mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
309 lines
7.5 KiB
Markdown
309 lines
7.5 KiB
Markdown
# Baseline Schema Schema
|
|
|
|
```txt
|
|
http://example.com/example.json
|
|
```
|
|
|
|
schema for baselines
|
|
|
|
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
|
|
| :------------------ | :--------- | :------------- | :----------- | :---------------- | :-------------------- | :------------------ | :--------------------------------------------------------------------------- |
|
|
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | [baselines.spec.json](../../spec/baselines.spec.json "open original schema") |
|
|
|
|
## Baseline Schema Type
|
|
|
|
`object` ([Baseline Schema](baselines.md))
|
|
|
|
# Baseline Schema Properties
|
|
|
|
| Property | Type | Required | Nullable | Defined by |
|
|
| :------------------------------------ | :-------- | :------- | :------------- | :----------------------------------------------------------------------------------------------------------------------- |
|
|
| [author](#author) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-author.md "#/properties/author#/properties/author") |
|
|
| [date](#date) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-date.md "#/properties/date#/properties/date") |
|
|
| [description](#description) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-description.md "#/properties/description#/properties/description") |
|
|
| [how_to_implement](#how_to_implement) | `string` | Optional | cannot be null | [Baseline Schema](baselines-properties-how_to_implement.md "#/properties/how_to_implement#/properties/how_to_implement") |
|
|
| [id](#id) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-id.md "#/properties/id#/properties/id") |
|
|
| [name](#name) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-name-of-baseline.md "#/properties/name#/properties/name") |
|
|
| [search](#search) | `string` | Required | cannot be null | [Baseline Schema](baselines-properties-search.md "#/properties/search#/properties/search") |
|
|
| [tags](#tags) | `object` | Required | cannot be null | [Baseline Schema](baselines-properties-tags.md "#/properties/tags#/properties/tags") |
|
|
| [datamodel](#datamodel) | `array` | Optional | cannot be null | [Baseline Schema](baselines-properties-datamodel.md "#/properties/datamodel#/properties/datamodel") |
|
|
| [version](#version) | `integer` | Required | cannot be null | [Baseline Schema](baselines-properties-version.md "#/properties/version#/properties/version") |
|
|
| Additional Properties | Any | Optional | can be null | |
|
|
|
|
## author
|
|
|
|
Author of the baseline
|
|
|
|
`author`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Baseline Schema](baselines-properties-author.md "#/properties/author#/properties/author")
|
|
|
|
### author Type
|
|
|
|
`string`
|
|
|
|
### author Examples
|
|
|
|
```yaml
|
|
Bahvin Patel, Splunk
|
|
|
|
```
|
|
|
|
## date
|
|
|
|
date of creation or modification, format yyyy-mm-dd
|
|
|
|
`date`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Baseline Schema](baselines-properties-date.md "#/properties/date#/properties/date")
|
|
|
|
### date Type
|
|
|
|
`string`
|
|
|
|
### date Examples
|
|
|
|
```yaml
|
|
'2019-12-06'
|
|
|
|
```
|
|
|
|
## description
|
|
|
|
A detailed description of the baseline
|
|
|
|
`description`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Baseline Schema](baselines-properties-description.md "#/properties/description#/properties/description")
|
|
|
|
### description Type
|
|
|
|
`string`
|
|
|
|
### description Examples
|
|
|
|
```yaml
|
|
>-
|
|
This search looks for CloudTrail events where an AWS instance is started and
|
|
creates a baseline of most recent time (latest) and the first time (earliest)
|
|
we've seen this region in our dataset grouped by the value awsRegion for the
|
|
last 30 days
|
|
|
|
```
|
|
|
|
## how_to_implement
|
|
|
|
information about how to implement. Only needed for non standard implementations.
|
|
|
|
`how_to_implement`
|
|
|
|
* is optional
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Baseline Schema](baselines-properties-how_to_implement.md "#/properties/how_to_implement#/properties/how_to_implement")
|
|
|
|
### how_to_implement Type
|
|
|
|
`string`
|
|
|
|
### how_to_implement Examples
|
|
|
|
```yaml
|
|
>-
|
|
This search requires Sysmon Logs and a Sysmon configuration, which includes
|
|
EventCode 10 for lsass.exe.
|
|
|
|
```
|
|
|
|
## id
|
|
|
|
UUID as unique identifier
|
|
|
|
`id`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Baseline Schema](baselines-properties-id.md "#/properties/id#/properties/id")
|
|
|
|
### id Type
|
|
|
|
`string`
|
|
|
|
### id Examples
|
|
|
|
```yaml
|
|
fc0edc95-ff2b-48b0-9f6f-63da3789fd63
|
|
|
|
```
|
|
|
|
## name
|
|
|
|
|
|
|
|
`name`
|
|
|
|
* is required
|
|
|
|
* Type: `string` ([Name of baseline](baselines-properties-name-of-baseline.md))
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Baseline Schema](baselines-properties-name-of-baseline.md "#/properties/name#/properties/name")
|
|
|
|
### name Type
|
|
|
|
`string` ([Name of baseline](baselines-properties-name-of-baseline.md))
|
|
|
|
### name Examples
|
|
|
|
```yaml
|
|
Previously Seen AWS Regions
|
|
|
|
```
|
|
|
|
## search
|
|
|
|
The Splunk search for the baseline
|
|
|
|
`search`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Baseline Schema](baselines-properties-search.md "#/properties/search#/properties/search")
|
|
|
|
### search Type
|
|
|
|
`string`
|
|
|
|
### search Examples
|
|
|
|
```yaml
|
|
>-
|
|
cloudtrail StartInstances | stats earliest(_time) as earliest latest(_time) as
|
|
latest by awsRegion | outputlookup previously_seen_aws_regions.csv
|
|
|
|
```
|
|
|
|
## tags
|
|
|
|
An array of key value pairs for tagging
|
|
|
|
`tags`
|
|
|
|
* is required
|
|
|
|
* Type: `object` ([Details](baselines-properties-tags.md))
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Baseline Schema](baselines-properties-tags.md "#/properties/tags#/properties/tags")
|
|
|
|
### tags Type
|
|
|
|
`object` ([Details](baselines-properties-tags.md))
|
|
|
|
### tags Constraints
|
|
|
|
**minimum number of items**: the minimum number of items for this array is: `1`
|
|
|
|
**unique items**: all items in this array must be unique. Duplicates are not allowed.
|
|
|
|
### tags Default Value
|
|
|
|
The default value is:
|
|
|
|
```json
|
|
{}
|
|
```
|
|
|
|
### tags Examples
|
|
|
|
```yaml
|
|
analytic_story: suspicious_aws_ec2_activities
|
|
custom_key: custom_value
|
|
|
|
```
|
|
|
|
## datamodel
|
|
|
|
datamodel used in the search
|
|
|
|
`datamodel`
|
|
|
|
* is optional
|
|
|
|
* Type: `string[]`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Baseline Schema](baselines-properties-datamodel.md "#/properties/datamodel#/properties/datamodel")
|
|
|
|
### datamodel Type
|
|
|
|
`string[]`
|
|
|
|
### datamodel Examples
|
|
|
|
```yaml
|
|
Endpoint
|
|
|
|
```
|
|
|
|
## version
|
|
|
|
version of baseline, e.g. 1 or 2 ...
|
|
|
|
`version`
|
|
|
|
* is required
|
|
|
|
* Type: `integer`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Baseline Schema](baselines-properties-version.md "#/properties/version#/properties/version")
|
|
|
|
### version Type
|
|
|
|
`integer`
|
|
|
|
### version Examples
|
|
|
|
```yaml
|
|
1
|
|
|
|
```
|
|
|
|
## Additional Properties
|
|
|
|
Additional properties are allowed and do not have to follow a specific schema
|