mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
265 lines
7.4 KiB
JSON
265 lines
7.4 KiB
JSON
{
|
|
"$id": "http://example.com/example.json",
|
|
"$schema": "http://json-schema.org/draft-07/schema",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "schema for deployment",
|
|
"properties": {
|
|
"alert_action": {
|
|
"$id": "#/properties/alert_action",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "Set alert action parameter for search",
|
|
"examples": [
|
|
{
|
|
"email": {
|
|
"message": "Splunk Alert $name$ triggered %fields%",
|
|
"subject": "Splunk Alert $name$",
|
|
"to": "test@test.com"
|
|
},
|
|
"index": {
|
|
"name": "asx"
|
|
},
|
|
"notable": {
|
|
"rule_description": "%description%",
|
|
"rule_title": "%name%"
|
|
}
|
|
}
|
|
],
|
|
"properties": {
|
|
"email": {
|
|
"$id": "#/properties/alert_action/properties/email",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "By enabling it, an email is sent with the results",
|
|
"examples": [
|
|
{
|
|
"message": "Splunk Alert $name$ triggered %fields%",
|
|
"subject": "Splunk Alert $name$",
|
|
"to": "test@test.com"
|
|
}
|
|
],
|
|
"properties": {
|
|
"message": {
|
|
"$id": "#/properties/alert_action/properties/email/properties/message",
|
|
"default": "",
|
|
"description": "message of email",
|
|
"examples": [
|
|
"Splunk Alert $name$ triggered %fields%"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"subject": {
|
|
"$id": "#/properties/alert_action/properties/email/properties/subject",
|
|
"default": "",
|
|
"description": "Subject of email",
|
|
"examples": [
|
|
"Splunk Alert $name$"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"to": {
|
|
"$id": "#/properties/alert_action/properties/email/properties/to",
|
|
"default": "",
|
|
"description": "Recipient of email",
|
|
"examples": [
|
|
"test@test.com"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"to",
|
|
"subject",
|
|
"message"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"index": {
|
|
"$id": "#/properties/alert_action/properties/index",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "By enabling it, the results are stored in another index",
|
|
"examples": [
|
|
{
|
|
"name": "asx"
|
|
}
|
|
],
|
|
"properties": {
|
|
"name": {
|
|
"$id": "#/properties/alert_action/properties/index/properties/name",
|
|
"default": "",
|
|
"description": "Name of the index",
|
|
"examples": [
|
|
"asx"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"name"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"notable": {
|
|
"$id": "#/properties/alert_action/properties/notable",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "By enabling it, a notable is generated",
|
|
"examples": [
|
|
{
|
|
"rule_description": "%description%",
|
|
"rule_title": "%name%"
|
|
}
|
|
],
|
|
"properties": {
|
|
"rule_description": {
|
|
"$id": "#/properties/alert_action/properties/notable/properties/rule_description",
|
|
"default": "",
|
|
"description": "Rule description of the notable event",
|
|
"examples": [
|
|
"%description%"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"rule_title": {
|
|
"$id": "#/properties/alert_action/properties/notable/properties/rule_title",
|
|
"default": "",
|
|
"description": "Rule title of the notable event",
|
|
"examples": [
|
|
"%name%"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"rule_title",
|
|
"rule_description"
|
|
],
|
|
"type": "object"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"date": {
|
|
"$id": "#/properties/date",
|
|
"default": "",
|
|
"description": "date of creation or modification, format yyyy-mm-dd",
|
|
"examples": [
|
|
"2019-12-06"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"$id": "#/properties/description",
|
|
"default": "",
|
|
"description": "description of the deployment configuration",
|
|
"examples": [
|
|
"This deployment configuration provides a standard scheduling policy over all rules."
|
|
],
|
|
"type": "string"
|
|
},
|
|
"id": {
|
|
"$id": "#/properties/id",
|
|
"default": "",
|
|
"description": "uuid as unique identifier",
|
|
"examples": [
|
|
"fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"$id": "#/properties/name",
|
|
"default": "",
|
|
"description": "Name of deployment configuration",
|
|
"examples": [
|
|
"Deployment Configuration all Detections"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"scheduling": {
|
|
"$id": "#/properties/scheduling",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "allows to set scheduling parameter",
|
|
"examples": [
|
|
{
|
|
"cron_schedule": "*/10 * * * *",
|
|
"earliest_time": "-10m",
|
|
"latest_time": "now",
|
|
"schedule_window": "auto"
|
|
}
|
|
],
|
|
"properties": {
|
|
"cron_schedule": {
|
|
"$id": "#/properties/scheduling/properties/cron_schedule",
|
|
"default": "",
|
|
"description": "Cron schedule to schedule the Splunk searches.",
|
|
"examples": [
|
|
"*/10 * * * *"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"earliest_time": {
|
|
"$id": "#/properties/scheduling/properties/earliest_time",
|
|
"default": "",
|
|
"description": "earliest time of search",
|
|
"examples": [
|
|
"-10m"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"latest_time": {
|
|
"$id": "#/properties/scheduling/properties/latest_time",
|
|
"default": "",
|
|
"description": "latest time of search",
|
|
"examples": [
|
|
"now"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"schedule_window": {
|
|
"$id": "#/properties/scheduling/properties/schedule_window",
|
|
"default": "",
|
|
"description": "schedule window for search",
|
|
"examples": [
|
|
"auto"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"cron_schedule",
|
|
"earliest_time",
|
|
"latest_time"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"tags": {
|
|
"$id": "#/properties/tags",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "An array of key value pairs for tagging",
|
|
"examples": [
|
|
{
|
|
"analytics_story": "credential_dumping"
|
|
}
|
|
],
|
|
"minItems": 1,
|
|
"type": "object",
|
|
"uniqueItems": true
|
|
}
|
|
},
|
|
"required": [
|
|
"name",
|
|
"id",
|
|
"date",
|
|
"description",
|
|
"scheduling",
|
|
"alert_action",
|
|
"tags"
|
|
],
|
|
"title": "Deployment Schema",
|
|
"type": "object"
|
|
}
|