{
  "$id": "http://example.com/example.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "description": "schema for baselines",
  "properties": {
    "author": {
      "$id": "#/properties/author",
      "default": "",
      "description": "Author of the baseline",
      "examples": [
        "Bahvin Patel, Splunk"
      ],
      "type": "string"
    },
    "date": {
      "$id": "#/properties/date",
      "default": "",
      "description": "date of creation or modification, format yyyy-mm-dd",
      "examples": [
        "2019-12-06"
      ],
      "type": "string"
    },
    "description": {
      "$id": "#/properties/description",
      "default": "",
      "description": "A detailed description of the baseline ",
      "examples": [
        "This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days"
      ],
      "type": "string"
    },
    "how_to_implement": {
      "$id": "#/properties/how_to_implement",
      "default": "",
      "description": "information about how to implement. Only needed for non standard implementations.",
      "examples": [
        "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
      ],
      "type": "string"
    },
    "id": {
      "$id": "#/properties/id",
      "default": "",
      "description": "UUID as unique identifier",
      "examples": [
        "fc0edc95-ff2b-48b0-9f6f-63da3789fd63"
      ],
      "type": "string"
    },
    "name": {
      "$id": "#/properties/name",
      "default": "",
      "examples": [
        "Previously Seen AWS Regions"
      ],
      "title": "Name of baseline",
      "type": "string"
    },
    "search": {
      "$id": "#/properties/search",
      "default": "",
      "description": "The Splunk search for the baseline",
      "examples": [
        "cloudtrail StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv"
      ],
      "type": "string"
    },
    "tags": {
      "$id": "#/properties/tags",
      "additionalProperties": true,
      "default": {},
      "description": "An array of key value pairs for tagging",
      "examples": [
        {
          "analytics_story": "suspicious_aws_ec2_activities",
          "custom_key": "custom_value"
        }
      ],
      "minItems": 1,
      "type": "object",
      "uniqueItems": true
    },
    "version": {
      "$id": "#/properties/version",
      "default": 0,
      "description": "version of baseline, e.g. 1 or 2 ...",
      "examples": [
        1
      ],
      "type": "integer"
    }
  },
  "required": [
    "name",
    "id",
    "version",
    "date",
    "description",
    "author",
    "search",
    "tags"
  ],
  "title": "Baseline Schema",
  "type": "object"
}