admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updates to enum

Browse Source
This commit is contained in:
bpatel
2019-03-27 18:54:42 -04:00
parent 5b10971172
commit a5d8d2cad7
4 changed files with 106 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spec/v2/baselines.json.spec
+26 -1
View File
@@ -131,7 +131,32 @@
"description": "A list of entities(important fields) that are in baseline output, which will be used by detections and are relevant to the story flow",
"type": "array",
"items": {
"enum": []
"enum": [
"accessKeyId",
"arn",
"awsRegion",
"bucketName",
"City",
"Country",
"dest_port",
"dest",
"event_id",
"instanceId",
"message_id",
"networkAclId",
"process_name",
"process",
"recipient",
"Region",
"resourceId",
"session_id",
"src_ip",
"src_ip",
"src_mac",
"src_user",
"src",
"user"
]
},
"minItems": 0,
"uniqueItems": true
spec/v2/detections.json.spec
+27 -1
View File
@@ -381,7 +381,33 @@
"description": "A list of entities that is outputed by the search...",
"type": "array",
"items": {
"enum": []
"enum": [
"accessKeyId",
"arn",
"awsRegion",
"bucketName",
"City",
"Country",
"dest_port",
"dest",
"event_id",
"instanceId",
"message_id",
"networkAclId",
"process_name",
"process",
"recipient",
"Region",
"resourceId",
"session_id",
"src_ip",
"src_ip",
"src_mac",
"src_user",
"src",
"user"
]
},
"minItems": 0,
"uniqueItems": true
spec/v2/investigations.json.spec
+26 -1
View File
@@ -193,7 +193,32 @@ ent
"description": "A list of entities that will used in the story flow or are relevant to the security investigation. ",
"type": "array",
"items": {
"enum": []
"enum": [
] "accessKeyId",
"arn",
"awsRegion",
"bucketName",
"City",
"Country",
"dest_port",
"dest",
"event_id",
"instanceId",
"message_id",
"networkAclId",
"process_name",
"process",
"recipient",
"Region",
"resourceId",
"session_id",
"src_ip",
"src_ip",
"src_mac",
"src_user",
"src",
"user"
]
},
"minItems": 0,
"uniqueItems": true
spec/v2/responses.json.spec
+27 -2
View File
@@ -183,13 +183,38 @@
"description": "A list of entities that is either an input or an output for the security workflow.",
"type": "array",
"items": {
"enum": []
"enum": [
"accessKeyId",
"arn",
"awsRegion",
"bucketName",
"City",
"Country",
"dest_port",
"dest",
"event_id",
"instanceId",
"message_id",
"networkAclId",
"process_name",
"process",
"recipient",
"Region",
"resourceId",
"session_id",
"src_ip",
"src_ip",
"src_mac",
"src_user",
"src",
"user"
]
},
"minItems": 0,
"uniqueItems": true
},
"product_type": {
"description": "The type of detection",
"description": "The type of product that does the reponse",
"enum": [
"splunk",
"phantom"