{
  "$id": "https://raw.githubusercontent.com/splunk/security-content/develop/docs/spec/response.spec.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "default": {},
  "description": "schema for response",
  "properties": {
    "author": {
      "$id": "#/properties/author",
      "default": "",
      "description": "Author of the response",
      "examples": [
        "Rico Valdez, Patrick Barei\u00df, Splunk"
      ],
      "type": "string"
    },
    "date": {
      "$id": "#/properties/date",
      "default": "",
      "description": "date of creation or modification, format yyyy-mm-dd",
      "examples": [
        "2019-12-06"
      ],
      "type": "string"
    },
    "description": {
      "$id": "#/properties/description",
      "default": "",
      "description": "Description of response",
      "examples": [
        "Response example."
      ],
      "type": "string"
    },
    "id": {
      "$id": "#/properties/id",
      "default": "",
      "description": "UUID as unique identifier",
      "examples": [
        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
      ],
      "type": "string"
    },
    "name": {
      "$id": "#/properties/name",
      "default": "",
      "description": "Name of response",
      "examples": [
        "Response Example"
      ],
      "type": "string"
    },
    "response_phase": {
      "$id": "#/properties/response_phases",
      "additionalProperties": true,
      "default": {},
      "description": "Response divided into phases. These will used to referenced known response_phase parameters",
      "examples": [
        {
          "preparation": [
            {
              "id": "7c72d944-3995-4485-8e57-67b4c353989b",
              "name": "Preparation NIST"
            }
          ],
          "identification": [
            {
              "id": "c36f3f48-e0bb-4c20-a62a-cdc8f6418892",
              "name": "Detection and Analysis"
            },
            {
              "id": "0dc849b2-2eb4-4fd2-add1-b6cc475765f0",
              "name": "Analysis"
            }
          ]
        }
      ],
      "minItems": 1,
      "type": "array"
    },
    "tags": {
      "$id": "#/properties/tags",
      "additionalProperties": true,
      "default": {},
      "description": "An array of key value pairs for tagging",
      "examples": [
        {
          "analytics_story": "credential_dumping"
        }
      ],
      "minItems": 1,
      "type": "object",
      "uniqueItems": true
    },
    "version": {
      "$id": "#/properties/version",
      "default": 0,
      "description": "version of detection, e.g. 1 or 2 ...",
      "examples": [
        1
      ],
      "type": "integer"
    },
    "is_note_required":{
      "$id": "#/properties/is_note_required",
      "default": false,
      "description": "Global assignment for notes being required for tasks, can be individually set in the task",
      "examples": [
        true,
        false
      ],
      "type": "boolean"
    },
    "references": {
      "$id": "#/properties/references",
      "additionalItems": true,
      "default": [],
      "description": "A list of references for this response, phase or task (e.g. web or printed citation)",
      "examples": [
        [
          "Blue Team Handbook by Don Murdoch - Alarm Triage Overview pages 146-148",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf"
        ]
      ],
      "items": {
        "$id": "#/properties/references/items",
        "default": "",
        "description": "An explanation about the purpose of this instance.",
        "examples": [
          "https://www.amazon.com/Blue-Team-Handbook-condensed-Responder/dp/1500734756"
        ],
        "title": "Blue Team Handbook by Don Murdoch - Amazon",
        "type": "string"
      },
      "type": "array"
    }
  },
  "required": [
    "name",
    "id",
    "version",
    "date",
    "description",
    "author",
    "response_phase",
    "tags"
  ],
  "title": "Response Schema",
  "type": "object"
}