  • Currently, we do not enforce observable names be unique within a single detection
  • We should, as we should have no reason to repeat observables
  • At the time of writing we have two detections with a typo that repeats an observable twice