admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
spec_3_converted_objects
splunk-security_content/spec/v2/detections.spec.json
T
bpatel 8e12891adb spec
2020-04-17 10:52:00 -07:00

1527 lines
44 KiB
JSON
Raw Permalink Blame History

{
"$id": "https://api.splunkresearch.com/schemas/detections.json",
"$schema": "http://json-schema.org/draft-07/schema#",
"definitions": {
"phantom": {
"properties": {
"correlation_rule": {
"description": "Various fields to enhance usability in Enterprise Security",
"properties": {
"notable": {
"description": "Various fields associated with creating a notable event",
"properties": {
"nes_fields": {
"description": "A list of suggested fields to be used for notable-event suppression",
"examples": [
"src"
],
"type": "string"
},
"rule_description": {
"description": "Description of the notable event that will display in Incident Review",
"examples": [
"The table represents a list of DNS records and their responses for corporate domains that have recently changed"
],
"type": "string"
},
"rule_title": {
"description": "Title of the notable event that will display in Incident Review. Add tokenized fieldnames",
"examples": [
"DNS record changed on $src$"
],
"type": "string"
}
},
"required": [
"rule_description",
"rule_title",
"nes_fields"
],
"type": "object"
},
"risk": {
"description": "Fields associated with assigning risk to objects",
"properties": {
"risk_object": {
"description": "TThe field to which you are assigning risk",
"examples": [
"src"
],
"type": "string"
},
"risk_object_type": {
"description": "The type of object to which you are assigning risk",
"examples": [
"system"
],
"items": {
"enum": [
"system",
"user",
"other"
],
"type": "string"
},
"maxItems": 1,
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"risk_score": {
"description": "Score assigned to risk_object",
"examples": [
"40"
],
"type": "integer"
}
},
"required": [
"risk_score",
"risk_object",
"risk_object_type"
],
"type": "object"
},
"schedule": {
"description": "Various fields to assist in scheduling the search",
"properties": {
"cron_schedule": {
"description": "Schedule of the search in cron format",
"examples": [
"0 * * * *"
],
"type": "string"
},
"earliest_time": {
"description": "The earliest time the search should run in Splunk format",
"examples": [
"-70m@m"
],
"type": "string"
},
"latest_time": {
"description": "The latest time tes search should run against in Splunk format",
"examples": [
"-10m@m"
],
"type": "string"
}
},
"type": "object"
},
"search": {
"description": "The search that will trigger phantom playbook",
"examples": [
"| sendalert runphantomplaybook"
],
"type": "string"
},
"suppress": {
"description": "Fields associated with suppressing the creation of multiple alerts",
"properties": {
"suppress_fields": {
"description": "The fields to base the suppression on",
"examples": [
"src"
],
"type": "string"
},
"suppress_period": {
"description": "The length of time the suppression should be in effect",
"examples": [
"28800s"
],
"type": "string"
}
},
"required": [
"suppress_fields",
"suppress_period"
],
"type": "object"
}
},
"required": [
"search",
"schedule"
],
"type": "object"
},
"phantom_server": {
"description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)",
"examples": [
"automation (hostname)"
],
"type": "string"
},
"playbook_name": {
"description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/<playbook_name>. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment",
"examples": [
"community/dns_hijack_detect_playbook"
],
"type": "string"
},
"playbook_url": {
"description": "Url of the playbook on Phantom website.",
"examples": [
"https://my.phantom.us/4.1/playbook/dns-hijack-investigation/"
],
"type": "string"
},
"sensitivity": {
"description": "TLP colors (white, green, amber or red)",
"examples": [
"green"
],
"type": "string"
},
"severity": {
"description": "Severity in phantom (High, Medium, Low)",
"examples": [
"high"
],
"type": "string"
}
},
"required": [
"correlation_rule",
"playbook_name",
"phantom_server",
"playbook_url"
],
"type": "object"
},
"splunk": {
"correlation_rule": {
"description": "Various fields to enhance usability in Enterprise Security",
"properties": {
"lookups": {
"description": "A list of lookups in the search",
"examples": [
"detection_search_lookup"
],
"items": {
"type": "string"
},
"type": "array"
},
"macros": {
"description": "A list of macros in the search",
"examples": [
"detection_search_output_filter"
],
"items": {
"type": "string"
},
"type": "array"
},
"notable": {
"description": "Various fields associated with creating a notable event",
"properties": {
"drilldown_name": {
"description": "The text for the drilldown hyperlink within the Incident Review dashboard",
"type": "string"
},
"drilldown_search": {
"description": "The actual drilldown search",
"type": "string"
},
"nes_fields": {
"description": "A list of suggested fields to be used for notable-event suppression",
"type": "string"
},
"rule_description": {
"description": "Description of the notable event that will display in Incident Review",
"type": "string"
},
"rule_title": {
"description": "Title of the notable event that will display in Incident Review",
"type": "string"
}
},
"required": [
"rule_description",
"rule_title",
"nes_fields"
],
"type": "object"
},
"risk": {
"description": "Fields associated with assigning risk to objects",
"properties": {
"risk_object": {
"description": "TThe field to which you are assigning risk",
"type": "string"
},
"risk_object_type": {
"description": "The type of object to which you are assigning risk",
"items": {
"enum": [
"system",
"user",
"other"
],
"type": "string"
},
"maxItems": 1,
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"risk_score": {
"description": "Score assigned to risk_object",
"type": "integer"
}
},
"required": [
"risk_score",
"risk_object",
"risk_object_type"
],
"type": "object"
},
"schedule": {
"description": "Various fields to assist in scheduling the search",
"properties": {
"cron_schedule": {
"description": "Schedule of the search in cron format",
"type": "string"
},
"earliest_time": {
"description": "The earliest time the search should run in Splunk format",
"type": "string"
},
"latest_time": {
"description": "The latest time tes search should run against in Splunk format",
"type": "string"
}
},
"type": "object"
},
"search": {
"description": "The search that will trigger phantom playbook",
"type": "string"
},
"suppress": {
"description": "Fields associated with suppressing the creation of multiple alerts",
"properties": {
"suppress_fields": {
"description": "The fields to base the suppression on",
"type": "string"
},
"suppress_period": {
"description": "The length of time the suppression should be in effect",
"type": "string"
}
},
"required": [
"suppress_fields",
"suppress_period"
],
"type": "object"
}
},
"required": [
"search",
"schedule"
],
"type": "object"
},
"type": "object"
},
"uba": {
"properties": {
"correlation_rule": {
"description": "Various fields to enhance usability in Enterprise Security",
"properties": {
"notable": {
"description": "Various fields associated with creating a notable event",
"properties": {
"nes_fields": {
"description": "A list of suggested fields to be used for notable-event suppression",
"type": "string"
},
"rule_description": {
"description": "Description of the notable event that will display in Incident Review",
"type": "string"
},
"rule_title": {
"description": "Title of the notable event that will display in Incident Review",
"type": "string"
}
},
"required": [
"rule_description",
"rule_title",
"nes_fields"
],
"type": "object"
},
"risk": {
"description": "Fields associated with assigning risk to objects",
"properties": {
"risk_object": {
"description": "TThe field to which you are assigning risk",
"type": "string"
},
"risk_object_type": {
"description": "The type of object to which you are assigning risk",
"items": {
"enum": [
"system",
"user",
"other"
],
"type": "string"
},
"maxItems": 1,
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"risk_score": {
"description": "Score assigned to risk_object",
"type": "integer"
}
},
"required": [
"risk_score",
"risk_object",
"risk_object_type"
],
"type": "object"
},
"schedule": {
"description": "Various fields to assist in scheduling the search",
"properties": {
"cron_schedule": {
"description": "Schedule of the search in cron format",
"type": "string"
},
"earliest_time": {
"description": "The earliest time the search should run in Splunk format",
"type": "string"
},
"latest_time": {
"description": "The latest time tes search should run against in Splunk format",
"type": "string"
}
},
"type": "object"
},
"search": {
"description": "The search (in SPL) executed within core Splunk",
"type": "string"
},
"suppress": {
"description": "Fields associated with suppressing the creation of multiple alerts",
"properties": {
"suppress_fields": {
"description": "The fields to base the suppression on",
"type": "string"
},
"suppress_period": {
"description": "The length of time the suppression should be in effect",
"type": "string"
}
},
"required": [
"suppress_fields",
"suppress_period"
],
"type": "object"
}
},
"required": [
"search",
"schedule"
],
"type": "object"
},
"event_type": {
"description": "An anomaly or threat.",
"examples": [
"anomaly"
],
"type": "string"
},
"model": {
"description": "The name of the Splunk UBA model that detected the anomaly.",
"examples": [
"UBA Model"
],
"type": "string"
},
"model_version": {
"description": "Url of the playbook on Phantom website.",
"examples": [
"2.0"
],
"type": "string"
},
"threat_category": {
"description": "The category of a threat in Splunk UBA.",
"examples": [
"Malware"
],
"type": "string"
}
},
"required": [
"correlation_rule",
"event_type",
"model",
"model_version",
"threat_category"
],
"type": "object"
}
},
"description": "A object that defines the parameters for detecting things using various Splunk capabilities",
"properties": {
"asset_type": {
"description": "Designates the type of asset being investigated",
"examples": [
"Endpoint"
],
"type": "string"
},
"baselines": {
"description": "An array of the baseline objects to exectute before the detection ",
"items": {
"properties": {
"id": {
"description": "UUID of the baseline object",
"examples": [
"c096f721-8842-42ce-bfc7-74bd8c72b7c3"
],
"type": "string"
},
"name": {
"description": "name of baseline object",
"examples": [
"Discover DNS records"
],
"type": "string"
},
"type": {
"description": "Type of baseline to execute",
"enum": [
"phantom",
"splunk",
"uba"
],
"examples": [
"splunk"
],
"type": "string"
}
},
"required": [
"type",
"name",
"id"
],
"type": "object"
},
"type": "array"
},
"confidence": {
"description": "Confidence that detected behavior is malicious",
"enum": [
"high",
"medium",
"low"
],
"examples": [
"high"
]
},
"creation_date": {
"description": "The date the story manifest was created",
"examples": [
"2019-02-14"
],
"type": "string"
},
"data_metadata": {
"description": "Information about the date being ingested",
"properties": {
"data_eventtypes": {
"description": "A list of eventtypes, if any, used by this search",
"examples": [
"wineventlog"
],
"items": {
"type": "string"
},
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"data_models": {
"description": "A list of data models, if any, used by this search",
"examples": [
"Network_Resolution"
],
"items": {
"enum": [
"Alerts",
"Application_State",
"Authentication",
"Certificates",
"Change_Analysis",
"Change",
"Cloud_Infrastructure",
"Malware",
"Email",
"Identity_Management",
"Network_Resolution",
"Network_Traffic",
"Vulnerabilities",
"Web",
"Network_Sessions",
"Updates",
"Risk",
"Endpoint",
"UEBA"
]
},
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"data_source": {
"description": "A high-level description of the type of data needed for this search to complete",
"examples": [
"DNS"
],
"items": {
"type": "string"
},
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"data_sourcetypes": {
"description": "The list of sourcetypes, if any, used by this search",
"examples": [
"stream:dns"
],
"items": {
"type": "string"
},
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"providing_technologies": {
"description": "A list of technologies that provide this data",
"examples": [
"Bro"
],
"items": {
"enum": [
"Apache",
"AWS",
"Azure",
"Bro",
"GCP",
"Microsoft Windows",
"Linux",
"macOS",
"Netbackup",
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Stream",
"Active Directory",
"Bluecoat",
"Carbon Black Response",
"Carbon Black Protect",
"CrowdStrike Falcon",
"Microsoft Exchange",
"Nessus",
"Palo Alto Firewall",
"Qualys",
"Sysmon",
"Tanium",
"Ziften",
"OSquery",
"Okta"
]
},
"minItems": 0,
"type": "array",
"uniqueItems": true
}
},
"required": [
"data_source",
"providing_technologies"
],
"type": "object"
},
"description": {
"description": "A description of what the detection is designed to find",
"examples": [
"The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day."
],
"type": "string"
},
"detect": {
"anyOf": [
{
"required": [
"splunk"
]
},
{
"required": [
"phantom"
]
},
{
"required": [
"uba"
]
}
],
"properties": {
"phantom": {
"$ref": "#/definitions/phantom"
},
"splunk": {
"$ref": "#/definitions/splunk"
},
"uba": {
"$ref": "#/definitions/uba"
}
},
"type": "object"
},
"eli5": {
"description": "Explain it like I am 5 - A detail description of the SPL of the search, written in a style that can be understood by a future Splunk expert",
"examples": [
"Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed."
],
"type": "string"
},
"entities": {
"description": "A list of entities that is outputed by the search...",
"examples": [
"dest",
"user"
],
"items": {
"enum": [
"accessKeyId",
"app",
"arn",
"awsRegion",
"bucketName",
"City",
"Country",
"dest_port",
"dest",
"event_id",
"instanceId",
"message_id",
"networkAclId",
"parent_process_id",
"parent_process_name",
"process_id",
"process_name",
"process",
"recipient",
"Region",
"region",
"resourceId",
"session_id",
"src_ip",
"src_mac",
"src_user",
"src",
"user",
"query",
"host",
"dest_ip",
"userName",
"dest_user",
"url",
"domain",
"cluster_name"
]
},
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"how_to_implement": {
"description": "A discussion on how to implement this search, from what needs to be ingested, config files modified, and suggested per site modifications",
"examples": [],
"type": "string"
},
"id": {
"description": "The unique identifier for the detection",
"examples": [
"To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\"."
],
"type": "string"
},
"investigations": {
"description": "An array of the investigation objects to exectute on the detection results ",
"items": {
"properties": {
"id": {
"description": "UUID of the investigation object",
"examples": [
"bc11a8cf-35e7-4bb2-8140-e756cc06fd72"
],
"type": "string"
},
"name": {
"description": "Name of investigation object ",
"examples": [
"Get DNS Server History for a host"
],
"type": "string"
},
"type": {
"description": "Type of investigation object",
"enum": [
"phantom",
"splunk",
"uba"
],
"examples": [
"splunk"
],
"type": "string"
}
},
"required": [
"type",
"name",
"id"
],
"type": "object"
},
"type": "array"
},
"known_false_positives": {
"description": "Scenarios in which detected behavior is benig, coupled with suggestions on how to verify the behavior",
"examples": [
"Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate."
],
"type": "string"
},
"maintainers": {
"description": "An array of the current maintainers of the Analytic Story.",
"items": {
"properties": {
"company": {
"description": "Company associated with the person maintaining this search",
"examples": [
"Splunk"
],
"type": "string"
},
"email": {
"description": "Email address of the person maintaining this search",
"examples": [
"daftpunk@splunk.com"
],
"type": "string"
},
"name": {
"description": "Name of the person maintaining this search",
"examples": [
"Daft Punk"
],
"type": "string"
}
},
"required": [
"name",
"email",
"company"
],
"type": "object"
},
"type": "array"
},
"mappings": {
"description": "Mappings to various industry standards and frameworks",
"properties": {
"cis20": {
"description": "A list of critical security controls this search helps you implement",
"examples": [
"CIS 12"
],
"items": {
"enum": [
"CIS 1",
"CIS 2",
"CIS 3",
"CIS 4",
"CIS 5",
"CIS 6",
"CIS 7",
"CIS 8",
"CIS 9",
"CIS 10",
"CIS 11",
"CIS 12",
"CIS 13",
"CIS 14",
"CIS 15",
"CIS 16",
"CIS 17",
"CIS 18",
"CIS 19",
"CIS 20"
]
},
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"kill_chain_phases": {
"description": "A list of kill-chain phases to which the search applies",
"examples": [
"Reconnaissance"
],
"items": {
"enum": [
"Reconnaissance",
"Weaponization",
"Delivery",
"Exploitation",
"Installation",
"Command and Control",
"Actions on Objectives"
]
},
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"mitre_attack": {
"description": "A list of the techniques and tactics identified by the search",
"examples": [
"Defense Evasion",
"Initial Access"
],
"items": {
"enum": [
"Initial Access",
"Impact",
"Execution",
"Persistence",
"Spearphishing Attachment",
"Spearphishing Link",
"Privilege Escalation",
"Defense Evasion",
"Credential Access",
"Discovery",
"Lateral Movement",
"Collection",
"Exfiltration",
"Accessibility Features",
"Account Discovery",
"AppInit DLLs",
"Application Shimming",
"Authentication Package",
"Change Default File Association",
"Command and Control",
"Command and Control Protocol",
"Command-Line Interface",
"Commonly Used Port",
"Credential Dumping",
"Custom Cryptographic Protocol",
"DLL Injection",
"DLL Search Order Hijacking",
"DLL Side-Loading",
"Data Compressed",
"Data Encrypted",
"Data Obfuscation",
"Data Staged",
"Data Transfer Size Limits",
"Data from Local System",
"Data from Network Shared Drive",
"Data from Removable Media",
"Disabling Security Tools",
"Email Collection",
"Execution through API",
"Exfiltration Over Alternative Protocol",
"Exfiltration Over Command and Control Channel",
"Exfiltration Over Other Network Medium",
"Exfiltration Over Physical Medium",
"Exploitation of Vulnerability",
"Fallback Channels",
"File Deletion",
"File System Logical Offsets",
"File System Permissions Weakness",
"File and Directory Discovery",
"Graphical User Interface",
"Hypervisor",
"Indicator Blocking",
"Indicator Removal from Tools",
"Indicator Removal on Host",
"Input Capture",
"InstallUtil",
"Legitimate Credentials",
"Local Network Configuration Discovery",
"Local Network Connections Discovery",
"Local Port Monitor",
"Logon Scripts",
"MSBuild",
"Masquerading",
"Modify Existing Service",
"Modify Registry",
"Multi-Stage Channels",
"Multiband Communication",
"Multilayer Encryption",
"NTFS Extended Attributes",
"Network Service Scanning",
"Network Share Connection Removal",
"Network Sniffing",
"New Service",
"Obfuscated Files or Information",
"Pass the Hash",
"Pass the Ticket",
"Path Interception",
"Peripheral Device Discovery",
"Permission Groups Discovery",
"PowerShell",
"Process Discovery",
"Process Hollowing",
"Query Registry",
"Redundant Access",
"Registry Run Keys / Start Folder",
"Regsvcs/Regasm",
"Regsvr32",
"Remote Desktop Protocol",
"Create Account",
"Remote File Copy",
"Remote Services",
"Remote System Discovery",
"Replication Through Removable Media",
"Rootkit",
"Rundll32",
"Scheduled Task",
"Scheduled Transfer",
"Screen Capture",
"Scripting",
"Security Software Discovery",
"Security Support Provider",
"Service Execution",
"Service Registry Permissions Weakness",
"Shared Webroot",
"Shortcut Modification",
"Software Packing",
"Standard Application Layer Protocol",
"Standard Cryptographic Protocol",
"Standard Non-Application Layer Protocol",
"System Information Discovery",
"System Owner/User Discovery",
"System Service Discovery",
"System Time Discovery",
"Taint Shared Content",
"Third-party Software",
"Timestomp",
"Two-Factor Authentication Interception",
"Uncommonly Used Port",
"Video Capture",
"Valid Accounts",
"Web Service",
"Web Shell",
"Windows Admin Shares",
"Windows Management Instrumentation Event Subscription",
"Windows Management Instrumentation",
"Windows Remote Management",
"Winlogon Helper DLL",
"Exploitation for Privilege Escalation"
]
},
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"mitre_technique_id": {
"description": "MITRE Technique ID identified by the search",
"examples": [
"T1001",
"T1002",
"T1003"
],
"items": {
"enum": [
"T1001",
"T1002",
"T1003",
"T1004",
"T1005",
"T1006",
"T1007",
"T1008",
"T1009",
"T1010",
"T1011",
"T1012",
"T1013",
"T1014",
"T1015",
"T1016",
"T1017",
"T1018",
"T1019",
"T1020",
"T1021",
"T1022",
"T1023",
"T1024",
"T1025",
"T1026",
"T1027",
"T1028",
"T1029",
"T1030",
"T1031",
"T1032",
"T1033",
"T1034",
"T1035",
"T1036",
"T1037",
"T1038",
"T1039",
"T1040",
"T1041",
"T1042",
"T1043",
"T1044",
"T1045",
"T1046",
"T1047",
"T1048",
"T1049",
"T1050",
"T1051",
"T1052",
"T1053",
"T1054",
"T1055",
"T1056",
"T1057",
"T1058",
"T1059",
"T1060",
"T1061",
"T1062",
"T1063",
"T1064",
"T1065",
"T1066",
"T1067",
"T1068",
"T1069",
"T1070",
"T1071",
"T1072",
"T1073",
"T1074",
"T1075",
"T1076",
"T1077",
"T1078",
"T1079",
"T1080",
"T1081",
"T1082",
"T1083",
"T1084",
"T1085",
"T1086",
"T1087",
"T1088",
"T1089",
"T1090",
"T1091",
"T1092",
"T1093",
"T1094",
"T1095",
"T1096",
"T1097",
"T1098",
"T1099",
"T1100",
"T1101",
"T1102",
"T1103",
"T1104",
"T1105",
"T1106",
"T1107",
"T1108",
"T1109",
"T1110",
"T1111",
"T1112",
"T1113",
"T1114",
"T1115",
"T1116",
"T1117",
"T1118",
"T1119",
"T1120",
"T1121",
"T1122",
"T1123",
"T1124",
"T1125",
"T1126",
"T1127",
"T1128",
"T1129",
"T1130",
"T1131",
"T1132",
"T1133",
"T1134",
"T1135",
"T1136",
"T1137",
"T1138",
"T1139",
"T1140",
"T1141",
"T1142",
"T1143",
"T1144",
"T1145",
"T1146",
"T1147",
"T1148",
"T1149",
"T1150",
"T1151",
"T1152",
"T1153",
"T1154",
"T1155",
"T1156",
"T1157",
"T1158",
"T1159",
"T1160",
"T1161",
"T1162",
"T1163",
"T1164",
"T1165",
"T1166",
"T1167",
"T1168",
"T1169",
"T1170",
"T1171",
"T1172",
"T1173",
"T1174",
"T1175",
"T1176",
"T1177",
"T1178",
"T1179",
"T1180",
"T1181",
"T1182",
"T1183",
"T1184",
"T1185",
"T1186",
"T1187",
"T1188",
"T1189",
"T1190",
"T1191",
"T1192",
"T1193",
"T1194",
"T1195",
"T1196",
"T1197",
"T1198",
"T1199",
"T1200",
"T1201",
"T1202",
"T1203",
"T1204",
"T1205",
"T1206",
"T1207",
"T1208",
"T1209",
"T1210",
"T1211",
"T1212",
"T1213",
"T1214",
"T1215",
"T1216",
"T1217",
"T1218",
"T1219",
"T1220",
"T1221",
"T1222",
"T1223",
"T1480",
"T1482",
"T1483",
"T1484",
"T1485",
"T1486",
"T1487",
"T1488",
"T1489",
"T1490",
"T1491",
"T1492",
"T1493",
"T1494",
"T1495",
"T1496",
"T1497",
"T1498",
"T1499",
"T1500",
"T1501",
"T1502",
"T1503",
"T1504",
"T1505",
"T1506",
"T1514",
"T1518",
"T1519",
"T1522",
"T1525",
"T1526",
"T1527",
"T1528",
"T1529",
"T1530",
"T1531",
"T1534",
"T1535",
"T1536",
"T1537",
"T1538",
"T1539"
]
},
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"nist": {
"description": "A list of the NIST controls the search helps you implement",
"examples": [
"ID.AM",
"PR.PT"
],
"items": {
"enum": [
"ID.AM",
"ID.RA",
"PR.DS",
"PR.IP",
"PR.AC",
"PR.PT",
"PR.AT",
"PR.MA",
"DE.CM",
"DE.DP",
"DE.AE",
"RS.MI",
"RS.AN",
"RS.RP",
"RS.IM",
"RS.CO",
"RC.IM",
"RC.CO"
]
},
"minItems": 0,
"type": "array",
"uniqueItems": true
}
},
"type": "object"
},
"modification_date": {
"description": "The date of the most recent modification to the search",
"examples": [
"2019-02-14"
],
"type": "string"
},
"name": {
"description": "The name of the detection",
"examples": [
"DNS record changed"
],
"type": "string"
},
"original_authors": {
"description": "A list of the original authors of the search",
"items": {
"properties": {
"company": {
"description": "Company associated with the person who originally authored the search",
"examples": [
"Splunk"
],
"type": "string"
},
"email": {
"description": "Email address of the person who originally authored the search",
"examples": [
"daftpunk@splunk.com"
],
"type": "string"
},
"name": {
"description": "Name of the person who originally authored the search",
"examples": [
"Daft Punk"
],
"type": "string"
}
},
"required": [
"name",
"email",
"company"
],
"type": "object"
},
"type": "array"
},
"references": {
"description": "A list of URLs that give more information about the search",
"examples": [
"https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
],
"items": {
"type": "string"
},
"minItems": 0,
"type": "array",
"uniqueItems": true
},
"responses": {
"description": "An array of the response objects to exectute on the detection results",
"items": {
"properties": {
"id": {
"description": "UUID of the Respose object",
"examples": [
"1169w17b-ef78-4b59-aae8-5369073014e1"
],
"type": "string"
},
"name": {
"description": "Name of Response Object",
"examples": [
"DNS Hijack Reponse"
],
"type": "string"
},
"type": {
"description": "Type of baseline to execute",
"enum": [
"phantom",
"splunk",
"uba"
],
"examples": [
"phantom"
],
"type": "string"
}
},
"required": [
"type",
"name",
"id"
],
"type": "object"
},
"type": "array"
},
"security_domain": {
"description": "The high-level security area to which the search belongs",
"enum": [
"access",
"endpoint",
"network",
"threat",
"cloud"
],
"examples": [
"endpoint"
]
},
"spec_version": {
"description": "The version of the detection specification this manifest follows",
"examples": [
"2.0"
],
"type": "integer"
},
"type": {
"description": "The type of detection",
"enum": [
"uba",
"splunk",
"phantom"
],
"examples": [
"phantom"
]
},
"version": {
"description": "The version of the detection",
"examples": [
"1"
],
"type": "string"
}
},
"required": [
"confidence",
"creation_date",
"data_metadata",
"eli5",
"how_to_implement",
"known_false_positives",
"maintainers",
"modification_date",
"original_authors",
"description",
"id",
"type",
"security_domain",
"version",
"detect"
],
"title": "Detection Manifest",
"type": "object"
}
Reference in New Issue View Git Blame Copy Permalink