fixed small bug

2026-06-08 17:32:49 +00:00 · 2023-03-03 12:19:41 +01:00
parent 43c92975d5
commit bbabdeb3d8
69 changed files with 70 additions and 1 deletions
@@ -83,7 +83,8 @@ class ObjToYmlAdapter(Adapter):
                                "risk_score": True,
                                "security_domain": True,
                                "required_fields": True,
-                                "research_site_url": True
+                                "research_site_url": True,
+                                "event_schema": True
                            },
                        "test": 
                            {
@@ -96,6 +96,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -100,6 +100,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/a0c8c292-d01a-11eb-aa18-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -97,6 +97,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/afb31de4-d023-11eb-98d5-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -97,6 +97,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -92,6 +92,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -93,6 +93,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/8f907d90-6173-11ec-9c23-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -96,6 +96,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/8776d79c-d26e-11eb-9a56-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -95,6 +95,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/b76eae28-cd25-11eb-9c92-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -99,6 +99,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd80-4ffa-a844-25026e0a0c94/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -105,6 +105,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/e8b74268-5454-11ec-a799-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -99,6 +99,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/ba858b08-d26c-11eb-af9b-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -100,6 +100,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/2452e632-9e0d-11eb-34ba-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -95,6 +95,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/f792cdc9-43ee-4429-a3c0-ffce4fed1a85/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -95,6 +95,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/c6da561a-cd29-11eb-ae65-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -98,6 +98,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/028e4406-6176-11ec-aec2-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -97,6 +97,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/9ae9a48a-cdbe-11eb-875a-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -98,6 +98,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/3ea3851a-8736-41a0-bc09-7e4485b48fa6/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -96,6 +96,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/dbc30554-d27e-11eb-9e5e-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -109,6 +109,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -302,6 +302,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/28179107-099a-464a-94d3-08301e6c055f/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -94,6 +94,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/71efbf52-4dbb-4c00-a520-306aa546cbb7/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -101,6 +101,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/5438113c-cdd9-11eb-93b8-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -97,6 +97,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/a4bdc944-cdd9-11eb-ac97-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -105,6 +105,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/1e25e97a-8ea4-11ec-9767-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -111,6 +111,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/d76e8188-8f5a-11ec-ace4-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -103,6 +103,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/b06983f4-8f72-11ec-ab50-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -100,6 +100,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/8cb1ad38-8f6d-11ec-87a3-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -101,6 +101,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/9ac29c40-8f6b-11ec-b19a-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -100,6 +100,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/0ae05a0f-bc84-456b-822a-a5b9c081c7ca/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -111,6 +111,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/cc8d046a-543b-11ec-b864-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -91,6 +91,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/c205bd2e-cd5b-4224-8510-578a2a1f83d7/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -94,6 +94,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/aa502688-9037-11ec-842d-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -136,6 +136,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/21179107-099a-324a-94d3-08301e6c065f/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -120,6 +120,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/1118bc65-b0c7-4589-bc2f-ad6802fd0909/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -103,6 +103,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/f253f9c2-10f0-4cc8-b469-f505ba8c2038/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -96,6 +96,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/695bfad6-9662-4f9e-a576-bf02a951aa60/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -133,6 +133,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/25689101-012a-324a-94d3-08301e6c065a/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -101,6 +101,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/f63f7e9c-9526-11ec-9fc7-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -101,6 +101,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/9b35c538-94ef-11ec-9439-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -99,6 +99,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/24962154-9524-11ec-9333-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -96,6 +96,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/7b6c3fac-0c37-4efc-a85e-de88f42b6763/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -106,6 +106,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/dad9ddec-a72a-47be-87b6-a0f7ba98ed6e/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -104,6 +104,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/e102e297-dbe6-4a19-b319-5c08f4c19a06/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -108,6 +108,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/477e068e-8b6d-11ec-b6c1-81af21670352/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -98,6 +98,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/d57b4d91-fc91-4482-a325-47693cced1eb/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -97,6 +97,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/dc3f2af7-ca69-47ce-a122-9f9787e19417/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -102,6 +102,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/46440222-81d5-44b1-a376-19dcd70d1b08/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -103,6 +103,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/0bafd086-8f61-11ec-996e-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -100,6 +100,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/6f42b8ce-1e15-11ec-ad5a-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -99,6 +99,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/c842931e-661f-42bc-a4df-0460d93cfb69/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -98,6 +98,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/ecaaf956-c516-4980-b08e-8c01c19614ca/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -98,6 +98,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/3284e4f4-67f7-49b6-ad5e-a8fcead2eef8/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -98,6 +98,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/e124f71f-11bc-47e4-9931-6046d256005d/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -99,6 +99,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/057c06c7-ef31-4749-b5c9-199152e53a06/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -98,6 +98,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/93862a89-abe0-4094-909a-08ec390aa5e3/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -98,6 +98,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/d75cc561-3828-4d0a-92c4-0eb93bfe0929/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -98,6 +98,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/6401d583-0052-4dc5-a713-68b510826d2b/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -98,6 +98,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/b8da7ea5-8c16-4eff-9787-54ec271159e0/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -94,6 +94,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/76bb9e35-f314-4c3d-a385-83c72a13ce4e/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -102,6 +102,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/0caa1dd6-94f5-11ec-9786-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -102,6 +102,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/92886f1c-9b11-11ec-848a-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -99,6 +99,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/11c32b19-05a6-48a8-ab28-18dbd9ec5d50/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -107,6 +107,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/0fec631a-7c9b-4e4c-b28b-93260953e25f/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -110,6 +110,7 @@ tags:
  security_domain: endpoint
  risk_severity: medium
  research_site_url: https://research.splunk.com/endpoint/ba0c2450-caea-4086-ac3a-a71e2659754b/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -93,6 +93,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/8d1d5570-722c-49a3-996c-2e2cceef5163/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -93,6 +93,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -93,6 +93,7 @@ tags:
  security_domain: endpoint
  risk_severity: low
  research_site_url: https://research.splunk.com/endpoint/df76a8d1-92e1-4ec9-b8f7-695b5838703e/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user
@@ -102,6 +102,7 @@ tags:
  security_domain: endpoint
  risk_severity: high
  research_site_url: https://research.splunk.com/endpoint/76b3b290-9b31-11ec-a934-acde48001122/
+  event_schema: ocsf
  mappings:
  - ocsf: process.user.name
    cim: user