# Response Schema Schema

```txt
https://raw.githubusercontent.com/splunk/security_content/develop/docs/spec/response.spec.json
```

schema for response

| Abstract            | Extensible | Status         | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In                                                                  |
| :------------------ | :--------- | :------------- | :----------- | :---------------- | :-------------------- | :------------------ | :-------------------------------------------------------------------------- |
| Can be instantiated | No         | Unknown status | No           | Forbidden         | Allowed               | none                | [responses.spec.json](../../out/responses.spec.json "open original schema") |

## Response Schema Type

`object` ([Response Schema](responses.md))

## Response Schema Default Value

The default value is:

```json
{}
```

# Response Schema Properties

| Property                              | Type      | Required | Nullable       | Defined by                                                                                                               |
| :------------------------------------ | :-------- | :------- | :------------- | :----------------------------------------------------------------------------------------------------------------------- |
| [author](#author)                     | `string`  | Required | cannot be null | [Response Schema](responses-properties-author.md "#/properties/author#/properties/author")                               |
| [date](#date)                         | `string`  | Required | cannot be null | [Response Schema](responses-properties-date.md "#/properties/date#/properties/date")                                     |
| [description](#description)           | `string`  | Required | cannot be null | [Response Schema](responses-properties-description.md "#/properties/description#/properties/description")                |
| [id](#id)                             | `string`  | Required | cannot be null | [Response Schema](responses-properties-id.md "#/properties/id#/properties/id")                                           |
| [name](#name)                         | `string`  | Required | cannot be null | [Response Schema](responses-properties-name.md "#/properties/name#/properties/name")                                     |
| [response_phase](#response_phase)     | `array`   | Required | cannot be null | [Response Schema](responses-properties-response_phase.md "#/properties/response_phases#/properties/response_phase")      |
| [tags](#tags)                         | `object`  | Required | cannot be null | [Response Schema](responses-properties-tags.md "#/properties/tags#/properties/tags")                                     |
| [version](#version)                   | `integer` | Required | cannot be null | [Response Schema](responses-properties-version.md "#/properties/version#/properties/version")                            |
| [is_note_required](#is_note_required) | `boolean` | Optional | cannot be null | [Response Schema](responses-properties-is_note_required.md "#/properties/is_note_required#/properties/is_note_required") |
| [references](#references)             | `array`   | Optional | cannot be null | [Response Schema](responses-properties-references.md "#/properties/references#/properties/references")                   |
| Additional Properties                 | Any       | Optional | can be null    |                                                                                                                          |

## author

Author of the response

`author`

*   is required

*   Type: `string`

*   cannot be null

*   defined in: [Response Schema](responses-properties-author.md "#/properties/author#/properties/author")

### author Type

`string`

### author Examples

```yaml
Rico Valdez, Patrick Bareiß, Splunk

```

## date

date of creation or modification, format yyyy-mm-dd

`date`

*   is required

*   Type: `string`

*   cannot be null

*   defined in: [Response Schema](responses-properties-date.md "#/properties/date#/properties/date")

### date Type

`string`

### date Examples

```yaml
'2019-12-06'

```

## description

Description of response

`description`

*   is required

*   Type: `string`

*   cannot be null

*   defined in: [Response Schema](responses-properties-description.md "#/properties/description#/properties/description")

### description Type

`string`

### description Examples

```yaml
Response example.

```

## id

UUID as unique identifier

`id`

*   is required

*   Type: `string`

*   cannot be null

*   defined in: [Response Schema](responses-properties-id.md "#/properties/id#/properties/id")

### id Type

`string`

### id Examples

```yaml
fb4c31b0-13e8-4155-8aa5-24de4b8d6717

```

## name

Name of response

`name`

*   is required

*   Type: `string`

*   cannot be null

*   defined in: [Response Schema](responses-properties-name.md "#/properties/name#/properties/name")

### name Type

`string`

### name Examples

```yaml
Response Example

```

## response_phase

Response divided into phases. These will used to referenced known response_phase parameters

`response_phase`

*   is required

*   Type: `array`

*   cannot be null

*   defined in: [Response Schema](responses-properties-response_phase.md "#/properties/response_phases#/properties/response_phase")

### response_phase Type

`array`

### response_phase Constraints

**minimum number of items**: the minimum number of items for this array is: `1`

### response_phase Default Value

The default value is:

```json
{}
```

### response_phase Examples

```yaml
preparation:
  - id: 7c72d944-3995-4485-8e57-67b4c353989b
    name: Preparation NIST
identification:
  - id: c36f3f48-e0bb-4c20-a62a-cdc8f6418892
    name: Detection and Analysis
  - id: 0dc849b2-2eb4-4fd2-add1-b6cc475765f0
    name: Analysis

```

## tags

An array of key value pairs for tagging

`tags`

*   is required

*   Type: `object` ([Details](responses-properties-tags.md))

*   cannot be null

*   defined in: [Response Schema](responses-properties-tags.md "#/properties/tags#/properties/tags")

### tags Type

`object` ([Details](responses-properties-tags.md))

### tags Constraints

**minimum number of items**: the minimum number of items for this array is: `1`

**unique items**: all items in this array must be unique. Duplicates are not allowed.

### tags Default Value

The default value is:

```json
{}
```

### tags Examples

```yaml
analytic_story: credential_dumping

```

## version

version of detection, e.g. 1 or 2 ...

`version`

*   is required

*   Type: `integer`

*   cannot be null

*   defined in: [Response Schema](responses-properties-version.md "#/properties/version#/properties/version")

### version Type

`integer`

### version Examples

```yaml
1

```

## is_note_required

Global assignment for notes being required for tasks, can be individually set in the task

`is_note_required`

*   is optional

*   Type: `boolean`

*   cannot be null

*   defined in: [Response Schema](responses-properties-is_note_required.md "#/properties/is_note_required#/properties/is_note_required")

### is_note_required Type

`boolean`

### is_note_required Examples

```yaml
true

```

```yaml
false

```

## references

A list of references for this response, phase or task (e.g. web or printed citation)

`references`

*   is optional

*   Type: `string[]` ([Blue Team Handbook by Don Murdoch - Amazon](responses-properties-references-blue-team-handbook-by-don-murdoch---amazon.md))

*   cannot be null

*   defined in: [Response Schema](responses-properties-references.md "#/properties/references#/properties/references")

### references Type

`string[]` ([Blue Team Handbook by Don Murdoch - Amazon](responses-properties-references-blue-team-handbook-by-don-murdoch---amazon.md))

### references Default Value

The default value is:

```json
[]
```

### references Examples

```yaml
- Blue Team Handbook by Don Murdoch - Alarm Triage Overview pages 146-148
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

```

## Additional Properties

Additional properties are allowed and do not have to follow a specific schema
