admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updating schedule field in specs, also corrected validation logic

Browse Source
This commit is contained in:
divious1
2019-04-02 17:31:02 -05:00
parent d76848cb39
commit 6112fcc9e6
4 changed files with 130 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spec/v2/baselines.spec.json
+49 -14
View File
@@ -16,6 +16,24 @@
"description": "Url of the playbook on Phantom website.",
"type": "string"
},
"schedule": {
"description": "Various fields to assist in scheduling the search",
"properties": {
"cron_schedule": {
"description": "Schedule of the search in cron format",
"type": "string"
},
"earliest_time": {
"description": "The earliest time the search should run in Splunk format",
"type": "string"
},
"latest_time": {
"description": "The latest time tes search should run against in Splunk format",
"type": "string"
}
},
"type": "object"
},
"sensitivity": {
"description": "TLP colors (White, Green, Amber or Red)",
"type": "string"
@@ -25,27 +43,31 @@
"type": "string"
}
},
"required": [
"phantom_server",
"playbook_name",
"playbook_url"
],
"type": "object"
},
"splunk": {
"properties": {
"schedule": {
"additionalProperties": false,
"description": "The fields associated on when this search should run relative to the detection event",
"description": "Various fields to assist in scheduling the search",
"properties": {
"cron_schedule": {
"description": "Schedule of the search in cron format",
"type": "string"
},
"earliest_time": {
"description": "The number of seconds into the past from the event time the search should cover",
"type": "integer"
"description": "The earliest time the search should run in Splunk format",
"type": "string"
},
"latest_time": {
"description": "The number of seconds into the future from the event time the search should cover",
"type": "integer"
"description": "The latest time tes search should run against in Splunk format",
"type": "string"
}
},
"required": [
"latest_time",
"earliest_time"
],
"type": "object"
},
"search": {
@@ -63,14 +85,27 @@
"description": "The fields that make up the manifest of a version 2 baseline search",
"properties": {
"baseline": {
"oneOf": [
"anyOf": [
{
"$ref": "#/definitions/splunk"
"required": [
"splunk"
]
},
{
"$ref": "#/definitions/phantom"
"required": [
"phantom"
]
}
]
],
"properties": {
"phantom": {
"$ref": "#/definitions/phantom"
},
"splunk": {
"$ref": "#/definitions/splunk"
}
},
"type": "object"
},
"creation_date": {
"description": "The date the baseline manifest was created",
spec/v2/detections.spec.json
+28 -10
View File
@@ -64,7 +64,7 @@
],
"type": "object"
},
"scheduling": {
"schedule": {
"description": "Various fields to assist in scheduling the search",
"properties": {
"cron_schedule": {
@@ -107,7 +107,7 @@
},
"required": [
"search",
"scheduling"
"schedule"
],
"type": "object"
},
@@ -201,7 +201,7 @@
],
"type": "object"
},
"scheduling": {
"schedule": {
"description": "Various fields to assist in scheduling the search",
"properties": {
"cron_schedule": {
@@ -244,7 +244,7 @@
},
"required": [
"search",
"scheduling"
"schedule"
],
"type": "object"
},
@@ -312,7 +312,7 @@
],
"type": "object"
},
"scheduling": {
"schedule": {
"description": "Various fields to assist in scheduling the search",
"properties": {
"cron_schedule": {
@@ -355,7 +355,7 @@
},
"required": [
"search",
"scheduling"
"schedule"
],
"type": "object"
},
@@ -537,17 +537,35 @@
"type": "string"
},
"detect": {
"oneOf": [
"anyOf": [
{
"$ref": "#/definitions/splunk"
"required": [
"splunk"
]
},
{
"required": [
"phantom"
]
},
{
"required": [
"uba"
]
}
],
"properties": {
"phantom": {
"$ref": "#/definitions/phantom"
},
{
"splunk": {
"$ref": "#/definitions/splunk"
},
"uba": {
"$ref": "#/definitions/uba"
}
]
},
"type": "object"
},
"eli5": {
"description": "Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert",
spec/v2/investigations.spec.json
+18 -15
View File
@@ -17,15 +17,19 @@
"type": "string"
},
"schedule": {
"description": "The time associated on when this investigste object should run relative to the detection event",
"description": "Various fields to assist in scheduling the search",
"properties": {
"cron_schedule": {
"description": "Schedule of the search in cron format",
"type": "string"
},
"earliest_time": {
"description": "The number of seconds into the past from the event time the search should cover",
"type": "integer"
"description": "The earliest time the search should run in Splunk format",
"type": "string"
},
"latest_time": {
"description": "The number of seconds into the future from the event time the search should cover",
"type": "integer"
"description": "The latest time tes search should run against in Splunk format",
"type": "string"
}
},
"type": "object"
@@ -55,22 +59,21 @@
"uniqueItems": true
},
"schedule": {
"additionalProperties": false,
"description": "The fields associated on when this search should run relative to the detection event",
"description": "Various fields to assist in scheduling the search",
"properties": {
"cron_schedule": {
"description": "Schedule of the search in cron format",
"type": "string"
},
"earliest_time": {
"description": "The number of seconds into the past from the event time the search should cover",
"type": "integer"
"description": "The earliest time the search should run in Splunk format",
"type": "string"
},
"latest_time": {
"description": "The number of seconds into the future from the event time the search should cover",
"type": "integer"
"description": "The latest time tes search should run against in Splunk format",
"type": "string"
}
},
"required": [
"latest_time",
"earliest_time"
],
"type": "object"
},
"search": {
spec/v2/responses.spec.json
+35 -20
View File
@@ -1,7 +1,6 @@
{
"$id": "https://api.splunkresearch.com/schemas/investigations.json",
"$id": "https://api.splunkresearch.com/schemas/responses.json",
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"definitions": {
"phantom": {
"properties": {
@@ -43,23 +42,22 @@
},
"splunk": {
"properties": {
"investigate_window": {
"additionalProperties": false,
"description": "The fields associated on when this search should run relative to the detection event",
"schedule": {
"description": "Various fields to assist in scheduling the search",
"properties": {
"earliest_time_offset": {
"description": "The number of seconds into the past from the event time the search should cover",
"type": "integer"
"cron_schedule": {
"description": "Schedule of the search in cron format",
"type": "string"
},
"latest_time_offset": {
"description": "The number of seconds into the future from the event time the search should cover",
"type": "integer"
"earliest_time": {
"description": "The earliest time the search should run in Splunk format",
"type": "string"
},
"latest_time": {
"description": "The latest time tes search should run against in Splunk format",
"type": "string"
}
},
"required": [
"latest_time_offset",
"earliest_time_offset"
],
"type": "object"
},
"search": {
@@ -67,10 +65,14 @@
"type": "string"
}
},
"required": [
"search",
"schedule"
],
"type": "object"
}
},
"description": "The fields that make up the manifest of a version 1 reponse spec",
"description": "The fields that make up the manifest of a version 1 response spec",
"properties": {
"creation_date": {
"description": "The date the story manifest was created",
@@ -279,14 +281,27 @@
]
},
"response": {
"oneOf": [
"anyOf": [
{
"$ref": "#/definitions/splunk"
"required": [
"splunk"
]
},
{
"$ref": "#/definitions/phantom"
"required": [
"phantom"
]
}
]
],
"properties": {
"phantom": {
"$ref": "#/definitions/phantom"
},
"splunk": {
"$ref": "#/definitions/splunk"
}
},
"type": "object"
},
"spec_version": {
"description": "The version of the investigative search specification this manifest follows",