{
  "$id": "http://example.com/example.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "default": {},
  "description": "schema analytics story",
  "properties": {
    "author": {
      "$id": "#/properties/author",
      "default": "",
      "description": "Author of the analytics story",
      "examples": [
        "Rico Valdez, Patrick Barei\u00df, Splunk"
      ],
      "type": "string"
    },
    "date": {
      "$id": "#/properties/date",
      "default": "",
      "description": "date of creation or modification, format yyyy-mm-dd",
      "examples": [
        "2019-12-06"
      ],
      "type": "string"
    },
    "description": {
      "$id": "#/properties/description",
      "default": "",
      "description": "description of the analytics story",
      "examples": [
        "Uncover activity consistent with credential dumping, a technique where attackers compromise systems and attempt to obtain and exfiltrate passwords."
      ],
      "type": "string"
    },
    "id": {
      "$id": "#/properties/id",
      "default": "",
      "description": "UUID as unique identifier",
      "examples": [
        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
      ],
      "type": "string"
    },
    "name": {
      "$id": "#/properties/name",
      "default": "",
      "description": "Name of the Analytics Story",
      "examples": [
        "Credential Dumping"
      ],
      "type": "string"
    },
    "narrative": {
      "$id": "#/properties/narrative",
      "default": "",
      "description": "narrative of the analytics story",
      "examples": [
        "gathering credentials from a target system, often hashed or encrypted, is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems."
      ],
      "type": "string"
    },
    "search": {
      "$id": "#/properties/search",
      "default": "",
      "description": "An additional Splunk search, which uses the result of the detections",
      "examples": [
        "index=asx mitre_id=t1003 | stats values(source) as detections values(process) as processes values(user) as users values(_time) as time count by dest"
      ],
      "type": "string"
    },
    "tags": {
      "$id": "#/properties/tags",
      "additionalProperties": true,
      "default": {},
      "description": "An explanation about the purpose of this instance.",
      "examples": [
        {
          "analytics_story": "credential_dumping"
        }
      ],
      "minItems": 1,
      "type": "object"
    },
    "version": {
      "$id": "#/properties/version",
      "default": 0,
      "description": "version of analytics story, e.g. 1 or 2 ...",
      "examples": [
        1
      ],
      "type": "integer"
    }
  },
  "required": [
    "name",
    "id",
    "version",
    "date",
    "description",
    "narrative",
    "author",
    "tags"
  ],
  "title": "Analytics Story Schema",
  "type": "object"
}