# Baseline Schema Schema ```txt http://example.com/example.json ``` schema for baselines | Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In | | :------------------ | :--------- | :------------- | :----------- | :---------------- | :-------------------- | :------------------ | :-------------------------------------------------------------------------- | | Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | [baselines.spec.json](../../out/baselines.spec.json "open original schema") | ## Baseline Schema Type `object` ([Baseline Schema](baselines.md)) # Baseline Schema Properties | Property | Type | Required | Nullable | Defined by | | :------------------------------------ | :-------- | :------- | :------------- | :----------------------------------------------------------------------------------------------------------------------- | | [author](#author) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-author.md "#/properties/author#/properties/author") | | [date](#date) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-date.md "#/properties/date#/properties/date") | | [description](#description) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-description.md "#/properties/description#/properties/description") | | [how_to_implement](#how_to_implement) | `string` | Optional | cannot be null | [Baseline Schema](baselines-properties-how_to_implement.md "#/properties/how_to_implement#/properties/how_to_implement") | | [id](#id) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-id.md "#/properties/id#/properties/id") | | [name](#name) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-name-of-baseline.md "#/properties/name#/properties/name") | | [search](#search) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-search.md "#/properties/search#/properties/search") | | [tags](#tags) | `object` | Required | cannot be null | [Baseline Schema](baselines-properties-tags.md "#/properties/tags#/properties/tags") | | [version](#version) | `integer` | Required | cannot be null | [Baseline Schema](baselines-properties-version.md "#/properties/version#/properties/version") | | Additional Properties | Any | Optional | can be null | | ## author Author of the baseline `author` * is required * Type: `string` * cannot be null * defined in: [Baseline Schema](baselines-properties-author.md "#/properties/author#/properties/author") ### author Type `string` ### author Examples ```yaml Bahvin Patel, Splunk ``` ## date date of creation or modification, format yyyy-mm-dd `date` * is required * Type: `string` * cannot be null * defined in: [Baseline Schema](baselines-properties-date.md "#/properties/date#/properties/date") ### date Type `string` ### date Examples ```yaml '2019-12-06' ``` ## description A detailed description of the baseline `description` * is required * Type: `string` * cannot be null * defined in: [Baseline Schema](baselines-properties-description.md "#/properties/description#/properties/description") ### description Type `string` ### description Examples ```yaml >- This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days ``` ## how_to_implement information about how to implement. Only needed for non standard implementations. `how_to_implement` * is optional * Type: `string` * cannot be null * defined in: [Baseline Schema](baselines-properties-how_to_implement.md "#/properties/how_to_implement#/properties/how_to_implement") ### how_to_implement Type `string` ### how_to_implement Examples ```yaml >- This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. ``` ## id UUID as unique identifier `id` * is required * Type: `string` * cannot be null * defined in: [Baseline Schema](baselines-properties-id.md "#/properties/id#/properties/id") ### id Type `string` ### id Examples ```yaml fc0edc95-ff2b-48b0-9f6f-63da3789fd63 ``` ## name `name` * is required * Type: `string` ([Name of baseline](baselines-properties-name-of-baseline.md)) * cannot be null * defined in: [Baseline Schema](baselines-properties-name-of-baseline.md "#/properties/name#/properties/name") ### name Type `string` ([Name of baseline](baselines-properties-name-of-baseline.md)) ### name Examples ```yaml Previously Seen AWS Regions ``` ## search The Splunk search for the baseline `search` * is required * Type: `string` * cannot be null * defined in: [Baseline Schema](baselines-properties-search.md "#/properties/search#/properties/search") ### search Type `string` ### search Examples ```yaml >- cloudtrail StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv ``` ## tags An array of key value pairs for tagging `tags` * is required * Type: `object` ([Details](baselines-properties-tags.md)) * cannot be null * defined in: [Baseline Schema](baselines-properties-tags.md "#/properties/tags#/properties/tags") ### tags Type `object` ([Details](baselines-properties-tags.md)) ### tags Constraints **minimum number of items**: the minimum number of items for this array is: `1` **unique items**: all items in this array must be unique. Duplicates are not allowed. ### tags Default Value The default value is: ```json {} ``` ### tags Examples ```yaml analytic_story: suspicious_aws_ec2_activities custom_key: custom_value ``` ## version version of baseline, e.g. 1 or 2 ... `version` * is required * Type: `integer` * cannot be null * defined in: [Baseline Schema](baselines-properties-version.md "#/properties/version#/properties/version") ### version Type `integer` ### version Examples ```yaml 1 ``` ## Additional Properties Additional properties are allowed and do not have to follow a specific schema