splunk-security_content/spec/response_task.spec.json

{
  "$id": "http://example.com/example.json",
  "$schema": "http://json-schema.org/draft-07/schema",
  "additionalProperties": true,
  "default": {},
  "description": "schema for response tasks",
  "properties": {
    "author": {
      "$id": "#/properties/author",
      "default": "",
      "description": "Author of response task",
      "examples": [
        "Patrick Barei\u00df, Splunk"
      ],
      "type": "string"
    },
    "dashboard": {
      "$id": "#/properties/dashboard",
      "default": "",
      "description": "Name of dashboard used as response task",
      "examples": [
        "process_chain_analysis.json"
      ],
      "type": "string"
    },
    "date": {
      "$id": "#/properties/date",
      "default": "",
      "description": "date of creation or modification, format yyyy-mm-dd",
      "examples": [
        "2019-12-06"
      ],
      "type": "string"
    },
    "description": {
      "$id": "#/properties/description",
      "default": "",
      "description": "Description of response task",
      "examples": [
        "Response Task example description"
      ],
      "type": "string"
    },
    "how_to_implement": {
        "$id": "#/properties/how_to_implement",
        "type": "string",
        "description": "information about how to implement. Only needed for non standard implementations.",
        "default": "",
        "examples": [
            "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
        ]
    },
    "id": {
      "$id": "#/properties/id",
      "default": "",
      "description": "UUID as unique identifier",
      "examples": [
        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
      ],
      "type": "string"
    },
    "inputs": {
      "$id": "#/properties/inputs",
      "default": [],
      "description": "Inputs used from the response task",
      "examples": [
        [
          "lookup_file"
        ]
      ],
      "type": "array"
    },
    "name": {
      "$id": "#/properties/name",
      "default": "",
      "description": "Namo fo response task",
      "examples": [
        "Response Tas Example"
      ],
      "type": "string"
    },
    "playbook": {
      "$id": "#/properties/playbook",
      "additionalProperties": true,
      "default": {},
      "description": "A phantom playbook as response task",
      "examples": [
        {
          "name": "lets_encrypt_domain_investigate.json",
          "url_json": "https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.json",
          "url_python": "https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.py"
        }
      ],
      "properties": {
        "name": {
          "$id": "#/properties/playbook/properties/name",
          "default": "",
          "description": "Name of Phantom Playbook",
          "examples": [
            "lets_encrypt_domain_investigate.json"
          ],
          "type": "string"
        },
        "url_json": {
          "$id": "#/properties/playbook/properties/url_json",
          "default": "",
          "description": "URL for phantom playbook json file",
          "examples": [
            "https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.json"
          ],
          "type": "string"
        },
        "url_python": {
          "$id": "#/properties/playbook/properties/url_python",
          "default": "",
          "description": "URL for phantom playbook python file",
          "examples": [
            "https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.py"
          ],
          "type": "string"
        }
      },
      "required": [
        "name",
        "url_json",
        "url_python"
      ],
      "type": "object"
    },
    "search": {
      "$id": "#/properties/search",
      "default": "",
      "description": "Search as response task",
      "examples": [
        "`sysmon` EventCode=1 | search [| inputlookup %lookup_file% ] | stats count by dest user process_name"
      ],
      "type": "string"
    },
    "version": {
      "$id": "#/properties/version",
      "default": 0,
      "description": "version of detection, e.g. 1 or 2 ...",
      "examples": [
        3
      ],
      "type": "integer"
    }
  },
  "required": [
    "name",
    "id",
    "version",
    "date",
    "description",
    "author"
  ],
  "title": "Response Task Schema",
  "type": "object"
}