splunk-security_content/spec/v2/responses.spec.json

{
  "$id": "https://api.splunkresearch.com/schemas/responses.json",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "definitions": {
    "phantom": {
      "properties": {
        "phantom_server": {
          "description": "IP address and username of the phantom server. Currently, we will ship this value as automation (hostname) and we encourage the users to modify those values according to their environment. Eg: automation (hostname)",
          "type": "string"
        },
        "playbook_display_name": {
          "description": "Display Name of the playbook. Capitalize each letter and remove underscores from playbook_name field. Eg: Simple Network Enrichment",
          "type": "string"
        },
        "playbook_name": {
          "description": "Name of the playbook. This name should be the same as the name on phantom community repository on github with underscores and appended with community/<playbook_name>. The playbooks are hosted on https://github.com/phantomcyber/playbooks. Eg: community/simple_network_enrichment",
          "type": "string"
        },
        "playbook_url": {
          "description": "Url of the playbook on Phantom website.",
          "type": "string"
        },
        "sensitivity": {
          "description": "TLP colors (White, Green, Amber or Red)",
          "type": "string"
        },
        "severity": {
          "description": "Severity in phantom (High, Medium, Low)",
          "type": "string"
        },
        "type": {
          "description": "Type of baseline to execute",
          "enum": [
            "phantom",
            "splunk",
            "uba"
          ],
          "type": "string"
        }
      },
      "type": "object"
    },
    "splunk": {
      "properties": {
        "schedule": {
          "description": "Various fields to assist in scheduling the search",
          "properties": {
            "cron_schedule": {
              "description": "Schedule of the search in cron format",
              "type": "string"
            },
            "earliest_time": {
              "description": "The earliest time the search should run in Splunk format",
              "type": "string"
            },
            "latest_time": {
              "description": "The latest time tes search should run against in Splunk format",
              "type": "string"
            }
          },
          "type": "object"
        },
        "search": {
          "description": "A reponse action exectued in splunk",
          "type": "string"
        }
      },
      "required": [
        "search",
        "schedule"
      ],
      "type": "object"
    }
  },
  "description": "The fields that make up the manifest of a version 1 response spec",
  "properties": {
    "creation_date": {
      "description": "The date the story manifest was created",
      "type": "string"
    },
    "data_metadata": {
      "additionalProperties": false,
      "description": "Information about the date being used to run the response",
      "properties": {
        "data_eventtypes": {
          "description": "A list of eventtypes, if any, used by this search",
          "items": {
            "type": "string"
          },
          "minItems": 0,
          "type": "array",
          "uniqueItems": true
        },
        "data_models": {
          "description": "A list of data models, if any, used by this search",
          "items": {
            "type": "string"
          },
          "minItems": 0,
          "type": "array",
          "uniqueItems": true
        },
        "data_source": {
          "description": "A high-level description of the type of data needed for this search to complete",
          "items": {
            "type": "string"
          },
          "minItems": 0,
          "type": "array",
          "uniqueItems": true
        },
        "data_sourcetypes": {
          "description": "The list of sourcetypes, if any, used by this search",
          "items": {
            "type": "string"
          },
          "minItems": 0,
          "type": "array",
          "uniqueItems": true
        },
        "providing_technologies": {
          "description": "A list of technologies that provide this data",
          "items": {
            "enum": [
              "Apache",
              "AWS",
              "Bro",
              "Microsoft Windows",
              "Censys",
              "Linux",
              "macOS",
              "Netbackup",
              "Splunk Enterprise",
              "Splunk Enterprise Security",
              "Splunk Stream",
              "Active Directory",
              "Bluecoat",
              "Carbon Black Response",
              "Carbon Black Protect",
              "CrowdStrike Falcon",
              "Microsoft Exchange",
              "Nessus",
              "Palo Alto Firewall",
              "Qualys",
              "Sysmon",
              "Tanium",
              "Ziften",
              "Censys",
              "Passive Total",
              "WHOIS"
            ]
          },
          "minItems": 0,
          "type": "array",
          "uniqueItems": true
        }
      },
      "required": [
        "data_source",
        "providing_technologies"
      ],
      "type": "object"
    },
    "description": {
      "description": "A description of what this reponse object will do ",
      "type": "string"
    },
    "entities": {
      "description": "A list of entities that is either an input or an output for the security workflow.",
      "items": {
        "enum": [
          "accessKeyId",
          "arn",
          "awsRegion",
          "bucketName",
          "City",
          "Country",
          "dest_port",
          "dest",
          "event_id",
          "instanceId",
          "message_id",
          "networkAclId",
          "process_name",
          "process",
          "recipient",
          "Region",
          "resourceId",
          "session_id",
          "src_ip",
          "src_mac",
          "src_user",
          "src",
          "user",
          "query",
          "answer",
          "domain"
        ]
      },
      "minItems": 0,
      "type": "array",
      "uniqueItems": true
    },
    "fields_required": {
      "description": "A list of fields that need to be in the result of the detection search for the search to be successful",
      "items": {
        "type": "string"
      },
      "minItems": 0,
      "type": "array",
      "uniqueItems": true
    },
    "how_to_implement": {
      "description": "A discussion on how to implement this reponse object, the config files, etc",
      "type": "string"
    },
    "id": {
      "description": "The unique identifier for the search",
      "type": "string"
    },
    "maintainers": {
      "description": "An array of the current maintainers of the reponse spec",
      "items": {
        "additionalProperties": false,
        "properties": {
          "company": {
            "description": "Company associated with the person maintaining this search",
            "type": "string"
          },
          "email": {
            "description": "Email address of the person maintaining this search",
            "type": "string"
          },
          "name": {
            "description": "Name of the person maintaining this search",
            "type": "string"
          }
        },
        "required": [
          "name",
          "email",
          "company"
        ],
        "type": "object"
      },
      "type": "array"
    },
    "modification_date": {
      "description": "The date of the most recent modification to the search",
      "type": "string"
    },
    "name": {
      "description": "The name of the search",
      "type": "string"
    },
    "original_authors": {
      "description": "A list of the original authors of the reponse object",
      "items": {
        "additionalProperties": false,
        "properties": {
          "company": {
            "description": "Company associated with the person who originally authored the search",
            "type": "string"
          },
          "email": {
            "description": "Email address of the person who originally authored the search",
            "type": "string"
          },
          "name": {
            "description": "Name of the person who originally authored the search",
            "type": "string"
          }
        },
        "required": [
          "name",
          "email",
          "company"
        ],
        "type": "object"
      },
      "type": "array"
    },
    "response": {
      "anyOf": [
        {
          "required": [
            "splunk"
          ]
        },
        {
          "required": [
            "phantom"
          ]
        }
      ],
      "properties": {
        "phantom": {
          "$ref": "#/definitions/phantom"
        },
        "splunk": {
          "$ref": "#/definitions/splunk"
        }
      },
      "type": "object"
    },
    "spec_version": {
      "description": "The version of the investigative search specification this manifest follows",
      "type": "integer"
    },
    "type": {
      "description": "The type of detection",
      "enum": [
        "splunk",
        "phantom"
      ]
    },
    "version": {
      "description": "The version of the search",
      "type": "string"
    }
  },
  "required": [
    "creation_date",
    "data_metadata",
    "entity",
    "how_to_implement",
    "maintainers",
    "modification_date",
    "original_authors",
    "search",
    "description",
    "id",
    "type",
    "spec_version",
    "version",
    "response"
  ],
  "title": "Response Manifest",
  "type": "object"
}