mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
136 lines
3.6 KiB
JSON
136 lines
3.6 KiB
JSON
{
|
|
"$id": "http://example.com/example.json",
|
|
"$schema": "http://json-schema.org/draft-07/schema",
|
|
"additionalProperties": true,
|
|
"description": "schema for baselines",
|
|
"properties": {
|
|
"author": {
|
|
"$id": "#/properties/author",
|
|
"default": "",
|
|
"description": "Author of the baseline",
|
|
"examples": [
|
|
"Bahvin Patel, Splunk"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"date": {
|
|
"$id": "#/properties/date",
|
|
"default": "",
|
|
"description": "date of creation or modification, format yyyy-mm-dd",
|
|
"examples": [
|
|
"2019-12-06"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"$id": "#/properties/description",
|
|
"default": "",
|
|
"description": "A detailed description of the baseline ",
|
|
"examples": [
|
|
"This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"how_to_implement": {
|
|
"$id": "#/properties/how_to_implement",
|
|
"default": "",
|
|
"description": "information about how to implement. Only needed for non standard implementations.",
|
|
"examples": [
|
|
"This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
|
|
],
|
|
"type": "string"
|
|
},
|
|
"id": {
|
|
"$id": "#/properties/id",
|
|
"default": "",
|
|
"description": "UUID as unique identifier",
|
|
"examples": [
|
|
"fc0edc95-ff2b-48b0-9f6f-63da3789fd63"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"$id": "#/properties/name",
|
|
"default": "",
|
|
"examples": [
|
|
"Previously Seen AWS Regions"
|
|
],
|
|
"title": "Name of baseline",
|
|
"type": "string"
|
|
},
|
|
"search": {
|
|
"$id": "#/properties/search",
|
|
"default": "",
|
|
"description": "The Splunk search for the baseline",
|
|
"examples": [
|
|
"cloudtrail StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"tags": {
|
|
"$id": "#/properties/tags",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "An array of key value pairs for tagging",
|
|
"examples": [
|
|
{
|
|
"analytic_story": "suspicious_aws_ec2_activities",
|
|
"custom_key": "custom_value"
|
|
}
|
|
],
|
|
"minItems": 1,
|
|
"type": "object",
|
|
"uniqueItems": true
|
|
},
|
|
"datamodel": {
|
|
"$id": "#/properties/datamodel",
|
|
"default": "",
|
|
"description": "datamodel used in the search",
|
|
"examples": [
|
|
"Endpoint"
|
|
],
|
|
"items": {
|
|
"enum": [
|
|
"Endpoint",
|
|
"Network_Traffic",
|
|
"Authentication",
|
|
"Change",
|
|
"Change_Analysis",
|
|
"Email",
|
|
"Endpoint",
|
|
"Network_Resolution",
|
|
"Network_Sessions",
|
|
"Network_Traffic",
|
|
"UEBA",
|
|
"Updates",
|
|
"Vulnerabilities",
|
|
"Web"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
},
|
|
"version": {
|
|
"$id": "#/properties/version",
|
|
"default": 0,
|
|
"description": "version of baseline, e.g. 1 or 2 ...",
|
|
"examples": [
|
|
1
|
|
],
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"required": [
|
|
"name",
|
|
"id",
|
|
"version",
|
|
"date",
|
|
"description",
|
|
"author",
|
|
"search",
|
|
"tags"
|
|
],
|
|
"title": "Baseline Schema",
|
|
"type": "object"
|
|
}
|