mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
657 lines
7.1 KiB
Markdown
657 lines
7.1 KiB
Markdown
|
|
# Deployment Schema Schema
|
|
|
|
```
|
|
http://example.com/example.json
|
|
```
|
|
|
|
schema for deployment
|
|
|
|
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Defined In |
|
|
|----------|------------|--------|--------------|-------------------|-----------------------|------------|
|
|
| Can be instantiated | No | Experimental | No | Forbidden | Permitted | |
|
|
|
|
# Deployment Schema Properties
|
|
|
|
| Property | Type | Required | Nullable | Default | Defined by |
|
|
|----------|------|----------|----------|---------|------------|
|
|
| [alert_action](#alert_action) | `object` | **Required** | No | `{}` | Deployment Schema (this schema) |
|
|
| [date](#date) | `string` | **Required** | No | `""` | Deployment Schema (this schema) |
|
|
| [description](#description) | `string` | **Required** | No | `""` | Deployment Schema (this schema) |
|
|
| [id](#id) | `string` | **Required** | No | `""` | Deployment Schema (this schema) |
|
|
| [name](#name) | `string` | **Required** | No | `""` | Deployment Schema (this schema) |
|
|
| [scheduling](#scheduling) | `object` | **Required** | No | `{}` | Deployment Schema (this schema) |
|
|
| [tags](#tags) | `object` | **Required** | No | `{}` | Deployment Schema (this schema) |
|
|
| `*` | any | Additional | Yes | this schema *allows* additional properties |
|
|
|
|
## alert_action
|
|
|
|
Set alert action parameter for search
|
|
|
|
`alert_action`
|
|
|
|
* is **required**
|
|
* type: `object`
|
|
* default: `{}`
|
|
* defined in this schema
|
|
|
|
### alert_action Type
|
|
|
|
|
|
`object` with following properties:
|
|
|
|
|
|
| Property | Type | Required | Default |
|
|
|----------|------|----------|---------|
|
|
| `email`| object | Optional | `{}` |
|
|
| `index`| object | Optional | `{}` |
|
|
| `notable`| object | Optional | `{}` |
|
|
|
|
|
|
|
|
#### email
|
|
|
|
By enabling it, an email is sent with the results
|
|
|
|
`email`
|
|
|
|
* is optional
|
|
* type: `object`
|
|
* default: `{}`
|
|
|
|
|
|
##### email Type
|
|
|
|
|
|
`object` with following properties:
|
|
|
|
|
|
| Property | Type | Required | Default |
|
|
|----------|------|----------|---------|
|
|
| `message`| string | **Required** | `""` |
|
|
| `subject`| string | **Required** | `""` |
|
|
| `to`| string | **Required** | `""` |
|
|
|
|
|
|
|
|
#### message
|
|
|
|
message of email
|
|
|
|
`message`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### message Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### message Example
|
|
|
|
```json
|
|
Splunk Alert $name$ triggered %fields%
|
|
```
|
|
|
|
|
|
|
|
|
|
#### subject
|
|
|
|
Subject of email
|
|
|
|
`subject`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### subject Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### subject Example
|
|
|
|
```json
|
|
Splunk Alert $name$
|
|
```
|
|
|
|
|
|
|
|
|
|
#### to
|
|
|
|
Recipient of email
|
|
|
|
`to`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### to Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### to Example
|
|
|
|
```json
|
|
test@test.com
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
##### email Example
|
|
|
|
```json
|
|
[object Object]
|
|
```
|
|
|
|
|
|
|
|
|
|
#### index
|
|
|
|
By enabling it, the results are stored in another index
|
|
|
|
`index`
|
|
|
|
* is optional
|
|
* type: `object`
|
|
* default: `{}`
|
|
|
|
|
|
##### index Type
|
|
|
|
|
|
`object` with following properties:
|
|
|
|
|
|
| Property | Type | Required | Default |
|
|
|----------|------|----------|---------|
|
|
| `name`| string | **Required** | `""` |
|
|
|
|
|
|
|
|
#### name
|
|
|
|
Name of the index
|
|
|
|
`name`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### name Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### name Example
|
|
|
|
```json
|
|
asx
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
##### index Example
|
|
|
|
```json
|
|
[object Object]
|
|
```
|
|
|
|
|
|
|
|
|
|
#### notable
|
|
|
|
By enabling it, a notable is generated
|
|
|
|
`notable`
|
|
|
|
* is optional
|
|
* type: `object`
|
|
* default: `{}`
|
|
|
|
|
|
##### notable Type
|
|
|
|
|
|
`object` with following properties:
|
|
|
|
|
|
| Property | Type | Required | Default |
|
|
|----------|------|----------|---------|
|
|
| `rule_description`| string | **Required** | `""` |
|
|
| `rule_title`| string | **Required** | `""` |
|
|
|
|
|
|
|
|
#### rule_description
|
|
|
|
Rule description of the notable event
|
|
|
|
`rule_description`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### rule_description Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### rule_description Example
|
|
|
|
```json
|
|
%description%
|
|
```
|
|
|
|
|
|
|
|
|
|
#### rule_title
|
|
|
|
Rule title of the notable event
|
|
|
|
`rule_title`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### rule_title Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### rule_title Example
|
|
|
|
```json
|
|
%name%
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
##### notable Example
|
|
|
|
```json
|
|
[object Object]
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
### alert_action Example
|
|
|
|
```json
|
|
{
|
|
"email": {
|
|
"message": "Splunk Alert $name$ triggered %fields%",
|
|
"subject": "Splunk Alert $name$",
|
|
"to": "test@test.com"
|
|
},
|
|
"index": {
|
|
"name": "asx"
|
|
},
|
|
"notable": {
|
|
"rule_description": "%description%",
|
|
"rule_title": "%name%"
|
|
}
|
|
}
|
|
```
|
|
|
|
|
|
## date
|
|
|
|
date of creation or modification, format yyyy-mm-dd
|
|
|
|
`date`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### date Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### date Example
|
|
|
|
```json
|
|
"2019-12-06"
|
|
```
|
|
|
|
|
|
## description
|
|
|
|
description of the deployment configuration
|
|
|
|
`description`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### description Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### description Example
|
|
|
|
```json
|
|
"This deployment configuration provides a standard scheduling policy over all rules."
|
|
```
|
|
|
|
|
|
## id
|
|
|
|
uuid as unique identifier
|
|
|
|
`id`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### id Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### id Example
|
|
|
|
```json
|
|
"fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
|
|
```
|
|
|
|
|
|
## name
|
|
|
|
Name of deployment configuration
|
|
|
|
`name`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### name Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### name Example
|
|
|
|
```json
|
|
"Deployment Configuration all Detections"
|
|
```
|
|
|
|
|
|
## scheduling
|
|
|
|
allows to set scheduling parameter
|
|
|
|
`scheduling`
|
|
|
|
* is **required**
|
|
* type: `object`
|
|
* default: `{}`
|
|
* defined in this schema
|
|
|
|
### scheduling Type
|
|
|
|
|
|
`object` with following properties:
|
|
|
|
|
|
| Property | Type | Required | Default |
|
|
|----------|------|----------|---------|
|
|
| `cron_schedule`| string | **Required** | `""` |
|
|
| `earliest_time`| string | **Required** | `""` |
|
|
| `latest_time`| string | **Required** | `""` |
|
|
| `schedule_window`| string | Optional | `""` |
|
|
|
|
|
|
|
|
#### cron_schedule
|
|
|
|
Cron schedule to schedule the Splunk searches.
|
|
|
|
`cron_schedule`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### cron_schedule Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### cron_schedule Example
|
|
|
|
```json
|
|
*/10 * * * *
|
|
```
|
|
|
|
|
|
|
|
|
|
#### earliest_time
|
|
|
|
earliest time of search
|
|
|
|
`earliest_time`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### earliest_time Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### earliest_time Example
|
|
|
|
```json
|
|
-10m
|
|
```
|
|
|
|
|
|
|
|
|
|
#### latest_time
|
|
|
|
latest time of search
|
|
|
|
`latest_time`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### latest_time Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### latest_time Example
|
|
|
|
```json
|
|
now
|
|
```
|
|
|
|
|
|
|
|
|
|
#### schedule_window
|
|
|
|
schedule window for search
|
|
|
|
`schedule_window`
|
|
|
|
* is optional
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### schedule_window Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### schedule_window Example
|
|
|
|
```json
|
|
auto
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
### scheduling Example
|
|
|
|
```json
|
|
{
|
|
"cron_schedule": "*/10 * * * *",
|
|
"earliest_time": "-10m",
|
|
"latest_time": "now",
|
|
"schedule_window": "auto"
|
|
}
|
|
```
|
|
|
|
|
|
## tags
|
|
|
|
An array of key value pairs for tagging
|
|
|
|
`tags`
|
|
|
|
* is **required**
|
|
* type: `object`
|
|
* default: `{}`
|
|
* defined in this schema
|
|
|
|
### tags Type
|
|
|
|
|
|
`object` with following properties:
|
|
|
|
|
|
| Property | Type | Required |
|
|
|----------|------|----------|
|
|
|
|
|
|
|
|
|
|
### tags Example
|
|
|
|
```json
|
|
{
|
|
"analytics_story": "credential_dumping"
|
|
}
|
|
```
|
|
|