splunk-security_content/dist/api/deployments.json

{
    "deployments": [
        {
            "name": "ESCU Default Configuration Anomaly",
            "id": "a9e210c6-9f50-4f8b-b60e-71bb26e4f216",
            "date": "2021-12-21",
            "author": "Patrick Bareiss",
            "description": "This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.",
            "scheduling": {
                "cron_schedule": "0 * * * *",
                "earliest_time": "-70m@m",
                "latest_time": "-10m@m",
                "schedule_window": "auto"
            },
            "rba": {
                "enabled": "true"
            },
            "tags": {
                "type": "Anomaly",
                "product": "ESCU"
            }
        },
        {
            "name": "ESCU Default Configuration Baseline",
            "id": "0f7ee854-1aad-4bef-89c5-5c402b488510",
            "date": "2021-12-21",
            "author": "Patrick Bareiss",
            "description": "This configuration file applies to all detections of type baseline.",
            "scheduling": {
                "cron_schedule": "0 * * * *",
                "earliest_time": "-70m@m",
                "latest_time": "-10m@m",
                "schedule_window": "auto"
            },
            "tags": {
                "type": "Baseline"
            }
        },
        {
            "name": "ESCU Default Configuration Correlation",
            "id": "36ba498c-46e8-4b62-8bde-67e984a40fb4",
            "date": "2021-12-21",
            "author": "Patrick Bareiss",
            "description": "This configuration file applies to all detections of type Correlation. These correlations will generate Notable Events.",
            "scheduling": {
                "cron_schedule": "0 * * * *",
                "earliest_time": "-70m@m",
                "latest_time": "-10m@m",
                "schedule_window": "auto"
            },
            "notable": {
                "rule_description": "%description%",
                "rule_title": "%name%",
                "nes_fields": []
            },
            "tags": {
                "type": "Correlation",
                "product": "ESCU"
            }
        },
        {
            "name": "ESCU Default Configuration Hunting",
            "id": "cc5895e8-3420-4ab7-af38-cf87a28f9c3b",
            "date": "2021-12-21",
            "author": "Patrick Bareiss",
            "description": "This configuration file applies to all detections of type hunting.",
            "scheduling": {
                "cron_schedule": "0 * * * *",
                "earliest_time": "-70m@m",
                "latest_time": "-10m@m",
                "schedule_window": "auto"
            },
            "tags": {
                "type": "Hunting",
                "product": "ESCU"
            }
        },
        {
            "name": "ESCU Default Configuration TTP",
            "id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b",
            "date": "2021-12-21",
            "author": "Patrick Bareiss",
            "description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.",
            "scheduling": {
                "cron_schedule": "0 * * * *",
                "earliest_time": "-70m@m",
                "latest_time": "-10m@m",
                "schedule_window": "auto"
            },
            "notable": {
                "rule_description": "%description%",
                "rule_title": "%name%",
                "nes_fields": []
            },
            "rba": {
                "enabled": "true"
            },
            "tags": {
                "type": "TTP"
            }
        }
    ]
}