splunk-security_content/spec/playbooks.spec.json

{
    "$id": "http://example.com/example.json",
    "$schema": "http://json-schema.org/draft-07/schema",
    "additionalProperties": true,
    "description": "schema for playbooks",
    "properties": {
        "author": {
            "$id": "#/properties/author",
            "default": "",
            "description": "Author of the playbook",
            "examples": [
                "Lou Stella, Splunk"
            ],
            "type": "string"
        },
        "date":{
            "$id": "#/properties/date",
            "default": "",
            "description": "date of creation or modification, format yyyy-mm-dd",
            "examples": [
                "2021-09-28"
            ],
            "type": "string"
        },
        "description": {
            "$id": "#/properties/description",
            "default": "",
            "description": "A detailed description of the playbook",
            "examples": [
                "This playbook investigates and contains ransomware detected on endpoints."
            ],
            "type": "string"
        },
        "how_to_implement": {
            "$id": "#/properties/how_to_implement",
            "default": "",
            "description": "information about how to implement the playbook in Splunk SOAR",
            "examples": [
                "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response."
            ],
            "type": "string"
        },
        "references": {
            "$id": "#/properties/references",
            "additionalItems": true,
            "default": [],
            "description": "A list of references for this playbook",
            "examples": [
                [
                    "https://www.splunk.com/en_us/blog/security/splunk-soar-playbooks-gcp-unusual-service-account-usage.html"
                ]
            ],
            "items": {
                "$id": "#/properties/references/items",
                "default": "", 
                "description": "An explanation about the purpose of this instance.",
                "examples": [
                    "https://www.splunk.com/en_us/blog/security/splunk-soar-playbooks-gcp-unusual-service-account-usage.html"
                ],
                "title": "The Items Schema",
                "type": "string" 
            },
            "type": "array"
        },
        "id": {
            "$id": "#/properties/id",
            "default": "", 
            "description": "UUID as unique identifier",
            "examples":[
                "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
            ],
            "type": "string"
        },
        "playbook":{
            "$id": "#/properties/playbook",
            "default": "", 
            "description": "name of playbook file within same directory without suffix",
            "examples":[
                "ransomware_investigate_and_contain"
            ],
            "type": "string" 
        },
        "name": {
            "$id": "#/properties/name",
            "default": "",
            "examples": [
            "Ransomware Investigate and Contain"
            ],
            "title": "name of playbook",
            "type": "string"        
        },
        "app_list":{
            "$id": "#/properties/app_list",
            "default": "", 
            "examples": [
                "LDAP"
            ],
            "type": "array"
        },
        "tags": {
            "$id": "#/properties/tags",
            "additionalProperties": true,
            "default": {},
            "description": "An array of key value pairs for tagging",
            "examples":[
                {
                    "analytic_story": "Ransomware",
                    "detections": "Conti Common Exec parameter",
                    "platform_tags": "Investigate",
                    "playbook_fields": "Username",
                    "product": "Splunk SOAR",
                    "defend_technique_id": "D3-DA"
                }
            ],
            "minItems": 1,
            "type": "object",
            "uniqueItems": true
        },
        "type":{
            "$id": "#/properties/type",
            "default": "", 
            "description": "type of playbook",
            "examples": [
                "Investigation"
            ],
            "items": {
                "enum": [
                    "Investigation",
                    "Response"
                ],
                "type": "string"
            },
            "type": "string"
        },
        "version": {
            "$id": "#/properties/version",
            "default": 0,
            "description": "version of playbook, e.g. 1 or 2...",
            "examples": [
                2
            ],
            "type": "integer"
        }
    },
    "required": [
        "name", 
        "id", 
        "version", 
        "date", 
        "description",
        "type", 
        "author",
        "playbook",
        "tags" 
    ],
    "title": "Playbook schema",
    "type": "object"
}