mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
118 lines
2.5 KiB
JSON
118 lines
2.5 KiB
JSON
{
|
|
"title": "Baseline",
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"title": "Name",
|
|
"type": "string"
|
|
},
|
|
"id": {
|
|
"title": "Id",
|
|
"type": "string"
|
|
},
|
|
"version": {
|
|
"title": "Version",
|
|
"type": "integer"
|
|
},
|
|
"date": {
|
|
"title": "Date",
|
|
"type": "string"
|
|
},
|
|
"author": {
|
|
"title": "Author",
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"title": "Type",
|
|
"type": "string"
|
|
},
|
|
"datamodel": {
|
|
"title": "Datamodel",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"description": {
|
|
"title": "Description",
|
|
"type": "string"
|
|
},
|
|
"search": {
|
|
"title": "Search",
|
|
"type": "string"
|
|
},
|
|
"how_to_implement": {
|
|
"title": "How To Implement",
|
|
"type": "string"
|
|
},
|
|
"known_false_positives": {
|
|
"title": "Known False Positives",
|
|
"type": "string"
|
|
},
|
|
"references": {
|
|
"title": "References",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"tags": {
|
|
"$ref": "#/definitions/BaselineTags"
|
|
}
|
|
},
|
|
"required": [
|
|
"name",
|
|
"id",
|
|
"version",
|
|
"date",
|
|
"author",
|
|
"type",
|
|
"datamodel",
|
|
"description",
|
|
"search",
|
|
"how_to_implement",
|
|
"known_false_positives",
|
|
"references",
|
|
"tags"
|
|
],
|
|
"definitions": {
|
|
"BaselineTags": {
|
|
"title": "BaselineTags",
|
|
"type": "object",
|
|
"properties": {
|
|
"analytic_story": {
|
|
"title": "Analytic Story",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"deployments": {
|
|
"title": "Deployments",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"detections": {
|
|
"title": "Detections",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"product": {
|
|
"title": "Product",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"required_fields": {
|
|
"title": "Required Fields",
|
|
"type": "array",
|
|
"items": {}
|
|
},
|
|
"security_domain": {
|
|
"title": "Security Domain",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"analytic_story",
|
|
"detections",
|
|
"product",
|
|
"required_fields",
|
|
"security_domain"
|
|
]
|
|
}
|
|
}
|
|
} |