mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
438 lines
5.5 KiB
Markdown
438 lines
5.5 KiB
Markdown
|
|
# Response Task Schema Schema
|
|
|
|
```
|
|
http://example.com/example.json
|
|
```
|
|
|
|
schema for response tasks
|
|
|
|
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Defined In |
|
|
|----------|------------|--------|--------------|-------------------|-----------------------|------------|
|
|
| Can be instantiated | No | Experimental | No | Forbidden | Permitted | |
|
|
|
|
# Response Task Schema Properties
|
|
|
|
| Property | Type | Required | Nullable | Default | Defined by |
|
|
|----------|------|----------|----------|---------|------------|
|
|
| [author](#author) | `string` | **Required** | No | `""` | Response Task Schema (this schema) |
|
|
| [dashboard](#dashboard) | `string` | Optional | No | `""` | Response Task Schema (this schema) |
|
|
| [date](#date) | `string` | **Required** | No | `""` | Response Task Schema (this schema) |
|
|
| [description](#description) | `string` | **Required** | No | `""` | Response Task Schema (this schema) |
|
|
| [how_to_implement](#how_to_implement) | `string` | Optional | No | `""` | Response Task Schema (this schema) |
|
|
| [id](#id) | `string` | **Required** | No | `""` | Response Task Schema (this schema) |
|
|
| [inputs](#inputs) | `array` | Optional | No | `[]` | Response Task Schema (this schema) |
|
|
| [name](#name) | `string` | **Required** | No | `""` | Response Task Schema (this schema) |
|
|
| [playbook](#playbook) | `object` | Optional | No | `{}` | Response Task Schema (this schema) |
|
|
| [search](#search) | `string` | Optional | No | `""` | Response Task Schema (this schema) |
|
|
| [version](#version) | `integer` | **Required** | No | `0` | Response Task Schema (this schema) |
|
|
| `*` | any | Additional | Yes | this schema *allows* additional properties |
|
|
|
|
## author
|
|
|
|
Author of response task
|
|
|
|
`author`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### author Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### author Example
|
|
|
|
```json
|
|
"Patrick Bareiß, Splunk"
|
|
```
|
|
|
|
|
|
## dashboard
|
|
|
|
Name of dashboard used as response task
|
|
|
|
`dashboard`
|
|
|
|
* is optional
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### dashboard Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### dashboard Example
|
|
|
|
```json
|
|
"process_chain_analysis.json"
|
|
```
|
|
|
|
|
|
## date
|
|
|
|
date of creation or modification, format yyyy-mm-dd
|
|
|
|
`date`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### date Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### date Example
|
|
|
|
```json
|
|
"2019-12-06"
|
|
```
|
|
|
|
|
|
## description
|
|
|
|
Description of response task
|
|
|
|
`description`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### description Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### description Example
|
|
|
|
```json
|
|
"Response Task example description"
|
|
```
|
|
|
|
|
|
## how_to_implement
|
|
|
|
information about how to implement. Only needed for non standard implementations.
|
|
|
|
`how_to_implement`
|
|
|
|
* is optional
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### how_to_implement Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### how_to_implement Example
|
|
|
|
```json
|
|
"This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
|
|
```
|
|
|
|
|
|
## id
|
|
|
|
UUID as unique identifier
|
|
|
|
`id`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### id Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### id Example
|
|
|
|
```json
|
|
"fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
|
|
```
|
|
|
|
|
|
## inputs
|
|
|
|
Inputs used from the response task
|
|
|
|
`inputs`
|
|
|
|
* is optional
|
|
* type: `array`
|
|
|
|
* default: `[]`
|
|
* defined in this schema
|
|
|
|
### inputs Type
|
|
|
|
|
|
Array type: `array`
|
|
|
|
|
|
|
|
|
|
### inputs Example
|
|
|
|
```json
|
|
[
|
|
"lookup_file"
|
|
]
|
|
```
|
|
|
|
|
|
## name
|
|
|
|
Namo fo response task
|
|
|
|
`name`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### name Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### name Example
|
|
|
|
```json
|
|
"Response Tas Example"
|
|
```
|
|
|
|
|
|
## playbook
|
|
|
|
A phantom playbook as response task
|
|
|
|
`playbook`
|
|
|
|
* is optional
|
|
* type: `object`
|
|
* default: `{}`
|
|
* defined in this schema
|
|
|
|
### playbook Type
|
|
|
|
|
|
`object` with following properties:
|
|
|
|
|
|
| Property | Type | Required | Default |
|
|
|----------|------|----------|---------|
|
|
| `name`| string | **Required** | `""` |
|
|
| `url_json`| string | **Required** | `""` |
|
|
| `url_python`| string | **Required** | `""` |
|
|
|
|
|
|
|
|
#### name
|
|
|
|
Name of Phantom Playbook
|
|
|
|
`name`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### name Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### name Example
|
|
|
|
```json
|
|
lets_encrypt_domain_investigate.json
|
|
```
|
|
|
|
|
|
|
|
|
|
#### url_json
|
|
|
|
URL for phantom playbook json file
|
|
|
|
`url_json`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### url_json Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### url_json Example
|
|
|
|
```json
|
|
https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.json
|
|
```
|
|
|
|
|
|
|
|
|
|
#### url_python
|
|
|
|
URL for phantom playbook python file
|
|
|
|
`url_python`
|
|
|
|
* is **required**
|
|
* type: `string`
|
|
* default: `""`
|
|
|
|
|
|
##### url_python Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
##### url_python Example
|
|
|
|
```json
|
|
https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.py
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
### playbook Example
|
|
|
|
```json
|
|
{
|
|
"name": "lets_encrypt_domain_investigate.json",
|
|
"url_json": "https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.json",
|
|
"url_python": "https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.py"
|
|
}
|
|
```
|
|
|
|
|
|
## search
|
|
|
|
Search as response task
|
|
|
|
`search`
|
|
|
|
* is optional
|
|
* type: `string`
|
|
* default: `""`
|
|
* defined in this schema
|
|
|
|
### search Type
|
|
|
|
|
|
`string`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### search Example
|
|
|
|
```json
|
|
"`sysmon` EventCode=1 | search [| inputlookup %lookup_file% ] | stats count by dest user process_name"
|
|
```
|
|
|
|
|
|
## version
|
|
|
|
version of detection, e.g. 1 or 2 ...
|
|
|
|
`version`
|
|
|
|
* is **required**
|
|
* type: `integer`
|
|
* default: `0`
|
|
* defined in this schema
|
|
|
|
### version Type
|
|
|
|
|
|
`integer`
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### version Example
|
|
|
|
```json
|
|
3
|
|
```
|
|
|