mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
bpatel
107 lines
3.0 KiB
JSON
107 lines
3.0 KiB
JSON
{
|
|
"$id": "http://example.com/example.json",
|
|
"$schema": "http://json-schema.org/draft-07/schema",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "schema analytics story",
|
|
"properties": {
|
|
"author": {
|
|
"$id": "#/properties/author",
|
|
"default": "",
|
|
"description": "Author of the analytics story",
|
|
"examples": [
|
|
"Rico Valdez, Patrick Barei\u00df, Splunk"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"date": {
|
|
"$id": "#/properties/date",
|
|
"default": "",
|
|
"description": "date of creation or modification, format yyyy-mm-dd",
|
|
"examples": [
|
|
"2019-12-06"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"$id": "#/properties/description",
|
|
"default": "",
|
|
"description": "description of the analytics story",
|
|
"examples": [
|
|
"Uncover activity consistent with credential dumping, a technique where attackers compromise systems and attempt to obtain and exfiltrate passwords."
|
|
],
|
|
"type": "string"
|
|
},
|
|
"id": {
|
|
"$id": "#/properties/id",
|
|
"default": "",
|
|
"description": "UUID as unique identifier",
|
|
"examples": [
|
|
"fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"$id": "#/properties/name",
|
|
"default": "",
|
|
"description": "Name of the Analytics Story",
|
|
"examples": [
|
|
"Credential Dumping"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"narrative": {
|
|
"$id": "#/properties/narrative",
|
|
"default": "",
|
|
"description": "narrative of the analytics story",
|
|
"examples": [
|
|
"gathering credentials from a target system, often hashed or encrypted, is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems."
|
|
],
|
|
"type": "string"
|
|
},
|
|
"search": {
|
|
"$id": "#/properties/search",
|
|
"default": "",
|
|
"description": "An additional Splunk search, which uses the result of the detections",
|
|
"examples": [
|
|
"index=asx mitre_id=t1003 | stats values(source) as detections values(process) as processes values(user) as users values(_time) as time count by dest"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"tags": {
|
|
"$id": "#/properties/tags",
|
|
"additionalProperties": true,
|
|
"default": {},
|
|
"description": "An explanation about the purpose of this instance.",
|
|
"examples": [
|
|
{
|
|
"analytics_story": "credential_dumping"
|
|
}
|
|
],
|
|
"minItems": 1,
|
|
"type": "object"
|
|
},
|
|
"version": {
|
|
"$id": "#/properties/version",
|
|
"default": 0,
|
|
"description": "version of analytics story, e.g. 1 or 2 ...",
|
|
"examples": [
|
|
1
|
|
],
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"required": [
|
|
"name",
|
|
"id",
|
|
"version",
|
|
"date",
|
|
"description",
|
|
"narrative",
|
|
"author",
|
|
"tags"
|
|
],
|
|
"title": "Analytics Story Schema",
|
|
"type": "object"
|
|
}
|