splunk-security_content/docs/spec/lookups.spec.md

Lookup Manifest Schema

https://api.splunkresearch.com/schemas/lookups.json

A object that defines a lookup file and its properties.

Abstract	Extensible	Status	Identifiable	Custom Properties	Additional Properties	Defined In
Can be instantiated	No	Experimental	No	Forbidden	Permitted

Lookup Manifest Properties

Property	Type	Required	Nullable	Defined by
case_sensitive_match	enum	Optional	No	Lookup Manifest (this schema)
collection	string	Optional	No	Lookup Manifest (this schema)
default_match	string	Optional	No	Lookup Manifest (this schema)
description	string	Optional	No	Lookup Manifest (this schema)
filename	string	Optional	No	Lookup Manifest (this schema)
match_type	string	Optional	No	Lookup Manifest (this schema)
max_matches	integer	Optional	No	Lookup Manifest (this schema)
min_matches	integer	Optional	No	Lookup Manifest (this schema)
name	string	Optional	No	Lookup Manifest (this schema)
*	any	Additional	Yes	this schema allows additional properties

case_sensitive_match

What the macro is intended to filter

case_sensitive_match

• is optional
• type: enum
• defined in this schema

The value of this property must be equal to one of the known values below.

case_sensitive_match Known Values

Value	Description
true
false

case_sensitive_match Example

"true"

collection

Name of the collection to use for this lookup

collection

• is optional
• type: string
• defined in this schema

collection Type

string

collection Example

"prohibited_apps_launching_cmd"

default_match

The default value if no match is found

default_match

• is optional
• type: string
• defined in this schema

default_match Type

string

default_match Example

"true"

description

The description of this lookup

description

• is optional
• type: string
• defined in this schema

description Type

string

description Example

"This lookup contains file names that exist in the Windows\\System32 directory"

filename

The name of the file to use for this lookup

filename

• is optional
• type: string
• defined in this schema

filename Type

string

filename Example

"prohibited_apps_launching_cmd.csv"

match_type

A comma and space-delimited list of <match_type>(<field_name>) specification to allow for non-exact matching

match_type

• is optional
• type: string
• defined in this schema

match_type Type

string

match_type Example

"WILDCARD(process)"

max_matches

The maximum number of possible matches for each input lookup value

max_matches

• is optional
• type: integer
• defined in this schema

max_matches Type

integer

max_matches Example

"100"

min_matches

Minimum number of possible matches for each input lookup value

min_matches

• is optional
• type: integer
• defined in this schema

min_matches Type

integer

min_matches Example

"1"

name

The name of the lookup to be used in searches

name

• is optional
• type: string
• defined in this schema

name Type

string

name Example

"isWindowsSystemFile_lookup"

One of the following conditions need to be fulfilled.

Condition 1

Condition 2