mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick
670 lines
22 KiB
JSON
670 lines
22 KiB
JSON
{
|
|
"$id": "http://example.com/example.json",
|
|
"$schema": "http://json-schema.org/draft-07/schema",
|
|
"additionalProperties": true,
|
|
"description": "schema for ba detections",
|
|
"properties": {
|
|
"name": {
|
|
"$id": "#/properties/name",
|
|
"default": "",
|
|
"examples": [
|
|
"Anomalous usage of Archive Tools"
|
|
],
|
|
"title": "Name of detection",
|
|
"type": "string"
|
|
},
|
|
"id": {
|
|
"$id": "#/properties/id",
|
|
"default": "",
|
|
"description": "UUID as unique identifier",
|
|
"examples": [
|
|
"fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"version": {
|
|
"$id": "#/properties/version",
|
|
"default": 0,
|
|
"description": "version of detection, e.g. 1 or 2 ...",
|
|
"examples": [
|
|
1
|
|
],
|
|
"type": "integer"
|
|
},
|
|
"status": {
|
|
"$id": "#/properties/status",
|
|
"default": "production",
|
|
"description": "status of detection: production or validation",
|
|
"examples": [
|
|
1
|
|
],
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"$id": "#/properties/description",
|
|
"default": "",
|
|
"description": "A detailed description of the detection",
|
|
"examples": [
|
|
"The following detection identifies the usage of archive tools from the command line."
|
|
],
|
|
"type": "string"
|
|
},
|
|
"search": {
|
|
"$id": "#/properties/search",
|
|
"default": "",
|
|
"description": "The Splunk search for the detection",
|
|
"examples": [
|
|
"| from read_ba_enriched_events()"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"how_to_implement": {
|
|
"$id": "#/properties/how_to_implement",
|
|
"default": "",
|
|
"description": "information about how to implement.",
|
|
"examples": [
|
|
"Ingest Windows Event Code 4688 with Command Line Logging enabled."
|
|
],
|
|
"type": "string"
|
|
},
|
|
"known_false_positives": {
|
|
"$id": "#/properties/knwon_false_positives",
|
|
"default": "",
|
|
"description": "known false postives",
|
|
"examples": [
|
|
"False positives can be ligitmate usage of archive tools from the command line."
|
|
],
|
|
"type": "string"
|
|
},
|
|
"references": {
|
|
"$id": "#/properties/references",
|
|
"additionalItems": true,
|
|
"default": [],
|
|
"description": "A list of references for this detection",
|
|
"examples": [
|
|
[
|
|
"https://attack.mitre.org/techniques/T1560/001/"
|
|
]
|
|
],
|
|
"items": {
|
|
"$id": "#/properties/references/items",
|
|
"default": "",
|
|
"description": "Link to reference",
|
|
"examples": [
|
|
"https://attack.mitre.org/techniques/T1560/001/"
|
|
],
|
|
"title": "The Items Schema",
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"runtime": {
|
|
"$id": "#/properties/runtime",
|
|
"default": "",
|
|
"description": "runtime for BA detection",
|
|
"examples": [
|
|
"SPL2"
|
|
],
|
|
"items": {
|
|
"enum": [
|
|
"DSP-SPL",
|
|
"SPL2",
|
|
"Spark"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"type": "string"
|
|
},
|
|
"detection_type": {
|
|
"$id": "#/properties/detection_type",
|
|
"default": "",
|
|
"description": "type of detection",
|
|
"examples": [
|
|
"Rule"
|
|
],
|
|
"items": {
|
|
"enum": [
|
|
"Rule",
|
|
"ML"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"type": "string"
|
|
},
|
|
"job_params": {
|
|
"$id": "#/properties/job_params",
|
|
"additionalProperties": true,
|
|
"default": "",
|
|
"description": "job parameters",
|
|
"examples": [
|
|
{
|
|
"entrypointClassName": "com.splunk.ssa.batch.poc.BatchEntryPoint",
|
|
"modelsJarFileName": "batch-models.jar"
|
|
}
|
|
],
|
|
"type": "object"
|
|
},
|
|
"model_params": {
|
|
"$id": "#/properties/model_params",
|
|
"additionalProperties": true,
|
|
"default": "",
|
|
"description": "model parameters",
|
|
"examples": [
|
|
{
|
|
"modelClassName": "com.splunk.ssa.batch.poc.models.DeviceAccessRareModel",
|
|
"lookBackPeriodInDays": 30
|
|
}
|
|
],
|
|
"type": "object"
|
|
},
|
|
"tags": {
|
|
"$id": "#/properties/tags",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "An array of key value pairs for tagging",
|
|
"examples": [
|
|
{
|
|
"annotations": {"analytic_story": ["NOBELIUM Group"], "cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack_id": ["T1560.001", "T1560"], "nist": ["DE.AE"]},
|
|
"ocsf_attributes": {"activity_id": 1, "category_uid": 2, "class_uid": 102001, "risk_level_id": 2, "risk_score": 42, "severity_id": 0, "rule": {"name": "Anomalous usage of Archive Tools", "uid": "63614a58-10e2-4c6c-ae81-ea1113681439", "type": "Streaming"}, "metadata": {"product": {"name": "Behavior Analytics", "vendor_name": "Splunk"}, "version": "1.0.0-rc.2"}, "type_uid": 10200101},
|
|
"required_fields": ["process.user.name", "device.hostname"],
|
|
"risk_score": 42,
|
|
"security_domain": "endpoint",
|
|
"risk_severity": "low",
|
|
"research_site_url": "https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/",
|
|
"event_schema": "ocsf",
|
|
"mappings": [{"ocsf": "process.user.name", "cim": "user"},{"ocsf": "device.hostname", "cim": "dest"}]
|
|
}
|
|
],
|
|
"type": "object",
|
|
"uniqueItems": true,
|
|
"required": [
|
|
"annotations",
|
|
"risk_score",
|
|
"security_domain",
|
|
"risk_severity",
|
|
"research_site_url",
|
|
"event_schema",
|
|
"mappings"
|
|
],
|
|
"properties": {
|
|
"annotations": {
|
|
"$id": "#/properties/tags/annotations",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "An array of key value pairs for annotations",
|
|
"examples": [
|
|
{
|
|
"analytic_story": ["NOBELIUM Group"],
|
|
"cis20": ["CIS 10"],
|
|
"kill_chain_phases": ["Exploitation"],
|
|
"mitre_attack_id": ["T1560.001"],
|
|
"nist": ["DE.AE"]
|
|
}
|
|
],
|
|
"type": "object",
|
|
"uniqueItems": true,
|
|
"required": [
|
|
"analytic_story",
|
|
"cis20",
|
|
"kill_chain_phases",
|
|
"mitre_attack_id",
|
|
"nist"
|
|
],
|
|
"properties": {
|
|
"analytic_story": {
|
|
"$id": "#/properties/tags/annotations/analytic_story",
|
|
"additionalItems": true,
|
|
"default": [],
|
|
"description": "A list of analytic stories for this detection",
|
|
"examples": [
|
|
[
|
|
"NOBELIUM Group"
|
|
]
|
|
],
|
|
"items": {
|
|
"$id": "#/properties/tags/annotations/analytic_story/items",
|
|
"default": "",
|
|
"description": "analytic story name",
|
|
"examples": [
|
|
"NOBELIUM Group"
|
|
],
|
|
"title": "The Items Schema",
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"cis20": {
|
|
"$id": "#/properties/tags/annotations/cis20",
|
|
"additionalItems": true,
|
|
"default": [],
|
|
"description": "cis tags",
|
|
"examples": [
|
|
["CIS 10"]
|
|
],
|
|
"items": {
|
|
"$id": "#/properties/tags/annotations/cis20/items",
|
|
"default": "",
|
|
"description": "cis tag",
|
|
"examples": [
|
|
"CIS 10"
|
|
],
|
|
"title": "The Items Schema",
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"kill_chain_phases": {
|
|
"$id": "#/properties/tags/annotations/kill_chain_phases",
|
|
"additionalItems": true,
|
|
"default": [],
|
|
"description": "kill_chain_phases",
|
|
"examples": [
|
|
["Exploitation"]
|
|
],
|
|
"items": {
|
|
"$id": "#/properties/tags/annotations/kill_chain_phases/items",
|
|
"default": "",
|
|
"description": "kill_chain_phase",
|
|
"examples": [
|
|
"Exploitation"
|
|
],
|
|
"title": "The Items Schema",
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"mitre_attack_id": {
|
|
"$id": "#/properties/tags/annotations/mitre_attack_id",
|
|
"additionalItems": true,
|
|
"default": [],
|
|
"description": "mitre_attack_id",
|
|
"examples": [
|
|
["T1560.001", "T1560"]
|
|
],
|
|
"items": {
|
|
"$id": "#/properties/tags/annotations/mitre_attack_id/items",
|
|
"default": "",
|
|
"description": "kill_chain_phase",
|
|
"examples": [
|
|
"T1560.001"
|
|
],
|
|
"title": "The Items Schema",
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"nist": {
|
|
"$id": "#/properties/tags/annotations/nist",
|
|
"additionalItems": true,
|
|
"default": [],
|
|
"description": "nist array",
|
|
"examples": [
|
|
["DE.AE"]
|
|
],
|
|
"items": {
|
|
"$id": "#/properties/tags/annotations/nist/items",
|
|
"default": "",
|
|
"description": "nist",
|
|
"examples": [
|
|
"DE.AE"
|
|
],
|
|
"title": "The Items Schema",
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
}
|
|
}
|
|
},
|
|
"ocsf_attributes": {
|
|
"$id": "#/properties/tags/ocsf_attributes",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "An array of key value pairs for static ocsf attributes",
|
|
"examples": [
|
|
{
|
|
"activity_id": 1,
|
|
"category_uid": 2,
|
|
"class_uid": 102001,
|
|
"risk_level_id": 2,
|
|
"risk_score": 42,
|
|
"severity_id": 0,
|
|
"rule": {
|
|
"name": "Anomalous usage of Archive Tools",
|
|
"uid": "63614a58-10e2-4c6c-ae81-ea1113681439",
|
|
"type": "Streaming"
|
|
},
|
|
"metadata": {
|
|
"product": {
|
|
"name": "Behavior Analytics",
|
|
"vendor_name": "Splunk"
|
|
},
|
|
"version": "1.0.0-rc.2"
|
|
},
|
|
"type_uid": 10200101
|
|
}
|
|
],
|
|
"type": "object",
|
|
"uniqueItems": true,
|
|
"required": [
|
|
"activity_id",
|
|
"category_uid",
|
|
"class_uid",
|
|
"risk_level_id",
|
|
"risk_score",
|
|
"severity_id",
|
|
"rule",
|
|
"metadata",
|
|
"type_uid"
|
|
],
|
|
"properties": {
|
|
"activity_id": {
|
|
"$id": "#/properties/tags/ocsf_attributes/activity_id",
|
|
"default": 1,
|
|
"description": "activity_id",
|
|
"examples": [
|
|
1
|
|
],
|
|
"type": "integer"
|
|
},
|
|
"category_uid": {
|
|
"$id": "#/properties/tags/ocsf_attributes/category_uid",
|
|
"default": 2,
|
|
"description": "category_uid",
|
|
"examples": [
|
|
2
|
|
],
|
|
"type": "integer"
|
|
},
|
|
"class_uid": {
|
|
"$id": "#/properties/tags/ocsf_attributes/class_uid",
|
|
"default": 102001,
|
|
"description": "class_uid",
|
|
"examples": [
|
|
102001
|
|
],
|
|
"type": "integer"
|
|
},
|
|
"risk_level_id": {
|
|
"$id": "#/properties/tags/ocsf_attributes/risk_level_id",
|
|
"default": 2,
|
|
"description": "risk_level_id",
|
|
"examples": [
|
|
2
|
|
],
|
|
"type": "integer"
|
|
},
|
|
"risk_score": {
|
|
"$id": "#/properties/tags/ocsf_attributes/risk_score",
|
|
"default": 42,
|
|
"description": "risk_score",
|
|
"examples": [
|
|
42
|
|
],
|
|
"type": "integer"
|
|
},
|
|
"severity_id": {
|
|
"$id": "#/properties/tags/ocsf_attributes/severity_id",
|
|
"default": 0,
|
|
"description": "severity_id",
|
|
"examples": [
|
|
0
|
|
],
|
|
"type": "integer"
|
|
},
|
|
"rule": {
|
|
"$id": "#/properties/tags/ocsf_attributes/rule",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "rule object",
|
|
"examples": [
|
|
{
|
|
"name": "Anomalous usage of Archive Tools",
|
|
"uid": "63614a58-10e2-4c6c-ae81-ea1113681439",
|
|
"type": "Streaming"
|
|
}
|
|
],
|
|
"type": "object",
|
|
"uniqueItems": true,
|
|
"required": [
|
|
"name",
|
|
"uid"
|
|
],
|
|
"properties": {
|
|
"name": {
|
|
"$id": "#/properties/tags/ocsf_attributes/rule/name",
|
|
"default": "",
|
|
"description": "rule name",
|
|
"examples": [
|
|
"Anomalous usage of Archive Tools"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"uid": {
|
|
"$id": "#/properties/tags/ocsf_attributes/rule/uid",
|
|
"default": "",
|
|
"description": "rule uid",
|
|
"examples": [
|
|
"63614a58-10e2-4c6c-ae81-ea1113681439"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"$id": "#/properties/tags/ocsf_attributes/rule/type",
|
|
"default": "",
|
|
"description": "rule type",
|
|
"examples": [
|
|
"Streaming"
|
|
],
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"metadata": {
|
|
"$id": "#/properties/tags/ocsf_attributes/metadata",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "metadata object",
|
|
"examples": [
|
|
{
|
|
"product": {
|
|
"name": "Behavior Analytics",
|
|
"vendor_name": "Splunk"
|
|
},
|
|
"version": "1.0.0-rc.2"
|
|
}
|
|
],
|
|
"type": "object",
|
|
"uniqueItems": true,
|
|
"required": [
|
|
"product",
|
|
"version"
|
|
],
|
|
"properties": {
|
|
"product": {
|
|
"$id": "#/properties/tags/ocsf_attributes/metadata/product",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "product object",
|
|
"examples": [
|
|
{
|
|
"name": "Behavior Analytics",
|
|
"vendor_name": "Splunk"
|
|
}
|
|
],
|
|
"type": "object",
|
|
"uniqueItems": true,
|
|
"required": [
|
|
"name",
|
|
"vendor_name"
|
|
],
|
|
"properties": {
|
|
"name": {
|
|
"$id": "#/properties/tags/ocsf_attributes/metadata/product/name",
|
|
"default": "",
|
|
"description": "product name",
|
|
"examples": [
|
|
"Behavior Analytics"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"vendor_name": {
|
|
"$id": "#/properties/tags/ocsf_attributes/metadata/product/vendor_name",
|
|
"default": "",
|
|
"description": "vendor product name",
|
|
"examples": [
|
|
"Splunk"
|
|
],
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"version": {
|
|
"$id": "#/properties/tags/ocsf_attributes/metadata/version",
|
|
"default": "",
|
|
"description": "ocsf schema version",
|
|
"examples": [
|
|
"1.0.0-rc.2"
|
|
],
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"type_uid": {
|
|
"$id": "#/properties/tags/ocsf_attributes/type_uid",
|
|
"default": 10200101,
|
|
"description": "type_uid",
|
|
"examples": [
|
|
10200101
|
|
],
|
|
"type": "integer"
|
|
}
|
|
}
|
|
},
|
|
"required_fields": {
|
|
"$id": "#/properties/tags/required_fields",
|
|
"additionalItems": true,
|
|
"default": [],
|
|
"description": "required_fields",
|
|
"examples": [
|
|
["process.user.name", "device.hostname"]
|
|
],
|
|
"items": {
|
|
"$id": "#/properties/tags/required_fields/items",
|
|
"default": "",
|
|
"description": "required_fields name",
|
|
"examples": [
|
|
"process.user.name"
|
|
],
|
|
"title": "The Items Schema",
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"risk_score": {
|
|
"$id": "#/properties/tags/risk_score",
|
|
"default": 50,
|
|
"description": "risk_score",
|
|
"examples": [
|
|
42
|
|
],
|
|
"type": "integer"
|
|
},
|
|
"security_domain": {
|
|
"$id": "#/properties/tags/security_domain",
|
|
"default": "",
|
|
"description": "security_domain",
|
|
"examples": [
|
|
"endpoint"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"risk_severity": {
|
|
"$id": "#/properties/tags/risk_severity",
|
|
"default": "",
|
|
"description": "risk_severity",
|
|
"examples": [
|
|
"low"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"research_site_url": {
|
|
"$id": "#/properties/tags/research_site_url",
|
|
"default": "",
|
|
"description": "research_site_url",
|
|
"examples": [
|
|
"https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"event_schema": {
|
|
"$id": "#/properties/tags/event_schema",
|
|
"default": "",
|
|
"description": "event_schema",
|
|
"examples": [
|
|
"ocsf"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"mappings": {
|
|
"$id": "#/properties/tags/mappings",
|
|
"default": [],
|
|
"description": "mappings array",
|
|
"examples": [
|
|
[{"ocsf": "process.user.name", "cim": "user"},{"ocsf": "device.hostname", "cim": "dest"}]
|
|
],
|
|
"items": {
|
|
"$id": "#/properties/tags/mappings/items",
|
|
"default": {},
|
|
"description": "mappings object",
|
|
"examples": [
|
|
{
|
|
"ocsf": "process.user.name",
|
|
"cim": "user"
|
|
}
|
|
],
|
|
"type": "object",
|
|
"uniqueItems": true,
|
|
"properties": {
|
|
"ocsf": {
|
|
"$id": "#/properties/tags/mappings/items/ocsf",
|
|
"default": "",
|
|
"description": "ocsf mapping",
|
|
"examples": [
|
|
"process.user.name"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"cim": {
|
|
"$id": "#/properties/tags/mappings/items/cim",
|
|
"default": "",
|
|
"description": "cim mapping",
|
|
"examples": [
|
|
"user"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"ocsf",
|
|
"cim"
|
|
]
|
|
},
|
|
"type": "array"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"name",
|
|
"id",
|
|
"version",
|
|
"description",
|
|
"how_to_implement",
|
|
"known_false_positives",
|
|
"references",
|
|
"tags"
|
|
],
|
|
"title": "BA Detection Schema",
|
|
"type": "object"
|
|
}
|
|
|