Home

Welcome to the contentctl wiki!

If you're seeing this and you clicked the link on GitHub, documentation is a Work-In-Progress... check back soon!

If you're seeing this because of a link in a detection you just created using contentctl new... Hello! This link was placed there as a placeholder. You want to change it to a link that points at logs for your detection. You can check out splunk/attack_data for an example store of logs we use in splunk/security_content, but you don't need to use LFS. Any link that points right to the logs will work!