Skip to content

4. Developing ESCU Content

Jump to bottom
Nasreddine Bencherchali edited this page Aug 14, 2026 · 5 revisions

Developing ESCU Content

Pre-Requisites

  1. Install contentctl-ng using pip install contentctl-ng to install the latest version of contentctl-ng, this is a pre-requisite to validate, build and test the content like the Splunk Threat Research team

Writing Content

  1. Select the content piece you want to write.
  2. Copy an example and edit it to suit your needs or simply use the provided VsCode snippet provided in the repo.
  3. Make a pull request.

Testing New Content

Run contentctl-ng locally. This will ensure your new content or changes are validated.

The pull request will trigger a set of validations to ensure the contribution passes our requirements for quality. If your tests pass, you're good to go! A repository maintainer will make sure the PR makes it into the next release. Which will be deployed in the ESCU app. If the GitHub Actions check fails, refer first to the CI results as some issues are easily fixed. If not do not worry, our team will work with you in the PR to make sure your content passes validation and its part of our next release!

For a more detailed explanation on how to contribute to the project, please see Contributing

Clone this wiki locally