mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
52 lines
1.1 KiB
Django/Jinja
52 lines
1.1 KiB
Django/Jinja
name: {{name}}
|
|
id: {{uuid}}
|
|
version: 1
|
|
date: '{{date}}'
|
|
author: {{author}}
|
|
type: {{type}}
|
|
datamodel:
|
|
{% for datamodel in datamodels -%}
|
|
- {{datamodel}}
|
|
{% endfor -%}
|
|
description: {{description}}
|
|
search: '{{search}}'
|
|
how_to_implement: {{how_to_implement}}
|
|
known_false_positives: {{known_false_positives}}
|
|
references:
|
|
{% for reference in references -%}
|
|
- {{reference}}
|
|
{% endfor -%}
|
|
tags:
|
|
analytic_story:
|
|
- {{analytic_story_name}}
|
|
dataset:
|
|
- {{dataset_url}}
|
|
kill_chain_phases:
|
|
{% for kill_chain_phase in kill_chain_phases -%}
|
|
- {{kill_chain_phase}}
|
|
{% endfor -%}
|
|
mitre_attack_id:
|
|
{% for id in mitre_attack_id -%}
|
|
- {{id}}
|
|
{% endfor -%}
|
|
product:
|
|
{% for product in products -%}
|
|
- {{product}}
|
|
{% endfor -%}
|
|
required_fields:
|
|
- _time
|
|
security_domain: {{security_domain}}
|
|
impact: {{impact}}
|
|
confidence: {{ confidence }}
|
|
# (impact * confidence)/100
|
|
risk_score: {{risk_score}}
|
|
context:
|
|
{% for context in contexts -%}
|
|
- {{contexts}}
|
|
{% endfor -%}
|
|
message: {{risk_message}}
|
|
observable:
|
|
{% for observable in observables -%}
|
|
- {{observable}}
|
|
{% endfor -%}
|