mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
322 lines
8.5 KiB
Markdown
322 lines
8.5 KiB
Markdown
# Lookup Manifest Schema
|
|
|
|
```txt
|
|
https://api.splunkresearch.com/schemas/lookups.json
|
|
```
|
|
|
|
A object that defines a lookup file and its properties.
|
|
|
|
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
|
|
| :------------------ | :--------- | :------------- | :----------- | :---------------- | :-------------------- | :------------------ | :----------------------------------------------------------------------- |
|
|
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | [lookups.spec.json](../../spec/lookups.spec.json "open original schema") |
|
|
|
|
## Lookup Manifest Type
|
|
|
|
`object` ([Lookup Manifest](lookups.md))
|
|
|
|
one (and only one) of
|
|
|
|
* [Untitled undefined type in Lookup Manifest](lookups-oneof-0.md "check type definition")
|
|
|
|
* [Untitled undefined type in Lookup Manifest](lookups-oneof-1.md "check type definition")
|
|
|
|
# Lookup Manifest Properties
|
|
|
|
| Property | Type | Required | Nullable | Defined by |
|
|
| :-------------------------------------------- | :-------- | :------- | :------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| [case_sensitive_match](#case_sensitive_match) | `string` | Optional | cannot be null | [Lookup Manifest](lookups-properties-case_sensitive_match.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/case_sensitive_match") |
|
|
| [collection](#collection) | `string` | Optional | cannot be null | [Lookup Manifest](lookups-properties-collection.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/collection") |
|
|
| [default_match](#default_match) | `string` | Optional | cannot be null | [Lookup Manifest](lookups-properties-default_match.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/default_match") |
|
|
| [description](#description) | `string` | Optional | cannot be null | [Lookup Manifest](lookups-properties-description.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/description") |
|
|
| [fields_list](#fields_list) | `string` | Optional | cannot be null | [Lookup Manifest](lookups-properties-fields_list.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/fields_list") |
|
|
| [filename](#filename) | `string` | Optional | cannot be null | [Lookup Manifest](lookups-properties-filename.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/filename") |
|
|
| [filter](#filter) | `string` | Optional | cannot be null | [Lookup Manifest](lookups-properties-filter.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/filter") |
|
|
| [match_type](#match_type) | `string` | Optional | cannot be null | [Lookup Manifest](lookups-properties-match_type.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/match_type") |
|
|
| [max_matches](#max_matches) | `integer` | Optional | cannot be null | [Lookup Manifest](lookups-properties-max_matches.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/max_matches") |
|
|
| [min_matches](#min_matches) | `integer` | Optional | cannot be null | [Lookup Manifest](lookups-properties-min_matches.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/min_matches") |
|
|
| [name](#name) | `string` | Optional | cannot be null | [Lookup Manifest](lookups-properties-name.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/name") |
|
|
|
|
## case_sensitive_match
|
|
|
|
What the macro is intended to filter
|
|
|
|
`case_sensitive_match`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Lookup Manifest](lookups-properties-case_sensitive_match.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/case_sensitive_match")
|
|
|
|
### case_sensitive_match Type
|
|
|
|
`string`
|
|
|
|
### case_sensitive_match Constraints
|
|
|
|
**enum**: the value of this property must be equal to one of the following values:
|
|
|
|
| Value | Explanation |
|
|
| :-------- | :---------- |
|
|
| `"true"` | |
|
|
| `"false"` | |
|
|
|
|
### case_sensitive_match Examples
|
|
|
|
```yaml
|
|
'true'
|
|
|
|
```
|
|
|
|
## collection
|
|
|
|
Name of the collection to use for this lookup
|
|
|
|
`collection`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Lookup Manifest](lookups-properties-collection.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/collection")
|
|
|
|
### collection Type
|
|
|
|
`string`
|
|
|
|
### collection Examples
|
|
|
|
```yaml
|
|
prohibited_apps_launching_cmd
|
|
|
|
```
|
|
|
|
## default_match
|
|
|
|
The default value if no match is found
|
|
|
|
`default_match`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Lookup Manifest](lookups-properties-default_match.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/default_match")
|
|
|
|
### default_match Type
|
|
|
|
`string`
|
|
|
|
### default_match Examples
|
|
|
|
```yaml
|
|
'true'
|
|
|
|
```
|
|
|
|
## description
|
|
|
|
The description of this lookup
|
|
|
|
`description`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Lookup Manifest](lookups-properties-description.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/description")
|
|
|
|
### description Type
|
|
|
|
`string`
|
|
|
|
### description Examples
|
|
|
|
```yaml
|
|
This lookup contains file names that exist in the Windows\System32 directory
|
|
|
|
```
|
|
|
|
## fields_list
|
|
|
|
A comma and space separated list of field names
|
|
|
|
`fields_list`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Lookup Manifest](lookups-properties-fields_list.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/fields_list")
|
|
|
|
### fields_list Type
|
|
|
|
`string`
|
|
|
|
### fields_list Examples
|
|
|
|
```yaml
|
|
_key, dest, process_name
|
|
|
|
```
|
|
|
|
## filename
|
|
|
|
The name of the file to use for this lookup
|
|
|
|
`filename`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Lookup Manifest](lookups-properties-filename.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/filename")
|
|
|
|
### filename Type
|
|
|
|
`string`
|
|
|
|
### filename Examples
|
|
|
|
```yaml
|
|
prohibited_apps_launching_cmd.csv
|
|
|
|
```
|
|
|
|
## filter
|
|
|
|
Use this attribute to improve search performance when working with significantly large KV
|
|
|
|
`filter`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Lookup Manifest](lookups-properties-filter.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/filter")
|
|
|
|
### filter Type
|
|
|
|
`string`
|
|
|
|
### filter Examples
|
|
|
|
```yaml
|
|
dest="SPLK_*"
|
|
|
|
```
|
|
|
|
## match_type
|
|
|
|
A comma and space-delimited list of \<match_type>(\<field_name>) specification to allow for non-exact matching
|
|
|
|
`match_type`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Lookup Manifest](lookups-properties-match_type.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/match_type")
|
|
|
|
### match_type Type
|
|
|
|
`string`
|
|
|
|
### match_type Examples
|
|
|
|
```yaml
|
|
WILDCARD(process)
|
|
|
|
```
|
|
|
|
## max_matches
|
|
|
|
The maximum number of possible matches for each input lookup value
|
|
|
|
`max_matches`
|
|
|
|
* is optional
|
|
|
|
* Type: `integer`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Lookup Manifest](lookups-properties-max_matches.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/max_matches")
|
|
|
|
### max_matches Type
|
|
|
|
`integer`
|
|
|
|
### max_matches Examples
|
|
|
|
```yaml
|
|
'100'
|
|
|
|
```
|
|
|
|
## min_matches
|
|
|
|
Minimum number of possible matches for each input lookup value
|
|
|
|
`min_matches`
|
|
|
|
* is optional
|
|
|
|
* Type: `integer`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Lookup Manifest](lookups-properties-min_matches.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/min_matches")
|
|
|
|
### min_matches Type
|
|
|
|
`integer`
|
|
|
|
### min_matches Examples
|
|
|
|
```yaml
|
|
'1'
|
|
|
|
```
|
|
|
|
## name
|
|
|
|
The name of the lookup to be used in searches
|
|
|
|
`name`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Lookup Manifest](lookups-properties-name.md "https://api.splunkresearch.com/schemas/lookups.json#/properties/name")
|
|
|
|
### name Type
|
|
|
|
`string`
|
|
|
|
### name Examples
|
|
|
|
```yaml
|
|
isWindowsSystemFile_lookup
|
|
|
|
```
|