splunk-security_content/spec/response.spec.json

{
  "$id": "http://example.com/example.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "default": {},
  "description": "schema for response",
  "properties": {
    "author": {
      "$id": "#/properties/author",
      "default": "",
      "description": "Author of the response",
      "examples": [
        "Rico Valdez, Patrick Barei\u00df, Splunk"
      ],
      "type": "string"
    },
    "date": {
      "$id": "#/properties/date",
      "default": "",
      "description": "version of detection, e.g. 1 or 2 ...",
      "examples": [
        "2019-12-06"
      ],
      "type": "string"
    },
    "description": {
      "$id": "#/properties/description",
      "default": "",
      "description": "Description of response",
      "examples": [
        "Response example."
      ],
      "type": "string"
    },
    "id": {
      "$id": "#/properties/id",
      "default": "",
      "description": "UUID as unique identifier",
      "examples": [
        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
      ],
      "type": "string"
    },
    "name": {
      "$id": "#/properties/name",
      "default": "",
      "description": "Name of response",
      "examples": [
        "Response Example"
      ],
      "type": "string"
    },
    "response_tasks": {
      "$id": "#/properties/response_tasks",
      "additionalProperties": true,
      "default": {},
      "description": "Response tasks divided into phases",
      "examples": [
        {
          "another_phase": [
            {
              "id": "7c72d944-3995-4485-8e57-67b4c353989b",
              "name": "Another investigation"
            }
          ],
          "identification": [
            {
              "id": "c36f3f48-e0bb-4c20-a62a-cdc8f6418892",
              "name": "Investigate Indicator of Compromise Hash"
            },
            {
              "id": "0dc849b2-2eb4-4fd2-add1-b6cc475765f0",
              "name": "Investigate Domains"
            }
          ]
        }
      ],
      "properties": null,
      "required": [],
      "type": "object"
    },
    "tags": {
      "$id": "#/properties/tags",
      "additionalProperties": true,
      "default": {},
      "description": "An array of key value pairs for tagging",
      "examples": [
        {
          "analytics_story": "credential_dumping"
        }
      ],
      "minItems": 1,
      "properties": null,
      "required": [],
      "type": "object",
      "uniqueItems": true
    },
    "version": {
      "$id": "#/properties/version",
      "default": 0,
      "description": "version of detection, e.g. 1 or 2 ...",
      "examples": [
        1
      ],
      "type": "integer"
    }
  },
  "required": [
    "name",
    "id",
    "version",
    "date",
    "description",
    "author",
    "response_tasks",
    "tags"
  ],
  "title": "Response Schema",
  "type": "object"
}