splunk-security_content/spec/response_tasks.spec.json

{
  "$id": "https://raw.githubusercontent.com/splunk/security-content/develop/docs/spec/response_tasks.spec.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "default": {},
  "description": "schema for response task",
  "properties": {
    "author": {
      "$id": "#/properties/author",
      "default": "",
      "description": "Author of the response task",
      "examples": [
        "ButterCup, Splunk"
      ],
      "type": "string"
    },
    "date": {
      "$id": "#/properties/date",
      "default": "",
      "description": "date of creation or modification, format yyyy-mm-dd",
      "examples": [
        "2019-12-06"
      ],
      "type": "string"
    },
    "description": {
      "$id": "#/properties/description",
      "default": "",
      "description": "Description of response task",
      "examples": [
        "Response example."
      ],
      "type": "string"
    },
    "id": {
      "$id": "#/properties/id",
      "default": "",
      "description": "UUID as unique identifier",
      "examples": [
        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
      ],
      "type": "string"
    },
    "name": {
      "$id": "#/properties/name",
      "default": "",
      "description": "Name of response task",
      "examples": [
        "Response Example"
      ],
      "type": "string"
    },
    "sla": {
      "$id": "#/properties/sla",
      "default": 0,
      "description": "Measured integer for Service Level Agreement for completion of the phase",
      "examples": [
        5,
        30
      ],
      "type": "integer"
    },
    "sla_type": {
      "$id": "#/properties/sla_type",
      "default": "minutes",
      "description": "Duration for measured integer for Service Level Agreement for completion of the phase (e.g. minutes, or hours, etc)",
      "examples": [
        "minutes",
        "hours",
        "days"
      ],
      "type": "string"
    },
    "automation": {
      "$id": "#/properties/automation",
      "additionalProperties": true,
      "default": {
        "is_note_required": false,
        "sla_type": "minutes",
        "sla": "",
        "role": "",
        "action": [],
        "playbooks": []
      },
      "description": "An array of key value pairs for defining actions and playbooks",
      "examples": [
        {
          "is_note_required": false,
          "sla_type": "minutes",
          "sla": 30,
          "action": [
            "run_query"
          ],
          "playbooks": [
            {
              "scm": "local",
              "playbook": "automate something"
            },
            {
              "scm": "local",
              "playbook": "automate something else"
            }
          ]
        }
      ],
      "minItems": 1,
      "uniqueItems": true,
      "type": "object"
    },
    "tags": {
      "$id": "#/properties/tags",
      "additionalProperties": true,
      "default": {},
      "description": "An array of key value pairs for tagging",
      "examples": [
        {
          "analytics_story": "credential_dumping"
        }
      ],
      "minItems": 1,
      "type": "object",
      "uniqueItems": true
    },
    "version": {
      "$id": "#/properties/version",
      "default": 0,
      "description": "version of detection, e.g. 1 or 2 ...",
      "examples": [
        1
      ],
      "type": "integer"
    },
    "references": {
      "$id": "#/properties/references",
      "additionalItems": true,
      "default": [],
      "description": "A list of references for this response, phase or task (e.g. web or printed citation)",
      "examples": [
        [
          "Blue Team Handbook by Don Murdoch - Alarm Triage Overview pages 146-148",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf"
        ]
      ],
      "items": {
        "$id": "#/properties/references/items",
        "default": "",
        "description": "An explanation about the purpose of this instance.",
        "examples": [
          "https://www.amazon.com/Blue-Team-Handbook-condensed-Responder/dp/1500734756"
        ],
        "title": "Blue Team Handbook by Don Murdoch - Amazon",
        "type": "string"
      },
      "type": "array"
    }
  },
  "required": [
    "name",
    "id",
    "version",
    "date",
    "description",
    "author",
    "tags"
  ],
  "title": "Response Schema",
  "type": "object"
}