mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
204 lines
4.2 KiB
JSON
204 lines
4.2 KiB
JSON
{
|
|
"title": "Detection",
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"title": "Name",
|
|
"type": "string"
|
|
},
|
|
"id": {
|
|
"title": "Id",
|
|
"type": "string"
|
|
},
|
|
"version": {
|
|
"title": "Version",
|
|
"type": "integer"
|
|
},
|
|
"date": {
|
|
"title": "Date",
|
|
"type": "string"
|
|
},
|
|
"author": {
|
|
"title": "Author",
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"title": "Type",
|
|
"type": "string"
|
|
},
|
|
"datamodel": {
|
|
"title": "Datamodel",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"description": {
|
|
"title": "Description",
|
|
"type": "string"
|
|
},
|
|
"search": {
|
|
"title": "Search",
|
|
"type": "string"
|
|
},
|
|
"how_to_implement": {
|
|
"title": "How To Implement",
|
|
"type": "string"
|
|
},
|
|
"known_false_positives": {
|
|
"title": "Known False Positives",
|
|
"type": "string"
|
|
},
|
|
"datamodel": {
|
|
"$id": "#/properties/datamodel",
|
|
"default": "",
|
|
"description": "datamodel used in the search",
|
|
"examples": [
|
|
"Endpoint"
|
|
],
|
|
"items": {
|
|
"enum": [
|
|
"Endpoint",
|
|
"Network_Traffic",
|
|
"Authentication",
|
|
"Change",
|
|
"Change_Analysis",
|
|
"Email",
|
|
"Endpoint",
|
|
"Network_Resolution",
|
|
"Network_Sessions",
|
|
"Network_Traffic",
|
|
"UEBA",
|
|
"Updates",
|
|
"Vulnerabilities",
|
|
"Web",
|
|
"Risk"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"tags": {
|
|
"$ref": "#/definitions/DetectionTags"
|
|
}
|
|
},
|
|
"required": [
|
|
"name",
|
|
"id",
|
|
"version",
|
|
"date",
|
|
"author",
|
|
"type",
|
|
"datamodel",
|
|
"description",
|
|
"search",
|
|
"how_to_implement",
|
|
"known_false_positives",
|
|
"references",
|
|
"tags"
|
|
],
|
|
"definitions": {
|
|
"DetectionTags": {
|
|
"title": "DetectionTags",
|
|
"type": "object",
|
|
"properties": {
|
|
"analytic_story": {
|
|
"title": "Analytic Story",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"asset_type": {
|
|
"title": "Asset Type",
|
|
"type": "string"
|
|
},
|
|
"cis20": {
|
|
"title": "Cis20",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"confidence": {
|
|
"title": "Confidence",
|
|
"type": "string"
|
|
},
|
|
"context": {
|
|
"title": "Context",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"dataset": {
|
|
"title": "Dataset",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"impact": {
|
|
"title": "Impact",
|
|
"type": "integer"
|
|
},
|
|
"kill_chain_phases": {
|
|
"title": "Kill Chain Phases",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"message": {
|
|
"title": "Message",
|
|
"type": "string"
|
|
},
|
|
"mitre_attack_id": {
|
|
"title": "Mitre Attack Id",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"nist": {
|
|
"title": "Nist",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"observable": {
|
|
"title": "Observable",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"product": {
|
|
"title": "Product",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"required_fields": {
|
|
"title": "Required Fields",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"risk_score": {
|
|
"title": "Risk Score",
|
|
"type": "integer"
|
|
},
|
|
"security_domain": {
|
|
"title": "Security Domain",
|
|
"type": "string"
|
|
},
|
|
"risk_severity": {
|
|
"title": "Risk Severity",
|
|
"type": "string"
|
|
},
|
|
"cve": {
|
|
"title": "Cve",
|
|
"type": "array",
|
|
"items": {}
|
|
}
|
|
},
|
|
"required": [
|
|
"name",
|
|
"analytic_story",
|
|
"asset_type",
|
|
"confidence",
|
|
"context",
|
|
"impact",
|
|
"kill_chain_phases",
|
|
"message",
|
|
"observable",
|
|
"product",
|
|
"required_fields",
|
|
"risk_score",
|
|
"security_domain"
|
|
]
|
|
}
|
|
}
|
|
} |