mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
288 lines
6.7 KiB
Markdown
288 lines
6.7 KiB
Markdown
# Analytics Story Schema Schema
|
|
|
|
```txt
|
|
http://example.com/example.json
|
|
```
|
|
|
|
schema analytics story
|
|
|
|
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
|
|
| :------------------ | :--------- | :------------- | :----------- | :---------------- | :-------------------- | :------------------ | :----------------------------------------------------------------------- |
|
|
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | [stories.spec.json](../../spec/stories.spec.json "open original schema") |
|
|
|
|
## Analytics Story Schema Type
|
|
|
|
`object` ([Analytics Story Schema](stories.md))
|
|
|
|
## Analytics Story Schema Default Value
|
|
|
|
The default value is:
|
|
|
|
```json
|
|
{}
|
|
```
|
|
|
|
# Analytics Story Schema Properties
|
|
|
|
| Property | Type | Required | Nullable | Defined by |
|
|
| :-------------------------- | :-------- | :------- | :------------- | :------------------------------------------------------------------------------------------------------------- |
|
|
| [author](#author) | `string` | Required | cannot be null | [Analytics Story Schema](stories-properties-author.md "#/properties/author#/properties/author") |
|
|
| [date](#date) | `string` | Required | cannot be null | [Analytics Story Schema](stories-properties-date.md "#/properties/date#/properties/date") |
|
|
| [description](#description) | `string` | Required | cannot be null | [Analytics Story Schema](stories-properties-description.md "#/properties/description#/properties/description") |
|
|
| [id](#id) | `string` | Required | cannot be null | [Analytics Story Schema](stories-properties-id.md "#/properties/id#/properties/id") |
|
|
| [name](#name) | `string` | Required | cannot be null | [Analytics Story Schema](stories-properties-name.md "#/properties/name#/properties/name") |
|
|
| [narrative](#narrative) | `string` | Required | cannot be null | [Analytics Story Schema](stories-properties-narrative.md "#/properties/narrative#/properties/narrative") |
|
|
| [search](#search) | `string` | Optional | cannot be null | [Analytics Story Schema](stories-properties-search.md "#/properties/search#/properties/search") |
|
|
| [tags](#tags) | `object` | Required | cannot be null | [Analytics Story Schema](stories-properties-tags.md "#/properties/tags#/properties/tags") |
|
|
| [version](#version) | `integer` | Required | cannot be null | [Analytics Story Schema](stories-properties-version.md "#/properties/version#/properties/version") |
|
|
| Additional Properties | Any | Optional | can be null | |
|
|
|
|
## author
|
|
|
|
Author of the analytics story
|
|
|
|
`author`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Analytics Story Schema](stories-properties-author.md "#/properties/author#/properties/author")
|
|
|
|
### author Type
|
|
|
|
`string`
|
|
|
|
### author Examples
|
|
|
|
```yaml
|
|
Rico Valdez, Patrick Bareiß, Splunk
|
|
|
|
```
|
|
|
|
## date
|
|
|
|
date of creation or modification, format yyyy-mm-dd
|
|
|
|
`date`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Analytics Story Schema](stories-properties-date.md "#/properties/date#/properties/date")
|
|
|
|
### date Type
|
|
|
|
`string`
|
|
|
|
### date Examples
|
|
|
|
```yaml
|
|
'2019-12-06'
|
|
|
|
```
|
|
|
|
## description
|
|
|
|
description of the analytics story
|
|
|
|
`description`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Analytics Story Schema](stories-properties-description.md "#/properties/description#/properties/description")
|
|
|
|
### description Type
|
|
|
|
`string`
|
|
|
|
### description Examples
|
|
|
|
```yaml
|
|
>-
|
|
Uncover activity consistent with credential dumping, a technique where
|
|
attackers compromise systems and attempt to obtain and exfiltrate passwords.
|
|
|
|
```
|
|
|
|
## id
|
|
|
|
UUID as unique identifier
|
|
|
|
`id`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Analytics Story Schema](stories-properties-id.md "#/properties/id#/properties/id")
|
|
|
|
### id Type
|
|
|
|
`string`
|
|
|
|
### id Examples
|
|
|
|
```yaml
|
|
fb4c31b0-13e8-4155-8aa5-24de4b8d6717
|
|
|
|
```
|
|
|
|
## name
|
|
|
|
Name of the Analytics Story
|
|
|
|
`name`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Analytics Story Schema](stories-properties-name.md "#/properties/name#/properties/name")
|
|
|
|
### name Type
|
|
|
|
`string`
|
|
|
|
### name Examples
|
|
|
|
```yaml
|
|
Credential Dumping
|
|
|
|
```
|
|
|
|
## narrative
|
|
|
|
narrative of the analytics story
|
|
|
|
`narrative`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Analytics Story Schema](stories-properties-narrative.md "#/properties/narrative#/properties/narrative")
|
|
|
|
### narrative Type
|
|
|
|
`string`
|
|
|
|
### narrative Examples
|
|
|
|
```yaml
|
|
>-
|
|
gathering credentials from a target system, often hashed or encrypted, is a
|
|
common attack technique. Even though the credentials may not be in plain text,
|
|
an attacker can still exfiltrate the data and set to cracking it offline, on
|
|
their own systems.
|
|
|
|
```
|
|
|
|
## search
|
|
|
|
An additional Splunk search, which uses the result of the detections
|
|
|
|
`search`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Analytics Story Schema](stories-properties-search.md "#/properties/search#/properties/search")
|
|
|
|
### search Type
|
|
|
|
`string`
|
|
|
|
### search Examples
|
|
|
|
```yaml
|
|
>-
|
|
index=asx mitre_id=t1003 | stats values(source) as detections values(process)
|
|
as processes values(user) as users values(_time) as time count by dest
|
|
|
|
```
|
|
|
|
## tags
|
|
|
|
An explanation about the purpose of this instance.
|
|
|
|
`tags`
|
|
|
|
* is required
|
|
|
|
* Type: `object` ([Details](stories-properties-tags.md))
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Analytics Story Schema](stories-properties-tags.md "#/properties/tags#/properties/tags")
|
|
|
|
### tags Type
|
|
|
|
`object` ([Details](stories-properties-tags.md))
|
|
|
|
### tags Constraints
|
|
|
|
**minimum number of items**: the minimum number of items for this array is: `1`
|
|
|
|
### tags Default Value
|
|
|
|
The default value is:
|
|
|
|
```json
|
|
{}
|
|
```
|
|
|
|
### tags Examples
|
|
|
|
```yaml
|
|
analytic_story: credential_dumping
|
|
|
|
```
|
|
|
|
## version
|
|
|
|
version of analytics story, e.g. 1 or 2 ...
|
|
|
|
`version`
|
|
|
|
* is required
|
|
|
|
* Type: `integer`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Analytics Story Schema](stories-properties-version.md "#/properties/version#/properties/version")
|
|
|
|
### version Type
|
|
|
|
`integer`
|
|
|
|
### version Examples
|
|
|
|
```yaml
|
|
1
|
|
|
|
```
|
|
|
|
## Additional Properties
|
|
|
|
Additional properties are allowed and do not have to follow a specific schema
|