mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
341 lines
8.1 KiB
Markdown
341 lines
8.1 KiB
Markdown
# Response Schema Schema
|
|
|
|
```txt
|
|
https://raw.githubusercontent.com/splunk/security_content/develop/docs/spec/response.spec.json
|
|
```
|
|
|
|
schema for response
|
|
|
|
| Abstract | Extensible | Status | Identifiable | Custom Properties | Additional Properties | Access Restrictions | Defined In |
|
|
| :------------------ | :--------- | :------------- | :----------- | :---------------- | :-------------------- | :------------------ | :--------------------------------------------------------------------------- |
|
|
| Can be instantiated | No | Unknown status | No | Forbidden | Allowed | none | [responses.spec.json](../../spec/responses.spec.json "open original schema") |
|
|
|
|
## Response Schema Type
|
|
|
|
`object` ([Response Schema](responses.md))
|
|
|
|
## Response Schema Default Value
|
|
|
|
The default value is:
|
|
|
|
```json
|
|
{}
|
|
```
|
|
|
|
# Response Schema Properties
|
|
|
|
| Property | Type | Required | Nullable | Defined by |
|
|
| :------------------------------------ | :-------- | :------- | :------------- | :----------------------------------------------------------------------------------------------------------------------- |
|
|
| [author](#author) | `string` | Required | cannot be null | [Response Schema](responses-properties-author.md "#/properties/author#/properties/author") |
|
|
| [date](#date) | `string` | Required | cannot be null | [Response Schema](responses-properties-date.md "#/properties/date#/properties/date") |
|
|
| [description](#description) | `string` | Required | cannot be null | [Response Schema](responses-properties-description.md "#/properties/description#/properties/description") |
|
|
| [id](#id) | `string` | Required | cannot be null | [Response Schema](responses-properties-id.md "#/properties/id#/properties/id") |
|
|
| [name](#name) | `string` | Required | cannot be null | [Response Schema](responses-properties-name.md "#/properties/name#/properties/name") |
|
|
| [response_phase](#response_phase) | `array` | Required | cannot be null | [Response Schema](responses-properties-response_phase.md "#/properties/response_phases#/properties/response_phase") |
|
|
| [tags](#tags) | `object` | Required | cannot be null | [Response Schema](responses-properties-tags.md "#/properties/tags#/properties/tags") |
|
|
| [version](#version) | `integer` | Required | cannot be null | [Response Schema](responses-properties-version.md "#/properties/version#/properties/version") |
|
|
| [is_note_required](#is_note_required) | `boolean` | Optional | cannot be null | [Response Schema](responses-properties-is_note_required.md "#/properties/is_note_required#/properties/is_note_required") |
|
|
| [references](#references) | `array` | Optional | cannot be null | [Response Schema](responses-properties-references.md "#/properties/references#/properties/references") |
|
|
| Additional Properties | Any | Optional | can be null | |
|
|
|
|
## author
|
|
|
|
Author of the response
|
|
|
|
`author`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Response Schema](responses-properties-author.md "#/properties/author#/properties/author")
|
|
|
|
### author Type
|
|
|
|
`string`
|
|
|
|
### author Examples
|
|
|
|
```yaml
|
|
Rico Valdez, Patrick Bareiß, Splunk
|
|
|
|
```
|
|
|
|
## date
|
|
|
|
date of creation or modification, format yyyy-mm-dd
|
|
|
|
`date`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Response Schema](responses-properties-date.md "#/properties/date#/properties/date")
|
|
|
|
### date Type
|
|
|
|
`string`
|
|
|
|
### date Examples
|
|
|
|
```yaml
|
|
'2019-12-06'
|
|
|
|
```
|
|
|
|
## description
|
|
|
|
Description of response
|
|
|
|
`description`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Response Schema](responses-properties-description.md "#/properties/description#/properties/description")
|
|
|
|
### description Type
|
|
|
|
`string`
|
|
|
|
### description Examples
|
|
|
|
```yaml
|
|
Response example.
|
|
|
|
```
|
|
|
|
## id
|
|
|
|
UUID as unique identifier
|
|
|
|
`id`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Response Schema](responses-properties-id.md "#/properties/id#/properties/id")
|
|
|
|
### id Type
|
|
|
|
`string`
|
|
|
|
### id Examples
|
|
|
|
```yaml
|
|
fb4c31b0-13e8-4155-8aa5-24de4b8d6717
|
|
|
|
```
|
|
|
|
## name
|
|
|
|
Name of response
|
|
|
|
`name`
|
|
|
|
* is required
|
|
|
|
* Type: `string`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Response Schema](responses-properties-name.md "#/properties/name#/properties/name")
|
|
|
|
### name Type
|
|
|
|
`string`
|
|
|
|
### name Examples
|
|
|
|
```yaml
|
|
Response Example
|
|
|
|
```
|
|
|
|
## response_phase
|
|
|
|
Response divided into phases. These will used to referenced known response_phase parameters
|
|
|
|
`response_phase`
|
|
|
|
* is required
|
|
|
|
* Type: `array`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Response Schema](responses-properties-response_phase.md "#/properties/response_phases#/properties/response_phase")
|
|
|
|
### response_phase Type
|
|
|
|
`array`
|
|
|
|
### response_phase Constraints
|
|
|
|
**minimum number of items**: the minimum number of items for this array is: `1`
|
|
|
|
### response_phase Default Value
|
|
|
|
The default value is:
|
|
|
|
```json
|
|
{}
|
|
```
|
|
|
|
### response_phase Examples
|
|
|
|
```yaml
|
|
preparation:
|
|
- id: 7c72d944-3995-4485-8e57-67b4c353989b
|
|
name: Preparation NIST
|
|
identification:
|
|
- id: c36f3f48-e0bb-4c20-a62a-cdc8f6418892
|
|
name: Detection and Analysis
|
|
- id: 0dc849b2-2eb4-4fd2-add1-b6cc475765f0
|
|
name: Analysis
|
|
|
|
```
|
|
|
|
## tags
|
|
|
|
An array of key value pairs for tagging
|
|
|
|
`tags`
|
|
|
|
* is required
|
|
|
|
* Type: `object` ([Details](responses-properties-tags.md))
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Response Schema](responses-properties-tags.md "#/properties/tags#/properties/tags")
|
|
|
|
### tags Type
|
|
|
|
`object` ([Details](responses-properties-tags.md))
|
|
|
|
### tags Constraints
|
|
|
|
**minimum number of items**: the minimum number of items for this array is: `1`
|
|
|
|
**unique items**: all items in this array must be unique. Duplicates are not allowed.
|
|
|
|
### tags Default Value
|
|
|
|
The default value is:
|
|
|
|
```json
|
|
{}
|
|
```
|
|
|
|
### tags Examples
|
|
|
|
```yaml
|
|
analytic_story: credential_dumping
|
|
|
|
```
|
|
|
|
## version
|
|
|
|
version of detection, e.g. 1 or 2 ...
|
|
|
|
`version`
|
|
|
|
* is required
|
|
|
|
* Type: `integer`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Response Schema](responses-properties-version.md "#/properties/version#/properties/version")
|
|
|
|
### version Type
|
|
|
|
`integer`
|
|
|
|
### version Examples
|
|
|
|
```yaml
|
|
1
|
|
|
|
```
|
|
|
|
## is_note_required
|
|
|
|
Global assignment for notes being required for tasks, can be individually set in the task
|
|
|
|
`is_note_required`
|
|
|
|
* is optional
|
|
|
|
* Type: `boolean`
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Response Schema](responses-properties-is_note_required.md "#/properties/is_note_required#/properties/is_note_required")
|
|
|
|
### is_note_required Type
|
|
|
|
`boolean`
|
|
|
|
### is_note_required Examples
|
|
|
|
```yaml
|
|
true
|
|
|
|
```
|
|
|
|
```yaml
|
|
false
|
|
|
|
```
|
|
|
|
## references
|
|
|
|
A list of references for this response, phase or task (e.g. web or printed citation)
|
|
|
|
`references`
|
|
|
|
* is optional
|
|
|
|
* Type: `string[]` ([Blue Team Handbook by Don Murdoch - Amazon](responses-properties-references-blue-team-handbook-by-don-murdoch---amazon.md))
|
|
|
|
* cannot be null
|
|
|
|
* defined in: [Response Schema](responses-properties-references.md "#/properties/references#/properties/references")
|
|
|
|
### references Type
|
|
|
|
`string[]` ([Blue Team Handbook by Don Murdoch - Amazon](responses-properties-references-blue-team-handbook-by-don-murdoch---amazon.md))
|
|
|
|
### references Default Value
|
|
|
|
The default value is:
|
|
|
|
```json
|
|
[]
|
|
```
|
|
|
|
### references Examples
|
|
|
|
```yaml
|
|
- Blue Team Handbook by Don Murdoch - Alarm Triage Overview pages 146-148
|
|
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
|
|
|
|
```
|
|
|
|
## Additional Properties
|
|
|
|
Additional properties are allowed and do not have to follow a specific schema
|